@bongos/core 1.25.3 → 1.25.5

package/modules/hall-ui/public/shell-game.js

@@ -443,8 +443,19 @@
       window.location.assign(menuPath() + (rest || '?from=' + encodeURIComponent(here)));
     }
   }
-  function buildOverlay(rest) {
-    var src = menuPath() + withEmbed(rest);
+  // Your profile in the same window (task 1005249): the visor's you-block opens it over
+  // the place, as Options does. Its own page is where a window cannot be drawn.
+  function profilePath() { return base() + '/profile'; }
+  function openProfile() {
+    try { buildOverlay('', { path: profilePath(), title: 'Your profile' }); } catch (_) {
+      overlay = null; dialog = null;
+      window.location.assign(profilePath());
+    }
+  }
+  // `page` is { path, title } for a page other than the menu; with none, the menu.
+  function buildOverlay(rest, page) {
+    var title = page ? page.title : 'Options';
+    var src = (page ? page.path : menuPath()) + withEmbed(rest);
     if (!overlay) {
       if (!window.OTBDialog || typeof window.OTBDialog.bind !== 'function') throw new Error('no dialog');
       overlay = document.createElement('div');
@@ -464,7 +475,14 @@
       });
     }
     var frame = overlay.querySelector('.opt-window__frame');
-    // A fresh address reloads the menu; the same one keeps it as it was left.
+    // The window says which page it holds: the box, its close button and the frame.
+    var named = [['.opt-window__box', 'aria-label', title], ['.opt-window__x', 'aria-label', 'Close ' + title.toLowerCase()]];
+    for (var n = 0; n < named.length; n += 1) {
+      var el = overlay.querySelector(named[n][0]);
+      if (el && el.setAttribute) el.setAttribute(named[n][1], named[n][2]);
+    }
+    frame.setAttribute('title', title);
+    // A fresh address reloads the page; the same one keeps it as it was left.
     if (frame.getAttribute('src') !== src) frame.setAttribute('src', src);
     dialog.open();
   }
@@ -477,7 +495,7 @@
   // The menu's own page never opens the window (nor a page in a frame: see the if below).
   function overlayHere() { return on() && !(document.body && document.body.getAttribute('data-page') === 'settings'); }
   if (!embedded) {
-    window.OTBOptionsOverlay = { open: openOverlay, close: closeOverlay, isOpen: overlayOpen };
+    window.OTBOptionsOverlay = { open: openOverlay, openProfile: openProfile, close: closeOverlay, isOpen: overlayOpen };
     // A link to the menu (the visor's Options row, the profile chip, the start
     // screen's Options) opens the window in game mode instead of leaving the place.
     if (document.addEventListener) document.addEventListener('click', function (e) {

package/modules/hall-ui/public/style.css

@@ -883,6 +883,7 @@ html[data-theme="dark"] .brand-mark__mark { --mark-ink: #e2e1e4; }
   html[data-game="on"] .visor__me, html[data-game="on"] .visor__hints { transform: none; }
   html[data-game="on"] .visor__me { gap: var(--ds-space-hair); }
   html[data-game="on"] .visor__sprite { width: 36px; height: 36px; }
+  html[data-game="on"] .visor__card { display: none; }
   html[data-game="on"] .visor__num { font-size: var(--ds-text-4xl); }
   html[data-game="on"] .visor__credits { flex-direction: column; align-items: flex-start; gap: 2px; }
   html[data-game="on"] .visor__unit { font-size: var(--ds-text-2xs); line-height: 1; }
@@ -4337,36 +4338,6 @@ html[data-door="out"] #hall-main { width: 100%; }
   box-sizing: border-box;
 }
 
-/* ---------- Home: the Standing card as the mock draws it (task 1003464) ----------
-   docs/design/mocks/hall/board/v3.html: an identity LINE (a 36px avatar, the
-   name over the handle, the rank on the right) and a three-row fact ledger —
-   Credits, On the board, Preferred work. With .view-zone--band stretching its
-   two cards, this content is what makes Standing end level with Goals. */
-.home-who { display: flex; align-items: center; gap: 12px; padding-bottom: 14px; }
-.home-who__avatar {
-  width: 36px; height: 36px; flex: none;
-  border-radius: 50%;
-  background: var(--skeleton);
-  border: 1px solid var(--rule);
-  object-fit: cover;
-}
-.home-who__meta { display: flex; flex-direction: column; min-width: 0; }
-.home-who__name { margin: 0; font-size: 15px; font-weight: 500; color: var(--ink); }
-.home-who__handle { margin: 0; font-family: var(--font-mono); font-size: 12px; color: var(--ink-faint); }
-.home-who__rank { margin-left: auto; }
-.home-facts { margin: 0; display: grid; grid-template-columns: 1fr auto; gap: 0; }
-.home-facts > div { display: contents; }
-.home-facts dt, .home-facts dd { margin: 0; padding: 9px 0; border-top: 1px solid var(--rule-soft); }
-.home-facts dt {
-  font-family: var(--label-face);
-  font-size: var(--label-size);
-  letter-spacing: var(--label-space);
-  text-transform: var(--label-case);
-  color: var(--ink-faint);
-}
-.home-facts dd { text-align: right; font-size: 14px; color: var(--ink); font-variant-numeric: tabular-nums; }
-.home-facts > div:first-child dt, .home-facts > div:first-child dd { border-top: 0; padding-top: 0; }
-
 /* ---------- hall-kit components (task 2166) ----------
    Styles for the shared kit (hall-kit.js / window.OTBKit): pager bar,
    filter-bar disclosure + chips, tab strip, empty state, skeleton shimmer,
@@ -4857,7 +4828,7 @@ html.palette-open { overflow: hidden; }
    under it, Standing as a chip at the top right with a hover card, the
    Needs-attention slices as cards that open a window, and Your work beside
    Recently shipped. */
-body[data-page="home"] .page-head--hall { position: relative; margin: 0 0 12px; padding-right: 180px; }
+body[data-page="home"] .page-head--hall { position: relative; margin: 0 0 12px; }
 body[data-page="home"] .stat-tile { padding: 12px 22px; min-height: 0; gap: 4px; }
 body[data-page="home"] .stat-tile__num { font-size: clamp(20px, 2vw, 26px); }
 body[data-page="home"] #home-stats .stat-row { border-bottom-left-radius: 0; border-bottom-right-radius: 0; }
@@ -4875,38 +4846,6 @@ body[data-page="home"] #home-stats .stat-row { border-bottom-left-radius: 0; bor
 .version-tab__fill { display: block; height: 100%; width: 0; background: var(--accent); border-radius: 4px; }
 .version-tab__pct { color: var(--ink-soft); font-size: 13px; white-space: nowrap; font-variant-numeric: tabular-nums; }
 
-.hall-standing { position: absolute; top: 0; right: 0; height: 44px; outline: none; }
-.hall-standing[hidden] { display: none; }
-/* The chip IS the top of the card: anchored at the right, it grows LEFT as the
-   name slides in, and only .hall-standing__more drops down below it. */
-.hall-standing__card {
-  position: absolute; top: 0; right: 0; z-index: 20; min-width: 0;
-  background: var(--bg-card); border-radius: 22px; padding: 4px 6px 4px 4px;
-  transition: min-width .2s ease, border-radius .2s ease, padding .2s ease, box-shadow .2s ease;
-}
-.hall-standing__card .home-who { gap: 8px; padding: 0; }
-.hall-standing__card .home-who__avatar { width: 36px; height: 36px; }
-.hall-standing__card .home-who__meta {
-  max-width: 0; opacity: 0; overflow: hidden; white-space: nowrap;
-  transition: max-width .2s ease, opacity .2s ease;
-}
-.hall-standing__more {
-  max-height: 0; overflow: hidden; opacity: 0;
-  transition: max-height .25s ease, opacity .2s ease;
-}
-.hall-standing__more .home-facts { margin-top: 12px; }
-.hall-standing__more .card-foot { margin: 12px 0 0; }
-.hall-standing:hover .hall-standing__card,
-.hall-standing:focus-within .hall-standing__card {
-  min-width: 300px; border-radius: var(--radius); padding: 14px 16px 16px;
-  box-shadow: 0 12px 40px rgba(0, 0, 0, .35);
-}
-.hall-standing:hover .home-who__meta,
-.hall-standing:focus-within .home-who__meta { max-width: 200px; opacity: 1; }
-.hall-standing:hover .hall-standing__more,
-.hall-standing:focus-within .hall-standing__more { max-height: 420px; opacity: 1; }
-.hall-standing:focus-visible .hall-standing__card { outline: 2px solid var(--focus); outline-offset: 2px; }
-
 .attn-cards { display: grid; grid-template-columns: repeat(auto-fill, minmax(220px, 1fr)); gap: 12px; }
 .attn-card {
   display: flex; flex-direction: column; align-items: flex-start; gap: 6px; min-height: 100px;
@@ -4926,20 +4865,11 @@ body[data-page="home"] #home-stats .stat-row { border-bottom-left-radius: 0; bor
 .home-split > .home-split__col[hidden] + .home-split__col { grid-column: 1 / -1; }
 
 @media (max-width: 760px) {
-  body[data-page="home"] .page-head--hall { padding-right: 0; }
-  .hall-standing { position: relative; display: block; margin-top: 10px; }
-  .hall-standing__card { left: 0; right: auto; }
-  .hall-standing:hover .hall-standing__card,
-  .hall-standing:focus-within .hall-standing__card { min-width: min(300px, calc(100vw - 32px)); }
   .home-split { grid-template-columns: 1fr; }
 }
 /* With Standing gone from the band, a lone card there (Goals) takes the row. */
 .view-zone--band > .scroll:only-child { grid-column: 1 / -1; }
-/* The Standing hover card's stat row: four figures in a 2x2 grid, label over number. */
-.home-facts--grid { grid-template-columns: 1fr 1fr; gap: 10px 14px; padding: 12px 0; border-top: 1px solid var(--rule-soft); border-bottom: 1px solid var(--rule-soft); }
-.home-facts--grid > div { display: flex; flex-direction: column; gap: 2px; }
-.home-facts--grid dt, .home-facts--grid dd { border-top: 0; padding: 0; text-align: left; }
-.home-facts--grid dd { font-family: var(--font-display); font-size: 20px; font-weight: 300; }
+
 
 /* NO TOP BLOCK (task 1004836, owner 2026-10-23). The left rail highlights the
    page and the top bar names it, so a page draws nothing above its first

package/modules/hall-ui/public/visor.css

@@ -86,10 +86,40 @@ html[data-game="on"] .visor:not([hidden]) {
   position: absolute; left: var(--visor-inset-left); right: var(--visor-inset-right); bottom: var(--visor-inset-bottom);
   display: grid; grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr); align-items: center; column-gap: var(--ds-space-sm);
 }
+/* you are a link (task 1005249): hover or focus shows your card above, a click opens your profile */
 .visor__me {
-  justify-self: start; display: flex; align-items: center; gap: var(--ds-space-sm);
+  pointer-events: auto; position: relative; justify-self: start; display: flex; align-items: center; gap: var(--ds-space-sm);
+  color: inherit; text-decoration: none; cursor: pointer;
   transform: perspective(900px) rotateY(16deg); transform-origin: left center;
 }
+.visor__me:hover { text-decoration: none; }
+.visor__me:hover .visor__name, .visor__me:focus-visible .visor__name { color: var(--ink); }
+.visor__me:focus-visible { outline: 0; box-shadow: var(--press-focus); }
+/* the card: the sheet's night panel between two strong hairlines, standing over you */
+.visor__card {
+  position: absolute; left: 0; bottom: calc(100% + var(--ds-space-xs)); z-index: 1;
+  box-sizing: border-box; width: 16rem; padding: var(--ds-space-sm);
+  display: flex; flex-direction: column; gap: var(--ds-space-xs);
+  background: var(--bg-card); color: var(--ink);
+  border: 0 solid var(--rule); border-left-width: var(--line-strong); border-right-width: var(--line-strong);
+  opacity: 0; visibility: hidden; transform: translateY(4px);
+  transition: opacity var(--ds-dur-fast) var(--ds-ease), transform var(--ds-dur-fast) var(--ds-ease), visibility 0s linear var(--ds-dur-fast);
+}
+.visor__me:hover .visor__card, .visor__me:focus-visible .visor__card {
+  opacity: 1; visibility: visible; transform: none; transition-delay: 0s;
+}
+.visor__card-who { display: flex; flex-direction: column; gap: 2px; }
+.visor__card-name { font-size: var(--ds-text-lg); color: var(--ink); }
+.visor__card-handle { font-family: var(--font-mono); font-size: var(--ds-text-sm); color: var(--ink-soft); }
+.visor__facts { display: flex; flex-direction: column; }
+.visor__fact {
+  display: flex; align-items: baseline; justify-content: space-between; gap: var(--ds-space-xs);
+  padding: var(--ds-space-hair) 0; border-top: var(--ds-line) solid var(--rule-soft);
+}
+.visor__fact-k { font-size: var(--ds-text-sm); color: var(--ink-soft); }
+.visor__fact-v { font-size: var(--ds-text-md); color: var(--ink); text-align: right; font-variant-numeric: tabular-nums; }
+.visor__card-open { font-size: var(--ds-text-sm); color: var(--accent-ink); }
+.visor__card-name, .visor__card-open, .visor__fact-k { font-family: var(--name-face); font-weight: var(--name-weight); text-transform: var(--name-case); letter-spacing: var(--name-space); }
 .visor__sprite {
   flex: none; box-sizing: border-box; width: 56px; height: 56px; object-fit: cover; image-rendering: pixelated;
   background: var(--bg-card); border: var(--line-strong) solid var(--char, var(--ink-soft)); clip-path: var(--cut-path-sm);

package/modules/hall-ui/public/visor.js

@@ -10,6 +10,10 @@
 //   - the foot row. Left: your sprite (your character's head, wearing the visor, its rim in
 //     the character's colour; task 1005218), your character's name and your credits
 //     (builders.total_credits — credits only, never a payout; the spec's "does not exist").
+//     That block is you: on hover or focus it shows your details (name, handle, rank,
+//     credits, karma, preferred work), and a click opens your whole profile in the game's
+//     window over the place (task 1005249; the Standing chip that sat top right of Home
+//     went with it).
 //     Centre: your character's main action, the one accent button, with its key. Right: the
 //     quiet key hints, no boxes: your other actions and "Actions" (key A), which opens the
 //     sheet (your character's actions, then the keys of the place you are in, then Options on
@@ -67,7 +71,9 @@
   var AVOID = ['l', '0', '/', '?', 'f', 'k', '+', '-', '='];
   var NAMES = { artisan: 'Artisan', artist: 'Artist', patron: 'Patron' };
 
-  function esc(v) { return window.OTB && window.OTB.escapeHtml ? window.OTB.escapeHtml(v) : String(v == null ? '' : v).replace(/[^\w .,:'-]/g, ''); }
+  // The hall's own escaper; without it, only safe characters pass. A link's '/' and a
+  // handle's '@' are among them (task 1005249: stripping them broke the profile link).
+  function esc(v) { return window.OTB && window.OTB.escapeHtml ? window.OTB.escapeHtml(v) : String(v == null ? '' : v).replace(/[^\w .,:@\/-]/g, ''); }
   function craft() { return window.OTBCraftMode || null; }
   // The character on the glass: the held one, else this session's mode, else none.
   function character() {
@@ -91,6 +97,22 @@
     var n = me && me.builder ? Number(me.builder.total_credits) : NaN;
     return isFinite(n) ? n : null;
   }
+  // You, from /me: the hover card's facts. Null until /me answers. Pure, for the tests.
+  function meFacts(me) {
+    var b = me && me.builder;
+    if (!b) return null;
+    var karma = Number(b.karma);
+    var rank = String(b.rank || '');
+    var prefs = Array.isArray(b.preferred_disciplines) ? b.preferred_disciplines.filter(Boolean) : [];
+    return {
+      name: String(b.display_name || b.github_login || 'Builder'),
+      handle: b.github_login ? '@' + String(b.github_login) : '',
+      rank: rank ? rank.charAt(0).toUpperCase() + rank.slice(1) : '',
+      credits: credits(),
+      karma: isFinite(karma) ? Math.round(karma) : 0,
+      prefs: prefs.join(', '),
+    };
+  }
   function creditsText(n) {
     if (n == null) return '';
     var v = Math.round(n);
@@ -299,11 +321,12 @@
       progressHtml() +
       focusHtml() +
       '<div class="visor__foot">' +
-        '<div class="visor__me">' +
+        '<a class="visor__me" data-visor-me href="' + esc(hallHref('/profile')) + '">' +
           (sprite ? '<img class="visor__sprite" src="' + esc(sprite) + '" alt="" width="32" height="32" decoding="async">' : '') +
           '<span class="visor__who"><span class="visor__name">' + esc(NAMES[id]) + '</span>' +
           '<span class="visor__credits" data-visor-credits>' + creditsHtml(n) + '</span></span>' +
-        '</div>' +
+          cardHtml() +
+        '</a>' +
         mainHtml(main) +
         '<div class="visor__hints">' + scene.actions.map(function (a, i) { return a.lead ? placeHintHtml(a, i, keys.place[i]) : ''; }).join('') + acts.slice(1).map(hintHtml).join('') +
           '<button class="visor__hint visor__hint--sheet" type="button" data-visor-sheet aria-expanded="false" aria-controls="visor-sheet">' +
@@ -311,6 +334,24 @@
         '</div>' +
       '</div>';
   }
+  // The hover card over the you-block (task 1005249): who you are and your standing, then
+  // what a click does. Text inside the link, so a reader hears it as part of the link.
+  function cardHtml() {
+    var C = craft();
+    var f = meFacts(C && typeof C.me === 'function' ? C.me() : null);
+    if (!f) return '<span class="visor__card"><span class="visor__card-open">Open your profile</span></span>';
+    var fact = function (k, v) { return '<span class="visor__fact"><span class="visor__fact-k">' + esc(k) + '</span><span class="visor__fact-v">' + esc(v) + '</span></span>'; };
+    return '<span class="visor__card">' +
+      '<span class="visor__card-who"><span class="visor__card-name">' + esc(f.name) + '</span>' +
+        (f.handle ? '<span class="visor__card-handle">' + esc(f.handle) + '</span>' : '') + '</span>' +
+      '<span class="visor__facts">' +
+        (f.rank ? fact('Rank', f.rank) : '') +
+        fact('Credits', f.credits == null ? '—' : creditsText(f.credits).replace(/ credits?$/, '')) +
+        fact('Karma', String(f.karma)) +
+        fact('Preferred work', f.prefs || 'Not set yet') +
+      '</span>' +
+      '<span class="visor__card-open">Open your profile</span></span>';
+  }
   // The kit's segments (controls.css .seg), always beside the words that say the same thing.
   function progressHtml() {
     if (!progress) return '';
@@ -434,6 +475,14 @@
     if (t.closest('[data-visor-unfocus]')) { dropFocus(); return; }
     if (t.closest('[data-visor-lead]')) { if (focus && focus.lead && !focus.lead.busy) { closeSheet(false); focus.lead.run(); } return; }
     if (t.closest('[data-visor-sheet]')) { openSheet(); return; }
+    // You: your profile in the game's window, the place still drawn behind it. With no
+    // window (shell-game.js absent), the link opens the profile page.
+    if (t.closest('[data-visor-me]')) {
+      var W = window.OTBOptionsOverlay;
+      closeSheet(false);
+      if (W && typeof W.openProfile === 'function' && !e.metaKey && !e.ctrlKey && !e.shiftKey) { e.preventDefault(); W.openProfile(); }
+      return;
+    }
     var sc = t.closest('[data-visor-scene]');
     if (sc && scene) { var a = scene.actions[Number(sc.getAttribute('data-visor-scene'))]; closeSheet(false); if (a) a.run(); return; }
     var act = t.closest('[data-visor-act]');
@@ -508,6 +557,7 @@
     keyFor: keyFor,
     resolveKeys: resolveKeys,
     creditsText: creditsText,
+    meFacts: meFacts,
     character: character,
     pickVersion: pickVersion,
     segStates: segStates,

package/modules/hall-ui/records/home-reshuffle.md

@@ -6,7 +6,7 @@ The owner's Builders' Hall feedback (idea 1001262), home-page half, built to the
 - **Banner + version tab.** The stat row is slimmer (`body[data-page="home"]` overrides), and under it
   `#home-version` draws the version the greeting's sub-line names, from the same `currentVersion()`
   read — `renderVersionTab` in `hall-render.js`. Hidden while nothing is being built.
-- **Standing is a chip, not a card.** The `home-standing` widget is gone; `#hall-standing` sits in the
+- **Standing is a chip, not a card.** *(Removed in task 1005249: your details are the visor's you-block now, `records/visor.md`.)* The `home-standing` widget is gone; `#hall-standing` sits in the
   page head (it is chrome, not a `<section class="scroll">`, so the registry rule is untouched). The
   card it opens on hover or keyboard focus is still `#home-standing-body`, filled by `renderProfile`.
   The place row reads "Leaderboard place" — the owner asked for no "on the board" wording. The chip

package/modules/hall-ui/records/visor.md

@@ -19,6 +19,16 @@ The visor is the control and the scene is the view: every main call to action in
 - **The glass binds keys in game mode only.** `onKey` now returns unless `html[data-game="on"]`: the glass was never drawn outside game mode, so its keys no longer act there either (before, a held character's letter keys still ran on a classic page).
 - **The Governor City keeps ADR 0403.** In game mode (`html.visor-on`) the door's button (`#cityStart`) and the archived Street links leave the scene (`city.css`). The door is the lead action, on D, in the door's own words and case ("decide 37 in a row", or "start governing"; lowercase is the door's, task 1005210); it re-registers only when those words change. The archived links are rows in the sheet ("Archived: Street", "Archived: Building Level Views"), read off the page's own archived line so the words and the addresses cannot drift; reached by A and the keyboard. The city line stays on the scene as words, raised to `bottom: 224px` because the extra hint wraps the hints onto a second line at a desk width and the centred accent button rises with it. A building's card is a pop-up, not the scene, and keeps its own buttons and keys. Classic mode is as it was.
 
+## You on the glass (task 1005249)
+
+- **The Standing chip is gone; you are on the visor.** The owner (2026-11-12): the profile card top right of Home (`#hall-standing`, task 1004774) is removed in both modes, and the you-block bottom left of the visor carries it. Home's two reads that fed only that chip (`/me/recent-ships?limit=5` and `/public/leaderboard`) went with it, so the Standing chip's leaderboard place and "#N as an artist" are on no page now; your shipped count is on the Profile page.
+- **Hover or focus shows your card.** `.visor__me` is a link (`pointer-events: auto`), and above it `.visor__card` shows your name and handle, then Rank, Credits, Karma and Preferred work, then "Open your profile". All from `/me` through `OTBCraftMode.me()` (`meFacts`, pure); no extra read. The card is the sheet's night panel between two strong hairlines. A phone has no hover, so the card is not drawn there (the shared phone block) and a tap goes straight to the profile.
+- **A click opens your whole profile in the game's window**, over the place, the way Options opens: `OTBOptionsOverlay.openProfile()` (`shell-game.js`) frames `/profile?embed=1` in the same `.opt-window`, which now names the page it holds (box, close button, frame title). Escape, the scrim and the close button shut it. With no window to draw, the link opens the profile page.
+- **Keyboard order is reading order.** You are the first stop on the glass, then the accent button.
+- **A fix that came with it.** The visor's fallback escaper (used when the hall's own `OTB.escapeHtml` is not loaded) stripped `/` and `@`, which would have broken the link; it lets both through now.
+
+Tests: `tests/hall_visor_profile.mjs` (the facts in a vm; the card, the window, Escape and the plain-link fallback in a real browser).
+
 ## The sky on the glass (task 1005210)
 
 - **What left the sky in game mode** (`thinking.css`, under `html.visor-on`): the top row's lens switch and every pill, the jump field, the thought composer, and the foot's clock and legend. The brand line and its figures stay, as words. A building-like pop-up (the panel, the list, the start dialog, the tour) is not the scene and keeps its buttons.

package/modules/provisioning/migrations/provisioning_037_update_subscribed.sql

@@ -0,0 +1,21 @@
+-- provisioning_037_update_subscribed.sql — whether an instance takes unattended patch upgrades,
+-- stored on the instance row (task 1004150, ADR 0325 decision 5).
+--
+-- WHY. Every other fleet fact lives in provisioning_instances; "which instances the nightly sweep
+-- moves on its own" lived only in config/update-subscriptions.json. That left GET /provisioning/fleet
+-- unable to answer the one question a fleet view exists for, and let a restored control-plane backup
+-- bring back every instance row with an empty roster — the sweep then reported failed=0 while
+-- upgrading nothing. On the row, the subscription and its update_channel (provisioning_029) travel
+-- and restore together.
+--
+-- DEFAULT false: an instance is armed only by an explicit act, as the shipped-empty roster was
+-- (ADR 0136). The roster file stays honoured as an override, so an operator's current arming is
+-- not silently dropped.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS update_subscribed boolean NOT NULL DEFAULT false;
+
+COMMIT;

package/modules/provisioning/module.json

@@ -20,6 +20,7 @@
       "core-upgrade",
       "env-manifest",
       "repo-private",
+      "update-subscription",
       "render-standup",
       "look",
       "demo",

package/modules/provisioning/routes/provisioning.js

@@ -164,6 +164,10 @@ function ownerInstance(row) {
 function fleetInstance(row) {
   return {
     owner: { id: row.owner_builder_id, github_login: row.github_login, display_name: row.display_name, rank: row.rank },
+    // Fleet-only (task 1004150): which rows take unattended upgrades, and under what rule. Kept off
+    // publicInstance, which feeds owner reads — who auto-upgrades is an operator's question.
+    update_channel: row.update_channel || 'patch',
+    update_subscribed: row.update_subscribed === true,
     ...ownerInstance(row),
   };
 }

package/modules/provisioning/routes/update-subscription.js

@@ -0,0 +1,51 @@
+// modules/provisioning/routes/update-subscription.js — POST /provisioning/instances/:id/update-subscription
+// (task 1004150, ADR 0325 decision 5).
+//
+// WHY. Whether the nightly sweep moves an instance on its own was only a line in
+// config/update-subscriptions.json, so the fleet roster could not report it and a restored
+// backup brought back every row with an empty roster. The flag lives on the row now
+// (provisioning_037); this is how an operator arms or disarms it. It changes a rule, never the
+// core: nothing is queued.
+//
+// Its own routes file (declared in module.json) because routes/provisioning.js sits at the
+// size ratchet — the routes/repo-private.js precedent.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const { failFrom } = require('../public-refusal');
+
+const log = api.logger('provisioning');
+
+module.exports = function buildUpdateSubscriptionRouter() {
+  const router = express.Router();
+
+  // Body: { subscribed: boolean }. Gate: the 'provisioning.fleet.manage' permission — the fleet's own.
+  router.post('/provisioning/instances/:id/update-subscription', api.requireBuilder, api.requirePermission('provisioning.fleet.manage'), async (req, res) => {
+    const id = parseId(req, res);
+    if (!id) return;
+    if (validateOrRespond(req, res, { subscribed: { type: 'boolean', required: true } }, { strict: true })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst) return res.fail('instance_not_found', 404);
+      const subscribed = req.body.subscribed === true;
+      const was = inst.update_subscribed === true;
+      if (was !== subscribed) {
+        await pool.query('UPDATE provisioning_instances SET update_subscribed = $2, updated_at = now() WHERE id = $1', [id, subscribed]);
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'update-subscription-changed',
+          detail: `unattended patch upgrades ${subscribed ? 'armed' : 'disarmed'} by ${req.builder.github_login || req.builder.id}`,
+          actor: `api:fleet:${req.builder.id}`,
+        }).catch(() => {});
+      }
+      res.json({ ok: true, update_subscribed: subscribed, previous: was, changed: was !== subscribed });
+    } catch (err) {
+      log.error('[provisioning] POST /provisioning/instances/:id/update-subscription', err);
+      failFrom(res, err, 'update_subscription_failed');
+    }
+  });
+
+  return router;
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.3",
+  "version": "1.25.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.3",
+      "version": "1.25.5",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.3",
+  "version": "1.25.5",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11712,5 +11712,21 @@
       "id": "1005199",
       "text": "Founding a project is faster: each finished stage goes to the Board Room by itself, every stage can be voted on at once with one \"vote yes on all\" button, and the Board Room no longer looks locked during genesis."
     }
+  ],
+  "1.25.4": [
+    {
+      "id": "1005249",
+      "text": "Your details now sit on your character at the bottom left of the game: hover to see them, click to open your full profile without leaving the scene. The old profile card at the top right is gone."
+    }
+  ],
+  "1.25.5": [
+    {
+      "id": "1004748",
+      "text": "Archon can now switch on a card requirement for a builder who has registered a card, with every change recorded."
+    },
+    {
+      "id": "1004150",
+      "text": "The fleet view can now show which projects get automatic patch upgrades, and the nightly upgrade run says so out loud when it has nothing to do."
+    }
   ]
 }

package/scripts/bongos/update-channel.js

@@ -333,13 +333,14 @@ function loadSubscriptions({ instanceDir = process.cwd(), fsImpl = fs, file = SU
 const CHANNEL_DB_ENV = 'UPDATE_CHANNEL_DB';
 const CHANNEL_SOURCE_DEPLOY = 'deploy';
 const CHANNEL_SOURCE_ROSTER = 'roster';
-const DB_CHANNELS_SQL = 'SELECT slug, update_channel FROM provisioning_instances';
+const DB_CHANNELS_SQL = 'SELECT slug, update_channel, update_subscribed FROM provisioning_instances';
 const DB_CHANNELS_TIMEOUT_MS = 15000;
 
 // PURE. psql's stderr reduced to a class that is safe to log.
 function psqlFailureClass(stderr) {
   const s = String(stderr || '');
   if (/relation .*provisioning_instances.* does not exist/i.test(s)) return 'no provisioning_instances table (provisioning module off?)';
+  if (/column .*update_subscribed.* does not exist/i.test(s)) return 'no update_subscribed column (migration provisioning_037 not applied)';
   if (/column .*update_channel.* does not exist/i.test(s)) return 'no update_channel column (migration provisioning_029 not applied)';
   if (/authentication failed|role .* does not exist|permission denied/i.test(s)) return 'the sweep\'s database login was refused';
   if (/could not connect|connection refused|no such file or directory|could not translate host/i.test(s)) return 'database unreachable';
@@ -366,11 +367,32 @@ function readDbChannels({ env = process.env, run = spawnSync } = {}) {
   }
   if (r.status !== 0) return { ok: false, reason: `psql exit ${r.status}: ${psqlFailureClass(r.stderr)}` };
   const channels = new Map();
+  const subscribed = new Map();
   for (const line of String(r.stdout || '').split('\n')) {
-    const [slug, ch] = line.split('\t');
-    if (slug && ch) channels.set(slug.trim(), ch.trim());
+    const [slug, ch, sub] = line.split('\t');
+    if (!slug || !ch) continue;
+    channels.set(slug.trim(), ch.trim());
+    subscribed.set(slug.trim(), String(sub || '').trim() === 't');
   }
-  return { ok: true, channels };
+  return { ok: true, channels, subscribed };
+}
+
+// PURE. Merge the two places a subscription can be written: the project row
+// (provisioning_instances.update_subscribed, task 1004150) and the roster file. The file is an
+// OVERRIDE — an entry in it is subscribed whatever the row says, so an operator's current arming
+// is not dropped — but a row subscribed with NO file entry can't be upgraded (the file carries the
+// `dir`), and it is returned in `unreachable` rather than vanishing, because "subscribed on the
+// fleet view, never touched by the sweep" is the silent failure this column exists to end.
+function applyDbSubscriptions(instances, db) {
+  const subscribed = db && db.ok && db.subscribed instanceof Map ? db.subscribed : null;
+  const slugs = new Set(instances.map((i) => i.slug));
+  const out = instances.map((inst) => {
+    if (!subscribed) return { ...inst, subscribedSource: CHANNEL_SOURCE_ROSTER };
+    if (subscribed.get(inst.slug) === true) return { ...inst, subscribedSource: CHANNEL_SOURCE_DEPLOY };
+    return { ...inst, subscribedSource: CHANNEL_SOURCE_ROSTER, subscribedNote: 'subscribed by the roster file only (the project row says not subscribed)' };
+  });
+  const unreachable = subscribed ? [...subscribed].filter(([slug, on]) => on && !slugs.has(slug)).map(([slug]) => slug) : [];
+  return { instances: out, unreachable };
 }
 
 // PURE. Give each roster entry the channel it is actually under, and say where it came from:
@@ -496,6 +518,7 @@ module.exports = {
   readDbChannels,
   CHANNEL_DB_ENV,
   applyDbChannels,
+  applyDbSubscriptions,
   channelLine,
   psqlFailureClass,
   CHANNEL_SOURCE_DEPLOY,

package/scripts/bongos/update-sweep.js

@@ -593,16 +593,29 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
   // CONTROL PLANE's database — this process's own env, never an entry's `env`, which points at that
   // instance's database. A core too old to carry the reader keeps the roster, as before.
   const db = typeof channel.readDbChannels === 'function' ? channel.readDbChannels({ env: process.env }) : null;
-  const instances = db ? channel.applyDbChannels(loaded.instances, db) : loaded.instances;
-  if (db && !db.ok && instances.length) console.log(`  • update rules: read from the roster — ${db.reason}`);
+  const withChannels = db ? channel.applyDbChannels(loaded.instances, db) : loaded.instances;
+  if (db && !db.ok && withChannels.length) console.log(`  • update rules: read from the roster — ${db.reason}`);
+  // Who is subscribed is also on the project row (task 1004150). The roster file stays an override.
+  const merged = db && typeof channel.applyDbSubscriptions === 'function'
+    ? channel.applyDbSubscriptions(withChannels, db) : { instances: withChannels, unreachable: [] };
+  const instances = merged.instances;
 
   const roster = only ? instances.filter((i) => i.slug === only || i.dir === only) : instances;
   const mode = apply ? 'apply' : 'dry-run';
   console.log(`core-update-subscription (${mode}) — ${roster.length} subscribed instance(s)${present ? '' : ' [no roster file — nothing subscribed]'}`);
-  for (const inst of roster) if (inst.channelNote) console.log(channel.channelLine(inst));
+  for (const inst of roster) {
+    if (inst.channelNote) console.log(channel.channelLine(inst));
+    if (inst.subscribedNote) console.log(`  • ${inst.slug}: ${inst.subscribedNote}`);
+  }
   if (only && roster.length === 0) console.error(`  ! --only ${only} matched no subscribed instance`);
 
   let upgraded = 0, skipped = 0, failed = 0, upToDate = 0, healed = 0;
+  // Subscribed on the project row but absent from this roster: there is no `dir` to upgrade, so say
+  // so and count it a skip. Silence here is how a restored backup reported failed=0 on a dead sweep.
+  for (const slug of only ? [] : merged.unreachable) {
+    console.error(`  ! ${slug}: subscribed on its project row, but this roster has no entry with a dir for it — not upgraded`);
+    skipped++;
+  }
   const refusalsFile = refusalsPath();
   const refusals = readRefusals(refusalsFile);
 
@@ -817,6 +830,7 @@ function main({ instanceRoot: defaultRoot = process.cwd() } = {}) {
     upgraded++;
   }
 
+  if (!only && roster.length === 0 && skipped === 0) console.log('\ncore-update-subscription: NOTHING SUBSCRIBED — no instance was considered, so no upgrade was attempted (this is not a clean run).');
   console.log(`\ncore-update-subscription: upgraded=${upgraded} up-to-date=${upToDate} skipped=${skipped} failed=${failed}${healed ? ` healed=${healed}` : ''} (${mode})`);
   return failed > 0 ? 1 : 0;
 }

package/src/bongos/api-errors.js

@@ -89,6 +89,8 @@ const OVERRIDES = Object.freeze({
   bfg_write_disabled: 'forbidden',
   target_is_system_principal: 'forbidden',
   cannot_change_own_tester: 'forbidden',
+  cannot_disable_own_card_requirement: 'forbidden',
+  no_card_registered: 'conflict',
   self_vote_forbidden: 'forbidden',
   self_dep: 'conflict',
   newcomer_must_ship_first: 'forbidden',