@underpostnet/cyberia 3.3.76 → 3.3.77

package/src/client/components/cryptokoyn/AppShellCryptokoyn.js

@@ -26,8 +26,6 @@ class AppShellCryptokoyn {
     const RouterInstance = RouterCryptokoyn.instance();
 
     const { barConfig } = await Themes[Css.currentTheme]();
-
-    const badgeNotificationMenuStyle = { top: '-33px', left: '24px' };
     const barMode = undefined; // 'top-bottom-bar';
     await Modal.instance({
       id: 'modal-menu',

package/src/client/components/cyberia-portal/RouterCyberiaPortal.js

@@ -56,10 +56,6 @@ class RouterCyberiaPortal {
         title: 'cyberia-entity-engine',
         render: () => s(`.main-btn-cyberia-entity-engine`).click(),
       },
-      '/fallback-world-engine': {
-        title: 'fallback-world-engine',
-        render: () => s(`.main-btn-fallback-world-engine`).click(),
-      },
       '/instance-selection': {
         title: 'instance-selection',
         render: () => s(`.main-btn-instance-selection`).click(),

package/src/client/components/default/AppShellDefault.js

@@ -31,8 +31,6 @@ class AppShellDefault {
     const RouterInstance = RouterDefault.instance();
 
     const { barConfig } = await Themes[Css.currentTheme]();
-
-    const badgeNotificationMenuStyle = { top: '-33px', left: '24px' };
     const barMode = undefined; // 'top-bottom-bar';
     await Modal.instance({
       id: 'modal-menu',
@@ -197,8 +195,7 @@ class AppShellDefault {
             ${await Badge.instance({
               id: 'main-btn-chat',
               type: 'circle-red',
-              style: badgeNotificationMenuStyle,
-              classList: 'hide',
+              classList: 'hide badge-notification-menu',
             })}`,
             attrs: `data-id="chat"`,
             tabHref: `${getProxyPath()}chat`,

package/src/client/components/itemledger/AppShellItemledger.js

@@ -27,8 +27,6 @@ class AppShellItemledger {
     const RouterInstance = RouterItemledger.instance();
 
     const { barConfig } = await Themes[Css.currentTheme]();
-
-    const badgeNotificationMenuStyle = { top: '-33px', left: '24px' };
     const barMode = undefined; // 'top-bottom-bar';
     await Modal.instance({
       id: 'modal-menu',

package/src/client/components/underpost/AppShellUnderpost.js

@@ -227,7 +227,7 @@ class AppShellUnderpost {
       titleRender: () => {
         return '';
       },
-      mode: 'slide-menu',
+      mode: 'slide-menu-right',
       RouterInstance,
       searchCustomImgClass: 'underpost-menu-icon',
       htmlMainBody: async () => {

package/src/client/public/cyberia-docs/CYBERIA.md

@@ -20,7 +20,7 @@ _Stackable Rendering Layers as a Unified Tokenized Reality_
 <!-- CI/CD and health -->
 <div align="center">
 
-[![Node.js CI](https://img.shields.io/github/actions/workflow/status/underpostnet/engine-cyberia/docker-image.engine-cyberia.ci.yml?branch=main&label=Node.js%20CI)](https://github.com/underpostnet/engine-cyberia/actions/workflows/docker-image.engine-cyberia.ci.yml) [![Test](https://img.shields.io/github/actions/workflow/status/underpostnet/engine-cyberia/coverall.cyberia.ci.yml?branch=main&label=Test)](https://github.com/underpostnet/engine-cyberia/actions/workflows/coverall.cyberia.ci.yml) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine-cyberia/badge.svg?branch=main)](https://coveralls.io/github/underpostnet/engine-cyberia?branch=main) [![Socket Badge](https://socket.dev/api/badge/npm/package/cyberia/3.3.76)](https://socket.dev/npm/package/cyberia/overview/3.3.76)
+[![Node.js CI](https://img.shields.io/github/actions/workflow/status/underpostnet/engine-cyberia/docker-image.engine-cyberia.ci.yml?branch=main&label=Node.js%20CI)](https://github.com/underpostnet/engine-cyberia/actions/workflows/docker-image.engine-cyberia.ci.yml) [![Test](https://img.shields.io/github/actions/workflow/status/underpostnet/engine-cyberia/coverall.cyberia.ci.yml?branch=main&label=Test)](https://github.com/underpostnet/engine-cyberia/actions/workflows/coverall.cyberia.ci.yml) [![Coverage Status](https://coveralls.io/repos/github/underpostnet/engine-cyberia/badge.svg?branch=main)](https://coveralls.io/github/underpostnet/engine-cyberia?branch=main) [![Socket Badge](https://socket.dev/api/badge/npm/package/cyberia/3.3.77)](https://socket.dev/npm/package/cyberia/overview/3.3.77)
 
 </div>
 

package/src/client/public/cyberia-docs/ROADMAP.md

@@ -1,6 +1,6 @@
 # Cyberia Online — Development Roadmap
 
-**Current version:** 3.3.76 | **Target milestone:** Open Alpha
+**Current version:** 3.3.77 | **Target milestone:** Open Alpha
 
 ---
 

package/src/client/public/cyberia-docs/WHITE-PAPER.md

@@ -18,7 +18,7 @@ _Stackable Rendering Layers as a Unified Tokenized Reality_
 
 ---
 
-**Version:** 3.3.76 | **Status:** Draft | **Authors:** Underpost Engineering
+**Version:** 3.3.77 | **Status:** Draft | **Authors:** Underpost Engineering
 
 ---
 

package/src/client/ssr/views/Cyberia404.js

@@ -155,7 +155,7 @@ const main = () => {
           text-align: center;
           padding: 24px;
         }
-        .badge {
+        .status-badge {
           display: inline-flex;
           align-items: center;
           gap: 8px;
@@ -168,7 +168,7 @@ const main = () => {
           margin-bottom: 26px;
           box-shadow: 0 0 12px rgba(34, 211, 238, 0.35);
         }
-        .badge .dot {
+        .status-badge .dot {
           width: 8px;
           height: 8px;
           background: var(--green);
@@ -296,7 +296,7 @@ const main = () => {
       </style>
       <div class="grid"></div>
       <main class="wrap">
-        <span class="badge"><span class="dot"></span> INSTANCE ${instanceLabel()}</span>
+        <span class="status-badge"><span class="dot"></span> INSTANCE ${instanceLabel()}</span>
         <div class="code" data-text="404">404</div>
         <div class="headline">SIGNAL LOST</div>
         <p class="sub">

package/src/index.js

@@ -52,7 +52,7 @@ class Underpost {
    * @type {String}
    * @memberof Underpost
    */
-  static version = 'v3.3.76';
+  static version = 'v3.3.77';
 
   /**
    * Required Node.js major version

package/src/runtime/engine-cyberia/Dockerfile

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.3.76
+ARG UNDERPOST_VERSION=3.3.77
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0

package/src/runtime/engine-cyberia/Dockerfile.dev

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.3.76
+ARG UNDERPOST_VERSION=3.3.77
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0

package/src/runtime/engine-cyberia/Dockerfile.test

@@ -6,7 +6,7 @@
 # Stage 1 — builder: clone the private deploy, build it, then scrub secrets.
 # ---------------------------------------------------------------------------
 FROM rockylinux/rockylinux:9 AS builder
-ARG UNDERPOST_VERSION=3.3.76
+ARG UNDERPOST_VERSION=3.3.77
 # Pin Node to an exact patch: dnf's nodejs:24 module lags (24.14.1) while
 # underpost's dependencies require >=24.15.0, so install the official binary.
 ARG NODE_VERSION=24.15.0

package/src/runtime/engine-cyberia/docker-compose.yml

@@ -135,7 +135,7 @@ services:
   # server starts but rejects connections until seeded). Serves REST/WS on 4005
   # and the engine gRPC data service on 50051.
   engine-cyberia-runtime:
-    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.3.76}
+    image: ${ENGINE_CYBERIA_IMAGE:-underpost/engine-cyberia-dev}:${ENGINE_CYBERIA_TAG:-v3.3.77}
     container_name: dd-cyberia-engine
     command:
       - /bin/sh
@@ -190,7 +190,7 @@ services:
   # gateway on host port 8081, so one port can route every instance path.
 
   cyberia-server-runtime:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.76}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.77}
     container_name: dd-cyberia-server
     environment:
       INSTANCE_CODE: amethyst-strata-expansion
@@ -228,7 +228,7 @@ services:
     restart: unless-stopped
 
   cyberia-server-forest:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.76}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.77}
     container_name: dd-cyberia-server-forest
     environment:
       INSTANCE_CODE: FOREST
@@ -266,7 +266,7 @@ services:
     restart: unless-stopped
 
   cyberia-server-test:
-    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.76}
+    image: ${CYBERIA_SERVER_IMAGE:-underpost/cyberia-server-dev}:${CYBERIA_SERVER_TAG:-v3.3.77}
     container_name: dd-cyberia-server-test
     environment:
       INSTANCE_CODE: TEST
@@ -315,7 +315,7 @@ services:
   #   cyberia-server-test   -> cyberia-client-test
 
   cyberia-client-runtime:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.76}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.77}
     container_name: dd-cyberia-client
     environment:
       CYBERIA_PORT: '8081'
@@ -340,7 +340,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-forest:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.76}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.77}
     container_name: dd-cyberia-client-forest
     environment:
       CYBERIA_PORT: '8081'
@@ -365,7 +365,7 @@ services:
     restart: unless-stopped
 
   cyberia-client-test:
-    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.76}
+    image: ${CYBERIA_CLIENT_IMAGE:-underpost/cyberia-client-dev}:${CYBERIA_CLIENT_TAG:-v3.3.77}
     container_name: dd-cyberia-client-test
     environment:
       CYBERIA_PORT: '8081'

package/src/server/network/underpost-gateway.js

@@ -957,6 +957,104 @@ const placeInstanceStaticAssets = ({ instances, options, label }) => {
   return assertStaticAssets({ records, hostRoot, label });
 };
 
+/**
+ * @method parseRawHttpResponse
+ * @description Splits a raw HTTP/1.x response into its status code and body. The body
+ * is everything after the first blank line, byte for byte, so it can be hashed against
+ * the document on disk.
+ * @param {string} raw - Response as read off the socket.
+ * @returns {{status: string, body: string}} Status code (empty when no status line) and body.
+ * @memberof UnderpostGateway
+ */
+const parseRawHttpResponse = (raw = '') => {
+  const status = /^HTTP\/[0-9.]+\s+([0-9]{3})/.exec(raw)?.[1] || '';
+  if (!status) return { status: '', body: '' };
+  const separator = raw.search(/\r?\n\r?\n/);
+  if (separator < 0) return { status, body: '' };
+  return { status, body: raw.slice(separator).replace(/^\r?\n\r?\n/, '') };
+};
+
+/**
+ * @method gatewayPodFetch
+ * @description One request against the gateway from inside its own pod, returning the
+ * status and the body even when the status is an error.
+ *
+ * Written on the socket with `nc` rather than fetched with `wget`: the image ships
+ * busybox, whose `wget` discards the body of any non-2xx response and exits — so a
+ * fallback document, which is by definition delivered with an upstream-failure status,
+ * could never be read through it. The probe that did so failed every attempt on a
+ * correct edge and looked like a hang. HTTP/1.0 keeps the reply unchunked, so the body
+ * is the document verbatim. Where `nc` is absent the `wget` pair still yields the status.
+ * @param {object} params
+ * @param {string} params.namespace - Namespace the gateway runs in.
+ * @param {string} params.host - Host header to present.
+ * @param {string} [params.path] - Request path.
+ * @returns {{status: string, body: string}} What the gateway answered.
+ * @memberof UnderpostGateway
+ */
+const gatewayPodFetch = ({ namespace, host, path = '/' }) => {
+  const exec = (script) =>
+    `${
+      shellExec(`kubectl exec -n ${namespace} deploy/${UNDERPOST_GATEWAY.name} -- sh -c "${script}"`, {
+        stdout: true,
+        silent: true,
+        silentOnError: true,
+        disableLog: true,
+      }) ?? ''
+    }`;
+  const request = path || '/';
+  const raw = exec(
+    `printf 'GET ${request} HTTP/1.0\\r\\nHost: ${host}\\r\\n\\r\\n' | nc -w 10 127.0.0.1 ${UNDERPOST_GATEWAY.port} 2>/dev/null || true`,
+  );
+  const parsed = parseRawHttpResponse(raw);
+  if (parsed.status) return parsed;
+  const url = `http://127.0.0.1${request}`;
+  const headers = exec(`wget -S -O /dev/null -T 10 --header 'Host: ${host}' ${url} 2>&1 || true`);
+  const status = [...headers.matchAll(/HTTP\/[0-9.]+\s+([0-9]{3})/g)].pop()?.[1] || '';
+  const body = exec(`wget -q -O - -T 10 --header 'Host: ${host}' ${url} 2>/dev/null || true`);
+  return { status, body };
+};
+
+/**
+ * @method gatewayFetch
+ * @description One request against the gateway, returning the status and the body
+ * even when the status is an error — the shape every fallback probe asserts on.
+ *
+ * Sent from this host with `curl` to the gateway Service first: the sync runs on the
+ * node that holds the gateway's volume, so the ClusterIP is reachable, and curl keeps
+ * the body of an error response. Only when that yields no status line does it fall back
+ * to {@link UnderpostGateway.gatewayPodFetch}, which needs nothing on the host at all.
+ * @param {object} params
+ * @param {string} params.namespace - Namespace the gateway runs in.
+ * @param {string} params.host - Host header to present.
+ * @param {string} [params.path] - Request path.
+ * @returns {{status: string, body: string, via: string}} What the gateway answered, and which way.
+ * @memberof UnderpostGateway
+ */
+const gatewayFetch = ({ namespace, host, path = '/' }) => {
+  const clusterIp = `${
+    shellExec(`kubectl get svc ${UNDERPOST_GATEWAY.serviceName} -n ${namespace} -o jsonpath='{.spec.clusterIP}'`, {
+      stdout: true,
+      silent: true,
+      silentOnError: true,
+      disableLog: true,
+    }) ?? ''
+  }`.trim();
+  if (/^[0-9a-f.:]+$/i.test(clusterIp)) {
+    const raw = `${
+      shellExec(
+        `curl -sS -i --noproxy '*' --max-time 10 -H 'Host: ${host}' http://${clusterIp}:${UNDERPOST_GATEWAY.port}${
+          path || '/'
+        } 2>/dev/null || true`,
+        { stdout: true, silent: true, silentOnError: true, disableLog: true },
+      ) ?? ''
+    }`;
+    const parsed = parseRawHttpResponse(raw);
+    if (parsed.status) return { ...parsed, via: 'host' };
+  }
+  return { ...gatewayPodFetch({ namespace, host, path }), via: 'pod' };
+};
+
 /**
  * @method gatewayFallbackProbeRunner
  * @description Proves the edge answers each configured fallback with the exact
@@ -1018,26 +1116,24 @@ const gatewayFallbackProbeRunner = async ({ checks, options, label, gatewayStatu
           silent: true,
           silentOnError: true,
         }).trim();
-      } else {
-        const request = `http://127.0.0.1${check.path || '/'}`;
-        body = shellExec(
-          `kubectl exec -n ${namespace} deploy/${UNDERPOST_GATEWAY.name} -- sh -c ` +
-            `"wget -q -O - -T 10 --header 'Host: ${check.host}' ${request} 2>/dev/null || true"`,
-          { stdout: true, silent: true, silentOnError: true },
-        );
-        const headers = shellExec(
-          `kubectl exec -n ${namespace} deploy/${UNDERPOST_GATEWAY.name} -- sh -c ` +
-            `"wget -S -O /dev/null -T 10 --header 'Host: ${check.host}' ${request} 2>&1 || true"`,
-          { stdout: true, silent: true, silentOnError: true },
-        );
-        status = [...headers.matchAll(/HTTP\/[0-9.]+\s+([0-9]{3})/g)].pop()?.[1] || '';
-      }
+      } else ({ status, body } = gatewayFetch({ namespace, host: check.host, path: check.path }));
       actualHash = crypto
         .createHash('sha256')
         .update(body || '')
         .digest('hex');
       passed = /^50[234]$/.test(status) && !!expectedHash && actualHash === expectedHash;
       if (passed) break;
+      // The first miss is reported as it happens: a probe that polls for minutes with
+      // nothing on the console reads as a hang, and what it saw is the whole diagnosis.
+      if (attempts === 1)
+        logger.warn(`[${label}] Fallback probe not yet satisfied; polling`, {
+          host: check.host,
+          path: check.path || '/',
+          status: status || '(none)',
+          bodyBytes: Buffer.byteLength(body || ''),
+          bodyMatchesConfiguredAsset: actualHash === expectedHash,
+          expectedAsset: expectedHash ? check.assetPath : '(missing on disk)',
+        });
       if (attempts < 30) await timer(2000);
     }
     const result = {
@@ -1059,6 +1155,8 @@ export {
   UNDERPOST_GATEWAY,
   assertStaticAssets,
   gatewayFallbackProbeRunner,
+  gatewayFetch,
+  gatewayPodFetch,
   gatewayStaticAssetExists,
   hostInstanceRegistryPathFactory,
   hostServerConfFactory,
@@ -1071,6 +1169,7 @@ export {
   kubernetesUpstreamFactory,
   underpostGatewayManifestsFactory,
   nginxConfFactory,
+  parseRawHttpResponse,
   seedDefaultStatusPage,
   staticLocationFactory,
   staticPathSegmentFactory,

package/src/server/runtime/conf.js

@@ -3001,14 +3001,41 @@ const syncPrivateConf = (deployId, extraPaths = []) => {
 };
 
 /**
- * Moves a deploy's public template sources into the engine working tree ahead of
- * the build copy step. Idempotent and safe to rerun: each move is guarded by
- * `existsSync`, so already-moved or absent sources are skipped rather than throwing.
- * The `[src, dest]` pairs come from the deploy's product catalog (passed in), so
- * this module stays product-agnostic.
+ * Mirrors a deploy's public template sources from the engine working tree to the source
+ * repo they came from. The engine ignores every one of these paths, so an edit made there
+ * never reaches a diff; the source repo is where it is reviewed and committed. Each path
+ * the engine holds is replaced wholesale there (removed, then copied) so the source repo's
+ * `git status` reads as exactly the engine tree's state, deletions included. The engine
+ * copies stay in place: this is a copy, not a move. A path the engine tree does not hold
+ * is left untouched in the source repo rather than deleted.
+ *
+ * @method syncDeployIdSourcesBack
+ * @param {Array<[string, string]>} [sourceMoves=[]] - Public `[src, dest]` pairs.
+ * @returns {string[]} The source paths that were mirrored.
+ * @memberof ServerConfBuilder
+ */
+const syncDeployIdSourcesBack = (sourceMoves = []) => {
+  const mirrored = [];
+  for (const [src, dest] of sourceMoves) {
+    if (!fs.existsSync(dest)) continue;
+    fs.removeSync(src);
+    fs.copySync(dest, src);
+    mirrored.push(src);
+  }
+  return mirrored;
+};
+
+/**
+ * Brings a deploy's public template sources into line ahead of the build copy step. The
+ * engine working tree is the working copy and the source repo its git view, so a path the
+ * engine already holds is mirrored out to the repo ({@link syncDeployIdSourcesBack}) and
+ * only a path the engine lacks is copied in. Nothing is moved: the repo's working tree
+ * keeps every file, so a build never leaves it reading as wholesale deletions, and an
+ * engine-side edit is never overwritten by the repo's copy. Safe to rerun: each step is
+ * guarded by `existsSync`.
  *
  * @method syncDeployIdSources
- * @param {Array<[string, string]>} [sourceMoves=[]] - Public `[src, dest]` move pairs.
+ * @param {Array<[string, string]>} [sourceMoves=[]] - Public `[src, dest]` pairs.
  * @returns {boolean} `true` when any sources were declared, else `false`.
  * @memberof ServerConfBuilder
  */
@@ -3016,7 +3043,8 @@ const syncDeployIdSources = (sourceMoves = []) => {
   if (!sourceMoves.length) return false;
   for (const dir of ['src/api', 'src/client/components', 'src/client/public', 'src/client/services'])
     fs.mkdirSync(dir, { recursive: true });
-  for (const [src, dest] of sourceMoves) if (fs.existsSync(src)) fs.moveSync(src, dest, { overwrite: true });
+  syncDeployIdSourcesBack(sourceMoves);
+  for (const [src, dest] of sourceMoves) if (!fs.existsSync(dest) && fs.existsSync(src)) fs.copySync(src, dest);
   return true;
 };
 
@@ -3448,6 +3476,7 @@ export {
   waitForPort,
   syncPrivateConf,
   syncDeployIdSources,
+  syncDeployIdSourcesBack,
   gitOriginRepositoryName,
   ensureTemplateCheckout,
   pruneTemplateWorkTree,

package/src/server/runtime/start.js

@@ -333,10 +333,19 @@ class UnderpostStartUp {
       const result = await awaitDeployMonitor(true);
       if (result === true) {
         // Withdraw every domain's local traces once the deployment is serving. Three calls
-        // rather than one cross-domain sweep: each domain owns what it put on disk.
+        // rather than one cross-domain sweep: each domain owns what it put on disk. Only the
+        // host domain is forced: its `--force` removes the ephemeral `engine-private` clone,
+        // which must not outlive the boot inside a container. For the other two, `--force`
+        // reaches into the cluster (the app Secret, secret purges) and is never wanted here.
         if (env === 'production' && Underpost.state.isInsideContainer())
           for (const domain of [Underpost.secret, Underpost.host, Underpost.app])
-            domain.clean({ env, namespace: 'default', args: {}, dryRun: false, force: false });
+            domain.clean({
+              env,
+              namespace: 'default',
+              args: {},
+              dryRun: false,
+              force: domain === Underpost.host,
+            });
         setTimeout(() => {
           setRuntimeStatus(deployId, env, RUNTIME_STATUS.RUNNING);
           setStartContainerStatus(deployId, env);

package/test/integration/infra/4-ingress/underpost-ingress.test.js

@@ -263,7 +263,7 @@ describe('shared ingress front', () => {
       );
       const testCandidate = install.indexOf("execIngress('nginx -t -c /tmp/nginx.candidate.conf'");
       const reload = install.indexOf('nginx -s reload -c /tmp/nginx.conf', testCandidate);
-      const persist = install.indexOf("shellExec(`kubectl apply -f - -n ${namespace} <<'EOF'", reload);
+      const persist = install.indexOf("`kubectl apply -f - -n ${namespace} <<'EOF'", reload);
       expect(testCandidate).to.be.greaterThan(-1);
       expect(reload).to.be.greaterThan(testCandidate);
       expect(persist).to.be.greaterThan(reload);

package/test/unit/catalog.test.js

@@ -14,6 +14,12 @@ import { TEST_TIERS } from '../../src/server/build/testing.js';
 const catalogs = await loadProductCatalogs();
 const describeProducts = describe.skipIf(catalogs.length === 0);
 
+// A product template keeps its own catalog but has every other product sliced away, so only
+// the unsliced engine tree carries every catalog and every tier directory. `buildTemplate`
+// drops `build:template` from the manifest and every product manifest inherits that, which
+// makes the script the one durable marker of the unsliced tree.
+const unsliced = !!JSON.parse(fs.readFileSync('./package.json', 'utf8')).scripts?.['build:template'];
+
 describeProducts('product catalogs', () => {
   it('every catalog carries the uniform shape', () => {
     for (const catalog of catalogs)
@@ -54,14 +60,19 @@ describeProducts('product catalogs and the test tiers', () => {
     catalogs.some(({ stripPaths }) => stripPaths.includes(`./${directory}`)),
   );
 
-  it('has products that own at least one tier', () => {
+  it.skipIf(!unsliced)('has products that own at least one tier', () => {
     expect(strippedTiers).to.not.be.empty;
   });
 
-  it('gives every tier a directory that exists in an unsliced tree', () => {
+  it.skipIf(!unsliced)('gives every tier a directory that exists in an unsliced tree', () => {
     for (const { name, directory } of TEST_TIERS) expect(fs.existsSync(directory), name).to.equal(true);
   });
 
+  it('carries the directory of every tier a present product owns', () => {
+    // Holds in a product template too: what it kept of itself must be whole.
+    for (const { name, directory } of strippedTiers) expect(fs.existsSync(directory), name).to.equal(true);
+  });
+
   it('ships every tier it strips from the base template', () => {
     for (const { name, directory } of strippedTiers) {
       const owner = catalogs.find(({ stripPaths }) => stripPaths.includes(`./${directory}`));

package/test/unit/conf-resolution.test.js

@@ -35,6 +35,7 @@ import {
   resolveHostKeyContext,
   resolveReplicaCount,
   syncDeployIdSources,
+  syncDeployIdSourcesBack,
   syncPrivateConf,
   updatePrivateEngineTestRepo,
   updatePrivateTemplateRepo,
@@ -757,17 +758,50 @@ describe('private conf sync', () => {
     expect(syncDeployIdSources([])).to.equal(false);
   });
 
-  it('moves every declared source that is present, skipping the rest', () => {
-    const moved = [];
-    vi.spyOn(fs, 'existsSync').mockImplementation((filePath) => `${filePath}`.includes('present'));
-    vi.spyOn(fs, 'moveSync').mockImplementation((src, dest) => moved.push(`${src} -> ${dest}`));
+  it('copies in only the sources the engine tree lacks, and never moves', () => {
+    // Regression: the repo copy used to be moved over the engine copy, so a build discarded
+    // every edit made in the engine tree and left the repo reading as wholesale deletions.
+    const calls = [];
+    const present = new Set(['../engine-x/src/new.js', '../engine-x/src/edited.js', 'src/api/edited.js']);
+    vi.spyOn(fs, 'mkdirSync').mockImplementation(() => {});
+    vi.spyOn(fs, 'existsSync').mockImplementation((filePath) => present.has(`${filePath}`));
+    vi.spyOn(fs, 'removeSync').mockImplementation((target) => calls.push(`remove ${target}`));
+    vi.spyOn(fs, 'copySync').mockImplementation((src, dest) => calls.push(`copy ${src} -> ${dest}`));
+    vi.spyOn(fs, 'moveSync').mockImplementation(() => calls.push('move'));
     expect(
       syncDeployIdSources([
-        ['src/present.js', 'src/api/present.js'],
-        ['src/absent.js', 'src/api/absent.js'],
+        ['../engine-x/src/new.js', 'src/api/new.js'],
+        ['../engine-x/src/edited.js', 'src/api/edited.js'],
+        ['../engine-x/src/absent.js', 'src/api/absent.js'],
       ]),
     ).to.equal(true);
-    expect(moved).to.deep.equal(['src/present.js -> src/api/present.js']);
+    expect(calls).to.deep.equal([
+      // The engine copy wins: it is mirrored out before anything is copied in.
+      'remove ../engine-x/src/edited.js',
+      'copy src/api/edited.js -> ../engine-x/src/edited.js',
+      'copy ../engine-x/src/new.js -> src/api/new.js',
+    ]);
+  });
+
+  it('mirrors every source the tree holds back to its repo, replacing it whole', () => {
+    // The engine ignores the moved-in paths, so the source repo is the only place a change to
+    // them is diffed; replacing rather than overlaying makes deletions reach that diff too.
+    const calls = [];
+    vi.spyOn(fs, 'existsSync').mockImplementation((filePath) => `${filePath}`.includes('present'));
+    vi.spyOn(fs, 'removeSync').mockImplementation((target) => calls.push(`remove ${target}`));
+    vi.spyOn(fs, 'copySync').mockImplementation((src, dest) => calls.push(`copy ${src} -> ${dest}`));
+    vi.spyOn(fs, 'moveSync').mockImplementation(() => calls.push('move'));
+    expect(
+      syncDeployIdSourcesBack([
+        ['../engine-x/src/present.js', 'src/api/present.js'],
+        ['../engine-x/src/absent.js', 'src/api/absent.js'],
+      ]),
+    ).to.deep.equal(['../engine-x/src/present.js']);
+    expect(calls).to.deep.equal([
+      'remove ../engine-x/src/present.js',
+      'copy src/api/present.js -> ../engine-x/src/present.js',
+    ]);
+    expect(syncDeployIdSourcesBack()).to.deep.equal([]);
   });
 });