cursedops 0.19.0 → 0.19.2

package/README.md

@@ -25,7 +25,7 @@ import shape, worked example, and the incident each one is pinned to.
 | `cursedops/backups` | `BACKUP_KEEP`, the fleet's one retention for dated snapshots; `BACKUP_STAMP_PATTERN`, `backupStamp` and `stampTime` |
 | `cursedops/serve` | the static tier's four helpers — the path-traversal guard, the MIME table, the hashed-asset test, the crash handlers |
 | `cursedops/worker-safety` | the two static checks every Worker app's suite runs over its own source — the import-graph walk an app's own test does from `worker/index.ts` (a value import of `bun:sqlite` or a Bun-only subpath is a deploy that goes green and a Worker that never starts), and the await port's silent shapes (`rows.filter(async …)` keeps every row) |
-| `cursedops/api-floor` | the rule that an unmatched `/api/...` is a phrase and never the app shell — the namespace predicates, the trailing-slash normaliser, the default 404 body |
+| `cursedops/api-floor` | the rule that an unmatched `/api/...` is a phrase and never the app shell — the namespace predicates, the trailing-slash normalizer, the default 404 body |
 | `cursedops/build-info` | which commit a checkout-served process is running and whether its tree was dirty, read once at load. `node:child_process`, so never in a Worker |
 | `cursedops/bound-lists` | the static check that no SQL builds an `IN (…)` list one `?` per value — the shape D1 500s on past 100 ids |
 | `cursedops/staged-client` | the IMMUTABLE client a checkout-served app serves — a build staged into `<APP_DATA_DIR>/client/<commit>/` behind `CURRENT` |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.19.0",
+	"version": "0.19.2",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots — and printing a command that runs when pasted — without knowing a path, the generation's whole-tree laws run over one repo from a checkout or a worktree, macOS launchd agent install/replace/remove and the live port a job serves, the scaffolding and verdicts of a deployed smoke (origin probe, the smoke's own environment, a network that lies about DNS, a settled version), the static-serving helpers eight apps copied — the path-traversal guard among them — the API floor that keeps an unmatched /api/... from ever being answered with the app shell, the commit and dirty flag a checkout-served process reports, the Cloudflare Worker deploy toolkit four apps copied (the deploy sequence, exact-set secrets over a pipe, origin-first rollback, the curl edge fetch, the row-for-row D1 import proof, the billed-CPU tail check around a deploy's walk and smoke, and each app's worker:secrets and worker:smoke main as one function of its data), the relay a Worker fronts a Mac-bound app with (the Durable Object, the frames, the Mac's dialer and key rotation — lifted from station for roms — and the signed-in stage walk's skeleton and the relay app's whole worker:deploy), the Worker import-graph and await-port checks every Worker app's suite runs over its own source, and the public-surface ratchet three published libraries each carried a forked copy of. Mechanism only — no app knows its name from here. Bun, zero runtime dependencies (typescript is an optional peer, for public-surface only), ships source.",
 	"type": "module",
 	"scripts": {

package/src/apiFloor.ts

@@ -19,7 +19,7 @@
  *   > this commit and reload"*, which sent the owner at a deploy that could not have
  *   > helped.
  *
- * Both halves of that are here, because a floor without the normaliser fixes the symptom
+ * Both halves of that are here, because a floor without the normalizer fixes the symptom
  * the owner did not have: {@link canonicalApiPath} makes the trailing slash a non-event,
  * and {@link isApiPath} + {@link apiNotFoundBody} make every remaining miss a JSON 404
  * that names the route, the app and the commit answering. A wrong path says "wrong path";
@@ -73,7 +73,7 @@ export const isApiPath = (urlPath: string): boolean =>
  * 🔴 One rule, and it is the one that broke the Openclaw page: a trailing slash on an API
  * path is never meaningful. Hono mounts a sub-app's `get("/")` at the mount point WITHOUT
  * a trailing slash and then matches strictly, so `/api/openclaw/` is a different path
- * from `/api/openclaw` and matched nothing at all. Normalising once, in front of the
+ * from `/api/openclaw` and matched nothing at all. Normalizing once, in front of the
  * router, means no caller anywhere can spell it the losing way again — which a fix in the
  * one client module that happened to do it would not have bought.
  *
@@ -86,8 +86,8 @@ export function canonicalApiPath(urlPath: string): string | null {
 }
 
 /**
- * The same normalisation, applied to a whole request. Returns the request unchanged when
- * there is nothing to normalise, so a caller that guards on {@link canonicalApiPath}
+ * The same normalization, applied to a whole request. Returns the request unchanged when
+ * there is nothing to normalize, so a caller that guards on {@link canonicalApiPath}
  * allocates nothing.
  *
  * 🔴 **Call it from INSIDE the floor handler and re-dispatch, not from the host's

package/src/d1Import.ts

@@ -14,17 +14,17 @@
  * ## 🔴 Row for row, never a count
  *
  * Two tables can hold the same NUMBER of different rows, and a count is exactly the check that
- * cannot tell — on `collections`' catalogue that would have been a caption, a rotation or a
+ * cannot tell — on `collections`' catalog that would have been a caption, a rotation or a
  * checksum silently replaced by another file's. `collections`, `vault`, `patterns` and `music`
  * each wrote this comparison (task 2097); the `rowDigest` bodies had drifted:
  *
- *   · `collections` normalised numbers — `bun:sqlite` hands back `0` where D1's JSON carries
+ *   · `collections` normalized numbers — `bun:sqlite` hands back `0` where D1's JSON carries
  *     `0.0`, and float noise past twelve significant digits — because `duration_seconds` is REAL
- *     on 39 of its rows and a comparison that called those different reported the catalogue
- *     corrupt on every run. `vault` and `music` did not normalise, and would have.
+ *     on 39 of its rows and a comparison that called those different reported the catalog
+ *     corrupt on every run. `vault` and `music` did not normalize, and would have.
  *   · `vault` and `music` spelled a BLOB as `X'…'` for the insert; `patterns` could not carry one.
  *
- * The body here is the union: numbers normalised, blobs compared as hex whichever side they came
+ * The body here is the union: numbers normalized, blobs compared as hex whichever side they came
  * from (a `Uint8Array` from `bun:sqlite`, an array of bytes from D1's JSON), booleans as 0/1.
  */
 
@@ -54,7 +54,7 @@ function cell(value: unknown): string | number | null {
 	return String(value);
 }
 
-/** One row flattened to a comparable string over `columns` — see the header for the normalisation. */
+/** One row flattened to a comparable string over `columns` — see the header for the normalization. */
 export function rowDigest(row: Readonly<Record<string, unknown>>, columns: readonly string[]): string {
 	return JSON.stringify(columns.map((column) => cell(row[column])));
 }

package/src/edgeFetch.ts

@@ -271,7 +271,7 @@ export const NO_ANSWER_STATUS = 599;
  * {@link NO_ANSWER_STATUS} `Response` whose body and `x-edge-error` header carry the reason, and
  * `onThrow` hears it first so the smoke's ledger can name it.
  *
- * 🔴 Why (2026-09-25): roms' `worker:smoke` asked a relayed path while the Mac's link redialled,
+ * 🔴 Why (2026-09-25): roms' `worker:smoke` asked a relayed path while the Mac's link redialed,
  * `edgeFetch` threw on curl exit 28, and the process died with a stack trace and no ledger — so a
  * healthy release exited 1. Every leg of a smoke is supposed to be RECORDED: a throw is a failed
  * leg naming its path, never the end of the run.

package/src/launchd.ts

@@ -66,7 +66,7 @@ export interface CommandResult {
 /**
  * How this module reaches launchd and the LaunchAgents directory.
  *
- * Injectable as one object because the interesting behaviour — clearing a label
+ * Injectable as one object because the interesting behavior — clearing a label
  * and *waiting* for it to go — cannot otherwise be reached from a test that does
  * not install a real login agent first, and a test nobody runs is not a test.
  */

package/src/relay.ts

@@ -38,7 +38,7 @@ export const DEFAULT_MAX_BODY_BYTES = 4 * 1024 * 1024;
 /** How long the Worker waits for the Mac to answer one request before it says so. */
 export const DEFAULT_RELAY_TIMEOUT_MS = 30_000;
 
-/** A request travelling DOWN the link. `path` includes the query string. */
+/** A request traveling DOWN the link. `path` includes the query string. */
 export interface RequestFrame {
 	t: "req";
 	id: string;
@@ -48,7 +48,7 @@ export interface RequestFrame {
 	body: string | null;
 }
 
-/** The Mac's answer, travelling UP. Multiple `set-cookie` lines stay separate pairs. */
+/** The Mac's answer, traveling UP. Multiple `set-cookie` lines stay separate pairs. */
 export interface ResponseFrame {
 	t: "res";
 	id: string;
@@ -459,7 +459,7 @@ export class RelayLink {
 			if (body.length <= (cache.maxKeptBody ?? 512 * 1024)) {
 				const at = this.now();
 				await this.state.storage.put(`c:${owner}:${keyed}`, { body, contentType: response.headers.get("content-type") ?? "application/json", at } satisfies Kept);
-				// The newest cookie the Mac honoured is the one a `warm` frame refreshes under.
+				// The newest cookie the Mac honored is the one a `warm` frame refreshes under.
 				await this.state.storage.put("warm", { cookie, at });
 			}
 		}
@@ -474,7 +474,7 @@ export class RelayLink {
 		if (keys.length > 0) await this.state.storage.delete(keys);
 	}
 
-	/** Refresh every read the Mac named, under the newest cookie it honoured — if that is still fresh. */
+	/** Refresh every read the Mac named, under the newest cookie it honored — if that is still fresh. */
 	private async warm(paths: readonly string[]): Promise<void> {
 		const cache = this.options.offline;
 		if (!cache) return;

package/src/relayStage.ts

@@ -163,7 +163,7 @@ export const realRun: Run = (argv, options) => {
 /**
  * 🔴 How many rounds in a row every `/healthz` must name a just-put link digest before a walk uses it.
  * A digest put is a new Worker version, and the edge takes it up instance by instance: the link
- * staying up for 15 s proves only that the instance the link dialled has it. The Worker signs the
+ * staying up for 15 s proves only that the instance the link dialed has it. The Worker signs the
  * Mac's identity with that digest, so a request answered by an instance still on the old one is the
  * Mac's own 401 (and station's kept read a 503). Measured 2026-10-15 (forge task 3235): station's
  * fast-lane walk at baf8495, the link steady for 15 s, then four writes 401 at the Mac; on the real

package/src/roots.ts

@@ -8,7 +8,7 @@
  * written independently against the same problem; measured 2026-09-16 the
  * `findForgeRoot` bodies were character-identical and the surrounding halves were
  * not, which is the definition of an extraction that is measurable rather than
- * speculative. Two implementations, one behaviour.
+ * speculative. Two implementations, one behavior.
  *
  * ## The rule this serves
  *
@@ -332,7 +332,7 @@ function shellDoubleQuoted(value: string): string {
  * {@link findForgeRoot}).
  *
  * 🔴 **Verified, never trusted.** A `$FORGE` pointing at a directory with no `forge.env` is a
- * stale export from a shell that outlived a move, and honouring it re-creates the exact defect
+ * stale export from a shell that outlived a move, and honoring it re-creates the exact defect
  * {@link repoCd} exists to end: a command naming a directory that is not there.
  * {@link forgeCodeRoot} deliberately keeps its older contract (the variable wins unchecked); this
  * is the one for text a person will paste.

package/src/serve.ts

@@ -9,7 +9,7 @@
  * `station` and `vault` each have a `src/server/serve.ts`. The FILES differ — 247
  * to 387 lines, eight distinct versions, which is why no `diff` ever flagged them —
  * but these four bodies are character-identical in **eight of eight**, with the
- * whitespace and comments normalised away.
+ * whitespace and comments normalized away.
  *
  * 🔴 **`fileWithin` is why this was urgent rather than tidy.** It is the check that
  * stops `%2e%2e%2f` reaching the filesystem. Eight copies of a security guarantee
@@ -28,7 +28,7 @@
  * `8  <symbol> src/server/serve.ts` and is the census that will notice if a copy
  * comes back.
  *
- * ## 🔴 The one behaviour that is NOT a byte-for-byte carry
+ * ## 🔴 The one behavior that is NOT a byte-for-byte carry
  *
  * The eight copies resolved containment LEXICALLY — `resolve(join(root, …))` and a
  * `startsWith` — which is correct for `..` and for `%2e%2e%2f`, and blind to a
@@ -42,7 +42,7 @@
  *     the same way — the failure mode a naive `realpath` on one side only would
  *     have introduced, and the reason this is not one line;
  *   - every caller today passes a Vite `dist/`, and all eight were checked for
- *     symlinks on 2026-09-17: there are none. So no app's behaviour moves, and the
+ *     symlinks on 2026-09-17: there are none. So no app's behavior moves, and the
  *     day one of them serves a directory it did not build, the guard already holds.
  *
  * `serve.test.ts` drives both halves, including the symlink escape, because a guard

package/src/ship.ts

@@ -39,12 +39,12 @@
  * flipped yesterday — the precedence the retired `fastMode.ts` settled on 2026-08-13). A stage
  * deploy is never deferred: it IS the fast way to see a change on a real edge.
  *
- * 🔴 **Under a batch (`$AUTOPILOT_BATCH` set) it is honoured only for the ship task or an incident**
+ * 🔴 **Under a batch (`$AUTOPILOT_BATCH` set) it is honored only for the ship task or an incident**
  * ({@link shipNowVerdict}), and only with a reason in `FORGE_SHIP_NOW_WHY`. Until task 2384 any agent
  * could prefix one variable and turn the owner's switch off for itself — the thing
  * `~/.claude/CLAUDE.md` §2 says an agent may never do — and no record said it had. Now every ask,
- * honoured or refused, is a `kind: "ship-now"` ledger row, and `autopilot doctor` lists the ones
- * with no reason. In the owner's own shell (no batch) it is honoured exactly as before, and recorded.
+ * honored or refused, is a `kind: "ship-now"` ledger row, and `autopilot doctor` lists the ones
+ * with no reason. In the owner's own shell (no batch) it is honored exactly as before, and recorded.
  */
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -92,7 +92,7 @@ export function readShipSetting(state: string | null): ShipSetting {
 	}
 }
 
-/** Is `FORGE_SHIP_NOW` set to something that means yes? Asked is not honoured — see {@link shipNowVerdict}. */
+/** Is `FORGE_SHIP_NOW` set to something that means yes? Asked is not honored — see {@link shipNowVerdict}. */
 export function shipNowAsked(env: NodeJS.ProcessEnv = process.env): boolean {
 	const v = env[SHIP_NOW_VAR]?.trim().toLowerCase();
 	return v === "1" || v === "true" || v === "yes";
@@ -116,7 +116,7 @@ export interface ShipNowVerdict {
 	asked: boolean;
 	/** Ship now: asked, and (outside a batch, or on a claim that earns it). */
 	honoured: boolean;
-	/** One sentence: what made it honoured or refused. */
+	/** One sentence: what made it honored or refused. */
 	why: string;
 	/** `FORGE_SHIP_NOW_WHY`, trimmed — `""` when not given. */
 	reason: string;
@@ -159,7 +159,7 @@ export interface ShipNowWhere {
 }
 
 /**
- * Is `FORGE_SHIP_NOW` honoured here? Outside a batch, whenever it is asked: that is the owner's own
+ * Is `FORGE_SHIP_NOW` honored here? Outside a batch, whenever it is asked: that is the owner's own
  * shell. Under `$AUTOPILOT_BATCH`, only when that batch holds a live `kind: "task"` board claim
  * (`$FORGE_STATE/state/board/*.json`, the pid alive and not expired) on a task in
  * `$FORGE/tasks/In_Progress/` whose `escalation-key:` is one of {@link SHIP_NOW_KEYS}, AND
@@ -206,11 +206,11 @@ export function shipNowVerdict(where: ShipNowWhere, env: NodeJS.ProcessEnv = pro
 		if (key && SHIP_NOW_KEYS.some((k) => k.test(key))) return { ...base, honoured: true, why: `batch ${batch} holds ${c.task} (escalation-key: ${key})`, task: c.task };
 	}
 	return refuse(
-		`batch ${batch} holds ${held.length ? held.join(", ") : "no live task claim"} — ${SHIP_NOW_VAR} is honoured under a batch only for the ship task or a prod incident (escalation-key: ship | prod-down:<host>)`,
+		`batch ${batch} holds ${held.length ? held.join(", ") : "no live task claim"} — ${SHIP_NOW_VAR} is honored under a batch only for the ship task or a prod incident (escalation-key: ship | prod-down:<host>)`,
 	);
 }
 
-/** The ledger line every ship-now ask leaves — honoured or refused. */
+/** The ledger line every ship-now ask leaves — honored or refused. */
 export interface ShipNowEventLine {
 	at: string;
 	kind: "ship-now";

package/src/smoke.ts

@@ -13,7 +13,7 @@
  *      its logs was wrong.
  *   3. A deploy *succeeded* while every byte of media was unreachable, because the
  *      failing layer answered before the thing being health-checked ran.
- *   4. An app was up, green, and serving a catalogue a MONTH out of date.
+ *   4. An app was up, green, and serving a catalog a MONTH out of date.
  *   5. Two apps went live answering `no built client at …/public` at `/` while the
  *      edge returned 200 out of its cache of the RETIRED deployment. Gate green,
  *      deploy green, smoke green, app down; the owner found it, not a check.
@@ -62,7 +62,7 @@
  * built, `patterns.cursedalchemy.com` served one built on 2026-09-12 out of a
  * Worker nobody knew about, and **every automated surface was green for six days.**
  * The app-local implementation that found it — `apps/patterns/scripts/worker-smoke.ts`,
- * `CROSS_CHECKS` — is what this generalises, because five more apps are moving
+ * `CROSS_CHECKS` — is what this generalizes, because five more apps are moving
  * behind an edge Worker and a check told ONE NAME is a check about that name.
  *
  * ## What this module will never grow
@@ -501,7 +501,7 @@ export async function compareDeployedShells(addresses: string[], options: ShellO
 		url.searchParams.set("cb", cacheBust());
 		// 🔴 Re-thrown WITH the address and with the original message intact: which
 		// of the addresses could not be reached is the whole diagnosis, and
-		// {@link Smoke.dnsHint} still has to recognise an ENOTFOUND inside it.
+		// {@link Smoke.dnsHint} still has to recognize an ENOTFOUND inside it.
 		const response = await send(url.toString(), {
 			redirect: "manual",
 			signal: AbortSignal.timeout(timeoutMs),
@@ -929,7 +929,7 @@ export async function steadyHealth<T = Record<string, unknown>>(
  */
 export const HEALTH_READ_MAX_TIME_SEC = 10;
 
-/** The init a smoke's `/healthz` read carries — `cursedops/edge-fetch` honours it; a plain `fetch` ignores it. */
+/** The init a smoke's `/healthz` read carries — `cursedops/edge-fetch` honors it; a plain `fetch` ignores it. */
 const healthRead: EdgeRequestInit = { maxTimeSec: HEALTH_READ_MAX_TIME_SEC };
 
 /** One question a deploy must answer the NEW way — `null` when it does, else why not. */

package/src/workerDeploy.ts

@@ -82,7 +82,7 @@ export function parseWorkerEnv(argv: readonly string[]): WorkerEnv {
 	const value = (joined !== undefined ? joined.slice("--env=".length) : argv[index + 1])?.trim();
 	if (value === "production" || value === "stage") return value;
 	throw new Error(
-		`unrecognised --env ${JSON.stringify(value ?? "")} — production (no flag) or stage. ` +
+		`unrecognized --env ${JSON.stringify(value ?? "")} — production (no flag) or stage. ` +
 			"This refuses rather than defaulting: a typo that meant production would report success against the owner's data.",
 	);
 }
@@ -802,6 +802,23 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		return finish({ code: 1, step, detail, commit, dirty });
 	};
 	const step = (message: string): void => log(`\n▸ ${message}`);
+	/**
+	 * 🔴 The clean-tree refusal, asked again where production READS the tree (forge task 3601). It
+	 * was asked once, at the start — and the stage leg is minutes long. On 2026-10-23 the ship's
+	 * station lane passed it clean at 9ab4e676, deployed the stage clean, then built production from
+	 * a session's half-written edit landed in between: `build.json` stamped `9ab4e676 (dirty)`, and
+	 * only the asset budget stopped a production that would have reported one commit and run
+	 * another. So before the production build, and again before anything is uploaded, HEAD must
+	 * still be the commit stamped and the tree must still be clean.
+	 */
+	const moved = (during: string): DeployResult | null => {
+		if (spec.env !== "production") return null;
+		const head = deps.git(["rev-parse", "HEAD"]);
+		const now = deps.git(["status", "--porcelain"]);
+		if (head === commit && now.length === 0) return null;
+		const what = head !== commit ? `HEAD is now ${head.slice(0, 8) || "unreadable"}, not ${commit.slice(0, 8)}` : `it has uncommitted changes:\n${now}`;
+		return stop("tree-moved", `the tree moved ${during} — ${what}\nProduction would report ${commit.slice(0, 8)} and run something else, so nothing was deployed to it. Deploy again once the tree is still.`);
+	};
 	/** What passed under a CPU tail that never attached — decision 6 of the CPU check. */
 	const unmeasured: string[] = [];
 
@@ -879,6 +896,8 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 			else if (walked !== 0) return stop("stage", `\`${command.join(" ")}\` failed — production was NOT touched.`);
 		}
 	}
+	const beforeBuild = moved(spec.stageFirst?.length || spec.stageWalk?.length ? "while the stage deployed" : "before the build");
+	if (beforeBuild) return beforeBuild;
 	if (spec.build) {
 		step("build");
 		enter("build");
@@ -889,6 +908,8 @@ export function runWorkerDeploy(spec: WorkerDeploySpec, deps: DeployDeps): Deplo
 		const why = refusal();
 		if (why) return stop("refusal", `${why} — nothing was deployed.`);
 	}
+	const beforeUpload = moved("while it built");
+	if (beforeUpload) return beforeUpload;
 	const envArgs = wranglerEnvArgs(spec.env);
 	if (spec.databaseName) {
 		const schema = spec.schemaFile ?? "db/schema.sql";
@@ -1264,7 +1285,7 @@ export interface JudgeOpts {
 	scriptName: string;
 	/** Paths that are never the static tier. Default {@link DEFAULT_API_PREFIXES}. */
 	apiPrefixes?: readonly string[];
-	/** Replace the labeller entirely. Default {@link tierRoute}. */
+	/** Replace the labeler entirely. Default {@link tierRoute}. */
 	route?: (method: string, path: string) => string | null;
 }
 

package/src/workerRollback.ts

@@ -16,7 +16,7 @@
  * ## Why this order, and why it is a library entry
  *
  * `patterns` wrote it first (2026-09-19) because the owner required the rollback to be ONE
- * command — a launchd invocation nobody runs monthly and a route id nobody has memorised are not
+ * command — a launchd invocation nobody runs monthly and a route id nobody has memorized are not
  * cheap at the moment somebody needs them — and `collections`, `vault` and `music` copied it.
  * Deleting the route while nothing listens on the Mac points the household's hostname at a dead
  * box; so this starts the origin, WAITS for it to answer, and refuses to touch the route if it
@@ -184,7 +184,7 @@ export async function runWorkerRollback(spec: WorkerRollbackSpec, argv: readonly
 	const found = await findWorkerRoute(spec.api, host);
 	log(`route   ${found.pattern} → ${found.route ? `${found.script} (${found.route})` : "(none — the hostname already falls through to the Mac)"}`);
 
-	log("\n▸ what D1 holds against the Mac's frozen catalogue (the writes a rollback loses):");
+	log("\n▸ what D1 holds against the Mac's frozen catalog (the writes a rollback loses):");
 	bun(["run", "scripts/worker-import.ts", "--verify-only"], spec.root);
 
 	if (argv.includes("--check")) {

package/src/workerSecrets.ts

@@ -30,7 +30,7 @@
  * never noticed an extra — the drift this module ends.
  *
  * 🔴 **A value that is already single-quoted is written as is.** {@link envFileLines}:
- * `collections`' seed serialiser returns `'{"kdf":…}'`, quoting it again wrote an escaped pair
+ * `collections`' seed serializer returns `'{"kdf":…}'`, quoting it again wrote an escaped pair
  * around it, `readEnvFile` stripped one layer, and the stage's master lock came up asking to
  * ENROLL a new password (found 2026-09-22 by the stage walk, one step past sign-in).
  */