fix(org): restore names bus recover for a stale lock; receipt taken at mount; restore-then-dashboard test (#1873)

Build review P3-1, P3-3 and P3-4.

docs/TOOLS.md

@@ -335,7 +335,7 @@ For local development on a named instance only, `mosaic bus start BUSINESS --dev
 
 `mosaic console restart` and `mosaic org reload ORG` are the Console's Settings controls (F3) from a terminal (U1, #1873). Each sends one request to the running Console named in the instance's console state, as the page sends it (the Console's own Host and Origin, `Sec-Fetch-Site: same-origin`, a JSON `{}` body), so the Console applies the same owner, `--send` and origin checks and writes the same action trail, `<dataRoot>/console/actions.jsonl`. Both refuse inside an agent run (exit 3) before reading anything, and refuse with exit 3 when no Console runs. `console restart` works only for a Console started in the foreground by `mosaic console start`, or by `mosaic console start --dev-local-owner --detach`, which leaves a detached supervisor (`packages/cli/src/console-supervisor.mjs`, its own session) running the Console as the foreground start does; its receipt adds the supervisor's `supervisor` pid, and its later warnings go to `console/supervisor-*.log` under the data root. `mosaic console stop` stops that Console, and its supervisor then exits. `mosaic console start` refuses inside an agent run (exit 3), with or without `--dev-local-owner` or `--detach`, checking the starting process's own environment as well as the one given for the Console (agent-guard, #1873). A detached start whose supervisor does not reply within 60 seconds signals the supervisor's process group, then kills it, and clears `console/start.lock` only when the lock names that supervisor (pid and start time) and it is gone. Any other Console answers `not-supervised`. `console restart` waits up to 30 seconds for the relaunched Console to answer and prints `{"outcome":"restarted","from":OLD,"boot":NEW}`. `org reload ORG` restarts a running bus or starts a stopped one and prints the Console's done receipt. A request that left but got no answer is reported as outcome unknown (exit 1) and is never retried; check `mosaic console status`, `mosaic bus status ORG` and the trail. `mosaic bus restart ORG` remains the trail-less host verb.
 
-The bus and Console lifecycle verbs refuse inside an agent run (agent-guard, #1873): `mosaic bus start`, `bus stop`, `bus restart` and `bus recover`, and `mosaic console start`, `console stop` and `console restart`, and `mosaic org archive` and `org delete`, which stop the organization's bus. Each exits 3 with `refused: this runs only from a human shell, outside any agent run (found MARKER in the environment)` before it reads anything. It checks the environment it is given and its own process environment, so a sanitized environment does not hide a marker. A usage error (a missing or extra argument, `--pm` with `--no-launch`, or a bad `--dev-insecure-bind`/`--dev-allow-host`) still comes first (exit 4). `mosaic bus status` and `mosaic console status` stay open to agents. The Console's Restart bus and Restart Console controls keep working: the Console starts its bus host with its own environment, which carries no marker, and Restart Console relaunches the Console under its supervisor without going through the CLI. The markers are the ones `packages/cli/src/transport.mjs` lists. The check is cooperative: a process that drops the markers from its environment is not stopped by it.
+The bus and Console lifecycle verbs refuse inside an agent run (agent-guard, #1873): `mosaic bus start`, `bus stop`, `bus restart` and `bus recover`, and `mosaic console start`, `console stop` and `console restart`, and `mosaic org archive` and `org delete`, which stop the organization's bus, and `mosaic org restore`, which starts it (`org restore --no-bus` starts nothing and is not refused). Each exits 3 with `refused: this runs only from a human shell, outside any agent run (found MARKER in the environment)` before it reads anything. It checks the environment it is given and its own process environment, so a sanitized environment does not hide a marker. A usage error (a missing or extra argument, `--pm` with `--no-launch`, or a bad `--dev-insecure-bind`/`--dev-allow-host`) still comes first (exit 4). `mosaic bus status` and `mosaic console status` stay open to agents. The Console's Restart bus and Restart Console controls keep working: the Console starts its bus host with its own environment, which carries no marker, and Restart Console relaunches the Console under its supervisor without going through the CLI. The markers are the ones `packages/cli/src/transport.mjs` lists. The check is cooperative: a process that drops the markers from its environment is not stopped by it.
 
 The instance processing switch is separate from per-business launches off/on.
 `mosaic halt` durably stops managed processing across every business in the

packages/cli/README.md

@@ -1299,7 +1299,19 @@ require the source and deleted folder to be on the same filesystem.
 
 `mosaic org archive` and `mosaic org delete` stop the organization bus, so like
 `bus stop` they refuse inside an agent run (exit 3, agent-guard #1873), after
-their usage checks and before any config is read. `org restore` is unchanged.
+their usage checks and before any config is read.
+
+`mosaic org restore ID --if-revision N` makes the organization active and starts
+its bus, as `mosaic bus start ID --dev-local-owner --detach` does (E1, P1-4). It
+makes that verb's checks before the restore, so a stamped build or an instance
+that refuses `--dev-local-owner` refuses the restore before anything changes
+(exit 3). Starting a bus is a human action, so inside an agent run `org restore`
+refuses like `bus start` (exit 3) before any config is read. The receipt's `bus`
+names the outcome: `started` with the host pid, or `failed` with the message and
+the verb that starts it (after `mosaic bus recover ID` when a host that died left a
+stale lock). A bus that does not start leaves the restore in place;
+the command prints the receipt and exits 3. `org restore ID --if-revision N
+--no-bus` restores without starting the bus, as before, and stays open to agents.
 
 System types are installed plug-ins. `mosaic org system-types installed` prints
 module metadata; `mosaic org system-types enabled ID` prints an organization's enabled

packages/cli/src/org.mjs

@@ -6,19 +6,28 @@ import { installedSystemTypes } from '../../plugins/src/system-types.mjs';
 import { DEV_OWNER, devOwnerInstance } from './dev-local-owner.mjs';
 import { loadSystem } from './config.mjs';
 import { CliError } from './errors.mjs';
-import { busStopForDelete } from './org-bus.mjs';
+import { busStart, busStopForDelete } from './org-bus.mjs';
+import { assertBuildStart, assertDevInstance } from './deployment.mjs';
 import { consoleBusRestart } from './org-console.mjs';
 import { refuseInsideAgent } from './transport.mjs';
 import { definitionsCommand, DEFINITIONS_USAGE } from './org-definitions.mjs';
-export const ORG_USAGE = 'mosaic org system-types installed | system-types enabled ID | lock show|clear ID | reload ID | archive ID --if-revision N [--json] | restore ID --if-revision N [--json] | delete ID --confirm ID [--if-revision N] [--json] | template render ID [--fixture local] --output FILE | validate FILE | create ID --from FILE | show ID [--json] | list [--json] | update ID --from FILE --if-revision N | queue init ID (--local-only --accept-local-loss-risk | --remote URL) | queue show ID [--json] | project repo init ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) | project repo show ID PROJECT [--json] | ' + DEFINITIONS_USAGE.slice('mosaic org '.length) + ' | config validate ID | config resolve ID INSTANCE [--project ID]';
-function parse(args) { const pos = [], values = {}, flags = new Set(); for (let i = 0; i < args.length; i++) { const a = args[i]; if (['--json', '--local-only', '--accept-local-loss-risk'].includes(a)) { if (flags.has(a)) throw new CliError(`duplicate ${a}`, 4); flags.add(a); } else if (['--fixture', '--output', '--from', '--if-revision', '--remote', '--confirm'].includes(a)) { if (values[a] !== undefined || !args[i+1] || args[i+1].startsWith('--')) throw new CliError(`${a} needs one value`, 4); values[a] = args[++i]; } else if (a.startsWith('--')) throw new CliError(`unknown option ${a}`, 4); else pos.push(a); } return { pos, values, flags }; }
+export const ORG_USAGE = 'mosaic org system-types installed | system-types enabled ID | lock show|clear ID | reload ID | archive ID --if-revision N [--json] | restore ID --if-revision N [--no-bus] [--json] | delete ID --confirm ID [--if-revision N] [--json] | template render ID [--fixture local] --output FILE | validate FILE | create ID --from FILE | show ID [--json] | list [--json] | update ID --from FILE --if-revision N | queue init ID (--local-only --accept-local-loss-risk | --remote URL) | queue show ID [--json] | project repo init ID PROJECT (--local-only --accept-local-loss-risk | --remote URL) | project repo show ID PROJECT [--json] | ' + DEFINITIONS_USAGE.slice('mosaic org '.length) + ' | config validate ID | config resolve ID INSTANCE [--project ID]';
+function parse(args) { const pos = [], values = {}, flags = new Set(); for (let i = 0; i < args.length; i++) { const a = args[i]; if (['--json', '--local-only', '--accept-local-loss-risk', '--no-bus'].includes(a)) { if (flags.has(a)) throw new CliError(`duplicate ${a}`, 4); flags.add(a); } else if (['--fixture', '--output', '--from', '--if-revision', '--remote', '--confirm'].includes(a)) { if (values[a] !== undefined || !args[i+1] || args[i+1].startsWith('--')) throw new CliError(`${a} needs one value`, 4); values[a] = args[++i]; } else if (a.startsWith('--')) throw new CliError(`unknown option ${a}`, 4); else pos.push(a); } return { pos, values, flags }; }
 // A refusal names the document by label and the error by its code, never by host path or bytes (PR #1916).
 const errorCode = e => typeof e?.code === 'string' && /^E[A-Z0-9]+$/.test(e.code) ? e.code : 'unreadable';
 async function document(file) { try { return JSON.parse(await readFile(file, 'utf8')); } catch (e) { throw new CliError(`cannot read organization document: ${e instanceof SyntaxError ? 'not valid JSON' : errorCode(e)}`, 2); } }
 // agent-guard (#1873): archive and delete stop the organization's bus, so an agent run is refused
 // as it is for `mosaic bus stop`: after the usage checks, before any config is read, and checking
-// this process's own environment as well as io.env. Restore starts nothing and stays as it was.
+// this process's own environment as well as io.env. Restore starts the organization's bus (E1, P1-4),
+// so it is refused the same way unless --no-bus is given; `restore --no-bus` starts nothing.
 function refuseAgentRun(io) { refuseInsideAgent(process.env); refuseInsideAgent(io.env); }
+// E1 (P1-4): the bus a restore starts is the one `mosaic bus start ID --dev-local-owner --detach`
+// starts, after that verb's checks. The checks run before the restore, so a refusal changes nothing.
+function restoreBusCheck(system, env) {
+  try { assertBuildStart({ devOwner: true }); assertDevInstance(system, env); }
+  catch (e) { throw new CliError(`restore starts the bus as the local dev owner, and ${e.message}; restore with --no-bus, then start the bus with mosaic bus start`, 3); }
+}
+const busStartVerb = id => `mosaic bus start ${id} --dev-local-owner --detach`;
 export async function orgCommand(args, io, deps = {}) {
  try {
   // #1873 T1: the definitions verbs take their own options.
@@ -32,7 +41,7 @@ export async function orgCommand(args, io, deps = {}) {
   if (words[0] === 'reload') refuseInsideAgent(io.env);
   const revision = (r, required) => { if (r === undefined && !required) return undefined; if (!/^[1-9][0-9]*$/.test(r ?? '')) throw new CliError(r === undefined ? '--if-revision is required' : 'invalid revision', 4); return Number(r); };
   let lifecycle = null;
-  if (['archive', 'restore'].includes(words[0]) && words.length === 2) { allowed(['--json'], ['--if-revision']); lifecycle = { ifRevision: revision(p.values['--if-revision'], true) }; if (words[0] === 'archive') refuseAgentRun(io); }
+  if (['archive', 'restore'].includes(words[0]) && words.length === 2) { allowed(['--json', ...(words[0] === 'restore' ? ['--no-bus'] : [])], ['--if-revision']); lifecycle = { ifRevision: revision(p.values['--if-revision'], true) }; if (words[0] === 'archive' || !p.flags.has('--no-bus')) refuseAgentRun(io); }
   else if (words[0] === 'delete' && words.length === 2) { allowed(['--json'], ['--confirm', '--if-revision']); const ifRevision = revision(p.values['--if-revision'], false); lifecycle = { confirm: need('--confirm'), ifRevision }; refuseAgentRun(io); }
   if (words[0] === 'system-types' && words[1] === 'installed' && words.length === 2) { allowed(['--json'], []); io.stdout.write(JSON.stringify(await installedSystemTypes(), null, 2) + '\n'); return; }
   const instance = devOwnerInstance(io.env); const system = deps.system ?? loadSystem({ env: io.env, instance }); const ctx = { configDir: configDir(io.env), dataRoot: system.dataRoot, instance, principal: DEV_OWNER };
@@ -40,7 +49,24 @@ export async function orgCommand(args, io, deps = {}) {
   else if (words[0] === 'lock' && ['show', 'clear'].includes(words[1]) && words.length === 3) { allowed([], []); result = await orgLock(ctx, words[2], { clear: words[1] === 'clear' }); }
   else if (words[0] === 'create' && words.length === 2) { allowed([], ['--from']); result = await createOrg(ctx, words[1], await document(need('--from'))); }
   else if (words[0] === 'update' && words.length === 2) { allowed([], ['--from', '--if-revision']); const r = need('--if-revision'); if (!/^[1-9][0-9]*$/.test(r)) throw new CliError('invalid revision', 4); result = await updateOrg(ctx, words[1], await document(need('--from')), { ifRevision: Number(r) }); }
-  else if (['archive', 'restore'].includes(words[0]) && words.length === 2) result = words[0] === 'archive' ? await archiveOrg(ctx, words[1], { ...lifecycle, busStop: busStopForDelete }) : await restoreOrg(ctx, words[1], lifecycle);
+  else if (words[0] === 'archive' && words.length === 2) result = await archiveOrg(ctx, words[1], { ...lifecycle, busStop: busStopForDelete });
+  else if (words[0] === 'restore' && words.length === 2) {
+   const startBus = !p.flags.has('--no-bus');
+   if (startBus) restoreBusCheck(system, io.env);
+   result = await restoreOrg(ctx, words[1], lifecycle);
+   // The restore stands whatever the bus does. A bus that does not start is said so, with the verb
+   // that starts it, and the command exits 3 after printing the restore receipt.
+   if (startBus) {
+    try { const started = await (deps.busStart ?? busStart)({ ...ctx, env: io.env }, words[1], { detach: true, devLocalOwner: true, pm: false }); result = { ...result, bus: { outcome: 'started', pid: started.pid } }; }
+    catch (e) {
+     // A host that died left its lock behind; `bus start` refuses it until `bus recover` clears it.
+     const message = e instanceof CliError ? e.message : 'the bus did not start', dead = /^stale /.test(message);
+     result = { ...result, bus: { outcome: 'failed', message, next: dead ? `mosaic bus recover ${words[1]}; ${busStartVerb(words[1])}` : busStartVerb(words[1]) } };
+     io.stdout.write(JSON.stringify(result, null, 2) + '\n');
+     throw new CliError(`${words[1]} was restored, but its bus did not start: ${message}; ${dead ? `clear the dead host with mosaic bus recover ${words[1]}, then start it with` : 'start it with'} ${busStartVerb(words[1])}`, 3);
+    }
+   }
+  }
   else if (words[0] === 'delete' && words.length === 2) result = await deleteOrg(ctx, words[1], { busStop: busStopForDelete, ...lifecycle });
   // U1 (#1873): the F3 bus control from a terminal, through the running Console's own route, which
   // checks the owner and writes the action trail (org-console.mjs consoleBusRestart).

packages/cli/tests/agent-guard.test.mjs

@@ -40,6 +40,8 @@ const GUARDED = [
   // archive and delete stop the organization's bus (review finding 2).
   ['org', 'archive', 'alpha', '--if-revision', '1'],
   ['org', 'delete', 'alpha', '--confirm', 'alpha'],
+  // E1 (P1-4): restore starts the organization's bus unless --no-bus is given.
+  ['org', 'restore', 'alpha', '--if-revision', '1'],
 ];
 
 // The CLI in this process, with the given io.env; stdout and stderr are collected.
@@ -129,7 +131,7 @@ test('consoleStart refuses a marker in its own process whatever environment it i
 
 test('usage errors still come first, so an agent sees the usage line, not the refusal', async () => {
   const env = { ...NOWHERE(), MOSAIC_AGENT_RUN: '1' };
-  for (const args of [['bus', 'stop'], ['bus', 'start'], ['bus', 'start', 'alpha', '--pm', '--no-launch'], ['console', 'stop', 'extra'], ['console', 'restart', 'extra'], ['console', 'start', '--dev-insecure-bind', '0.0.0.0'], ['console', 'start', '--dev-allow-host', 'x'], ['console', 'start', 'extra'], ['org', 'archive', 'alpha'], ['org', 'delete', 'alpha'], ['org', 'delete', 'alpha', '--confirm', 'alpha', '--if-revision', 'x']]) {
+  for (const args of [['bus', 'stop'], ['bus', 'start'], ['bus', 'start', 'alpha', '--pm', '--no-launch'], ['console', 'stop', 'extra'], ['console', 'restart', 'extra'], ['console', 'start', '--dev-insecure-bind', '0.0.0.0'], ['console', 'start', '--dev-allow-host', 'x'], ['console', 'start', 'extra'], ['org', 'archive', 'alpha'], ['org', 'restore', 'alpha'], ['org', 'restore', 'alpha', '--if-revision', '1', '--no-bus', '--no-bus'], ['org', 'delete', 'alpha'], ['org', 'delete', 'alpha', '--confirm', 'alpha', '--if-revision', 'x']]) {
     const r = await mosaic(env, args, 30000);
     assert.equal(r.status, 4, `${args.join(' ')}: ${r.stderr}`);
   }
@@ -247,8 +249,29 @@ test("the Console's Restart bus works: the new host runs with the Console's envi
   // An archived organization has no bus status, so the old host's /proc entry shows it stopped.
   for (let i = 0; i < 100 && existsSync(`/proc/${after.pid}`); i++) await new Promise(r => setTimeout(r, 100));
   assert.ok(!existsSync(`/proc/${after.pid}`), 'archive from a human shell stops the bus host');
-  const restored = await mosaic(env, ['org', 'restore', 'alpha', '--if-revision', String(JSON.parse(archived.stdout).revision), '--json']);
+  // E1 (P1-4): restore starts the bus, so an agent run is refused before anything changes, and
+  // `--no-bus` (which starts nothing) is the only restore an agent run may make.
+  const archivedRevision = JSON.parse(archived.stdout).revision;
+  for (const marker of ['CLAUDECODE', 'MOSAIC_AGENT_RUN']) {
+    const r = await mosaic({ ...env, [marker]: '1' }, ['org', 'restore', 'alpha', '--if-revision', String(archivedRevision), '--json']);
+    assert.equal(r.status, 3, r.stderr); assert.match(r.stderr, REFUSED(marker)); assert.equal(r.stdout, '');
+  }
+  const listed = await mosaic(env, ['org', 'list', '--json']); assert.equal(listed.status, 0, listed.stderr);
+  assert.equal(JSON.parse(listed.stdout).find(o => o.id === 'alpha').state, 'archived', 'the refused restore changed nothing');
+  const quiet = await mosaic(agent, ['org', 'restore', 'alpha', '--if-revision', String(archivedRevision), '--no-bus', '--json']);
+  assert.equal(quiet.status, 0, quiet.stderr); assert.equal(JSON.parse(quiet.stdout).bus, null);
+  assert.equal((await busStatus(ctx, 'alpha')).healthy, false, 'restore --no-bus starts nothing');
+  // A person's restore starts the bus as the dev owner, with no agent marker in its host.
+  const again = await mosaic(env, ['org', 'archive', 'alpha', '--if-revision', String((await show()).revision), '--json']);
+  assert.equal(again.status, 0, again.stderr);
+  const restored = await mosaic(env, ['org', 'restore', 'alpha', '--if-revision', String(JSON.parse(again.stdout).revision), '--json']);
   assert.equal(restored.status, 0, restored.stderr);
+  const restoredBus = JSON.parse(restored.stdout).bus;
+  assert.equal(restoredBus.outcome, 'started');
+  const up = await busStatus(ctx, 'alpha'); assert.equal(up.healthy, true); assert.equal(up.pid, restoredBus.pid);
+  const hostNames = readFileSync(`/proc/${up.pid}/environ`, 'utf8').split('\0').map(l => l.split('=')[0]);
+  for (const marker of AGENT_MARKERS) assert.ok(!hostNames.includes(marker), marker);
+  await busStop({ ...ctx, env }, 'alpha');
   // A marker in the environment the host is started with stops it at the guarded entry.
   await assert.rejects(busStart({ ...ctx, env: { ...env, MOSAIC_AGENT_RUN: '1' } }, 'alpha', { detach: true, noLaunch: true }), e => e.exitCode === 3 && /bus failed to start/.test(e.message));
   assert.match(readFileSync(join(after.root ?? join(ctx.dataRoot, 'org-runtime/alpha'), 'bus-host/host.log'), 'utf8'), /outside any agent run \(found MOSAIC_AGENT_RUN/);

packages/cli/tests/org-restore-bus.test.mjs

@@ -0,0 +1,94 @@
+// E1 (P1-4): `mosaic org restore` brings the organization back running. It starts the bus as
+// `mosaic bus start ID --dev-local-owner --detach` would; a bus that does not start is said so with
+// that verb, and the restore stands. On an instance where that start is refused, the restore is
+// refused first and changes nothing. `--no-bus` keeps the old restore. The bus start itself is a
+// stand-in here; agent-guard.test.mjs and org.test.mjs start a real one.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import * as service from '../../organization/src/org-service.mjs';
+import { listOrgs } from '../../organization/src/org-registry.mjs';
+import { DEV_OWNER } from '../src/dev-local-owner.mjs';
+import { orgCommand } from '../src/org.mjs';
+import { io, humanEnv } from './helpers.mjs';
+
+// A named instance under a temporary HOME (the dev-owner checks read the instance from HOME), with
+// one archived organization.
+async function archived(t) {
+  const home = mkdtempSync(join(tmpdir(), 'e1-restore-')), saved = process.env.HOME;
+  process.env.HOME = home;
+  t.after(() => { process.env.HOME = saved; rmSync(home, { recursive: true, force: true }); });
+  const configDir = join(home, '.config', 'mosaic-e1test'), dataRoot = join(home, 'data');
+  mkdirSync(configDir, { recursive: true, mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 });
+  const ctx = { configDir, dataRoot, instance: 'e1test', principal: DEV_OWNER };
+  const created = await service.createOrg(ctx, 'alpha', await service.templateRender('alpha'));
+  const gone = await service.archiveOrg(ctx, 'alpha', { ifRevision: created.revision, busStop: async () => ({ stopped: false }) });
+  const env = humanEnv({ HOME: home, MOSAIC_CONFIG: join(configDir, 'config.json') });
+  const state = async () => (await listOrgs(ctx)).find(e => e.id === 'alpha').state;
+  return { ctx, env, revision: gone.revision, state, system: { dataRoot } };
+}
+const restore = (f, deps, ...extra) => { const x = io(f.env); return orgCommand(['restore', 'alpha', '--if-revision', String(f.revision), '--json', ...extra], x, { system: f.system, ...deps }).then(() => x, e => { e.io = x; throw e; }); };
+
+test('E1: restore starts the bus as the dev owner and its receipt names the bus', async t => {
+  const f = await archived(t), calls = [];
+  const x = await restore(f, { busStart: async (ctx, id, opts) => { calls.push([ctx.dataRoot, ctx.env === f.env, id, opts]); return { org: id, pid: 4242, socket: '/s', root: '/r' }; } });
+  assert.deepEqual(calls, [[f.ctx.dataRoot, true, 'alpha', { detach: true, devLocalOwner: true, pm: false }]]);
+  const receipt = JSON.parse(x.out.text);
+  assert.equal(receipt.revision, f.revision + 1);
+  assert.deepEqual(receipt.bus, { outcome: 'started', pid: 4242 });
+  assert.equal(await f.state(), 'active');
+});
+
+test('E1: a bus that does not start after a good restore is said so, with the verb, and the restore stands', async t => {
+  const f = await archived(t);
+  const { CliError } = await import('../src/errors.mjs');
+  const busStart = async () => { throw new CliError('bus failed to start; see the bus log', 3); };
+  await assert.rejects(restore(f, { busStart }), e => {
+    assert.equal(e.exitCode, 3);
+    assert.equal(e.message, 'alpha was restored, but its bus did not start: bus failed to start; see the bus log; start it with mosaic bus start alpha --dev-local-owner --detach');
+    // The restore receipt is printed before the refusal.
+    const receipt = JSON.parse(e.io.out.text);
+    assert.equal(receipt.revision, f.revision + 1);
+    assert.deepEqual(receipt.bus, { outcome: 'failed', message: 'bus failed to start; see the bus log', next: 'mosaic bus start alpha --dev-local-owner --detach' });
+    return true;
+  });
+  assert.equal(await f.state(), 'active');
+});
+
+test('E1: a bus host that died leaves a stale lock; the receipt names bus recover before the start', async t => {
+  const f = await archived(t);
+  const { CliError } = await import('../src/errors.mjs');
+  const busStart = async () => { throw new CliError('stale bus host lock', 3); };
+  await assert.rejects(restore(f, { busStart }), e => {
+    assert.equal(e.exitCode, 3);
+    assert.equal(e.message, 'alpha was restored, but its bus did not start: stale bus host lock; clear the dead host with mosaic bus recover alpha, then start it with mosaic bus start alpha --dev-local-owner --detach');
+    assert.deepEqual(JSON.parse(e.io.out.text).bus, { outcome: 'failed', message: 'stale bus host lock', next: 'mosaic bus recover alpha; mosaic bus start alpha --dev-local-owner --detach' });
+    return true;
+  });
+  assert.equal(await f.state(), 'active');
+});
+
+test('E1: where a dev-owner bus start is refused, restore is refused before it changes anything, and --no-bus restores', async t => {
+  const f = await archived(t); let starts = 0;
+  const busStart = async () => { starts++; return { pid: 1 }; };
+  writeFileSync(join(f.ctx.dataRoot, '.deployed'), '{}\n');
+  await assert.rejects(restore(f, { busStart }), e => e.exitCode === 3 && /^restore starts the bus as the local dev owner, and --dev-local-owner refuses \.deployed; restore with --no-bus, then start the bus with mosaic bus start$/.test(e.message) && e.io.out.text === '');
+  assert.equal(await f.state(), 'archived');
+  const x = await restore(f, { busStart }, '--no-bus');
+  assert.equal(JSON.parse(x.out.text).bus, null);
+  assert.equal(starts, 0);
+  assert.equal(await f.state(), 'active');
+});
+
+test('E1: an agent run may restore only with --no-bus', async t => {
+  const f = await archived(t); let starts = 0;
+  const busStart = async () => { starts++; return { pid: 1 }; };
+  f.env = { ...f.env, MOSAIC_AGENT_RUN: '1' };
+  await assert.rejects(restore(f, { busStart }), e => e.exitCode === 3 && /MOSAIC_AGENT_RUN/.test(e.message));
+  assert.equal(await f.state(), 'archived');
+  await restore(f, { busStart }, '--no-bus');
+  assert.equal(starts, 0);
+  assert.equal(await f.state(), 'active');
+});

packages/cli/tests/org.test.mjs

@@ -21,6 +21,8 @@ test('organization CLI renders, validates, creates, updates and initializes git'
  info = JSON.parse(invoke('org', 'show', 'alpha', '--json')); const archived = JSON.parse(invoke('org', 'archive', 'alpha', '--if-revision', String(info.revision), '--json')); assert.equal(archived.revision, info.revision + 1);
  assert.equal(JSON.parse(invoke('org', 'list', '--json'))[0].state, 'archived');
  const restored = JSON.parse(invoke('org', 'restore', 'alpha', '--if-revision', String(archived.revision), '--json')); assert.equal(restored.revision, archived.revision + 1);
+ // E1 (P1-4): restore brings the organization back running; the delete below stops the bus again.
+ assert.equal(restored.bus.outcome, 'started'); assert.ok(Number.isInteger(restored.bus.pid)); assert.equal(JSON.parse(invoke('bus', 'status', 'alpha', '--json')).healthy, true);
  info = JSON.parse(invoke('org', 'show', 'alpha', '--json')); const receipt = JSON.parse(invoke('org', 'delete', 'alpha', '--confirm', 'alpha', '--if-revision', String(info.revision), '--json')); assert.equal(receipt.org, 'alpha'); assert.deepEqual(JSON.parse(invoke('org', 'list', '--json')), []);
 });
 test('business and org aliases conflict in either order', () => { for (const args of [['--business','alpha','--org','beta'], ['--org','beta','--business','alpha']]) { const r = run(process.env, 'tasks', ...args); assert.notEqual(r.status, 0); assert.match(r.stderr, /conflict/i); } });

packages/webui/src/org-admin.mjs

@@ -16,6 +16,7 @@
 //   POST /api/orgs/ID/setup/queue           C2 queueInit     mosaic org queue init
 //   POST /api/orgs/ID/setup/project/P       C2 projectRepoInit  mosaic org project repo init
 //   POST /api/orgs/ID/setup/bus             C3 busStart      mosaic bus start --detach
+//   POST /api/orgs/ID/restore               C2 restoreOrg, then C3 busStart (E1: the answer's `bus`)
 //   POST /api/orgs/ID/restart/bus           C3 busRestart    mosaic bus restart (F3; busStart when stopped;
 //                                           busRevive for a host that died, dev-local owner only, D2)
 //   POST /api/orgs/ID/stop/bus              C3 busStop       mosaic bus stop (a stopped bus answers state stopped)
@@ -465,7 +466,9 @@ async function route(req, res, { path, search, org, admin, principal, write, log
       const fn = kind === 'archive' ? service.archiveOrg : service.restoreOrg;
       if (typeof fn !== 'function') return json(res, 503, { error: 'not-configured', step: kind });
       const receipt = await fn(ctx, id, { ifRevision: body.revision, ...(busStop ? { busStop } : {}) });
-      return json(res, 200, { outcome: 'done', step: kind, receipt: forReceipt(ctx, receipt), verb: verbFor(kind, id, { revision: body.revision }) });
+      const done = { outcome: 'done', step: kind, receipt: forReceipt(ctx, receipt), verb: verbFor(kind, id, { revision: body.revision }) };
+      if (kind === 'archive') return json(res, 200, done);
+      return json(res, 200, { ...done, bus: await restoreBus({ id, ctx, admin, log, trail, by }) });
     } catch (e) { return refusal(res, e, { step: kind, id, unknownOk: true }); }
   }
   if (kind === 'delete' && !sub && write) {
@@ -571,6 +574,46 @@ async function route(req, res, { path, search, org, admin, principal, write, log
   return json(res, 404, { error: 'not found' });
 }
 
+// E1 (P1-4): Restore brings the organization back running. After a good restore the bus starts as
+// Restart bus starts a stopped one: the owner, origin and --send checks were made for the restore,
+// the trail line is written first, and a trail that cannot be written starts nothing. The restore
+// stands whatever happens here; the answer's `bus` says what did, and the page offers Restart bus
+// when the bus did not start. Never throws.
+async function restoreBus({ id, ctx, admin, log, trail, by }) {
+  const verb = verbFor('bus', id);
+  const notStarted = (error, message) => ({ outcome: 'not-started', error, message, verb });
+  let bus = null;
+  try { bus = await admin.bus(); } catch { /* reported as not configured */ }
+  if (!bus || typeof bus.busStart !== 'function' || typeof bus.busStatus !== 'function') return notStarted('not-configured', 'bus control is not available on this Console, so the bus was not started');
+  if (!trail) return notStarted('trail-unavailable', 'this Console has no action trail, so it does not start buses');
+  let root = null;
+  try {
+    const status = await bus.busStatus(ctx, id);
+    if (status?.healthy) return { outcome: 'done', existing: true, healthy: true, receipt: forReceipt(ctx, status), verb };
+    root = status?.root ?? null;
+  } catch (e) {
+    if (!isCliError(e)) { log(`org-admin: ${id} restore: bus status: ${e?.code ?? e?.name ?? 'error'}`); return notStarted('bus-refused', 'the bus state could not be read, so the bus was not started'); }
+    return notStarted('bus-refused', `${plainMessage(ctx, e.message)}. Inspect it with mosaic bus status ${id}; mosaic bus recover ${id} clears a host that died.`);
+  }
+  try { trail({ by, action: 'bus.start', org: id, outcome: 'requested', after: 'restore' }); }
+  catch { return notStarted('trail-unavailable', 'the action trail could not be written, so the bus was not started'); }
+  const note = outcome => { try { trail({ by, action: 'bus.start', org: id, outcome, after: 'restore' }); } catch { log(`org-admin: ${id} restore bus start: trail write failed after ${outcome}`); } };
+  let receipt;
+  try { receipt = await bus.busStart(ctx, id, { detach: true, devLocalOwner: by?.provider === 'local-dev', pm: false }); }
+  catch (e) {
+    const failed = isCliError(e) && /^bus failed to start\b/.test(e.message);
+    note(failed ? 'failed' : 'refused');
+    if (!isCliError(e)) { log(`org-admin: ${id} restore bus start: ${e?.code ?? e?.name ?? 'error'}`); return { outcome: 'failed', error: 'bus-failed', message: 'the bus did not start', verb }; }
+    const said = failed ? await hostRefusal(root) : null;
+    return { outcome: 'failed', error: failed ? 'bus-failed' : 'bus-refused', message: plainMessage(ctx, said ? `${e.message}. The bus host said: ${said}` : e.message), verb };
+  }
+  note('done');
+  log(`org-admin: ${id} bus started after restore`);
+  let healthy = null;
+  try { healthy = (await bus.busStatus(ctx, id)).healthy; } catch { /* the receipt still stands */ }
+  return { outcome: 'done', healthy, receipt: forReceipt(ctx, receipt), verb };
+}
+
 // F3 (REQ-WEB-3): one control restarts an organization's bus and answers with a done receipt. A
 // running host restarts on the options it was started with (C3 busRestart keeps --dev-local-owner);
 // a stopped one starts as setup starts it. The trail line is written before anything changes, and

packages/webui/src/public/bus.js

@@ -1923,7 +1923,8 @@
     if (path.startsWith('/chat')||path.startsWith('/projects')||path.startsWith('/inbox')||path.startsWith('/settings')||path.startsWith('/docs/')||wsPage(path)) render(false); else if (window.MosaicOrg ? path === '/board' : path === '/' || path === '') paintHeld(heldErr);
   };
   configRead = fetch('/api/config', { cache: 'no-store', redirect: 'manual' }).then(r => { if (r.type === 'opaqueredirect') { signOut(); return null; } return r.json(); }).then(applyConfig).catch(() => {});
-  document.addEventListener('mosaic-config', e => { if (e.detail && typeof e.detail === 'object') applyConfig(e.detail); });
+  // E1 (P1-5): after Restart bus the organization dashboard draws its bus line and system types now, not at the next poll.
+  document.addEventListener('mosaic-config', e => { if (e.detail && typeof e.detail === 'object') { applyConfig(e.detail); if (window.MosaicOrg && routeOf().split('?')[0] === '/organization') render(false); } });
   // The cross-organization pages ask for a repaint after a filter, sort or selection change,
   // and report the inbox count across organizations for the sidebar.
   document.addEventListener('mosaic-workspace-render', () => { if (wsPage(routeOf().split('?')[0])) render(false); });

packages/webui/src/public/org-create.js

@@ -68,13 +68,13 @@
   <button type="button" id="org-archive-open" data-write>Archive organization</button>
   <div id="org-archive-confirm" tabindex="-1" hidden aria-labelledby="org-archive-confirm-title">
     <h4 id="org-archive-confirm-title">Review archive</h4>
-    <ul><li>The organization's bus stops.</li><li>All files stay where they are.</li><li>The organization leaves the switcher.</li><li>Restore brings it back without starting the bus.</li></ul>
+    <ul><li>The organization's bus stops.</li><li>All files stay where they are.</li><li>The organization leaves the switcher.</li><li>Restore brings it back and starts its bus.</li></ul>
     <div class="settings-actions"><button type="button" id="org-archive-cancel" class="org-secondary">Cancel</button><button type="button" id="org-archive-final" data-write>Archive</button></div>
   </div>
 </section>
 <section id="org-archived" class="panel" tabindex="-1" hidden aria-labelledby="org-archived-title">
   <h3 id="org-archived-title">Organization archived</h3>
-  <p>Editing and setup are unavailable while archived. Files remain in place; restoring does not start the bus.</p>
+  <p>Editing and setup are unavailable while archived. Files remain in place; restoring starts the bus again.</p>
   <p id="org-restore-verb" class="org-verb"></p>
   <button type="button" id="org-restore" data-write>Restore organization</button>
 </section>
@@ -342,7 +342,8 @@
           if (result.body.verb) card.querySelector('code').textContent = result.body.verb;
         }
         editorDirty = false; $('org-new-id').value = ''; $('org-quick-open-org').hidden = false; $('org-quick-interview').hidden = !window.MosaicOnboarding; status('Organization setup complete.');
-        await refreshList();
+        // E1 (P1-5): the sidebar and header list the new organization without a reload.
+        await refreshOrganizations();
       } catch (e) {
         const card = list.children[Math.min(current, steps.length - 1)];
         card.querySelector('.org-pill').textContent = 'Stopped'; card.querySelector('.org-field-err').textContent = current === 4
@@ -350,7 +351,7 @@
           : `${e.message} Open the organization to inspect and continue; do not repeat a step whose outcome is unknown.`;
         if (current >= 4) { editorDirty = false; $('org-new-id').value = ''; $('org-quick-open-org').hidden = false; }
         card.classList.add('org-step-warn'); card.focus(); status('Setup stopped.');
-        await refreshList();
+        await refreshOrganizations();
       }
     }
     async function openExisting(id, { toSetup = false } = {}) {
@@ -549,6 +550,37 @@
       const hash = next ? `#/orgs/${encodeURIComponent(next.id)}/settings/organizations` : '#/settings/organizations';
       history.replaceState(null, '', hash); location.reload(); return true;
     }
+    // E1 (P1-4): a restore also starts the bus (org-admin.mjs restoreBus). One receipt names both
+    // results; a bus that did not start says why and offers Restart bus for this organization.
+    const RESTORED = 'mosaic-org-restored:';
+    function keepRestored(id, bus) { try { sessionStorage.setItem(RESTORED + id, JSON.stringify(bus ?? null)); } catch { /* the reloaded page shows the bus state only */ } }
+    function takeRestored(id) {
+      try { const v = sessionStorage.getItem(RESTORED + id); sessionStorage.removeItem(RESTORED + id); return v === null ? undefined : JSON.parse(v); } catch { return undefined; }
+    }
+    function restoredReceipt(id, bus) {
+      const check = `mosaic bus status ${id}`, known = bus && typeof bus === 'object';
+      const line = !known ? `The bus outcome is unknown. Check it with ${check}.`
+        : bus.outcome === 'done' ? (bus.existing ? 'Its bus was already running.' : `Bus started. ${bus.healthy ? 'It answers.' : `It has not answered yet. Check it with ${check}.`}`)
+        : `The bus did not start: ${bus.message || 'no reason was given.'}`;
+      const offer = (!known || bus.outcome !== 'done') && canWrite;
+      const box = $('org-archive-success');
+      box.innerHTML = `<p>Organization restored. ${txt(line)}</p>${known && bus.verb ? `<p class="org-verb">Same as <code>${txt(bus.verb)}</code></p>` : ''}${offer ? `<p><button type="button" data-restore-bus="${txt(id)}">Restart bus</button> <span role="status" data-restore-bus-receipt></span></p>` : ''}`;
+      box.hidden = false; box.focus();
+    }
+    // Restart bus for the restored organization, the same route as the dashboard's (console-restart.js).
+    async function restartRestored(e) {
+      const button = e.target.closest('[data-restore-bus]'); if (!button || button.disabled) return;
+      const id = button.dataset.restoreBus, out = button.parentElement.querySelector('[data-restore-bus-receipt]');
+      button.disabled = true; button.textContent = 'Restarting…'; out.textContent = '';
+      let r = null; try { r = await api('POST', `/api/orgs/${encodeURIComponent(id)}/restart/bus`, {}); } catch { r = null; }
+      if (!alive) return;
+      const done = r?.status === 200 && r.body.outcome === 'done' && r.body.step === 'bus-restart';
+      out.textContent = !r ? `Outcome unknown. Check the bus with mosaic bus status ${id} before retrying.`
+        : done ? `${r.body.recovered ? 'Dead bus host cleared; bus started' : r.body.restarted ? 'Bus restarted' : 'Bus started'}. ${r.body.healthy ? 'It answers.' : `It has not answered yet. Check it with mosaic bus status ${id}.`}`
+        : (r.body.message || 'The restart was refused. Nothing was retried.');
+      button.textContent = 'Restart bus'; button.disabled = done && r.body.healthy === true;
+      if (done) await refreshOrganizations();
+    }
     async function runLifecycle(step) {
       const id = st.id, revision = st.revision, button = $(step === 'archive' ? 'org-archive-final' : 'org-restore');
       button.disabled = true; if (step === 'archive') button.textContent = 'Archiving…'; $('org-archive-error').textContent = '';
@@ -558,11 +590,11 @@
         if (!verifiedReply(reply, step)) throw Error('unknown lifecycle outcome');
         const rows = await refreshOrganizations();
         if (step === 'archive' && switchIfCurrentRemoved(id, rows)) return;
-        if (step === 'restore' && !window.MosaicOrg) { history.replaceState(null, '', `#/orgs/${encodeURIComponent(id)}/settings/organizations`); location.reload(); return; }
+        // The page reloads into the restored organization; its receipt is kept for that page to show.
+        if (step === 'restore' && !window.MosaicOrg) { keepRestored(id, reply.body.bus); history.replaceState(null, '', `#/orgs/${encodeURIComponent(id)}/settings/organizations?org=${encodeURIComponent(id)}`); location.reload(); return; }
         await openExisting(id);
-        if (step === 'restore') {
-          const box = $('org-archive-success'); box.textContent = 'Organization restored. The bus remains stopped.'; box.hidden = false; box.focus();
-        } else $('org-archived').focus();
+        if (step === 'restore') restoredReceipt(id, reply.body.bus);
+        else $('org-archived').focus();
         status(`Organization ${step === 'archive' ? 'archived' : 'restored'}.`);
       } catch {
         if (step === 'archive') button.textContent = 'Archive';
@@ -615,6 +647,7 @@
       [$('org-archive-cancel'), 'click', () => { resetArchive(); $('org-archive-open').focus(); }],
       [$('org-archive-final'), 'click', () => runLifecycle('archive')],
       [$('org-restore'), 'click', () => runLifecycle('restore')],
+      [$('org-archive-success'), 'click', restartRestored],
       [$('org-delete-open'), 'click', () => { $('org-delete-open').hidden = true; $('org-delete-first').hidden = false; $('org-delete-first').focus(); }],
       [$('org-delete-cancel'), 'click', cancelDelete],
       [$('org-delete-cancel-second'), 'click', cancelDelete],
@@ -643,6 +676,9 @@
       [$('org-steps'), 'input', e => { const card = e.target.closest('.org-step'); if (card && e.target.matches('[data-remote]')) { keepChoice(card); showVerb(card); } }],
     ];
     for (const [el, ev, fn] of handlers) el.addEventListener(ev, fn);
+    // A restore receipt carried across the reload is taken now, before anything below can fail, so a
+    // later visit never shows it again.
+    const carried = (() => { const o = query().get('org'); return o && ID.test(o) ? takeRestored(o) : undefined; })();
     fetch(new URL('/api/config', location.href), { cache: 'no-store' }).then(r => r.json()).then(async config => {
       if (!alive) return;
       canWrite = (config.orgSetup === true || config.send === true) && config.tester !== true && config.user !== true;
@@ -655,6 +691,7 @@
       // Resume: ?org=ID reopens the organization and its setup, read back from the server.
       if (org && ID.test(org)) {
         await openExisting(org, { toSetup: setup });
+        if (carried !== undefined) restoredReceipt(org, carried);
         if (created && st.setup?.notifications?.receipt) showReceipt('Organization created', st.setup.notifications);
         if (setup) focusFirstOpen();
       }

packages/webui/tests/org-admin.test.mjs

@@ -579,6 +579,60 @@ test('a bus that refuses to restart is a visible failure and the trail says refu
   assert.equal(c.calls.slice(before).filter(y => ['busStart', 'busRestart'].includes(y[0])).length, 0);
 });
 
+// E1 (P1-4): a restore brings the organization back running. The bus starts as Restart bus starts a
+// stopped one, the trail says it came after a restore, and the answer names both results.
+const restorable = c => { c.service.restoreOrg = async (ctx, id, opts) => { c.calls.push(['restoreOrg', id, opts.ifRevision]); return { op: 'org.restore', org: id, revision: 3 }; }; };
+
+test('E1: a restore starts the organization\'s bus and the answer names both results', async t => {
+  const tr = trailIn(t);
+  const c = await console_(t, { trail: tr.trail });
+  await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') }); restorable(c);
+  const r = await c.call('POST', '/api/orgs/acme/restore', { revision: 2 });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.outcome, 'done'); assert.equal(r.body.step, 'restore'); assert.equal(r.body.verb, 'mosaic org restore acme --if-revision 2');
+  assert.deepEqual(r.body.bus, { outcome: 'done', healthy: true, receipt: { org: 'acme', pid: 4242, socket: '<host path>', root: '<data root>/org-runtime/acme' }, verb: 'mosaic bus start acme --dev-local-owner --detach' });
+  assert.deepEqual(c.calls.filter(x => ['restoreOrg', 'busStart'].includes(x[0])).map(x => x.slice(0, 3)), [['restoreOrg', 'acme', 2], ['busStart', 'acme', { detach: true, devLocalOwner: true, pm: false }]]);
+  assert.deepEqual(tr.lines(), [
+    { by: DEV, action: 'bus.start', org: 'acme', outcome: 'requested', after: 'restore' },
+    { by: DEV, action: 'bus.start', org: 'acme', outcome: 'done', after: 'restore' },
+  ]);
+  // A bus that already answers is left as it is.
+  const again = await c.call('POST', '/api/orgs/acme/restore', { revision: 3 });
+  assert.deepEqual({ outcome: again.body.bus.outcome, existing: again.body.bus.existing, healthy: again.body.bus.healthy }, { outcome: 'done', existing: true, healthy: true });
+  assert.equal(c.calls.filter(x => x[0] === 'busStart').length, 1);
+});
+
+test('E1: a bus that does not start after a good restore is said so, with the verb, and the restore stands', async t => {
+  const tr = trailIn(t);
+  const c = await console_(t, { trail: tr.trail });
+  await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') }); restorable(c);
+  const bus = await c.admin.bus();
+  bus.busStart = async () => { throw cliError('bus failed to start; see /data/org-runtime/acme/bus-host/host.log'); };
+  const r = await c.call('POST', '/api/orgs/acme/restore', { revision: 2 });
+  assert.equal(r.status, 200, r.raw); assert.equal(r.body.outcome, 'done'); assert.equal(r.body.step, 'restore');
+  assert.deepEqual(r.body.bus, { outcome: 'failed', error: 'bus-failed', message: 'bus failed to start; see <data root>/org-runtime/acme/bus-host/host.log', verb: 'mosaic bus start acme --dev-local-owner --detach' });
+  assert.doesNotMatch(r.raw, /\/data\//);
+  assert.deepEqual(tr.lines().map(e => e.outcome), ['requested', 'failed']);
+  // A bus whose state cannot be read is not started.
+  bus.busStatus = async () => { throw cliError('stale bus host lock'); };
+  const s = await c.call('POST', '/api/orgs/acme/restore', { revision: 3 });
+  assert.equal(s.status, 200); assert.equal(s.body.bus.outcome, 'not-started'); assert.equal(s.body.bus.error, 'bus-refused');
+  assert.equal(s.body.bus.message, 'stale bus host lock. Inspect it with mosaic bus status acme; mosaic bus recover acme clears a host that died.');
+  assert.equal(tr.lines().length, 2);
+});
+
+test('E1: a Console with no trail, or a trail that cannot be written, restores without starting the bus', async t => {
+  for (const trail of [undefined, () => { throw new Error('disk full'); }]) {
+    const c = await console_(t, trail ? { trail } : {});
+    await c.call('POST', '/api/orgs', { id: 'acme', doc: browserDoc('acme') }); restorable(c);
+    const r = await c.call('POST', '/api/orgs/acme/restore', { revision: 2 });
+    assert.equal(r.status, 200, r.raw); assert.equal(r.body.outcome, 'done');
+    assert.equal(r.body.bus.outcome, 'not-started'); assert.equal(r.body.bus.error, 'trail-unavailable');
+    assert.equal(r.body.bus.verb, 'mosaic bus start acme --dev-local-owner --detach');
+    assert.equal(c.calls.filter(x => x[0] === 'busStart').length, 0);
+  }
+});
+
 // D2 (P0-3): on the dev Console, Restart bus on a host that died (its state left behind by a
 // Console unit stop) clears that state through busRevive and starts the bus. busRevive's
 // busRecover is the proof; a live or unprovable host refuses and nothing starts.

packages/webui/tests/org-archive-browser.test.mjs

@@ -11,18 +11,23 @@ import * as service from '../../organization/src/org-service.mjs';
 import * as registry from '../../organization/src/org-registry.mjs';
 import { orgPaths } from '../../cli/src/config.mjs';
 import { busStopForDelete } from '../../cli/src/org-bus.mjs';
+import { CliError } from '../../cli/src/errors.mjs';
+import { actionTrail } from '../src/action-trail.mjs';
 import { browser } from './browser.mjs';
+import { systemTypesFake } from './helpers/system-types-fake.mjs';
 import { close } from './fixture.mjs';
 
-async function fixture(t, ids = ['alpha', 'beta'], { health = null } = {}) {
+// E1: `bus` adds verbs to the admin's bus (busStart for a restore); `trail` gives the Console its action trail;
+// `extra` adds to each organization's transports (the dashboard's bus reads and System types).
+async function fixture(t, ids = ['alpha', 'beta'], { health = null, bus = {}, trail = false, extra = () => ({}) } = {}) {
   const dir = await mkdtemp(join(tmpdir(), 'archive-browser-'));
   const configDir = join(dir, 'config'), dataRoot = join(dir, 'data'); await mkdir(configDir, { mode: 0o700 }); await mkdir(dataRoot, { mode: 0o700 });
   const ctx = { configDir, dataRoot, instance: 'test', principal: { provider: 'local-dev', iss: 'local-dev', sub: 'local-dev-owner' } };
   for (const id of ids) await service.createOrg(ctx, id, await service.templateRender(id));
   const busStatus = async () => ({ healthy: health ? health.up : false });
-  const organizations = organizationConsole({ ctx, listOrgs: registry.listOrgs, resolveOrg: registry.resolveOrg, showOrg: service.showOrg, orgPaths, busStatus, options: ({ id }) => ({ reads: { business: async () => ({ business: { id, projects: ['work'] } }), settings: async () => ({}) }, bus: {}, send: async () => ({}) }) });
-  const admin = createOrgAdmin({ service, registry, bus: { busStatus, busStopForDelete }, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
-  const server = await startServer({ port: 0, sso: createDevOwner(), orgAdmin: admin, organizations, send: async () => ({}), board: 'http://127.0.0.1:9', log: () => {} });
+  const organizations = organizationConsole({ ctx, listOrgs: registry.listOrgs, resolveOrg: registry.resolveOrg, showOrg: service.showOrg, orgPaths, busStatus, options: ({ id }) => ({ reads: { business: async () => ({ business: { id, projects: ['work'] } }), settings: async () => ({}) }, bus: {}, send: async () => ({}), ...extra(id) }) });
+  const admin = createOrgAdmin({ service, registry, bus: { busStatus, busStopForDelete, ...bus }, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const server = await startServer({ port: 0, sso: createDevOwner(), orgAdmin: admin, organizations, send: async () => ({}), board: 'http://127.0.0.1:9', log: () => {}, ...(trail ? { trail: actionTrail(join(dir, 'console')) } : {}) });
   const b = await browser({ machine: false }); t.after(async () => { await b.close(); await close(server); await rm(dir, { recursive: true, force: true }); });
   const wait = async expression => { for (let i = 0; i < 400; i++) { try { if (await b.evaluate(expression)) return; } catch {} await new Promise(r => setTimeout(r, 30)); } throw Error(expression); };
   await b.navigate(`http://127.0.0.1:${server.address().port}/#/orgs/alpha/settings/organizations`);
@@ -36,7 +41,7 @@ async function fixture(t, ids = ['alpha', 'beta'], { health = null } = {}) {
       await b.screenshot(join(process.env.ORG_ARCHIVE_SHOTS, `${state}-${width}-${mode}.png`));
     }
   }
-  return { b, wait, open, shots, ctx, port: server.address().port };
+  return { b, wait, open, shots, ctx, port: server.address().port, dir };
 }
 
 test('archive and restore a non-current organization', { timeout: 45000 }, async t => {
@@ -88,6 +93,76 @@ test('opening another editor resets the archive confirmation and error', { timeo
   assert.deepEqual(await f.b.evaluate(`({trigger:document.querySelector('#org-archive-open').hidden,panel:document.querySelector('#org-archive-confirm').hidden,error:document.querySelector('#org-archive-error').textContent,disabled:document.querySelector('#org-archive-final').disabled})`), {trigger:false,panel:true,error:'',disabled:false});
 });
 
+// E1 (P1-4): one Restore restores the organization and starts its bus; the receipt names both.
+const startingBus = (health, fails = 0) => {
+  const starts = [];
+  return { starts, busStart: async (ctx, id, opts) => { starts.push([id, opts]); if (starts.length <= fails) throw new CliError('bus failed to start; see the bus log', 3); health.up = true; return { org: id, pid: 4242, socket: join(ctx.dataRoot, 'bus.sock'), root: join(ctx.dataRoot, 'org-runtime', id) }; } };
+};
+const archiveBeta = async f => { await f.open('beta'); await f.b.evaluate(`document.querySelector('#org-archive-open').click();document.querySelector('#org-archive-final').click()`); await f.wait(`!document.querySelector('#org-archived').hidden`); };
+
+test('E1 (P1-4): Restore restores the organization and starts its bus, with one receipt naming both', { timeout: 45000 }, async t => {
+  const health = { up: false }, bus = startingBus(health);
+  const f = await fixture(t, ['alpha', 'beta'], { health, bus, trail: true }); await archiveBeta(f);
+  await f.b.evaluate(`document.querySelector('#org-restore').click()`);
+  await f.wait(`!document.querySelector('#org-archive-success').hidden`);
+  assert.equal((await registry.listOrgs(f.ctx)).find(e => e.id === 'beta').state, 'active');
+  assert.deepEqual(bus.starts, [['beta', { detach: true, devLocalOwner: true, pm: false }]]);
+  const text = await f.b.evaluate(`document.querySelector('#org-archive-success').innerText`);
+  assert.match(text, /^Organization restored\. Bus started\. It answers\./);
+  assert.match(text, /Same as mosaic bus start beta --dev-local-owner --detach/);
+  assert.doesNotMatch(text, /remains stopped/);
+  assert.equal(await f.b.evaluate(`document.querySelector('[data-restore-bus]')`), null, 'a running bus needs no Restart bus');
+  assert.deepEqual(await f.b.evaluate(`window.MosaicOrg.list.then(rows=>rows.map(row=>[row.id,row.busHealthy]))`), [['alpha', true], ['beta', true]]);
+  await f.shots('e1-restored-started', '#org-archive-success');
+});
+
+test('E1 (P1-4): a bus that does not start after a good restore is said so, and Restart bus starts it', { timeout: 45000 }, async t => {
+  const health = { up: false }, bus = startingBus(health, 1);
+  const f = await fixture(t, ['alpha', 'beta'], { health, bus, trail: true }); await archiveBeta(f);
+  await f.b.evaluate(`document.querySelector('#org-restore').click()`);
+  await f.wait(`!document.querySelector('#org-archive-success').hidden`);
+  assert.equal((await registry.listOrgs(f.ctx)).find(e => e.id === 'beta').state, 'active', 'the restore stands');
+  assert.match(await f.b.evaluate(`document.querySelector('#org-archive-success').innerText`), /^Organization restored\. The bus did not start: bus failed to start; see the bus log/);
+  assert.equal(await f.b.evaluate(`document.querySelector('[data-restore-bus]').textContent`), 'Restart bus');
+  await f.shots('e1-restored-bus-failed', '#org-archive-success');
+  await f.b.evaluate(`document.querySelector('[data-restore-bus]').click()`);
+  await f.wait(`/It answers/.test(document.querySelector('[data-restore-bus-receipt]')?.textContent || '')`);
+  assert.equal(await f.b.evaluate(`document.querySelector('[data-restore-bus-receipt]').textContent`), 'Bus started. It answers.');
+  assert.equal(await f.b.evaluate(`document.querySelector('[data-restore-bus]').disabled`), true);
+  assert.deepEqual(bus.starts.map(([id]) => id), ['beta', 'beta']);
+  await f.shots('e1-restored-bus-restarted', '#org-archive-success');
+});
+
+test('E1 (P1-4): restoring the only organization reloads into it and still shows the restore and bus receipt', { timeout: 45000 }, async t => {
+  const health = { up: false }, bus = startingBus(health);
+  const f = await fixture(t, ['alpha'], { health, bus, trail: true }); await f.open('alpha');
+  await f.b.evaluate(`document.querySelector('#org-archive-open').click();document.querySelector('#org-archive-final').click()`);
+  await f.wait(`!window.MosaicOrg && document.querySelector('#org-open-id')?.value === 'alpha'`);
+  await f.open('alpha'); await f.b.evaluate(`document.querySelector('#org-restore').click()`);
+  await f.wait(`window.MosaicOrg?.id === 'alpha' && document.querySelector('#org-archive-success')?.hidden === false`);
+  assert.match(await f.b.evaluate(`document.querySelector('#org-archive-success').innerText`), /^Organization restored\. Bus started\. It answers\./);
+  assert.deepEqual(bus.starts.map(([id]) => id), ['alpha']);
+  // The kept receipt is shown once: a later visit does not repeat it.
+  assert.equal(await f.b.evaluate(`Object.keys(sessionStorage).filter(k=>k.startsWith('mosaic-org-restored:')).length`), 0);
+});
+
+test('E1 (P1-5): after restoring another organization, its dashboard shows the bus running and its System types', { timeout: 45000 }, async t => {
+  const health = { up: false }, bus = startingBus(health), st = await systemTypesFake({ enabled: ['coding'] });
+  const extra = id => ({
+    requestRead: st.requestRead,
+    reads: { business: async () => ({ business: { id, human: 'local-dev-owner', arbiters: [], projects: [], vars: {}, instances: [] } }), settings: async () => ({}), queue: async () => ({ rows: [] }), busStatus: async () => ({}) },
+    bus: { instances: async () => ({ business: id, revision: 'a'.repeat(64), launch: true, noHire: [], retired: [], definitions: {}, instances: {} }), messages: async () => ({ messages: [], unread: 0 }), agents: async () => [], 'thread.claims': async () => [], inbox: async () => [], tasks: async () => [] },
+  });
+  const f = await fixture(t, ['alpha', 'beta'], { health, bus, trail: true, extra }); await archiveBeta(f);
+  await f.b.evaluate(`document.querySelector('#org-restore').click()`);
+  await f.wait(`/Bus started\. It answers\./.test(document.querySelector('#org-archive-success')?.innerText || '')`);
+  await f.wait(`!!document.querySelector('#workspace-nav [data-workspace-org=beta]')`);
+  await f.b.evaluate(`location.hash = '#/orgs/beta/organization'`);
+  await f.wait(`/bus running, read/.test(document.querySelector('[data-org-dashboard]')?.innerText || '') && !!document.querySelector('[data-org-dashboard] [data-system-type-chips] .ws-chip')`);
+  assert.doesNotMatch(await f.b.evaluate(`document.querySelector('[data-org-dashboard] [data-system-type-chips]').textContent`), /unavailable/);
+  assert.deepEqual(bus.starts.map(([id]) => id), ['beta']);
+});
+
 test('restore does not announce success for an unexpected response', { timeout: 45000 }, async t => {
   const f = await fixture(t); await f.open('beta');
   await f.b.evaluate(`document.querySelector('#org-archive-open').click();document.querySelector('#org-archive-final').click()`);

packages/webui/tests/org-refresh-browser.test.mjs

@@ -0,0 +1,94 @@
+// E1 (P1-5): pages follow a state change without a reload. Restart bus redraws the organization
+// dashboard's bus line and System types at once, and Quick Setup puts the new organization in the
+// sidebar. Neither waits for the 10 s repaint: each check runs well inside that window.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { startServer } from '../src/serve.mjs';
+import { createDevOwner } from '../src/dev-owner.mjs';
+import { createOrgAdmin } from '../src/org-admin.mjs';
+import { actionTrail } from '../src/action-trail.mjs';
+import * as service from '../../organization/src/org-service.mjs';
+import { browser } from './browser.mjs';
+import { close } from './fixture.mjs';
+import { systemTypesFake } from './helpers/system-types-fake.mjs';
+
+const waitFor = (b, tries = 150) => expression => b.evaluate(`(async()=>{for(let i=0;i<${tries};i++){if(${expression})return;await new Promise(r=>setTimeout(r,30))}throw Error(${JSON.stringify(expression)})})()`);
+
+// One organization whose bus state the fake bus below owns. A stopped bus has no reads, as
+// organizations.mjs resolves it; a running one answers the dashboard's reads and System types.
+async function westOrgs(state) {
+  const st = await systemTypesFake({ enabled: ['coding'] });
+  const running = () => ({
+    busHealthy: true, requestRead: st.requestRead, systemTypesWrite: null,
+    reads: { business: async () => ({ business: { id: 'west', human: 'jason', arbiters: [], projects: [], vars: {}, instances: [] } }), settings: async () => ({}), queue: async () => ({ rows: [] }), busStatus: async () => ({}) },
+    bus: { instances: async () => ({ business: 'west', revision: 'a'.repeat(64), launch: true, noHire: [], retired: [], definitions: {}, instances: {} }), messages: async () => ({ messages: [], unread: 0 }), agents: async () => [], 'thread.claims': async () => [], inbox: async () => [], tasks: async () => [] },
+    chat: { projects: async () => [], threads: async () => [] },
+  });
+  return {
+    list: async () => [{ id: 'west', label: 'West', busHealthy: state.running }],
+    resolve: async id => id !== 'west' ? null : state.running ? running() : { busHealthy: false, reads: null, bus: {}, chat: { projects: async () => [], threads: async () => [] } },
+  };
+}
+
+test('E1 (P1-5b): Restart bus redraws the dashboard bus line and System types without a reload or the 10 s repaint', { timeout: 45000 }, async t => {
+  const state = { running: false }; const starts = [];
+  const bus = {
+    busStatus: async (ctx, id) => ({ org: id, healthy: state.running, pid: state.running ? 4242 : null }),
+    busStart: async (ctx, id, opts) => { starts.push([id, opts]); state.running = true; return { org: id, pid: 4242, socket: '/data/s', root: '/data/org-runtime/west' }; },
+    busRestart: async () => { throw Error('not reached: the bus is stopped'); },
+  };
+  const orgAdmin = createOrgAdmin({ service: { showOrg: async (ctx, id) => ({ id, revision: 1, doc: {} }) }, registry: { listOrgs: async () => [] }, bus, context: async () => ({ configDir: '/cfg', dataRoot: '/data', instance: 'test' }) });
+  const root = mkdtempSync(join(tmpdir(), 'e1-refresh-')); t.after(() => rmSync(root, { recursive: true, force: true }));
+  const server = await startServer({ port: 0, sso: createDevOwner(), send: async () => ({}), organizations: await westOrgs(state), orgAdmin, trail: actionTrail(join(root, 'console')), log: () => {} }); t.after(() => close(server));
+  const b = await browser({ machine: false }); t.after(() => b.close());
+  const wait = waitFor(b);
+  await b.navigate(`http://127.0.0.1:${server.address().port}/#/orgs/west/organization`);
+  await wait('document.querySelector("[data-org-dashboard] [data-bus-restart]") && /bus unavailable, read/.test(document.querySelector("[data-org-dashboard]").innerText)');
+  assert.match(await b.evaluate('document.querySelector("[data-org-dashboard] [data-system-type-chips]").textContent'), /System types unavailable/);
+  // The page's own repaint is 10 s after its last draw; mark the draw this test starts from.
+  await b.evaluate('window.__drawn = Date.now(); window.__first = document.querySelector("[data-org-dashboard]")');
+  await b.evaluate('document.querySelector("[data-org-dashboard] [data-bus-restart]").click()');
+  await wait('/It answers/.test(document.querySelector("[data-org-dashboard] [data-bus-restart-receipt]")?.textContent || "")');
+  // No reload: the page keeps its globals, and the dashboard shows the running bus and the enabled type.
+  await wait('/bus running, read/.test(document.querySelector("[data-org-dashboard]")?.innerText || "") && !!document.querySelector("[data-org-dashboard] [data-system-type-chips] .ws-chip")');
+  assert.ok(await b.evaluate('Date.now() - window.__drawn') < 8000, 'the dashboard redrew before the 10 s repaint');
+  assert.equal(await b.evaluate('typeof window.__first'), 'object', 'the page was not reloaded');
+  assert.doesNotMatch(await b.evaluate('document.querySelector("[data-org-dashboard] [data-system-type-chips]").textContent'), /unavailable/);
+  assert.match(await b.evaluate('document.querySelector("[data-org-dashboard] [data-bus-restart-receipt]").textContent'), /^Bus started at .*It answers\./);
+  assert.deepEqual(starts.map(([id]) => id), ['west']);
+});
+
+test('E1 (P1-5a): Quick Setup from inside another organization lists the new one in the sidebar without a reload', { timeout: 60000 }, async t => {
+  const registry = await import('../../organization/src/org-registry.mjs');
+  const dir = mkdtempSync(join(tmpdir(), 'e1-quick-'));
+  const configDir = join(dir, 'config'), dataRoot = join(dir, 'data'); mkdirSync(configDir, { mode: 0o700 }); mkdirSync(dataRoot, { mode: 0o700 });
+  let started = false;
+  const bus = { busStatus: async () => ({ healthy: false }), busStart: async () => { started = true; return { healthy: true }; } };
+  const admin = createOrgAdmin({ service, registry, bus, context: async () => ({ configDir, dataRoot, instance: 'test' }) });
+  const projects = [];
+  const shell = { send: async () => ({}), busHealthy: true, chat: { projects: async () => projects, threads: async () => [], createProject: async args => { const row = { id: '20000000-0000-4000-8000-000000000002', ...args }; projects.push(row); return row; } } };
+  const organizations = {
+    list: async () => [{ id: 'east', label: 'East', busHealthy: true }, ...(started ? [{ id: 'alpha', label: 'alpha', busHealthy: true }] : [])],
+    resolve: async id => (id === 'east' || (id === 'alpha' && started)) ? shell : null,
+  };
+  const server = await startServer({ port: 0, sso: createDevOwner(), organizations, orgAdmin: admin, send: async () => ({}), board: 'http://127.0.0.1:9', log: () => {} }); t.after(() => close(server));
+  const b = await browser({ machine: false }); t.after(() => b.close());
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const wait = waitFor(b, 300);
+  await b.navigate(`http://127.0.0.1:${server.address().port}/#/orgs/east/settings/organizations`);
+  await wait('document.querySelector("[data-workspace-org=east]") && document.querySelector("#org-new-form [data-write]") && !document.querySelector("#org-new-form [data-write]").disabled');
+  assert.equal(await b.evaluate('document.querySelector("[data-workspace-org=alpha]")'), null);
+  await b.evaluate('window.__first = true');
+  await b.evaluate(`document.querySelector('#org-new-id').value='alpha';document.querySelector('#org-new-form [data-write]').click()`);
+  await wait('document.querySelector("#org-quick-open") && !document.querySelector("#org-paths").hidden');
+  await b.evaluate(`document.querySelector('#org-quick-open').click();document.querySelector('#org-risk-accept').click();document.querySelector('#org-quick-run').click()`);
+  await wait(`document.querySelector('[data-quick-step="5"] .org-pill')?.textContent === 'Done'`);
+  await b.evaluate('window.__done = Date.now()');
+  await wait('!!document.querySelector("[data-workspace-org=alpha]")');
+  assert.ok(await b.evaluate('Date.now() - window.__done') < 8000, 'the sidebar followed the setup, not a later poll');
+  assert.equal(await b.evaluate('window.__first'), true, 'the page was not reloaded');
+  assert.equal(started, true);
+});