fix: pin health refresh bundle and serving recovery

.github/workflows/console-full-bundle-release.yml

@@ -70,13 +70,13 @@ jobs:
       - name: Check out fixed frontend snapshot
         uses: actions/checkout@v4
         with:
-          ref: 85504dd6ee201fd358f6ea3489742ea5c47afcf8
+          ref: 0b5d9527313d719547ef844797b47158c83dea53
           path: candidate-snapshot
           persist-credentials: false
       - name: Check out fixed recovery snapshot
         uses: actions/checkout@v4
         with:
-          ref: 37bd4798cba9fa12673709964b67a907a7d40d96
+          ref: 85504dd6ee201fd358f6ea3489742ea5c47afcf8
           path: recovery-snapshot
           persist-credentials: false
       - uses: actions/setup-node@v6

scripts/console_frontend_candidate_build.sh

@@ -8,16 +8,16 @@ readonly verifier="$(cd "$(dirname "$0")" && pwd)/console_frontend_candidate_pre
 readonly mode="${2:-frontend}"
 case "$mode" in
  frontend)
-  expected_commit=85504dd6ee201fd358f6ea3489742ea5c47afcf8
-  expected_tree=ce46afc9354beb08ce808593595ca1e08a96a52e
-  expected_asset=acb728faf6247535bdc173b0f18c82adeea3485e
+  expected_commit=0b5d9527313d719547ef844797b47158c83dea53
+  expected_tree=46b2e2a2cea43d4f03deb70badc0b9a367c58301
+  expected_asset=cc3782b3b13233662e0af274567a667db4413a5e
   output_name=console-frontend-candidate
   verifier_flag=""
   ;;
  recovery-main)
-  expected_commit=37bd4798cba9fa12673709964b67a907a7d40d96
-  expected_tree=f3c557f3f01aab2302c94f893b0a8a5e6dd49c91
-  expected_asset=2c53dfcbdd106dbb9e763c6ef3bbef9c3c8b60f2
+  expected_commit=85504dd6ee201fd358f6ea3489742ea5c47afcf8
+  expected_tree=ce46afc9354beb08ce808593595ca1e08a96a52e
+  expected_asset=acb728faf6247535bdc173b0f18c82adeea3485e
   output_name=console-recovery-candidate
   verifier_flag="--recovery"
   ;;

scripts/console_frontend_candidate_preflight.mjs

@@ -4,21 +4,21 @@ import {readFile,readdir} from 'node:fs/promises';
 import {pathToFileURL} from 'node:url';
 
 export const SNAPSHOT = Object.freeze({
+  commit: '0b5d9527313d719547ef844797b47158c83dea53',
+  tree: '46b2e2a2cea43d4f03deb70badc0b9a367c58301',
+  assetBlob: 'cc3782b3b13233662e0af274567a667db4413a5e',
+  buildId: 'd7935e42f5c309421d081abfc8d8183e61758938236ae7d3a028057fdc40bee4',
+  bundleSha256: '59b2316fb8153a4266d60baed19ac781c4de503d4850a9898853da2a1949badb',
+});
+// The complete serving 85504dd6 bundle is the recovery target and retains
+// native-task protocol guards.
+export const RECOVERY_SNAPSHOT = Object.freeze({
   commit: '85504dd6ee201fd358f6ea3489742ea5c47afcf8',
   tree: 'ce46afc9354beb08ce808593595ca1e08a96a52e',
   assetBlob: 'acb728faf6247535bdc173b0f18c82adeea3485e',
   buildId: '58894b1c9aa1e7627d9985edbbc09e8f6a06f1b8521811032266fc11565c74d5',
-  bundleSha256: '44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af',
-});
-// The complete serving 37bd4798 bundle is the recovery target and retains
-// native-task protocol guards.
-export const RECOVERY_SNAPSHOT = Object.freeze({
-  commit: '37bd4798cba9fa12673709964b67a907a7d40d96',
-  tree: 'f3c557f3f01aab2302c94f893b0a8a5e6dd49c91',
-  assetBlob: '2c53dfcbdd106dbb9e763c6ef3bbef9c3c8b60f2',
-  buildId: '68f4d2367c7556748b4d2cdd8cafa449c5a90cdb44e716a0ee8a587a4ff6355a',
   // Current serving module is the fixed recovery target.
-  bundleSha256: '1f58021acb0b6af1738c89d81f9698dee72ff272980f3165ea76df468f1873da',
+  bundleSha256: '44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af',
 });
 export const verifyEvidence = evidence => verifySnapshot(SNAPSHOT, evidence);
 export function verifyRecoveryEvidence(evidence) {

scripts/console_full_bundle_release.mjs

@@ -11,8 +11,8 @@ const uuid = s => typeof s === 'string' && /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9
 const outerFailureKinds = new Set(['active_identity_mismatch','active_module_invalid','active_module_mismatch',
   'active_configuration_invalid','transport','size','length','envelope','id']);
 export const POLICY = Object.freeze({
-  frontend: Object.freeze({before:'1f58021acb0b6af1738c89d81f9698dee72ff272980f3165ea76df468f1873da', candidate:'44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af'}),
-  recovery: Object.freeze({before:'44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af', candidate:'1f58021acb0b6af1738c89d81f9698dee72ff272980f3165ea76df468f1873da'}),
+  frontend: Object.freeze({before:'44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af', candidate:'59b2316fb8153a4266d60baed19ac781c4de503d4850a9898853da2a1949badb'}),
+  recovery: Object.freeze({before:'59b2316fb8153a4266d60baed19ac781c4de503d4850a9898853da2a1949badb', candidate:'44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af'}),
 });
 function verifyActive(result, expected) {
   const d=result?.deployments?.[0];

tests/console_named_export_surface.test.mjs

@@ -16,7 +16,7 @@ const methods = ['effectiveAccountSettings', 'dispatchAccountDiagnosis'];
 
 test('pinned candidate has no RPC or HTTP surface for the two test helpers', async () => {
   assert.ok(path, 'QRS_NEW_WORKER_BUNDLE is required');
-  assert.equal(digest(await readFile(path)), '44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af', 'candidate bundle must be exact');
+  assert.equal(digest(await readFile(path)), '59b2316fb8153a4266d60baed19ac781c4de503d4850a9898853da2a1949badb', 'candidate bundle must be exact');
   const root = dirname(path);
   const target = { name: 'candidate', modules: true, scriptPath: path, modulesRoot: root, rootPath: root,
     compatibilityDate: '2026-06-08', bindings: { SESSION_SECRET: 'synthetic-only-session-key' },
@@ -86,8 +86,8 @@ test('candidate and serving recovery expose the same named module exports', asyn
   assert.ok(path && process.env.QRS_RECOVERY_WORKER_BUNDLE, 'both fixed bundle paths are required');
   const recoveryPath = resolve(process.env.QRS_RECOVERY_WORKER_BUNDLE);
   const [candidate, recovery] = await Promise.all([readFile(path), readFile(recoveryPath)]);
-  assert.equal(digest(candidate), '44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af');
-  assert.equal(digest(recovery), '1f58021acb0b6af1738c89d81f9698dee72ff272980f3165ea76df468f1873da');
+  assert.equal(digest(candidate), '59b2316fb8153a4266d60baed19ac781c4de503d4850a9898853da2a1949badb');
+  assert.equal(digest(recovery), '44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af');
   const exportsOf = bytes => {
     const match = /\nexport \{([^}]+)\};\s*\/\/# sourceMappingURL=worker\.js\.map\s*$/.exec(bytes.toString('utf8'));
     assert.ok(match, 'expected one final bundle export declaration');

tests/console_recovery_compat.test.mjs

@@ -59,7 +59,7 @@ test('production to candidate to compatible serving recovery preserves SQLite pr
   const recoveryPath = resolve(process.env.QRS_RECOVERY_WORKER_BUNDLE);
   const [oldBytes, newBytes, recoveryBytes] = await Promise.all([readFile(oldPath), readFile(newPath), readFile(recoveryPath)]);
   assert.equal(sha(oldBytes), oldDigest, 'old Worker must be the fixed, previously verified production candidate');
-  assert.equal(sha(newBytes), '44386d5bb3eddf40be110c2503bfbeae5a3cc1b227eaef03a31846e8ea4098af', 'candidate must be the fixed complete new bundle');
+  assert.equal(sha(newBytes), '59b2316fb8153a4266d60baed19ac781c4de503d4850a9898853da2a1949badb', 'candidate must be the fixed complete new bundle');
   assert.equal(sha(recoveryBytes), RECOVERY_SNAPSHOT.bundleSha256, 'recovery bundle must match the independently observed complete serving module');
   assert.notEqual(sha(recoveryBytes), oldDigest, 'recovery is not the incompatible production rollback');
   assert.notEqual(sha(recoveryBytes), sha(newBytes), 'recovery must be a distinct complete bundle');