@bongos/core 1.19.1071 → 1.19.1073

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1071",
-  "core_contract": "1.19.1071",
-  "source_commit": "e952aeff8fd966ba7aea8a72df82e4d825c22648",
+  "core_version": "1.19.1073",
+  "core_contract": "1.19.1073",
+  "source_commit": "f7dcd35989f2df1316f3069f437ce9b1ae974e55",
   "source_ref": "HEAD",
-  "built_at": "2026-09-28T19:35:40.500Z",
+  "built_at": "2026-09-28T21:17:50.856Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 549,
+    "docs_redacted": 550,
     "agent_docs_stubbed": 26,
     "functional_verbatim": 2560,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3136,
-  "tree_sha256": "364a060541bc6ea130edf33f92ee954d0ccf420f8727ea29239c18392f5621c1",
+  "file_count": 3137,
+  "tree_sha256": "68645d4224ae1c55d9346455697851316d8f01b5a3bd5718e177c9dbf33de844",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2172,7 +2172,7 @@
     {
       "path": "docs/adr/0341-the-page-is-the-unit-of-tweak-mode.md",
       "mode": "0000644",
-      "sha256": "9229f8449bfa7d80918239f031dd3b9147557be34109eb74841b740c8a90e36f"
+      "sha256": "cd7bbf1e309b2d5fbe398719cab7e50ae73bec5af50796b71fdcf21869b31b77"
     },
     {
       "path": "docs/adr/0342-module-categories-are-eight-parents-with-approved-sub-categories.md",
@@ -2184,10 +2184,15 @@
       "mode": "0000644",
       "sha256": "821f3c073de063aa9f3df9622a5b138cc5060754bb986cd5c747494150ec59db"
     },
+    {
+      "path": "docs/adr/0344-a-tester-is-a-project-that-opts-in-once.md",
+      "mode": "0000644",
+      "sha256": "ca2a376a0c555f28a3ce82542f9e7b5ac4d5da1713bf0a423087515a81d8ee7e"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "36568b2672c4b2ea76feda41fa9fe5bdffa3c10a1aaa56f862c663559712ed8b"
+      "sha256": "b71955b19cfcee3de2457ee433f8e839a823278cff4df07a8d1b32e4b2905c20"
     },
     {
       "path": "docs/api-reference.md",
@@ -2757,7 +2762,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e8f17d79acc62fcacbcdb415295e23a8385bb050cc544b1c20fb3328b05eaa49"
+      "sha256": "61af0d34245c199e415765d8ec4a5acadda14ef08449cb67aca5fd4b397bdea7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8647,12 +8652,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b8899117fdc884212b4d763f9a01641137ac5e5b148f2b608d5866137ec86afe"
+      "sha256": "6c48fb62c55950b2d9e2d0b4e1bffe80543939dbb1e96b243024aa9b7c8461a7"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d5ff7c99d5927cf91fc93d442725c14383695ed34576cd76840ae3d1579336a3"
+      "sha256": "ed4b62b1b605513188f7da4d4816a7659696bfb7a692a36dc2c00ee95a7c29b9"
     },
     {
       "path": "public-docs/index.html",
@@ -8672,7 +8677,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "71549984e44e3f37dd1b858db883c2f9916ad409dff338a42e2664258980c420"
+      "sha256": "627d599954ed0b7c69df1c1b17108e5b88dcce87d5cd4fb1b20b9aa67b2330f5"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10762,7 +10767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f05875c00f06c453f995f13626deff2da66a9a31730d4f483756f4d74cbcc588"
+      "sha256": "4d5ca55a9ec23962455f97b3e3e92ec11db491403b8309efc6060cb7454b9ef8"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0341-the-page-is-the-unit-of-tweak-mode.md

@@ -1,6 +1,6 @@
 # ADR 0341 — The page is the unit of Tweak Mode: one tweak task per page round, its status derived from the ledger
 
-- **Status:** Accepted (the owner's decisions written down; the builder's picks for the gaps are listed in "Decided by the builder, owner to confirm")
+- **Status:** Accepted (the owner's decisions written down; the builder's picks for the gaps, listed in "Decided by the builder, confirmed by the owner", were accepted by the owner on 2026-09-28)
 - **Date:** 2026-09-27
 - **Task:** [task 1004332](https://cloudbongos.com/builders#/task/1004332) (BV2.TW03, goal 1000095, working area 6). Spec: [`docs/specs/<redacted>.md`](../specs/<redacted>.md). Master design: [`docs/design/mocks/tweak-mode/`](../design/mocks/tweak-mode/README.md).
 - **Deciders:** the owner, Masterqua (area owner), at the planning session of 2026-09-27 (meta task 1004312): the interview, then the prototype review. This ADR adds no decision the spec did not make, except the gaps listed at the end.
@@ -181,7 +181,9 @@ The lifecycle port gains what these need: `updateTaskDescription`, `webClaimTask
 - `wrong_page`: the file's `page_id` is not the page;
 - `reading_moved`: the file's `reading_hash` is not the draft's, because the page changed since the download. The artist is asked to download again, so no stale line is merged by position.
 
-## Decided by the builder, owner to confirm
+## Decided by the builder, confirmed by the owner
+
+**Confirmed 2026-09-28:** the owner accepted every pick below as written (recorded under [task 1004313](https://cloudbongos.com/builders#/task/1004313)).
 
 The spec does not answer these. Each is the choice most faithful to it, and each is a small change here if the owner rules otherwise. (The TW03 task text said a gap should become a blocker. The owner's overnight rule for this chain says to pick and list, so they are listed rather than filed.)
 

package/docs/adr/0344-a-tester-is-a-project-that-opts-in-once.md

@@ -0,0 +1,77 @@
+# ADR 0344 — A tester is a project that opts in once; an untested version reaches everyone after seven days
+
+- **Status:** accepted
+- **Date:** 2026-09-28
+- **Task:** [task 1003801](https://cloudbongos.com/builders#/task/1003801) (goal 1000091 — working area 5, Module distribution & economy)
+- **Deciders:** Will (owner of working area 5) chose the opt-in shape and the no-volunteer rule, and accepted the defaults for updates and tester pricing; Claude wrote the record.
+- **Related:** [ADR 0338](0338-modules-travel-through-a-bongos-hosted-store.md) (the hosted store and its channel check) · [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) (the security gate and tester feedback as a score part) · [ADR 0264](0264-the-ten-working-areas.md)
+
+## Context
+
+Criterion `wa5-staged-rollout` says willing users test a version before everyone gets it.
+"Willing" was undecided, and the build depends on it. The open questions: does a project opt in
+once or per module; who can opt in; what happens when nobody volunteers; does this cover
+updates; and do testers pay.
+
+## Decision
+
+### D1 — A project opts in once, and can skip individual modules (owner)
+
+Being a tester is a **per-project** setting, switched on by that project's own admin. A tester
+project gets tester-channel versions of **every module it has**, except any module it has
+switched to "general only".
+
+- It is the **project**, not an individual builder, that opts in, because the project is what
+  runs the module. A builder cannot opt in someone else's project.
+- The switch is visible and reversible. Turning it off puts the project back on general
+  versions from its next update.
+- "Willing" is load-bearing: a project is never a tester by default.
+
+### D2 — Testing covers updates, not only first releases
+
+Every new version, first release or update, goes to the tester channel first. An update to a
+module people already rely on is where an untested version does the most damage.
+
+### D3 — An untested version reaches everyone after seven days (owner)
+
+A new version moves from the tester channel to general **after seven days**, if it still passes
+the security gate and its tests (ADR 0343). This applies whether or not any tester picked it up,
+so a module nobody volunteers for still gets updated.
+
+The seven days is the baseline. The promotion gate (task 1003804) may also promote **earlier** on
+evidence (for example, enough clean tester installs) or **hold** a version on evidence (tester
+errors), but it never holds one forever for lack of testers.
+
+### D4 — Testers pay the normal price
+
+A tester gets an early version of a module it already has, on the same terms. Being a tester is
+not a way to get a paid module for free. **A discount or free access for testers is area 8's
+call** (credits and payments, goal 1000092). This ADR names the question rather than deciding it.
+
+### D5 — What testers see feeds the score
+
+A tester project's install success, errors and crashes on a tester version are the tester
+feedback part of the module's score (ADR 0343 D1, task 1003806).
+
+## Consequences
+
+- **Task 1003802** (opt in) builds a per-project tester switch plus a per-module
+  "general only" override, on the project's own admin surface.
+- **Task 1003803** (tester channel first) applies to every published version, updates included.
+- **Task 1003804** (promotion gate) builds to D3: seven days by default, may promote earlier or
+  hold on evidence, and never waits forever.
+- **Task 1003805** (install/update honour the channel) serves a tester project tester versions,
+  except for its "general only" modules.
+- **Removal is unchanged.** Under ADR 0338 D2, a version a tester already installed keeps
+  working even if it is later withdrawn.
+
+## Rejected
+
+- **Opt in per module only.** More control, but few projects would bother, leaving too few
+  testers.
+- **One all-or-nothing switch.** There'd be no way to avoid early versions of a module a project
+  depends on heavily.
+- **Waiting for a tester before general release.** A module nobody volunteers for would never be
+  updated.
+- **Releasing to everyone at once.** Testing would only happen when volunteers happened to be
+  there.

package/docs/adr/README.md

@@ -432,6 +432,7 @@ This keeps the decision history honest and traceable.
 | 0338 | [**Modules travel through a Bongos-hosted store, and an acquired module keeps working forever** ([task 1003782](https://cloudbongos.com/builders#/task/1003782), goal 1000091 — working area 5, owner Will). A module had no transport of its own: it reached an instance only inside the core (ADR 0107 §6) or in the instance's repo. Weighed npm packages, a Bongos-hosted store and git refs against the four things area 5's criteria require — entitlement before install, a per-version score, a tester channel, and a delist that stops distribution. npm and git refs fail entitlement and delist by construction. **D1:** Cloud Bongos hosts the store; a module version is a tarball + hash manifest in the same format `package-core.js` already emits (same `isPublishable()` gate), registry rows on the control-plane DB, artifacts in the already-paid DO Spaces bucket, served by the control plane only after an entitlement + channel check; free modules take the same path at price zero; install/update verify hashes on arrival; modules' own npm deps still travel via npm (ADR 0138). No new fixed cost. **D2 (owner):** delisting, author withdrawal or deletion removes a module from the catalog and stops new acquisitions and updates, but **an acquired module keeps working forever** — the store never disables or removes an installed copy and a delist never revokes an entitlement; the holder is told no more updates will come. Security issues are not a special case; a remote kill switch would need a superseding ADR. Rejected: npm, git refs, remote disable on delist.](0338-modules-travel-through-a-bongos-hosted-store.md) | modules / distribution / economy |
 | 0339 | [**A project's owner upgrades it, and a hosted project hands off to the hub's door** ([task 1004174](https://cloudbongos.com/builders#/task/1004174), goal 1000090 — the owner's ruling of 2026-09-26 that only a project's owner upgrades it). Amends ADR 0293 D5. **D1:** the deploy door's preview and move routes admit the OWNER of a tenant row (`co-tenant`/`cloud-host`) for that row, asked first; every other caller meets the unmodified `core.pin.move` gate, so a non-owner's refusal is unchanged whether or not the id exists and the widening can only admit. **D2:** the platform's own row stays atom-only. **D3:** `GET /core-update` names `<hub>/deploy?project=<slug>` on a federated project, and the hosted hall's banner and rail hand off there (the dead local Deploy item is gone); the hub's `/deploy` shell admits a project owner through `alsoAdmits: 'isProjectOwner'`. **D4:** the intent's actor records the door (`api:owner:<id>` / `api:archon:<id>`), both attributed on the `core_upgrades` ledger. Rejected: a tenant-side API that performs the upgrade, granting the system atom to owners, owners moving the platform row. ADR 0328 Phase 1 (task 1004159) should fold this gate into `requireProjectOwner`.](0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md) | provisioning / deploy door / permissions |
 | 0340 | [**Every hall takes its update from Settings, and /deploy is the platform hall's page** ([task 1004296](https://cloudbongos.com/builders#/task/1004296), goal 1000090 — the owner's 2026-09-25 asks: a Settings version panel "just like iOS", and /deploy only in the Bongos hall). Amends ADR 0339 D3 and the reach of ADR 0293's page. **D1:** Settings → Software update in the core — the running core, the newest release the runner's own channel rule allows, and what each version in between carries from the newest package's release notes; every signed-in builder reads it, and "up to date" is said only from an answer. **D2:** its Update button leads to the door (local /deploy, the hub's /deploy?project=, or a `bongos upgrade` sentence), drawn only for holders of core.pin.move. **D3:** /deploy 302s to Settings on a hall without the provisioning module. **D4:** the banner links Settings everywhere but the platform; the rail is no longer re-pointed; /core-update drops deploy_url. **D5:** the registry reader moved into the core (module-api readPackageRegistry). Rejected: a second copy of the two-step door, gating the panel on the atom, a "moved" page.](0340-every-hall-takes-its-update-from-settings-and-deploy-is-the-platform-halls-page.md) | deploy door / settings / core update |
-| 0341 | [**The page is the unit of Tweak Mode: one tweak task per page round, its status derived from the ledger** ([task 1004332](https://cloudbongos.com/builders#/task/1004332), goal 1000095 — BV2.TW03, the owner's Tweak Mode decisions of 2026-09-27 written down). Amends ADR 0233 (a proposal becomes a page batch); replaces the artist-review-on-ship cascade rule. **D1-D3:** every record keys on a page id from docs/page-inventory.json; a round is a `page-tweak` task (`source_ref page-tweak/<page>/r<n>`, 30c, catch-all goal, one open round per page under an advisory lock); TW04 commits docs/page-readings.json (line keys, placed/shared/unplaced, reading and files hashes, no browser in ship-check). **D4:** the draft, the frozen batch, the apply record and each send-back are fenced blocks on the task, parsed by a pure pages.js; unplaced rewrites file their own engineer task; copy_no_cms.mjs grows in reviewed diffs. **D5-D6:** artist-craft builders claim with a web claim; anyone asks, and a page ask is a copy_desk_flags row with scope page. **D7:** round states are derived; a passed grade on a page tweak holds at completed until the artist approves (the confirm) or sends it back to the apply queue, with the owner override as the escape hatch. **D8:** count, status, changelog, drift (against the last round's lines_after), N of M per surface, the tally and the recommendation order are all reads. **D9:** the cascade rule is removed; hasCopyOrVisualWork stays for the reader lens. **D10:** the reviews paid 30c per task on the estimate stream (withheld under cost-plus-only) plus the session's cost-plus; an approved page pays its artist 30c on a new artist lane that cost-plus-only does not suppress, payee from the claims table, applier keeps its session reward. **D11-D12:** the route table; a dependency-free .docx with content-control line tags, refused as structure_changed, wrong_page or reading_moved. Twelve builder picks are listed for the owner to confirm.](0341-the-page-is-the-unit-of-tweak-mode.md) | copy desk / artist loop / economy |
+| 0341 | [**The page is the unit of Tweak Mode: one tweak task per page round, its status derived from the ledger** ([task 1004332](https://cloudbongos.com/builders#/task/1004332), goal 1000095 — BV2.TW03, the owner's Tweak Mode decisions of 2026-09-27 written down). Amends ADR 0233 (a proposal becomes a page batch); replaces the artist-review-on-ship cascade rule. **D1-D3:** every record keys on a page id from docs/page-inventory.json; a round is a `page-tweak` task (`source_ref page-tweak/<page>/r<n>`, 30c, catch-all goal, one open round per page under an advisory lock); TW04 commits docs/page-readings.json (line keys, placed/shared/unplaced, reading and files hashes, no browser in ship-check). **D4:** the draft, the frozen batch, the apply record and each send-back are fenced blocks on the task, parsed by a pure pages.js; unplaced rewrites file their own engineer task; copy_no_cms.mjs grows in reviewed diffs. **D5-D6:** artist-craft builders claim with a web claim; anyone asks, and a page ask is a copy_desk_flags row with scope page. **D7:** round states are derived; a passed grade on a page tweak holds at completed until the artist approves (the confirm) or sends it back to the apply queue, with the owner override as the escape hatch. **D8:** count, status, changelog, drift (against the last round's lines_after), N of M per surface, the tally and the recommendation order are all reads. **D9:** the cascade rule is removed; hasCopyOrVisualWork stays for the reader lens. **D10:** the reviews paid 30c per task on the estimate stream (withheld under cost-plus-only) plus the session's cost-plus; an approved page pays its artist 30c on a new artist lane that cost-plus-only does not suppress, payee from the claims table, applier keeps its session reward. **D11-D12:** the route table; a dependency-free .docx with content-control line tags, refused as structure_changed, wrong_page or reading_moved. Twelve builder picks were listed and the owner confirmed them all on 2026-09-28.](0341-the-page-is-the-unit-of-tweak-mode.md) | copy desk / artist loop / economy |
 | 0342 | [**Module categories are eight fixed parents, with narrow sub-categories an author proposes and Metic+ approves** ([task 1003783](https://cloudbongos.com/builders#/task/1003783), goal 1000091 — working area 5, owner Will). The owner's cap of ten listed modules needs a comparable set, and nothing carried a category. **D1:** eight parents derived from the live roster — Work & planning, Team & people, Quality & review, Money, Communication, Pages & design, Hosting & deploy, Knowledge — for browsing only; the cap never applies to a parent. **D2:** the sub-category (the narrow set a buyer chooses between, e.g. "Stripe payments") is where the cap, ranking and comparison run. **D3 (owner):** an author proposes a sub-category and a Metic+ builder approves, renames or merges it, because free-naming would split one comparable set into near-duplicates and the cap would never bite; a pending module lists under its parent and counts toward no cap. **D4:** one sub-category per module. Rejected: free naming, Metic+-only creation, a flat list, parent-level caps.](0342-module-categories-are-eight-parents-with-approved-sub-categories.md) | modules / store / economy |
 | 0343 | [**A module's score is a security gate, then an average of parts every buyer can see** ([task 1003790](https://cloudbongos.com/builders#/task/1003790), goal 1000091 — working area 5, owner Will). No module score existed; the floor, ranking and cap all derive from this one. **D1:** five parts, each 0–100 per version — Security and Tests day one; Install, Reliability (from real installs) and Tester feedback later. **D2 (owner):** failing Security means not listed, never averaged in. **D3 (owner):** overall = unweighted average of the other parts that have data; a missing part is left out, not zero. **D4 (owner):** every part's score is shown to buyers beside the overall, so they can pick the module strongest where they care (tasks 1003798/1003799). **D5:** a version without real-world data is labelled "New". **D6:** price is never an input; the Metic+ override/delist sits on top and is audited. Rejected: security in the average, day-one weights, a single number, missing-as-zero.](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) | modules / store / quality |
+| 0344 | [**A tester is a project that opts in once; an untested version reaches everyone after seven days** ([task 1003801](https://cloudbongos.com/builders#/task/1003801), goal 1000091 — working area 5, owner Will). Settles "willing user" for criterion `wa5-staged-rollout`. **D1 (owner):** a project's own admin switches on "tester" once and gets tester versions of every module it has, with a per-module "general only" override; never on by default; a builder cannot opt in someone else's project. **D2:** first releases and updates alike go to testers first. **D3 (owner):** a version moves to general after seven days if it still passes the security gate and tests, tested or not; the promotion gate may promote earlier or hold on evidence, never forever. **D4:** testers pay the normal price; any tester discount is area 8's call, named not decided. **D5:** tester installs, errors and crashes feed the score (ADR 0343). Rejected: per-module-only opt-in, one all-or-nothing switch, waiting for a tester, releasing at once.](0344-a-tester-is-a-project-that-opts-in-once.md) | modules / store / rollout |

package/docs/module-api-changelog.md

@@ -2629,5 +2629,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1069 with no explicit bump. run 36472133987. (task 1002620)
   1.19.1071 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1070 with no explicit bump. run 36473239367. (task 1002620)
+  1.19.1072 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1071 with no explicit bump. run 36474285523. (task 1002620)
+  1.19.1073 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1072 with no explicit bump. run 36485068639. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1071",
+  "version": "1.19.1073",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1071",
+      "version": "1.19.1073",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1071",
+  "version": "1.19.1073",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7731,5 +7731,17 @@
       "id": "1003790",
       "text": "Decided how the store scores modules: a failed security check keeps a module out, the rest is averaged, and buyers can see each part of the score to pick the module that is best at what they need."
     }
+  ],
+  "1.19.1072": [
+    {
+      "id": "1003801",
+      "text": "Decided who tests new module versions first: projects that switch on testing once, and a version nobody tests still reaches everyone after seven days."
+    }
+  ],
+  "1.19.1073": [
+    {
+      "id": "1004313",
+      "text": "Tweak Mode is live on cloudbongos.com, and the artist gate is off. Artists can now open the lofi studio, take a whole page, rewrite it (in the studio or in Word), and approve the finished page before it ships. The seven old pe"
+    }
   ]
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1071'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1073'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');