@bongos/core 1.19.1072 → 1.19.1073

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1072",
-  "core_contract": "1.19.1072",
-  "source_commit": "48d55ade62291fbba8936935b42af6a649afe2fb",
+  "core_version": "1.19.1073",
+  "core_contract": "1.19.1073",
+  "source_commit": "f7dcd35989f2df1316f3069f437ce9b1ae974e55",
   "source_ref": "HEAD",
-  "built_at": "2026-09-28T19:44:55.659Z",
+  "built_at": "2026-09-28T21:17:50.856Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 550,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3137,
-  "tree_sha256": "9f1989ff166c82430f3ddabbe39fefb2fb4ddee0f2e12cf747c100b5954c9957",
+  "tree_sha256": "68645d4224ae1c55d9346455697851316d8f01b5a3bd5718e177c9dbf33de844",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2172,7 +2172,7 @@
     {
       "path": "docs/adr/0341-the-page-is-the-unit-of-tweak-mode.md",
       "mode": "0000644",
-      "sha256": "9229f8449bfa7d80918239f031dd3b9147557be34109eb74841b740c8a90e36f"
+      "sha256": "cd7bbf1e309b2d5fbe398719cab7e50ae73bec5af50796b71fdcf21869b31b77"
     },
     {
       "path": "docs/adr/0342-module-categories-are-eight-parents-with-approved-sub-categories.md",
@@ -2192,7 +2192,7 @@
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "f319359f17b3ae842b73ea32f7150915189048d7faf55b77d43fa0129835daf0"
+      "sha256": "b71955b19cfcee3de2457ee433f8e839a823278cff4df07a8d1b32e4b2905c20"
     },
     {
       "path": "docs/api-reference.md",
@@ -2762,7 +2762,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "45f4eae24f6557f3bbec81455b4ec6020f9941477f557415f184ff2c0287490e"
+      "sha256": "61af0d34245c199e415765d8ec4a5acadda14ef08449cb67aca5fd4b397bdea7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8652,12 +8652,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6d69aeb12a310ff98b05459e0a7a9d070267e953de7d9dc9836368b4d3034090"
+      "sha256": "6c48fb62c55950b2d9e2d0b4e1bffe80543939dbb1e96b243024aa9b7c8461a7"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "45e245a9e6d915f4e6625b5bf21be85d69a5d97a787acf1f790ff75e65f41d46"
+      "sha256": "ed4b62b1b605513188f7da4d4816a7659696bfb7a692a36dc2c00ee95a7c29b9"
     },
     {
       "path": "public-docs/index.html",
@@ -8677,7 +8677,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f04ac4ef2f41e8c246bc190e16b649ff8251a49d682a3eec0830a6595d816756"
+      "sha256": "627d599954ed0b7c69df1c1b17108e5b88dcce87d5cd4fb1b20b9aa67b2330f5"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10767,7 +10767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c62ff0384b44fb6900657484cd1e5d53e8920d1f815d8af3b247aecc605f795c"
+      "sha256": "4d5ca55a9ec23962455f97b3e3e92ec11db491403b8309efc6060cb7454b9ef8"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0341-the-page-is-the-unit-of-tweak-mode.md

@@ -1,6 +1,6 @@
 # ADR 0341 — The page is the unit of Tweak Mode: one tweak task per page round, its status derived from the ledger
 
-- **Status:** Accepted (the owner's decisions written down; the builder's picks for the gaps are listed in "Decided by the builder, owner to confirm")
+- **Status:** Accepted (the owner's decisions written down; the builder's picks for the gaps, listed in "Decided by the builder, confirmed by the owner", were accepted by the owner on 2026-09-28)
 - **Date:** 2026-09-27
 - **Task:** [task 1004332](https://cloudbongos.com/builders#/task/1004332) (BV2.TW03, goal 1000095, working area 6). Spec: [`docs/specs/<redacted>.md`](../specs/<redacted>.md). Master design: [`docs/design/mocks/tweak-mode/`](../design/mocks/tweak-mode/README.md).
 - **Deciders:** the owner, Masterqua (area owner), at the planning session of 2026-09-27 (meta task 1004312): the interview, then the prototype review. This ADR adds no decision the spec did not make, except the gaps listed at the end.
@@ -181,7 +181,9 @@ The lifecycle port gains what these need: `updateTaskDescription`, `webClaimTask
 - `wrong_page`: the file's `page_id` is not the page;
 - `reading_moved`: the file's `reading_hash` is not the draft's, because the page changed since the download. The artist is asked to download again, so no stale line is merged by position.
 
-## Decided by the builder, owner to confirm
+## Decided by the builder, confirmed by the owner
+
+**Confirmed 2026-09-28:** the owner accepted every pick below as written (recorded under [task 1004313](https://cloudbongos.com/builders#/task/1004313)).
 
 The spec does not answer these. Each is the choice most faithful to it, and each is a small change here if the owner rules otherwise. (The TW03 task text said a gap should become a blocker. The owner's overnight rule for this chain says to pick and list, so they are listed rather than filed.)
 

package/docs/adr/README.md

@@ -432,7 +432,7 @@ This keeps the decision history honest and traceable.
 | 0338 | [**Modules travel through a Bongos-hosted store, and an acquired module keeps working forever** ([task 1003782](https://cloudbongos.com/builders#/task/1003782), goal 1000091 — working area 5, owner Will). A module had no transport of its own: it reached an instance only inside the core (ADR 0107 §6) or in the instance's repo. Weighed npm packages, a Bongos-hosted store and git refs against the four things area 5's criteria require — entitlement before install, a per-version score, a tester channel, and a delist that stops distribution. npm and git refs fail entitlement and delist by construction. **D1:** Cloud Bongos hosts the store; a module version is a tarball + hash manifest in the same format `package-core.js` already emits (same `isPublishable()` gate), registry rows on the control-plane DB, artifacts in the already-paid DO Spaces bucket, served by the control plane only after an entitlement + channel check; free modules take the same path at price zero; install/update verify hashes on arrival; modules' own npm deps still travel via npm (ADR 0138). No new fixed cost. **D2 (owner):** delisting, author withdrawal or deletion removes a module from the catalog and stops new acquisitions and updates, but **an acquired module keeps working forever** — the store never disables or removes an installed copy and a delist never revokes an entitlement; the holder is told no more updates will come. Security issues are not a special case; a remote kill switch would need a superseding ADR. Rejected: npm, git refs, remote disable on delist.](0338-modules-travel-through-a-bongos-hosted-store.md) | modules / distribution / economy |
 | 0339 | [**A project's owner upgrades it, and a hosted project hands off to the hub's door** ([task 1004174](https://cloudbongos.com/builders#/task/1004174), goal 1000090 — the owner's ruling of 2026-09-26 that only a project's owner upgrades it). Amends ADR 0293 D5. **D1:** the deploy door's preview and move routes admit the OWNER of a tenant row (`co-tenant`/`cloud-host`) for that row, asked first; every other caller meets the unmodified `core.pin.move` gate, so a non-owner's refusal is unchanged whether or not the id exists and the widening can only admit. **D2:** the platform's own row stays atom-only. **D3:** `GET /core-update` names `<hub>/deploy?project=<slug>` on a federated project, and the hosted hall's banner and rail hand off there (the dead local Deploy item is gone); the hub's `/deploy` shell admits a project owner through `alsoAdmits: 'isProjectOwner'`. **D4:** the intent's actor records the door (`api:owner:<id>` / `api:archon:<id>`), both attributed on the `core_upgrades` ledger. Rejected: a tenant-side API that performs the upgrade, granting the system atom to owners, owners moving the platform row. ADR 0328 Phase 1 (task 1004159) should fold this gate into `requireProjectOwner`.](0339-a-projects-owner-upgrades-it-and-a-hosted-project-hands-off-to-the-hub-door.md) | provisioning / deploy door / permissions |
 | 0340 | [**Every hall takes its update from Settings, and /deploy is the platform hall's page** ([task 1004296](https://cloudbongos.com/builders#/task/1004296), goal 1000090 — the owner's 2026-09-25 asks: a Settings version panel "just like iOS", and /deploy only in the Bongos hall). Amends ADR 0339 D3 and the reach of ADR 0293's page. **D1:** Settings → Software update in the core — the running core, the newest release the runner's own channel rule allows, and what each version in between carries from the newest package's release notes; every signed-in builder reads it, and "up to date" is said only from an answer. **D2:** its Update button leads to the door (local /deploy, the hub's /deploy?project=, or a `bongos upgrade` sentence), drawn only for holders of core.pin.move. **D3:** /deploy 302s to Settings on a hall without the provisioning module. **D4:** the banner links Settings everywhere but the platform; the rail is no longer re-pointed; /core-update drops deploy_url. **D5:** the registry reader moved into the core (module-api readPackageRegistry). Rejected: a second copy of the two-step door, gating the panel on the atom, a "moved" page.](0340-every-hall-takes-its-update-from-settings-and-deploy-is-the-platform-halls-page.md) | deploy door / settings / core update |
-| 0341 | [**The page is the unit of Tweak Mode: one tweak task per page round, its status derived from the ledger** ([task 1004332](https://cloudbongos.com/builders#/task/1004332), goal 1000095 — BV2.TW03, the owner's Tweak Mode decisions of 2026-09-27 written down). Amends ADR 0233 (a proposal becomes a page batch); replaces the artist-review-on-ship cascade rule. **D1-D3:** every record keys on a page id from docs/page-inventory.json; a round is a `page-tweak` task (`source_ref page-tweak/<page>/r<n>`, 30c, catch-all goal, one open round per page under an advisory lock); TW04 commits docs/page-readings.json (line keys, placed/shared/unplaced, reading and files hashes, no browser in ship-check). **D4:** the draft, the frozen batch, the apply record and each send-back are fenced blocks on the task, parsed by a pure pages.js; unplaced rewrites file their own engineer task; copy_no_cms.mjs grows in reviewed diffs. **D5-D6:** artist-craft builders claim with a web claim; anyone asks, and a page ask is a copy_desk_flags row with scope page. **D7:** round states are derived; a passed grade on a page tweak holds at completed until the artist approves (the confirm) or sends it back to the apply queue, with the owner override as the escape hatch. **D8:** count, status, changelog, drift (against the last round's lines_after), N of M per surface, the tally and the recommendation order are all reads. **D9:** the cascade rule is removed; hasCopyOrVisualWork stays for the reader lens. **D10:** the reviews paid 30c per task on the estimate stream (withheld under cost-plus-only) plus the session's cost-plus; an approved page pays its artist 30c on a new artist lane that cost-plus-only does not suppress, payee from the claims table, applier keeps its session reward. **D11-D12:** the route table; a dependency-free .docx with content-control line tags, refused as structure_changed, wrong_page or reading_moved. Twelve builder picks are listed for the owner to confirm.](0341-the-page-is-the-unit-of-tweak-mode.md) | copy desk / artist loop / economy |
+| 0341 | [**The page is the unit of Tweak Mode: one tweak task per page round, its status derived from the ledger** ([task 1004332](https://cloudbongos.com/builders#/task/1004332), goal 1000095 — BV2.TW03, the owner's Tweak Mode decisions of 2026-09-27 written down). Amends ADR 0233 (a proposal becomes a page batch); replaces the artist-review-on-ship cascade rule. **D1-D3:** every record keys on a page id from docs/page-inventory.json; a round is a `page-tweak` task (`source_ref page-tweak/<page>/r<n>`, 30c, catch-all goal, one open round per page under an advisory lock); TW04 commits docs/page-readings.json (line keys, placed/shared/unplaced, reading and files hashes, no browser in ship-check). **D4:** the draft, the frozen batch, the apply record and each send-back are fenced blocks on the task, parsed by a pure pages.js; unplaced rewrites file their own engineer task; copy_no_cms.mjs grows in reviewed diffs. **D5-D6:** artist-craft builders claim with a web claim; anyone asks, and a page ask is a copy_desk_flags row with scope page. **D7:** round states are derived; a passed grade on a page tweak holds at completed until the artist approves (the confirm) or sends it back to the apply queue, with the owner override as the escape hatch. **D8:** count, status, changelog, drift (against the last round's lines_after), N of M per surface, the tally and the recommendation order are all reads. **D9:** the cascade rule is removed; hasCopyOrVisualWork stays for the reader lens. **D10:** the reviews paid 30c per task on the estimate stream (withheld under cost-plus-only) plus the session's cost-plus; an approved page pays its artist 30c on a new artist lane that cost-plus-only does not suppress, payee from the claims table, applier keeps its session reward. **D11-D12:** the route table; a dependency-free .docx with content-control line tags, refused as structure_changed, wrong_page or reading_moved. Twelve builder picks were listed and the owner confirmed them all on 2026-09-28.](0341-the-page-is-the-unit-of-tweak-mode.md) | copy desk / artist loop / economy |
 | 0342 | [**Module categories are eight fixed parents, with narrow sub-categories an author proposes and Metic+ approves** ([task 1003783](https://cloudbongos.com/builders#/task/1003783), goal 1000091 — working area 5, owner Will). The owner's cap of ten listed modules needs a comparable set, and nothing carried a category. **D1:** eight parents derived from the live roster — Work & planning, Team & people, Quality & review, Money, Communication, Pages & design, Hosting & deploy, Knowledge — for browsing only; the cap never applies to a parent. **D2:** the sub-category (the narrow set a buyer chooses between, e.g. "Stripe payments") is where the cap, ranking and comparison run. **D3 (owner):** an author proposes a sub-category and a Metic+ builder approves, renames or merges it, because free-naming would split one comparable set into near-duplicates and the cap would never bite; a pending module lists under its parent and counts toward no cap. **D4:** one sub-category per module. Rejected: free naming, Metic+-only creation, a flat list, parent-level caps.](0342-module-categories-are-eight-parents-with-approved-sub-categories.md) | modules / store / economy |
 | 0343 | [**A module's score is a security gate, then an average of parts every buyer can see** ([task 1003790](https://cloudbongos.com/builders#/task/1003790), goal 1000091 — working area 5, owner Will). No module score existed; the floor, ranking and cap all derive from this one. **D1:** five parts, each 0–100 per version — Security and Tests day one; Install, Reliability (from real installs) and Tester feedback later. **D2 (owner):** failing Security means not listed, never averaged in. **D3 (owner):** overall = unweighted average of the other parts that have data; a missing part is left out, not zero. **D4 (owner):** every part's score is shown to buyers beside the overall, so they can pick the module strongest where they care (tasks 1003798/1003799). **D5:** a version without real-world data is labelled "New". **D6:** price is never an input; the Metic+ override/delist sits on top and is audited. Rejected: security in the average, day-one weights, a single number, missing-as-zero.](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) | modules / store / quality |
 | 0344 | [**A tester is a project that opts in once; an untested version reaches everyone after seven days** ([task 1003801](https://cloudbongos.com/builders#/task/1003801), goal 1000091 — working area 5, owner Will). Settles "willing user" for criterion `wa5-staged-rollout`. **D1 (owner):** a project's own admin switches on "tester" once and gets tester versions of every module it has, with a per-module "general only" override; never on by default; a builder cannot opt in someone else's project. **D2:** first releases and updates alike go to testers first. **D3 (owner):** a version moves to general after seven days if it still passes the security gate and tests, tested or not; the promotion gate may promote earlier or hold on evidence, never forever. **D4:** testers pay the normal price; any tester discount is area 8's call, named not decided. **D5:** tester installs, errors and crashes feed the score (ADR 0343). Rejected: per-module-only opt-in, one all-or-nothing switch, waiting for a tester, releasing at once.](0344-a-tester-is-a-project-that-opts-in-once.md) | modules / store / rollout |

package/docs/module-api-changelog.md

@@ -2631,5 +2631,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1070 with no explicit bump. run 36473239367. (task 1002620)
   1.19.1072 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1071 with no explicit bump. run 36474285523. (task 1002620)
+  1.19.1073 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1072 with no explicit bump. run 36485068639. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1072",
+  "version": "1.19.1073",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1072",
+      "version": "1.19.1073",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1072",
+  "version": "1.19.1073",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7737,5 +7737,11 @@
       "id": "1003801",
       "text": "Decided who tests new module versions first: projects that switch on testing once, and a version nobody tests still reaches everyone after seven days."
     }
+  ],
+  "1.19.1073": [
+    {
+      "id": "1004313",
+      "text": "Tweak Mode is live on cloudbongos.com, and the artist gate is off. Artists can now open the lofi studio, take a whole page, rewrite it (in the studio or in Word), and approve the finished page before it ships. The seven old pe"
+    }
   ]
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1072'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1073'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');