@bongos/core 1.19.881 → 1.19.883

package/modules/hall-ui/public/collab.css

@@ -21,10 +21,36 @@
    sees it. Four bands, four treatments: faint, soft, warn, danger. The 3px
    coloured band the first cut painted down the row's left edge is gone — this
    world marks state with a pill, never with a bar. */
+/* THE CHIP ONLY WEARS ITS RING PAST THE THRESHOLD (artist verdict, task
+   1004041). All four bands still have their own ink, because that is what makes
+   the column readable at a glance and it is what the criterion asked for. What
+   changed is that the two CALM bands stop being pills: a ring around "just
+   asked" draws a chip on a row where nothing is wrong, so a board of healthy
+   asks opened as a wall of chips and the two bands that actually mean something
+   had no shape of their own left to mean it with. Faint and soft read as plain
+   quiet text; aging and stale keep the pill.
+
+   The WORDS carry the real age now (collab-lib ageLabel), so two stale rows no
+   longer read identically — which is the other half of the same verdict. */
 .cb-age--fresh   { color: var(--ink-faint); }
 .cb-age--waiting { color: var(--ink-soft); }
 .cb-age--aging   { color: var(--warn); }
 .cb-age--stale   { color: var(--danger); font-weight: 600; }
+.cb-age--fresh,
+.cb-age--waiting {
+  border-color: transparent;
+  padding-left: 0;
+  padding-right: 0;
+}
+
+/* ---- the figure strip -----------------------------------------------------
+   The shell's .stat-row, unchanged, except that this page's third tile holds
+   WORDS (the roles you answer for) rather than a figure. The shell's own
+   --badge modifier says that at 15px, but its phone block restates
+   .stat-tile__num at the same specificity and later in the sheet, so on a phone
+   the modifier loses and a list of role names sets at 28px. Two classes here
+   outrank both without touching the shell. */
+.cb-figs .stat-tile__num--badge { font-size: 15px; letter-spacing: -0.02em; }
 
 /* ---- the blocks ------------------------------------------------------------------
    The top band is the shell's two-up grid (it stacks to one column at the
@@ -103,9 +129,13 @@
 .cb-row .ov-row__facts a { color: var(--accent-ink); }
 /* Inside the two condensed blocks a row has half the page: the state and the
    actions drop UNDER the words as one line (the archetype's own phone shape),
-   the date yields to the age pill, and the two-up itself becomes one column
-   before the shell's phone breakpoint, at the width where two half-rows stop
-   holding a sentence. The wide block below keeps the archetype's two columns. */
+   and the two-up itself becomes one column before the shell's phone breakpoint,
+   at the width where two half-rows stop holding a sentence. The wide block below
+   keeps the archetype's two columns.
+   The separate date line this block used to suppress is gone from the markup
+   entirely (task 1004041): the age pill says how long in words and carries the
+   exact timestamp on its title, so a date beside it was the same fact twice —
+   which is what the "All open asks" rows were doing at full width. */
 .cb-band .ov-row--lead { grid-template-columns: auto minmax(0, 1fr); row-gap: 8px; }
 .cb-band .ov-row--lead > .ov-row__right {
   grid-column: 2;
@@ -115,7 +145,6 @@
   text-align: left;
 }
 .cb-band .ov-row__actions { justify-content: flex-start; }
-.cb-band .ov-row__when { display: none; }
 @media (max-width: 1100px) {
   .cb-band { grid-template-columns: 1fr; }
 }

package/modules/hall-ui/public/collab.html

@@ -35,6 +35,13 @@
            where people are asking, their faces. The rows are the hall's row
            archetype (oversight.css) led by a face; collab.js fills them. -->
       <main id="hall-main">
+        <!-- The glass figure strip task 1003942 promised and did not build, and
+             the artist's verdict (task 1004041) asked for by name: three calm
+             numbers a person meets BEFORE any age pill. The shell's .stat-row,
+             the same band Harbor, Gate and the copy desk open on; collab.js
+             fills it from the two reads it already makes. -->
+        <div class="stat-row ov-summary cb-figs" id="cb-figs" aria-label="Where the asks stand"></div>
+
         <div class="view-zone view-zone--band cb-band">
           <section class="scroll cb-block" aria-labelledby="cb-for-me-h">
             <div class="cb-block__head">
@@ -98,7 +105,7 @@
 <script src="/builders/shell.js?v=2026-07-02-shell1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
-<script src="/builders/collab-lib.js?v=2026-09-16-twosentence"></script>
-<script src="/builders/collab.js?v=2026-09-16-twosentence"></script>
+<script src="/builders/collab-lib.js?v=2026-09-19-agewords"></script>
+<script src="/builders/collab.js?v=2026-09-19-agewords"></script>
 </body>
 </html>

package/modules/hall-ui/public/collab.js

@@ -47,16 +47,15 @@
 
   let settling = false;
 
-  // The age pill: the band's words, in the band's colour (collab.css .cb-age--*).
+  // The age pill: the band picks the colour (collab.css .cb-age--*), the LABEL
+  // carries the real age, so fourteen old rows read as fourteen different ages
+  // instead of fourteen copies of one alarm (artist verdict, task 1004041). The
+  // exact timestamp stays on the title, where a reader who wants the date can
+  // still reach it — which is also why the separate date line that used to sit
+  // under this pill is gone: the same fact twice is one fact too many.
   function ageChip(req, nowMs) {
     const band = L.ageBand(req.created_at, nowMs);
-    return `<span class="fact-pill cb-age cb-age--${band.id}" title="Asked ${escapeHtml(String(req.created_at || ''))}">${escapeHtml(band.label)}</span>`;
-  }
-
-  function whenLine(iso) {
-    const d = iso ? new Date(iso) : null;
-    if (!d || Number.isNaN(d.getTime())) return '';
-    return `<span class="ov-row__when">${escapeHtml(d.toLocaleDateString(undefined, { day: 'numeric', month: 'short', year: 'numeric' }))}</span>`;
+    return `<span class="fact-pill cb-age cb-age--${band.id}" title="Asked ${escapeHtml(String(req.created_at || ''))}">${escapeHtml(L.ageLabel(req.created_at, nowMs))}</span>`;
   }
 
   // A DOM id per row that is stable, unique and safe to put in an attribute. The
@@ -183,21 +182,30 @@
       <div class="ov-row__main">${askHtml(req, key)}
         <div class="ov-row__facts">${directionFact(req, 'in')}${contextChip(req)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}${whenLine(req.created_at)}</div>
+      <div class="ov-row__right">${ageChip(req, nowMs)}</div>
     </li>`;
   }
 
   // Your own ask, led by who you asked, with the two settle actions. Only the
   // asker can settle — the server enforces it in the UPDATE's WHERE, this is
   // just the affordance.
+  //
+  // THE AGE SITS WITH THE FACTS HERE, NOT IN THE RIGHT COLUMN (artist verdict,
+  // task 1004041). On every other block the right column holds one thing and the
+  // age is it. On this one it held the age AND the two settle buttons, so an
+  // alarm in the danger ink and a solid accent control ended up two centimetres
+  // apart — and DESIGN.md spends the accent only on what is pressable or live,
+  // which is precisely the distinction a reader could no longer make. Moving the
+  // pill down to the facts line puts the warning with the other facts about the
+  // ask and leaves the right column as what it is here: the place you act.
   function mineRow(req, nowMs, extra, key) {
     const id = escapeHtml(String(req.id));
     return `<li class="ov-row ov-row--lead cb-row" data-id="${id}"${extra ? ' data-extra hidden' : ''}>
       ${faceHtml(L.faceOf(req, 'out'))}
       <div class="ov-row__main">${askHtml(req, key)}
-        <div class="ov-row__facts">${directionFact(req, 'out')}${contextChip(req)}</div>
+        <div class="ov-row__facts">${directionFact(req, 'out')}${contextChip(req)}${ageChip(req, nowMs)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}
+      <div class="ov-row__right">
         <div class="ov-row__actions">
           <button class="btn-accent" data-settle="answered" data-id="${id}">Someone helped</button>
           <button class="btn-ghost" data-settle="withdrawn" data-id="${id}">Withdraw</button>
@@ -214,7 +222,7 @@
       <div class="ov-row__main">${askHtml(req, key)}
         <div class="ov-row__facts">${boardFact(req)}${contextChip(req)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}${whenLine(req.created_at)}</div>
+      <div class="ov-row__right">${ageChip(req, nowMs)}</div>
     </li>`;
   }
 
@@ -247,6 +255,46 @@
     }
   }
 
+  // ---- the figure strip -------------------------------------------------------
+  //
+  // THREE CALM NUMBERS BEFORE ANY PILL (artist verdict, task 1004041). Task
+  // 1003942's description promised "a glass figure strip at the top (waiting on
+  // you / your open asks / crafts you answer for)" and it was never built — the
+  // grader's narc worker caught the omission and the artist named what it cost:
+  // with no numbers to open on, the first thing a person meets is the wall of
+  // age pills, which is why the two findings were one defect seen twice. So the
+  // strip is the shell's .stat-row, the same glass band Harbor, Gate and the
+  // copy desk open on, and it is drawn BEFORE the blocks in the markup.
+  //
+  // The figures repeat what the block heads count, and that is the point rather
+  // than a duplication: a head's count is found by reading the head, and a strip
+  // is read in one glance at the top of the page. The third one is not a count of
+  // asks at all — it is the roles that decide which asks reach you, which is the
+  // fact behind every empty "Asked of you" and has never been stated on the page.
+  // `badge` is the shell's own modifier for a tile whose value is WORDS rather
+  // than a figure — the display face at 34px is sized for a numeral and sets a
+  // list of role names as a headline.
+  function figureHtml(label, value, sub, badge) {
+    return `<div class="stat-tile">
+      <span class="stat-tile__label">${escapeHtml(label)}</span>
+      <span class="stat-tile__num${badge ? ' stat-tile__num--badge' : ''}">${escapeHtml(String(value))}</span>
+      <span class="stat-tile__sub">${escapeHtml(sub)}</span>
+    </div>`;
+  }
+
+  function paintFigures(forMe, mine, crafts) {
+    const host = $('#cb-figs');
+    if (!host) return;
+    const axis = window.OTB.roleAxisLabel().toLowerCase();
+    // A ROLE LIST IS NOT A NUMBER, so the third tile shows the roles themselves
+    // and falls back to the honest em dash rather than to "0", which would read
+    // as a count of something rather than as "you have not set one".
+    const roles = crafts.map((c) => window.OTB.roleWord(c)).join(', ');
+    host.innerHTML = figureHtml('Waiting on you', forMe.length, forMe.length === 1 ? 'ask' : 'asks')
+      + figureHtml('Your open asks', mine.length, mine.length === 1 ? 'ask' : 'asks')
+      + figureHtml('Roles you answer for', roles || '—', roles ? `your ${axis}` : `no ${axis} set yet`, true);
+  }
+
   // The per-row door. Independent of the block's "Show all N", which flips
   // [data-extra] on the <li>s: this flips one <p> inside one row, so opening a
   // row inside a condensed block and then expanding the block cannot leave either
@@ -323,6 +371,7 @@
     const rowsOf = (r) => ((r && r.ok && r.data && r.data.help_requests) || []);
     const crafts = (forMe.ok && forMe.data && forMe.data.crafts) || [];
 
+    paintFigures(rowsOf(forMe), rowsOf(mine), crafts);
     paintBlock('for-me', rowsOf(forMe), forMeRow, nowMs, true);
     paintBlock('mine', rowsOf(mine), mineRow, nowMs, false);
     paintBlock('all', rowsOf(all), allRow, nowMs, true);
@@ -330,11 +379,15 @@
     const sub = $('#cb-sub');
     if (sub) {
       // task 1003936: the axis word comes from OTB.roleAxisLabel(), never typed.
-      // The VALUES are named through roleLabel() for the same reason the filters are.
+      // task 1004041: the VALUES take roleWord(), not roleLabel() — this is a
+      // sentence, and the page said "Asks to Builders" six lines above "You asked
+      // artists". The opening clause is gone with it: it named the same two
+      // parties the clause after it names, and the page's own head and its three
+      // block headings already say what the page is.
       const axis = window.OTB.roleAxisLabel().toLowerCase();
       sub.textContent = crafts.length
-        ? `Builders asking builders. Asks to ${crafts.map((c) => `${window.OTB.roleLabel(c)}s`).join(', ')}, and to you by name, land in your block.`
-        : `Builders asking builders. With no ${axis} set, only asks addressed to you by name land in your block.`;
+        ? `Asks to ${crafts.map((c) => `${window.OTB.roleWord(c)}s`).join(', ')}, and to you by name, land in your block.`
+        : `With no ${axis} set, only asks addressed to you by name land in your block.`;
     }
 
     // The social half. Best-effort and LAST: an introductions read that fails

package/modules/hall-ui/public/dom-utils.js

@@ -209,6 +209,28 @@
     return s === 'ui' ? 'UI' : s.charAt(0).toUpperCase() + s.slice(1);
   }
 
+  // A CONTROL TAKES roleLabel(); A SENTENCE TAKES roleWord() — the rule task
+  // 1004041 exists to write down, next to the helper that made it necessary.
+  //
+  // roleLabel() capitalises, and that is right for a control: a picker option, a
+  // filter, a column head, a row tag. It is wrong in RUNNING PROSE, where a role
+  // is a common noun. Task 1003936 routed Collab's sub line through roleLabel and
+  // left collab-lib.js lowercase, reasoning about the two call sites separately —
+  // so one screen said "Asks to Builders" six lines above "You asked artists",
+  // which is the same word capitalised two ways on one page, the exact defect
+  // 1003936 existed to remove. Deciding per call site is what guarantees that;
+  // the axis needs two helpers, not one helper and a judgement each time.
+  //
+  // NOT ESCAPE-SAFE, like roleLabel(): a caller rendering it into markup escapes
+  // the result. The acronym exception is the same one, because 'UI' is not a
+  // common noun in any sentence either.
+  function roleWord(d) {
+    const s = String(d || '');
+    if (!s) return '';
+    if (s === ROLE_UNSET) return 'no role yet';
+    return s === 'ui' ? 'UI' : s.toLowerCase();
+  }
+
   // The option list for any Role <select>, so no surface types the values or the
   // labels again. Prefers the roles the SERVER serves (the same list
   // db.updateBuilderDisciplines validates a PATCH against), and falls back to the
@@ -422,7 +444,7 @@
   window.OTB = {
     escapeHtml, $, fmtNum, num, fmtInt, fmtCompact, fmtDate, rankLabel, toast, moduleOn, disciplines,
     // task 1003936 — ONE word for the role axis, all six surfaces
-    roleAxisLabel, roleLabel, roleOptions, roleIsUnset, ROLE_UNSET,
+    roleAxisLabel, roleLabel, roleWord, roleOptions, roleIsUnset, ROLE_UNSET,
     fillKindFilter, kindLabel, kindIsUnset, KIND_UNSET, // task 1003453 — one Kind filler, all three surfaces
     errCode, errMessage, errDetails, // task 1002462 — ADR 0116 envelope readers
     contributeSettingsPanel, settingsPanels,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.881",
+  "version": "1.19.883",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.881",
+      "version": "1.19.883",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.881",
+  "version": "1.19.883",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -340,45 +340,50 @@ function copyTreeTransformed(srcDir, destDir, { dryRun, onFile, overwrite = true
 // path and is the agent's escape hatch, so allow-listing it would be a blanket
 // grant wearing a narrow rule's clothes. The one script the core's own list
 // blesses (`api.js`) is named in full instead.
-const STARTER_ALLOW = [
-  'Bash(bongos claim:*)',
-  'Bash(bongos ship:*)',
-  'Bash(bongos release:*)',
-  'Bash(bongos reauth:*)',
-  'Bash(bongos paste-token:*)',
-  'Bash(bongos exec scripts/gds/api.js:*)',
+const STARTER_COMMANDS = [
+  'bongos claim:*',
+  'bongos ship:*',
+  'bongos release:*',
+  'bongos reauth:*',
+  'bongos paste-token:*',
+  'bongos exec scripts/gds/api.js:*',
   // The read-only subset (task 1003992, ADR 0304). `git branch` and `git fetch`
   // are exact forms on purpose: a flag turns either into a write or an exec. No
   // `git diff|log|show` rule, also on purpose: the harness already runs their
   // read-only forms unprompted, and a prefix rule would switch off its flag check
   // (`--output=<file>` writes anywhere, `diff --no-index` reads any file).
   // tests/box_ship_permissions.mjs pins this list to the core's, rule for rule.
-  'Bash(bongos start:*)',
-  'Bash(bongos status:*)',
-  'Bash(bongos recall:*)',
-  'Bash(bongos exec scripts/gds/me.js:*)',
-  'Bash(bongos doctor:*)',
-  'Bash(bongos exec scripts/gds/preflight.js:*)',
-  'Bash(bongos exec scripts/gds/skill-preflight.js:*)',
-  'Bash(bongos exec scripts/gds/ship-check.js:*)',
-  'Bash(bongos exec scripts/gds/fitness.js:*)',
-  'Bash(bongos exec scripts/gds/strand-watch.js:*)',
-  'Bash(bongos exec scripts/gds/stale-worktrees.js:*)',
-  'Bash(bongos exec scripts/gds/read-session-export.js:*)',
-  'Bash(git status:*)',
-  'Bash(git branch --list)',
-  'Bash(git branch --show-current)',
-  'Bash(git branch -a)',
-  'Bash(git branch -vv)',
-  'Bash(git fetch)',
-  'Bash(git fetch origin)',
-  'Bash(git fetch origin main)',
-  'Bash(gh pr view:*)',
-  'Bash(gh pr checks:*)',
-  'Bash(gh pr list:*)',
-  'Bash(gh run view:*)',
-  'Bash(gh run list:*)',
+  'bongos start:*',
+  'bongos status:*',
+  'bongos recall:*',
+  'bongos exec scripts/gds/me.js:*',
+  'bongos doctor:*',
+  'bongos exec scripts/gds/preflight.js:*',
+  'bongos exec scripts/gds/skill-preflight.js:*',
+  'bongos exec scripts/gds/ship-check.js:*',
+  'bongos exec scripts/gds/fitness.js:*',
+  'bongos exec scripts/gds/strand-watch.js:*',
+  'bongos exec scripts/gds/stale-worktrees.js:*',
+  'bongos exec scripts/gds/read-session-export.js:*',
+  'git status:*',
+  'git branch --list',
+  'git branch --show-current',
+  'git branch -a',
+  'git branch -vv',
+  'git fetch',
+  'git fetch origin',
+  'git fetch origin main',
+  'gh pr view:*',
+  'gh pr checks:*',
+  'gh pr list:*',
+  'gh run view:*',
+  'gh run list:*',
 ];
+// One rule per command PER SHELL TOOL (task 1004014): the shell tool is `PowerShell` on a Windows
+// laptop, and a `Bash(...)` rule says nothing about its commands. The tools are the ones the guards
+// see (`.claude/hooks/shell-tools.js`) — held equal by tests/box_ship_permissions.mjs, not a require.
+const STARTER_SHELL_TOOLS = ['Bash', 'PowerShell'];
+const STARTER_ALLOW = STARTER_SHELL_TOOLS.flatMap((tool) => STARTER_COMMANDS.map((command) => `${tool}(${command})`));
 
 // The starter an instance gets when the core root carries no settings.json — a
 // package-only install. Permissions ONLY: no hooks (they are topology), no env.
@@ -676,8 +681,8 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
       }
       addWritten('.claude/settings.json');
       summary.settings = true;
-      summary.notes.push(`.claude/settings.json written from the starter — ${STARTER_ALLOW.length} blessed command(s), permissions only.`);
-      log(`  ${dryRun ? '[dry-run] would write' : '✓ wrote'} .claude/settings.json (starter: ${STARTER_ALLOW.length} blessed commands, no hooks)`);
+      summary.notes.push(`.claude/settings.json written from the starter — ${STARTER_COMMANDS.length} blessed command(s) for each of ${STARTER_SHELL_TOOLS.join(' + ')}, permissions only.`);
+      log(`  ${dryRun ? '[dry-run] would write' : '✓ wrote'} .claude/settings.json (starter: ${STARTER_COMMANDS.length} blessed commands × ${STARTER_SHELL_TOOLS.length} shell tools, no hooks)`);
     }
   }
 

package/scripts/hall-preview/server.js

@@ -124,9 +124,46 @@ const FIXTURE_FALLBACKS = [
   [/^connections\/degree\/[^/]+$/, 'connections__degree'],
 ];
 
+// A DATE THAT ROTS CANNOT DEMO AN AGE SIGNAL (task 1004041). The help-request
+// fixtures were written with absolute timestamps chosen to land one row in each
+// of collab's four age bands — and three weeks later every one of them had
+// drifted into the oldest band, so the harness rendered fourteen identical
+// "waiting over a week" pills and an artist reviewing the page reasonably read
+// that as the page's own defect. (Half of it was; the other half was this.)
+//
+// So a fixture may write a RELATIVE timestamp: "@-3d" is three days before the
+// moment the page is served, "@-6h" six hours. Resolved on every load, so the
+// bands the fixture was written to demonstrate are the bands it demonstrates a
+// year from now. Any string field may use it; nothing else changes, so a fixture
+// with absolute dates is served exactly as before.
+//
+// WRITE A FRACTIONAL OFFSET. "@-3d" lands exactly on the 3-day band boundary, so
+// whether it reads as 2 days or 3 depends on the milliseconds between this
+// resolve and the browser's own clock — the row flickers between two bands
+// across reloads and a screenshot pass cannot be compared. "@-3.4d" cannot.
+const RELATIVE_AT = /^@-(\d+(?:\.\d+)?)([dh])$/;
+const HOUR_MS = 60 * 60 * 1000;
+
+function resolveRelativeDates(v, nowMs) {
+  if (typeof v === 'string') {
+    const m = RELATIVE_AT.exec(v);
+    if (!m) return v;
+    const hours = Number(m[1]) * (m[2] === 'd' ? 24 : 1);
+    return new Date(nowMs - hours * HOUR_MS).toISOString();
+  }
+  if (Array.isArray(v)) return v.map((x) => resolveRelativeDates(x, nowMs));
+  if (v && typeof v === 'object') {
+    const out = {};
+    for (const [k, val] of Object.entries(v)) out[k] = resolveRelativeDates(val, nowMs);
+    return out;
+  }
+  return v;
+}
+
 function loadFixture(name) {
   try {
-    return JSON.parse(fs.readFileSync(path.join(FIXTURES, `${name}.json`), 'utf8'));
+    const raw = JSON.parse(fs.readFileSync(path.join(FIXTURES, `${name}.json`), 'utf8'));
+    return resolveRelativeDates(raw, Date.now());
   } catch (_) { return undefined; }
 }
 

package/src/bongos/module-overrides.js

@@ -0,0 +1,117 @@
+// src/bongos/module-overrides.js — durable module enablement (task 1002857,
+// migration core_248).
+//
+// WHAT THIS FIXES. The hall's Modules-tab toggle wrote config/modules.json and
+// reloaded the cache, so the effect was immediate on the box — but that file is
+// the committed instance pack, and the pull-deploy runs `git reset --hard
+// origin/main`. The toggle therefore reverted on the next deploy, silently,
+// unless a human remembered to commit it. This module moves the durable half of
+// that decision into the database, where the rest of this instance's live state
+// already lives.
+//
+// THE SHAPE, and why it is this shape. src/modules.js's loadModules() is
+// SYNCHRONOUS — a lazy cached singleton every caller reaches through modules() —
+// and making it async would ripple into effectively every consumer of a module
+// flag. So the database is never read inline. Instead this file reads the
+// overrides ONCE per refresh and hands src/modules.js a plain snapshot, which its
+// pure resolver treats as one more precedence layer. The refresh points are the
+// two moments the answer can change: server boot, and a write through this file.
+//
+// FAILURE IS A NO-OP, DELIBERATELY. Every function here swallows its database
+// error and leaves the snapshot alone. An empty snapshot means "no opinion", not
+// "everything off", so an unreachable database resolves modules exactly as this
+// instance resolved them before the table existed. The alternative — letting a
+// DB outage change which modules are mounted — would make a read-path dependency
+// out of a feature whose entire purpose is durability.
+
+const { pool } = require('./pool');
+// Named imports rather than a namespace object (task 1004052 strand walk): knip cannot
+// follow property access on a CommonJS namespace, so reaching these through one made
+// moduleScopeKey and setModuleOverrides read as unused exports of src/modules.js and
+// tripped the dead-code ratchet — which is what held this branch out of main for 20h.
+const { moduleScopeKey, setModuleOverrides } = require('../modules');
+
+// One log line per distinct failure reason, not per call: refreshOverrides() runs
+// on boot and after every toggle, and a persistently unreachable database would
+// otherwise fill the log with the same sentence.
+const _warned = new Set();
+function warnOnce(reason, err, log = console) {
+  if (_warned.has(reason)) return;
+  _warned.add(reason);
+  log.warn(
+    `[bongos] module overrides ${reason}: ${err && err.message}. Module enablement falls back to the `
+    + 'config packs and env for now — no module changes state because of this.',
+  );
+}
+
+// Read every override for THIS instance's scope and install it as the live
+// snapshot. Returns the resolved module set on success, or null if the database
+// could not be read (in which case the previous snapshot stands).
+async function refreshOverrides({ scope = moduleScopeKey() } = {}) {
+  let rows;
+  try {
+    ({ rows } = await pool.query(
+      'SELECT module_key, enabled FROM module_enablement_overrides WHERE scope = $1',
+      [scope],
+    ));
+  } catch (err) {
+    warnOnce('could not be read', err);
+    return null;
+  }
+  const map = {};
+  for (const r of rows) map[r.module_key] = r.enabled;
+  return setModuleOverrides(map);
+}
+
+// Record an operator's toggle and make it live in the same call. The UPSERT is
+// keyed on (scope, module_key) so a second toggle of the same module updates the
+// row rather than accumulating history — the audit trail this table carries is
+// "who set the CURRENT state, and when", which is what an operator looking at a
+// surprising module needs. Throws on a write failure: unlike a read, a write that
+// silently did nothing would tell the operator their toggle was durable when it
+// was not, which is the original bug wearing a different hat.
+async function setOverride(moduleKey, enabled, { builderId = null, scope = moduleScopeKey() } = {}) {
+  await pool.query(
+    `INSERT INTO module_enablement_overrides (scope, module_key, enabled, set_by, set_at)
+          VALUES ($1, $2, $3, $4, now())
+     ON CONFLICT (scope, module_key)
+       DO UPDATE SET enabled = EXCLUDED.enabled, set_by = EXCLUDED.set_by, set_at = now()`,
+    [scope, moduleKey, enabled, builderId],
+  );
+  return refreshOverrides({ scope });
+}
+
+// Drop the override and fall back to whatever the packs and env say. This is the
+// only way back to "no opinion": setting the override to the pack's own value
+// would look identical in the UI but would keep outranking a later edit to the
+// committed pack.
+async function clearOverride(moduleKey, { scope = moduleScopeKey() } = {}) {
+  await pool.query(
+    'DELETE FROM module_enablement_overrides WHERE scope = $1 AND module_key = $2',
+    [scope, moduleKey],
+  );
+  return refreshOverrides({ scope });
+}
+
+// The rows behind the current snapshot, for the hall's Modules tab: who set each
+// override and when, which the file-write path never recorded. Read-only and
+// failure-tolerant for the same reason refreshOverrides is — a broken audit read
+// must not break the page that lists the modules.
+async function listOverrides({ scope = moduleScopeKey() } = {}) {
+  try {
+    const { rows } = await pool.query(
+      `SELECT o.module_key, o.enabled, o.set_by, o.set_at, b.github_login AS set_by_login
+         FROM module_enablement_overrides o
+         LEFT JOIN builders b ON b.id = o.set_by
+        WHERE o.scope = $1
+        ORDER BY o.module_key`,
+      [scope],
+    );
+    return rows;
+  } catch (err) {
+    warnOnce('could not be listed', err);
+    return [];
+  }
+}
+
+module.exports = { refreshOverrides, setOverride, clearOverride, listOverrides };