@bongos/core 1.19.882 → 1.19.883

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.882",
-  "core_contract": "1.19.882",
-  "source_commit": "53773e5b697f506fc84dd9bea64f16a7bf5e3ed7",
+  "core_version": "1.19.883",
+  "core_contract": "1.19.883",
+  "source_commit": "38ac16c0f1716d2a3d3b040a38b4d61bcafb4598",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T18:55:17.107Z",
+  "built_at": "2026-09-19T19:12:16.216Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 501,
+    "docs_redacted": 498,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2312,
+    "functional_verbatim": 2315,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
   "file_count": 2839,
-  "tree_sha256": "75c8382243dd3244295f5de5f2f89f988899b41aaee0d8f212952a215c78bf00",
+  "tree_sha256": "d96e15159f4ccd498d4c218b70f298a70541b1d97dae0f21124c8fde891881f0",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "97df7667d10d5678cfdbdcd496b51bec50add8ce83fb1b642ad7d42fcb362cec"
+      "sha256": "a433058b1d11a710689cb4eebe94d4182f5d644bc2df341359ee4ec6348718b4"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2034,10 +2034,15 @@
       "mode": "0000644",
       "sha256": "feab2773d4b8954874ed42bf922bc74d1b9c37e7d5ffef13c5c3cf58fd36507a"
     },
+    {
+      "path": "docs/adr/0309-durable-module-enablement-db-override.md",
+      "mode": "0000644",
+      "sha256": "2aabad9f28113f3e6087b4e850d46a232aaa03c68ce9e793d04b2263e06998f5"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "f19111877404016a28176ac0375e28713dad9d8895b5d637622497b3f461546c"
+      "sha256": "22f4f461a476d43d15a9f77626bdce552736d1a5d96210b5dbd638eb758fbec5"
     },
     {
       "path": "docs/api-reference.md",
@@ -2047,7 +2052,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "5ca72d280163127bea9ec0867c80023041b22040e47531a290481e15c6e26fba"
+      "sha256": "4a74552e803444eb13792a0c61fc41da324bda5c35c50b070d8980025d4d4935"
     },
     {
       "path": "docs/architecture.md",
@@ -2072,12 +2077,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "975590f5b51bb0fbdcace395fe2700ebb6113ed463d29e479072ed1b00476053"
+      "sha256": "f1b9049057c56a02af6031f472a2634050753ca1539aa79549f663851db22e54"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "5f70fd3dc4880222ab4cf6b98a8ed8a848dd06e4e88b9a0481541a7fc5030cac"
+      "sha256": "969894adbb9bc33d4e6f1656aaaa3ba863aba18a5fa7cdce15922916e4d43a6d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2592,7 +2597,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "89bfd7d8da1430abf5d67caf8cba4bf18be0ea934f656145068a0e5622d8efa5"
+      "sha256": "0b1b89161e2c4731dd634a0efd074dd78e85301b1e161366a94b19dd69019905"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2602,7 +2607,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "9be0e20f1f760b01e4fdbd63ab26034c7b327be17ffd56898f775d40e12aad1f"
+      "sha256": "a8791c0dfacd9fb522681fa5af7ddfcc63937dd597f0c30a2fa1b42498f4ee01"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2712,12 +2717,7 @@
     {
       "path": "docs/recipes/bongos-cli-release.md",
       "mode": "0000644",
-      "sha256": "23f40396a4bc9efd4668a7471f1ed33ac34ddfa963b8b806722014907e5a00ec"
-    },
-    {
-      "path": "docs/recipes/builder-box-lifecycle.md",
-      "mode": "0000644",
-      "sha256": "dfffcee084534239d8a748b7468409644d9375e952143b0bd09b9c2c7341e844"
+      "sha256": "de596822f2f5925fd9e4008cc0214c025a73f5ec3a0275aa6f9a117368ed2a76"
     },
     {
       "path": "docs/recipes/claude-design-loop.md",
@@ -2729,16 +2729,6 @@
       "mode": "0000644",
       "sha256": "53721b3314eab8f538aa7027862253abdbdd41be59f9dce75431c1b40ef80e63"
     },
-    {
-      "path": "docs/recipes/devbox-app-release.md",
-      "mode": "0000644",
-      "sha256": "9334dacaa4e7c601e90c9670f101b8320d3664bc54a2cba221e93967c5f6082e"
-    },
-    {
-      "path": "docs/recipes/devbox-app-windows-test.md",
-      "mode": "0000644",
-      "sha256": "0fe7e43b52eeb6633cdd47589bf7bace159bda115efb125ab6e3daefd231ea3f"
-    },
     {
       "path": "docs/recipes/failed-ship-recovery-proof.md",
       "mode": "0000644",
@@ -2777,7 +2767,7 @@
     {
       "path": "docs/recipes/managed-settings-remote-control.md",
       "mode": "0000644",
-      "sha256": "9f4b133b01256e04658a80ffbb21f48ac0cdbeef1163024b35462e0c26149ebd"
+      "sha256": "d1bc074f2a8de8d6d32f32d832e425637dc1dc6a03ae57ec417cd5a003264237"
     },
     {
       "path": "docs/recipes/memory-backup.md",
@@ -2874,11 +2864,6 @@
       "mode": "0000644",
       "sha256": "dba962c19bf22e5773fd05eb6667581d15f62ecda7292a37f83b12227ad14049"
     },
-    {
-      "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
-      "mode": "0000644",
-      "sha256": "cd676096bd45af0d8c95c280f9cfc7f0cc2ef410b830498a20007bca792bbbdb"
-    },
     {
       "path": "docs/research/cursor-competitive-analysis.md",
       "mode": "0000644",
@@ -3709,6 +3694,11 @@
       "mode": "0000644",
       "sha256": "e8d3e3f764b61ea559df7f997758e639f8778ee24da4293908e9d45ca30a425b"
     },
+    {
+      "path": "migrations/core_248_module_enablement_overrides.sql",
+      "mode": "0000644",
+      "sha256": "4f35f87050a532f26b7c9cd0a9bc6f298ab5c0e15eb1c36ddcdd4d261201291d"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -3982,7 +3972,7 @@
     {
       "path": "modules/dev-box/app/README.md",
       "mode": "0000644",
-      "sha256": "28dbc9d51db3ec99ab10654d05dc64c72f381df441cc4d182c9a35fea0d4f234"
+      "sha256": "2c82fe59e0f32aa5eaee94aac7ca896fbf822a85c7cd280748caa44eacdf8bd5"
     },
     {
       "path": "modules/dev-box/app/assets/tray/mac-alertTemplate.png",
@@ -4837,22 +4827,22 @@
     {
       "path": "modules/hall-ui/public/collab-lib.js",
       "mode": "0000644",
-      "sha256": "b5bb0d5f86879fe7fb154aaa819f2c5bceda50138f6c7cf9150bce2d0b51a832"
+      "sha256": "c8c30e5f3cb5982a8218b6e8b135923c76b75604be553dcf3ed46fca0466e67f"
     },
     {
       "path": "modules/hall-ui/public/collab.css",
       "mode": "0000644",
-      "sha256": "12c967c9bbed5fa4d1cb58b57f6f70eb90fee9626c7cad8e30e3a36b1f8c8db8"
+      "sha256": "884118a3b38b0c1ed5e1ac9c90c0b5994714bbabde67959f67c49e7f49536983"
     },
     {
       "path": "modules/hall-ui/public/collab.html",
       "mode": "0000644",
-      "sha256": "be7b4a74502e4fc4c7249b318254d09019b579516202930b0bb864d5650c4f3a"
+      "sha256": "186a0828e1c3e44388146b94c56f239ea6b2392bd599f143c7c73029da35da32"
     },
     {
       "path": "modules/hall-ui/public/collab.js",
       "mode": "0000644",
-      "sha256": "803531f64900d39b99f065757001f0bb9f37b0942e11346de6c7c34a91f7a164"
+      "sha256": "7d589e6c98f9f52831a9be9429493b49e68c3aa62f98f19cbcb77adbac70c0ca"
     },
     {
       "path": "modules/hall-ui/public/collab.states.json",
@@ -4942,7 +4932,7 @@
     {
       "path": "modules/hall-ui/public/dom-utils.js",
       "mode": "0000644",
-      "sha256": "76c0a4513e7caa9452a5c47ebe1d01c8f59a5fc44c371ea25603e77d80a710c3"
+      "sha256": "d32e03626886c73bdd36b3897588d0d17af6beee2c4477b5e06e2e4ecc0e22cd"
     },
     {
       "path": "modules/hall-ui/public/drachmae.html",
@@ -7927,12 +7917,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3062290396748c314e30d2e8d5fc37771f16add79c0a3e2260ff0c4f75fa1244"
+      "sha256": "469884a3047b45a3ef2d4913c2316c2a8e2c7232bba7ff0c3d7ee3002b964be0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1c24014839d73e6c52495564dbf5b7c62a56770849a6985575f7ae6715dd088f"
+      "sha256": "1651df890fb2d85a35efe8281ba5c81a0c683b16db37158b2ed985d11544c683"
     },
     {
       "path": "public-docs/index.html",
@@ -9537,7 +9527,7 @@
     {
       "path": "scripts/hall-preview/server.js",
       "mode": "0000644",
-      "sha256": "8310b06431522364b38a45a4f459bc62e51cfe800d773bf7022df6a9b7540817"
+      "sha256": "0052e9ed7ea2f5779c5bda8d54b1dabd731c0c11de87b4f8e06b00d051ed7a25"
     },
     {
       "path": "scripts/hall-preview/task-visual.js",
@@ -9739,6 +9729,11 @@
       "mode": "0000644",
       "sha256": "d19b83f04b32d5ca942fb2ed3a210af6ef8607e3e9c949338f816337a3b6cf8c"
     },
+    {
+      "path": "src/bongos/module-overrides.js",
+      "mode": "0000644",
+      "sha256": "91e1df91a44f1fd7eaeefcff7bf8ab1211d5f1559a50a7b3355184914bf970af"
+    },
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
@@ -9872,7 +9867,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "321cc9823af0482568fbb5cd7f9ef75c978bd5acc90af29e056f9e49cc9ed003"
+      "sha256": "c12483b8b788420f88e7690311e0c1e079e90eaa6912df92706f7d0d584cb9d1"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -9937,7 +9932,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8f029fa54f8656711dea16cd051c3c13eb3e6b277d9f8786980bab6361b75bfb"
+      "sha256": "b64003ea52fe47207f7723521aba5b1bec5b7286f3e545a4b323d379259b99ab"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9972,12 +9967,12 @@
     {
       "path": "src/modules.js",
       "mode": "0000644",
-      "sha256": "85557da8a52b5050640bc44d8962cdc19db42928d8d2d373f191f1d542df0cce"
+      "sha256": "f0a19c4cda35c81c81ad62cbe2eb01dc8c7393d6129c27813d1f08b62bc356d1"
     },
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "e6cb079ae91d327e93bbea3a0147f37597f745271e156745b99bf7cb35f92ebc"
+      "sha256": "ed0f3284b85d0f2b6b909832597f627b068684960ea2441f807a463946be9fd3"
     },
     {
       "path": "src/role-responsibilities.js",
@@ -10562,7 +10557,7 @@
     {
       "path": "tests/box_sweep_docs.mjs",
       "mode": "0000644",
-      "sha256": "e56b09e961b0c68ee27a6e5049750cd2828e94d9870ddc7837bf9de44fcaa0b7"
+      "sha256": "de2b626477f61e275bc0acc992d6e3b8aad20c93baa14ff3c9e888dffc2e7475"
     },
     {
       "path": "tests/box_sync.mjs",
@@ -10787,7 +10782,7 @@
     {
       "path": "tests/collab_page.mjs",
       "mode": "0000644",
-      "sha256": "3f9e3ea6d2b88cd6592ba7b0575908eb020a072e6ccdb8cdf908bfba65b5191c"
+      "sha256": "d7bbf03d41d8808f5f86f333a9e925291a628b5e5b4cac483be34880a6d42d04"
     },
     {
       "path": "tests/compose_demo_credentials.mjs",
@@ -12522,13 +12517,18 @@
     {
       "path": "tests/modules.mjs",
       "mode": "0000644",
-      "sha256": "09ef08f9ab5ad1927ddfea15202c0cf6820dcff12030a3ff87a4c38718c5fa0f"
+      "sha256": "cffb354efd9aaedd462dfc36a1e8b741635e8434a30edb962273b189bedf0bde"
     },
     {
       "path": "tests/modules_route.mjs",
       "mode": "0000644",
       "sha256": "079d7eef5828912e306e9dbbe081fef6004526067bd15aa6433dc2ff1873a4be"
     },
+    {
+      "path": "tests/modules_route_wiring.mjs",
+      "mode": "0000644",
+      "sha256": "d58c353c7e32002d97da550fc493ed40b66dc624b2ed11be9d2e111a164d8aea"
+    },
     {
       "path": "tests/my_projects_surface.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -95,7 +95,7 @@ export interface GetMemoryBuildersBuilderIdFilesResponse { builder_id: unknown;
 export interface GetMemoryFileResponse { builder_id: unknown; path: unknown; content: unknown; sha256: unknown; byte_len: unknown; mtime: unknown; updated_at: unknown; created_at: unknown }
 export interface GetMemoryFilesResponse { builder_id: unknown; count: unknown; files: unknown }
 export interface GetMingleResponse { mingle: unknown; open_pairs: unknown; you: unknown; matching: unknown }
-export interface GetModulesResponse { modules: unknown; own_built: unknown; core_loaded: unknown; catalog: unknown; submit_pipeline_live: boolean }
+export interface GetModulesResponse { modules: unknown; scope: unknown; own_built: unknown; core_loaded: unknown; catalog: unknown; submit_pipeline_live: boolean }
 export interface GetModulesSubmissionsResponse { submissions: unknown }
 export interface GetMyProjectsInvitesResponse { invites: unknown }
 export interface GetMyProjectsResponse { owned: unknown; building: unknown; applied: unknown }
@@ -347,7 +347,7 @@ export interface PostMinglePairsIdDecideResponse { pair: unknown }
 export interface PostMingleRoundRequest { limit?: number }
 export interface PostMingleRoundResponse { paired: unknown; count: unknown; skipped: unknown }
 export interface PostModulesKeyEnableRequest { enabled?: unknown }
-export interface PostModulesKeyEnableResponse { ok: boolean; key: unknown; enabled: unknown; note: unknown }
+export interface PostModulesKeyEnableResponse { ok: boolean; key: unknown; enabled: unknown; effective: unknown; source: unknown; note: unknown }
 export interface PostModulesKeySubmitRequest { signed_by?: string }
 export interface PostModulesKeySubmitResponse { ok: boolean; submission: unknown }
 export interface PostMyProjectsClientIdLeaveResponse { ok: boolean; left: unknown }

package/docs/adr/0309-durable-module-enablement-db-override.md

@@ -0,0 +1,116 @@
+# ADR 0309 — Module enablement is a database row, above the committed pack and below env
+
+**Status:** accepted · **Date:** 2026-09-18 · **Task:** [task 1002857](https://cloudbongos.com/builders#/task/1002857) (goal 1000091 — BONGOS-V2)
+
+**Related:** [ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) §9 (the Modules tab that ships the toggle) · [ADR 0016](<redacted>.md) (why an HTTP handler may not write to `main`) · [ADR 0083](<redacted>.md) (the module contract this resolves)
+
+## Context
+
+The hall's Modules-tab toggle wrote `config/modules.json` and reloaded the
+in-process cache. The effect was immediate, so the toggle looked like it worked.
+
+`config/modules.json` is the **committed instance pack**, and the pull-deploy runs
+`git reset --hard origin/main`. An operator's toggle therefore reverted on the
+next deploy unless somebody remembered to commit it — and reverted *silently*, so
+a module an operator had deliberately turned off could come back on hours later
+with nothing to connect the two events. That is worse than a toggle that refuses:
+a control that reports success and then quietly undoes itself teaches people not
+to trust the panel.
+
+The route's own header recorded the trade-off and named the follow-up; this is it.
+
+## The decision
+
+**Enablement lives in `module_enablement_overrides` (migration `core_248`), read
+as one precedence layer inside `resolveModules`.** The resolution order becomes:
+
+    neutral pack  →  instance pack  →  DB override  →  env  →  registry default
+
+Three things in that line are the actual decision.
+
+### 1. Above the committed pack
+
+Outranking the file *is* the point. The pack is what `git reset --hard` restores
+on every deploy, so an override that sat below it would be erased by the very
+event it exists to survive.
+
+### 2. Below env
+
+`<PREFIX>_MODULE_<KEY>` stays the highest layer, because it is the **incident
+knob**. An operator must be able to force a module off on one box without a
+working database. If the database outranked env, the failure mode would be "the
+module I am trying to kill is being switched back on by a row I cannot reach to
+delete" — which is the kind of thing that turns an incident into an outage.
+
+### 3. Not an auto-commit
+
+The other way to make the toggle durable is for the handler to commit and push
+`config/modules.json` to `main`. That was rejected, and remains rejected: it would
+make an HTTP request a writer on `main`, bypassing the ship/grade/deploy pipeline
+and the [ADR 0016](<redacted>.md) trust boundary. Durability
+belongs in the database, where this instance's live state already lives.
+
+## The two design points the task left open
+
+### The scope key is the instance pack path
+
+One deployed checkout can run **two instances against one database**,
+differentiated only by `BONGOS_MODULES_FILE` / `BONGOS_BRANDING_FILE`: the default
+instance on `config/modules.json`, and a vanilla sibling on
+`config/modules.neutral.json`. A single global row per module would let one
+sibling's toggle flip the other's module.
+
+The scope key is therefore the **resolved instance pack path, relative to the
+instance root, posix-separated** — chosen because it is not an invented
+identifier: it is precisely the axis those two processes already differ on, so it
+cannot say "same instance" where `loadModules` says "different pack". Normalising
+it keeps the key stable across a moved checkout, an absolute-vs-relative env
+value, and Windows vs Linux. `resolveInstancePackPath()` was extracted so the key
+and the read share one ladder rather than two copies that drift.
+
+### The DB is read into a snapshot, never inline
+
+`loadModules()` is synchronous, behind a lazy cached singleton every caller
+reaches through `modules()`. Making it async would ripple into effectively every
+consumer of a module flag.
+
+So the database is never read on the resolution path. `src/bongos/module-overrides.js`
+reads the overrides **once per refresh** and hands `src/modules.js` a plain
+snapshot, which the pure resolver treats as one more injected layer. There are
+exactly two refresh points, because there are exactly two moments the answer can
+change: **server boot**, and **a write through the route**.
+
+The boot read is awaited *before* `buildPlatformApp()`, because routes mount from
+the resolved module set — an override that landed after construction would not
+change what is mounted until the next restart, which is the same complaint in a
+new costume.
+
+## Consequences
+
+**An unreachable database changes nothing.** Every read here swallows its error
+and leaves the snapshot alone, and an empty snapshot means *no opinion*, not
+*everything off*. An instance that cannot reach its database resolves modules
+exactly as it did before the table existed — on the packs and env alone. This is
+what keeps the awaited boot read a best-effort improvement rather than a boot-time
+dependency: it buys a better answer when the database is there, and never
+withholds the server when it is not.
+
+**Writes are not forgiving, deliberately.** `setOverride` throws. A toggle that
+reported success while persisting nothing would be the original bug with better
+manners.
+
+**The winning layer is now visible.** `GET /modules` reports `enabled_source` per
+module (`neutral` / `instance` / `override` / `env` / `spend-refusal` / `default`),
+the override's author and timestamp, and the process's scope key. Without it,
+"why is this module on?" costs a shell and a grep — and with two precedence layers
+added since the tab was built, the question got harder, not easier. `sources` is
+attached non-enumerably so no existing consumer of the boolean map sees a new key.
+
+**One regression, caught in review and worth recording.** Wrapping the boot in an
+`async` IIFE turned `buildPlatformApp()`'s fatal throw — an enabled module
+consuming a port nothing provides — into a promise rejection, which the
+unhandled-rejection backstop deliberately *survives*. The server came up
+half-wired and said nothing, which is exactly what that throw exists to prevent.
+The boot now rethrows from `process.nextTick`, restoring the uncaught exception
+Node already prints raw and exits non-zero on. Pinned by
+`tests/platform_boot.mjs`'s task 1003820 case.

package/docs/adr/README.md

@@ -400,3 +400,4 @@ This keeps the decision history honest and traceable.
 | 0306 | [**Instance supervision is a seam, with systemd as the default** ([task 1003997](https://cloudbongos.com/builders#/task/1003997), goal 1000106, F13 from the task-1002718 QA walk). `provision-units.js` hardcoded `/etc/systemd/system` in three path functions and the runner reached for `systemctl` inline at fifteen call sites, so a standup was impossible on any plane without systemd — the self-host image runs `USER node`, installs no `sudo` and boots no systemd. **A directory knob does not fix this**: pointing the unit path somewhere writable still emits `daemon-reload` into a namespace where systemd is not PID 1. What varies is not where the unit file goes, it is what supervises the process. Chosen: four operations (install+enable, install backup schedule, restart, remove) move behind `scripts/gds/provision-process.js`, taking the `{ exec, writeFile, sudoP, log }` io the runbook already threads, so dry-run, remote-ssh and logging behaviour carry over untouched (ADR 0130). Selection is explicit (`PROVISION_PROCESS_MANAGER`, an unknown value throws) → probed (`/run/systemd/system`, the `sd_booted(3)` check) → supervisord. **The live box is unchanged by construction** — it boots systemd, and the systemd implementation emits byte-identical commands; the untouched composition assertions in `tests/provision.mjs` are the proof. Rejected: systemd `--user` units (fix an unprivileged VM we do not have, while a plain container has no user bus either). Consequences: isolation is restated per manager (systemd `User=` → supervisord `user=`, ADR 0281) or it silently drops; supervisord has no timers, so it installs no backup schedule and prints the `crontab` line instead of re-implementing cron; the seam is two implementations wide, not speculatively N. **This removes one of four container blockers** — ingress ([task 1004017](https://cloudbongos.com/builders#/task/1004017)), per-instance identity ([task 1004018](https://cloudbongos.com/builders#/task/1004018)) and the hardcoded backup-dir owner ([task 1002719](https://cloudbongos.com/builders#/task/1002719)) remain, so task 1003997's done-when was narrowed to the seam rather than claiming a self-host story that is not there.](0306-instance-supervision-is-a-seam-with-systemd-as-the-default.md) | infra / provisioning |
 | 0307 | [**Autobongos: a deterministic supervisor, agentic workers** ([task 1003900](https://cloudbongos.com/builders#/task/1003900), goal 1000119). An always-on machine works the queue unattended inside owner-allowlisted goals. Most of the loop already existed wired to the wrong trigger — `sequence.js`'s ten-reason halt matrix (ADR 0153), an open blocker as the hold state, the Windows-aware headless spawn seam, `overnight-builder` — but the trigger was cron rather than capacity, and the **supervisor was itself a Claude session**. Decided: the supervisor is a **program**, only the worker is a session; the gauge is the statusLine's `rate_limits.five_hour`/`seven_day`, which per Anthropic's own note is absent until a session's first API response and so **cannot be read cold** (a statusline script persists it, a stale file is *unknown*, never *headroom*); **one session per task, metering not estimating** (a successor cannot be claimed until its predecessor ships, so a batch produces the same order while risking a half-done window, and a fresh session avoids a checkout going stale behind main); **completion is read from the ledger, never the session** (a worker that stopped needing a decision returns `subtype: success`, identical to one that finished); **no terminal stop, only speeds** (three failures → a probing state that self-heals; the only true stop is the server-side kill switch); the machine holds **no push credential**, so a grader outage stops the run rather than shipping unreviewed. The load-bearing finding was **tested before it was decided**: a worker told plainly to stop and ask instead settled four judgement calls and wrote them to disk — competent, and fatal to any design that waits for raised hands. Hence **gate before, record after, nothing in between**: the halt matrix refuses ambiguous work at pick time, and the worker's verdict must declare what the spec did not determine. Rejected: per-call `--permission-prompt-tool` (a thousand weak gates, and one slow supervisor stalls every worker), `--max-budget-usd` (caps dollars; on a subscription the constraint is capacity, so the bound is wall-clock), extending `overnight-builder`, and a terminal stop. Deliberately not built: mid-flight question answering, portability, per-task estimation.](0307-autobongos-a-deterministic-supervisor-and-agentic-workers.md) | autonomy / sessions |
 | 0308 | [**An eleventh working area: Autobongos** ([task 1003900](https://cloudbongos.com/builders#/task/1003900), goal 1000119). Amends [ADR 0264](0264-the-ten-working-areas.md), which nine days earlier collapsed 38 goals into **ten** areas held until 5,000 builders. Area 11 is Autobongos ([goal 1000119](https://cloudbongos.com/builders#/goal/1000119), owner Lars). **Area 6 was the obvious home and was rejected**: area 6 is about a human's experience of the platform, and this area has no human in it — which limits to spend, which fences hold unsupervised, how it recovers with nobody at the keyboard. Those get less attention next to work with a user in front of it, not better answers. It **reopens** goal 1000028 (*Autonomy groundwork*), archived in the 38→10 cut with no successor and carried as `succeeds_goal_id`, so the lineage is in the ledger rather than the prose — and ADR 0264 §3 had already left "fold, keep as an eleventh, or close" as a live owner question. Admitting it cost something recorded: BONGOS-V2 is `building`, so its goal set is closed (ADR 0250) and `POST /goals` refuses `version_not_planning` — an Archon reopened it with a stored `admit_reason`, which is the cut holding well enough that adding to it left evidence. Does not decide: the ten-area discipline stands (one exception, written reason, 5,000-builder horizon unchanged), 0264 §3's other two open rows, or a second goal for the area.](0308-an-eleventh-working-area.md) | methodology / goals |
+| 0309 | [**Module enablement is a database row, above the committed pack and below env** ([task 1002857](https://cloudbongos.com/builders#/task/1002857), goal 1000091). The hall Modules-tab toggle ([ADR 0107](0107-module-upstreaming-contribution-to-core-catalog.md) §9) wrote `config/modules.json` and reloaded the cache, so it looked like it worked — but that file is the committed instance pack and the pull-deploy runs `git reset --hard origin/main`, so the toggle reverted on the next deploy, **silently**. Enablement moves to `module_enablement_overrides` (migration `core_248`), read as one precedence layer: neutral pack → instance pack → **DB override** → env → default. **Above the pack** because the pack is what a deploy restores, so an override below it would be erased by the event it exists to survive; **below env** because `<PREFIX>_MODULE_<KEY>` is the incident knob and must not need a reachable database. **Auto-committing to `main` stays rejected** ([ADR 0016](<redacted>.md)): durability belongs in the DB, not in an HTTP handler that writes to the default branch. Two open design points settled: the **scope key** is the resolved instance pack path (the only axis two instances sharing one database differ on, so one sibling's toggle cannot flip the other's module), and the DB is read into a **snapshot** refreshed at boot and on write rather than inline, because `loadModules()` is synchronous and making it async would ripple into every consumer of a module flag. An unreachable database is a **no-op** — no row means "no opinion", not "off". Does not decide: whether a toggle should also restart the process so remounting is immediate.](0309-durable-module-enablement-db-override.md) | modules / ops |

package/docs/api/openapi.json

@@ -19648,6 +19648,7 @@
         "type": "object",
         "properties": {
           "modules": {},
+          "scope": {},
           "own_built": {},
           "core_loaded": {},
           "catalog": {},
@@ -19657,6 +19658,7 @@
         },
         "required": [
           "modules",
+          "scope",
           "own_built",
           "core_loaded",
           "catalog",
@@ -23479,12 +23481,16 @@
           },
           "key": {},
           "enabled": {},
+          "effective": {},
+          "source": {},
           "note": {}
         },
         "required": [
           "ok",
           "key",
           "enabled",
+          "effective",
+          "source",
           "note"
         ]
       },