@bongos/core 1.19.882 → 1.19.883

package/modules/hall-ui/public/collab.css

@@ -21,10 +21,36 @@
    sees it. Four bands, four treatments: faint, soft, warn, danger. The 3px
    coloured band the first cut painted down the row's left edge is gone — this
    world marks state with a pill, never with a bar. */
+/* THE CHIP ONLY WEARS ITS RING PAST THE THRESHOLD (artist verdict, task
+   1004041). All four bands still have their own ink, because that is what makes
+   the column readable at a glance and it is what the criterion asked for. What
+   changed is that the two CALM bands stop being pills: a ring around "just
+   asked" draws a chip on a row where nothing is wrong, so a board of healthy
+   asks opened as a wall of chips and the two bands that actually mean something
+   had no shape of their own left to mean it with. Faint and soft read as plain
+   quiet text; aging and stale keep the pill.
+
+   The WORDS carry the real age now (collab-lib ageLabel), so two stale rows no
+   longer read identically — which is the other half of the same verdict. */
 .cb-age--fresh   { color: var(--ink-faint); }
 .cb-age--waiting { color: var(--ink-soft); }
 .cb-age--aging   { color: var(--warn); }
 .cb-age--stale   { color: var(--danger); font-weight: 600; }
+.cb-age--fresh,
+.cb-age--waiting {
+  border-color: transparent;
+  padding-left: 0;
+  padding-right: 0;
+}
+
+/* ---- the figure strip -----------------------------------------------------
+   The shell's .stat-row, unchanged, except that this page's third tile holds
+   WORDS (the roles you answer for) rather than a figure. The shell's own
+   --badge modifier says that at 15px, but its phone block restates
+   .stat-tile__num at the same specificity and later in the sheet, so on a phone
+   the modifier loses and a list of role names sets at 28px. Two classes here
+   outrank both without touching the shell. */
+.cb-figs .stat-tile__num--badge { font-size: 15px; letter-spacing: -0.02em; }
 
 /* ---- the blocks ------------------------------------------------------------------
    The top band is the shell's two-up grid (it stacks to one column at the
@@ -103,9 +129,13 @@
 .cb-row .ov-row__facts a { color: var(--accent-ink); }
 /* Inside the two condensed blocks a row has half the page: the state and the
    actions drop UNDER the words as one line (the archetype's own phone shape),
-   the date yields to the age pill, and the two-up itself becomes one column
-   before the shell's phone breakpoint, at the width where two half-rows stop
-   holding a sentence. The wide block below keeps the archetype's two columns. */
+   and the two-up itself becomes one column before the shell's phone breakpoint,
+   at the width where two half-rows stop holding a sentence. The wide block below
+   keeps the archetype's two columns.
+   The separate date line this block used to suppress is gone from the markup
+   entirely (task 1004041): the age pill says how long in words and carries the
+   exact timestamp on its title, so a date beside it was the same fact twice —
+   which is what the "All open asks" rows were doing at full width. */
 .cb-band .ov-row--lead { grid-template-columns: auto minmax(0, 1fr); row-gap: 8px; }
 .cb-band .ov-row--lead > .ov-row__right {
   grid-column: 2;
@@ -115,7 +145,6 @@
   text-align: left;
 }
 .cb-band .ov-row__actions { justify-content: flex-start; }
-.cb-band .ov-row__when { display: none; }
 @media (max-width: 1100px) {
   .cb-band { grid-template-columns: 1fr; }
 }

package/modules/hall-ui/public/collab.html

@@ -35,6 +35,13 @@
            where people are asking, their faces. The rows are the hall's row
            archetype (oversight.css) led by a face; collab.js fills them. -->
       <main id="hall-main">
+        <!-- The glass figure strip task 1003942 promised and did not build, and
+             the artist's verdict (task 1004041) asked for by name: three calm
+             numbers a person meets BEFORE any age pill. The shell's .stat-row,
+             the same band Harbor, Gate and the copy desk open on; collab.js
+             fills it from the two reads it already makes. -->
+        <div class="stat-row ov-summary cb-figs" id="cb-figs" aria-label="Where the asks stand"></div>
+
         <div class="view-zone view-zone--band cb-band">
           <section class="scroll cb-block" aria-labelledby="cb-for-me-h">
             <div class="cb-block__head">
@@ -98,7 +105,7 @@
 <script src="/builders/shell.js?v=2026-07-02-shell1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
-<script src="/builders/collab-lib.js?v=2026-09-16-twosentence"></script>
-<script src="/builders/collab.js?v=2026-09-16-twosentence"></script>
+<script src="/builders/collab-lib.js?v=2026-09-19-agewords"></script>
+<script src="/builders/collab.js?v=2026-09-19-agewords"></script>
 </body>
 </html>

package/modules/hall-ui/public/collab.js

@@ -47,16 +47,15 @@
 
   let settling = false;
 
-  // The age pill: the band's words, in the band's colour (collab.css .cb-age--*).
+  // The age pill: the band picks the colour (collab.css .cb-age--*), the LABEL
+  // carries the real age, so fourteen old rows read as fourteen different ages
+  // instead of fourteen copies of one alarm (artist verdict, task 1004041). The
+  // exact timestamp stays on the title, where a reader who wants the date can
+  // still reach it — which is also why the separate date line that used to sit
+  // under this pill is gone: the same fact twice is one fact too many.
   function ageChip(req, nowMs) {
     const band = L.ageBand(req.created_at, nowMs);
-    return `<span class="fact-pill cb-age cb-age--${band.id}" title="Asked ${escapeHtml(String(req.created_at || ''))}">${escapeHtml(band.label)}</span>`;
-  }
-
-  function whenLine(iso) {
-    const d = iso ? new Date(iso) : null;
-    if (!d || Number.isNaN(d.getTime())) return '';
-    return `<span class="ov-row__when">${escapeHtml(d.toLocaleDateString(undefined, { day: 'numeric', month: 'short', year: 'numeric' }))}</span>`;
+    return `<span class="fact-pill cb-age cb-age--${band.id}" title="Asked ${escapeHtml(String(req.created_at || ''))}">${escapeHtml(L.ageLabel(req.created_at, nowMs))}</span>`;
   }
 
   // A DOM id per row that is stable, unique and safe to put in an attribute. The
@@ -183,21 +182,30 @@
       <div class="ov-row__main">${askHtml(req, key)}
         <div class="ov-row__facts">${directionFact(req, 'in')}${contextChip(req)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}${whenLine(req.created_at)}</div>
+      <div class="ov-row__right">${ageChip(req, nowMs)}</div>
     </li>`;
   }
 
   // Your own ask, led by who you asked, with the two settle actions. Only the
   // asker can settle — the server enforces it in the UPDATE's WHERE, this is
   // just the affordance.
+  //
+  // THE AGE SITS WITH THE FACTS HERE, NOT IN THE RIGHT COLUMN (artist verdict,
+  // task 1004041). On every other block the right column holds one thing and the
+  // age is it. On this one it held the age AND the two settle buttons, so an
+  // alarm in the danger ink and a solid accent control ended up two centimetres
+  // apart — and DESIGN.md spends the accent only on what is pressable or live,
+  // which is precisely the distinction a reader could no longer make. Moving the
+  // pill down to the facts line puts the warning with the other facts about the
+  // ask and leaves the right column as what it is here: the place you act.
   function mineRow(req, nowMs, extra, key) {
     const id = escapeHtml(String(req.id));
     return `<li class="ov-row ov-row--lead cb-row" data-id="${id}"${extra ? ' data-extra hidden' : ''}>
       ${faceHtml(L.faceOf(req, 'out'))}
       <div class="ov-row__main">${askHtml(req, key)}
-        <div class="ov-row__facts">${directionFact(req, 'out')}${contextChip(req)}</div>
+        <div class="ov-row__facts">${directionFact(req, 'out')}${contextChip(req)}${ageChip(req, nowMs)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}
+      <div class="ov-row__right">
         <div class="ov-row__actions">
           <button class="btn-accent" data-settle="answered" data-id="${id}">Someone helped</button>
           <button class="btn-ghost" data-settle="withdrawn" data-id="${id}">Withdraw</button>
@@ -214,7 +222,7 @@
       <div class="ov-row__main">${askHtml(req, key)}
         <div class="ov-row__facts">${boardFact(req)}${contextChip(req)}</div>
       </div>
-      <div class="ov-row__right">${ageChip(req, nowMs)}${whenLine(req.created_at)}</div>
+      <div class="ov-row__right">${ageChip(req, nowMs)}</div>
     </li>`;
   }
 
@@ -247,6 +255,46 @@
     }
   }
 
+  // ---- the figure strip -------------------------------------------------------
+  //
+  // THREE CALM NUMBERS BEFORE ANY PILL (artist verdict, task 1004041). Task
+  // 1003942's description promised "a glass figure strip at the top (waiting on
+  // you / your open asks / crafts you answer for)" and it was never built — the
+  // grader's narc worker caught the omission and the artist named what it cost:
+  // with no numbers to open on, the first thing a person meets is the wall of
+  // age pills, which is why the two findings were one defect seen twice. So the
+  // strip is the shell's .stat-row, the same glass band Harbor, Gate and the
+  // copy desk open on, and it is drawn BEFORE the blocks in the markup.
+  //
+  // The figures repeat what the block heads count, and that is the point rather
+  // than a duplication: a head's count is found by reading the head, and a strip
+  // is read in one glance at the top of the page. The third one is not a count of
+  // asks at all — it is the roles that decide which asks reach you, which is the
+  // fact behind every empty "Asked of you" and has never been stated on the page.
+  // `badge` is the shell's own modifier for a tile whose value is WORDS rather
+  // than a figure — the display face at 34px is sized for a numeral and sets a
+  // list of role names as a headline.
+  function figureHtml(label, value, sub, badge) {
+    return `<div class="stat-tile">
+      <span class="stat-tile__label">${escapeHtml(label)}</span>
+      <span class="stat-tile__num${badge ? ' stat-tile__num--badge' : ''}">${escapeHtml(String(value))}</span>
+      <span class="stat-tile__sub">${escapeHtml(sub)}</span>
+    </div>`;
+  }
+
+  function paintFigures(forMe, mine, crafts) {
+    const host = $('#cb-figs');
+    if (!host) return;
+    const axis = window.OTB.roleAxisLabel().toLowerCase();
+    // A ROLE LIST IS NOT A NUMBER, so the third tile shows the roles themselves
+    // and falls back to the honest em dash rather than to "0", which would read
+    // as a count of something rather than as "you have not set one".
+    const roles = crafts.map((c) => window.OTB.roleWord(c)).join(', ');
+    host.innerHTML = figureHtml('Waiting on you', forMe.length, forMe.length === 1 ? 'ask' : 'asks')
+      + figureHtml('Your open asks', mine.length, mine.length === 1 ? 'ask' : 'asks')
+      + figureHtml('Roles you answer for', roles || '—', roles ? `your ${axis}` : `no ${axis} set yet`, true);
+  }
+
   // The per-row door. Independent of the block's "Show all N", which flips
   // [data-extra] on the <li>s: this flips one <p> inside one row, so opening a
   // row inside a condensed block and then expanding the block cannot leave either
@@ -323,6 +371,7 @@
     const rowsOf = (r) => ((r && r.ok && r.data && r.data.help_requests) || []);
     const crafts = (forMe.ok && forMe.data && forMe.data.crafts) || [];
 
+    paintFigures(rowsOf(forMe), rowsOf(mine), crafts);
     paintBlock('for-me', rowsOf(forMe), forMeRow, nowMs, true);
     paintBlock('mine', rowsOf(mine), mineRow, nowMs, false);
     paintBlock('all', rowsOf(all), allRow, nowMs, true);
@@ -330,11 +379,15 @@
     const sub = $('#cb-sub');
     if (sub) {
       // task 1003936: the axis word comes from OTB.roleAxisLabel(), never typed.
-      // The VALUES are named through roleLabel() for the same reason the filters are.
+      // task 1004041: the VALUES take roleWord(), not roleLabel() — this is a
+      // sentence, and the page said "Asks to Builders" six lines above "You asked
+      // artists". The opening clause is gone with it: it named the same two
+      // parties the clause after it names, and the page's own head and its three
+      // block headings already say what the page is.
       const axis = window.OTB.roleAxisLabel().toLowerCase();
       sub.textContent = crafts.length
-        ? `Builders asking builders. Asks to ${crafts.map((c) => `${window.OTB.roleLabel(c)}s`).join(', ')}, and to you by name, land in your block.`
-        : `Builders asking builders. With no ${axis} set, only asks addressed to you by name land in your block.`;
+        ? `Asks to ${crafts.map((c) => `${window.OTB.roleWord(c)}s`).join(', ')}, and to you by name, land in your block.`
+        : `With no ${axis} set, only asks addressed to you by name land in your block.`;
     }
 
     // The social half. Best-effort and LAST: an introductions read that fails

package/modules/hall-ui/public/dom-utils.js

@@ -209,6 +209,28 @@
     return s === 'ui' ? 'UI' : s.charAt(0).toUpperCase() + s.slice(1);
   }
 
+  // A CONTROL TAKES roleLabel(); A SENTENCE TAKES roleWord() — the rule task
+  // 1004041 exists to write down, next to the helper that made it necessary.
+  //
+  // roleLabel() capitalises, and that is right for a control: a picker option, a
+  // filter, a column head, a row tag. It is wrong in RUNNING PROSE, where a role
+  // is a common noun. Task 1003936 routed Collab's sub line through roleLabel and
+  // left collab-lib.js lowercase, reasoning about the two call sites separately —
+  // so one screen said "Asks to Builders" six lines above "You asked artists",
+  // which is the same word capitalised two ways on one page, the exact defect
+  // 1003936 existed to remove. Deciding per call site is what guarantees that;
+  // the axis needs two helpers, not one helper and a judgement each time.
+  //
+  // NOT ESCAPE-SAFE, like roleLabel(): a caller rendering it into markup escapes
+  // the result. The acronym exception is the same one, because 'UI' is not a
+  // common noun in any sentence either.
+  function roleWord(d) {
+    const s = String(d || '');
+    if (!s) return '';
+    if (s === ROLE_UNSET) return 'no role yet';
+    return s === 'ui' ? 'UI' : s.toLowerCase();
+  }
+
   // The option list for any Role <select>, so no surface types the values or the
   // labels again. Prefers the roles the SERVER serves (the same list
   // db.updateBuilderDisciplines validates a PATCH against), and falls back to the
@@ -422,7 +444,7 @@
   window.OTB = {
     escapeHtml, $, fmtNum, num, fmtInt, fmtCompact, fmtDate, rankLabel, toast, moduleOn, disciplines,
     // task 1003936 — ONE word for the role axis, all six surfaces
-    roleAxisLabel, roleLabel, roleOptions, roleIsUnset, ROLE_UNSET,
+    roleAxisLabel, roleLabel, roleWord, roleOptions, roleIsUnset, ROLE_UNSET,
     fillKindFilter, kindLabel, kindIsUnset, KIND_UNSET, // task 1003453 — one Kind filler, all three surfaces
     errCode, errMessage, errDetails, // task 1002462 — ADR 0116 envelope readers
     contributeSettingsPanel, settingsPanels,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.882",
+  "version": "1.19.883",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.882",
+      "version": "1.19.883",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.882",
+  "version": "1.19.883",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/hall-preview/server.js

@@ -124,9 +124,46 @@ const FIXTURE_FALLBACKS = [
   [/^connections\/degree\/[^/]+$/, 'connections__degree'],
 ];
 
+// A DATE THAT ROTS CANNOT DEMO AN AGE SIGNAL (task 1004041). The help-request
+// fixtures were written with absolute timestamps chosen to land one row in each
+// of collab's four age bands — and three weeks later every one of them had
+// drifted into the oldest band, so the harness rendered fourteen identical
+// "waiting over a week" pills and an artist reviewing the page reasonably read
+// that as the page's own defect. (Half of it was; the other half was this.)
+//
+// So a fixture may write a RELATIVE timestamp: "@-3d" is three days before the
+// moment the page is served, "@-6h" six hours. Resolved on every load, so the
+// bands the fixture was written to demonstrate are the bands it demonstrates a
+// year from now. Any string field may use it; nothing else changes, so a fixture
+// with absolute dates is served exactly as before.
+//
+// WRITE A FRACTIONAL OFFSET. "@-3d" lands exactly on the 3-day band boundary, so
+// whether it reads as 2 days or 3 depends on the milliseconds between this
+// resolve and the browser's own clock — the row flickers between two bands
+// across reloads and a screenshot pass cannot be compared. "@-3.4d" cannot.
+const RELATIVE_AT = /^@-(\d+(?:\.\d+)?)([dh])$/;
+const HOUR_MS = 60 * 60 * 1000;
+
+function resolveRelativeDates(v, nowMs) {
+  if (typeof v === 'string') {
+    const m = RELATIVE_AT.exec(v);
+    if (!m) return v;
+    const hours = Number(m[1]) * (m[2] === 'd' ? 24 : 1);
+    return new Date(nowMs - hours * HOUR_MS).toISOString();
+  }
+  if (Array.isArray(v)) return v.map((x) => resolveRelativeDates(x, nowMs));
+  if (v && typeof v === 'object') {
+    const out = {};
+    for (const [k, val] of Object.entries(v)) out[k] = resolveRelativeDates(val, nowMs);
+    return out;
+  }
+  return v;
+}
+
 function loadFixture(name) {
   try {
-    return JSON.parse(fs.readFileSync(path.join(FIXTURES, `${name}.json`), 'utf8'));
+    const raw = JSON.parse(fs.readFileSync(path.join(FIXTURES, `${name}.json`), 'utf8'));
+    return resolveRelativeDates(raw, Date.now());
   } catch (_) { return undefined; }
 }
 

package/src/bongos/module-overrides.js

@@ -0,0 +1,117 @@
+// src/bongos/module-overrides.js — durable module enablement (task 1002857,
+// migration core_248).
+//
+// WHAT THIS FIXES. The hall's Modules-tab toggle wrote config/modules.json and
+// reloaded the cache, so the effect was immediate on the box — but that file is
+// the committed instance pack, and the pull-deploy runs `git reset --hard
+// origin/main`. The toggle therefore reverted on the next deploy, silently,
+// unless a human remembered to commit it. This module moves the durable half of
+// that decision into the database, where the rest of this instance's live state
+// already lives.
+//
+// THE SHAPE, and why it is this shape. src/modules.js's loadModules() is
+// SYNCHRONOUS — a lazy cached singleton every caller reaches through modules() —
+// and making it async would ripple into effectively every consumer of a module
+// flag. So the database is never read inline. Instead this file reads the
+// overrides ONCE per refresh and hands src/modules.js a plain snapshot, which its
+// pure resolver treats as one more precedence layer. The refresh points are the
+// two moments the answer can change: server boot, and a write through this file.
+//
+// FAILURE IS A NO-OP, DELIBERATELY. Every function here swallows its database
+// error and leaves the snapshot alone. An empty snapshot means "no opinion", not
+// "everything off", so an unreachable database resolves modules exactly as this
+// instance resolved them before the table existed. The alternative — letting a
+// DB outage change which modules are mounted — would make a read-path dependency
+// out of a feature whose entire purpose is durability.
+
+const { pool } = require('./pool');
+// Named imports rather than a namespace object (task 1004052 strand walk): knip cannot
+// follow property access on a CommonJS namespace, so reaching these through one made
+// moduleScopeKey and setModuleOverrides read as unused exports of src/modules.js and
+// tripped the dead-code ratchet — which is what held this branch out of main for 20h.
+const { moduleScopeKey, setModuleOverrides } = require('../modules');
+
+// One log line per distinct failure reason, not per call: refreshOverrides() runs
+// on boot and after every toggle, and a persistently unreachable database would
+// otherwise fill the log with the same sentence.
+const _warned = new Set();
+function warnOnce(reason, err, log = console) {
+  if (_warned.has(reason)) return;
+  _warned.add(reason);
+  log.warn(
+    `[bongos] module overrides ${reason}: ${err && err.message}. Module enablement falls back to the `
+    + 'config packs and env for now — no module changes state because of this.',
+  );
+}
+
+// Read every override for THIS instance's scope and install it as the live
+// snapshot. Returns the resolved module set on success, or null if the database
+// could not be read (in which case the previous snapshot stands).
+async function refreshOverrides({ scope = moduleScopeKey() } = {}) {
+  let rows;
+  try {
+    ({ rows } = await pool.query(
+      'SELECT module_key, enabled FROM module_enablement_overrides WHERE scope = $1',
+      [scope],
+    ));
+  } catch (err) {
+    warnOnce('could not be read', err);
+    return null;
+  }
+  const map = {};
+  for (const r of rows) map[r.module_key] = r.enabled;
+  return setModuleOverrides(map);
+}
+
+// Record an operator's toggle and make it live in the same call. The UPSERT is
+// keyed on (scope, module_key) so a second toggle of the same module updates the
+// row rather than accumulating history — the audit trail this table carries is
+// "who set the CURRENT state, and when", which is what an operator looking at a
+// surprising module needs. Throws on a write failure: unlike a read, a write that
+// silently did nothing would tell the operator their toggle was durable when it
+// was not, which is the original bug wearing a different hat.
+async function setOverride(moduleKey, enabled, { builderId = null, scope = moduleScopeKey() } = {}) {
+  await pool.query(
+    `INSERT INTO module_enablement_overrides (scope, module_key, enabled, set_by, set_at)
+          VALUES ($1, $2, $3, $4, now())
+     ON CONFLICT (scope, module_key)
+       DO UPDATE SET enabled = EXCLUDED.enabled, set_by = EXCLUDED.set_by, set_at = now()`,
+    [scope, moduleKey, enabled, builderId],
+  );
+  return refreshOverrides({ scope });
+}
+
+// Drop the override and fall back to whatever the packs and env say. This is the
+// only way back to "no opinion": setting the override to the pack's own value
+// would look identical in the UI but would keep outranking a later edit to the
+// committed pack.
+async function clearOverride(moduleKey, { scope = moduleScopeKey() } = {}) {
+  await pool.query(
+    'DELETE FROM module_enablement_overrides WHERE scope = $1 AND module_key = $2',
+    [scope, moduleKey],
+  );
+  return refreshOverrides({ scope });
+}
+
+// The rows behind the current snapshot, for the hall's Modules tab: who set each
+// override and when, which the file-write path never recorded. Read-only and
+// failure-tolerant for the same reason refreshOverrides is — a broken audit read
+// must not break the page that lists the modules.
+async function listOverrides({ scope = moduleScopeKey() } = {}) {
+  try {
+    const { rows } = await pool.query(
+      `SELECT o.module_key, o.enabled, o.set_by, o.set_at, b.github_login AS set_by_login
+         FROM module_enablement_overrides o
+         LEFT JOIN builders b ON b.id = o.set_by
+        WHERE o.scope = $1
+        ORDER BY o.module_key`,
+      [scope],
+    );
+    return rows;
+  } catch (err) {
+    warnOnce('could not be listed', err);
+    return [];
+  }
+}
+
+module.exports = { refreshOverrides, setOverride, clearOverride, listOverrides };

package/src/bongos/routes/modules.js

@@ -23,23 +23,28 @@
 // /backup/trigger — it changes running behavior for the whole instance (or
 // files something into a shared review queue), not just the caller.
 //
-// Persistence note: /modules/:key/enable writes config/modules.json on disk
-// and reloads the in-process cache, so the effect is immediate on this box.
-// Like any other hand-edit of that file, surviving the next `git reset --hard`
-// deploy needs the change committed — this route does not auto-commit (an
-// HTTP handler auto-pushing to main bypasses the ship/grade/deploy pipeline,
-// which the project's trust boundary treats as a bigger risk than a toggle
-// that needs a human/agent to land it properly). Captured as a follow-up
-// idea: durable (DB-backed) module enablement that survives a deploy with no
-// extra step.
+// Persistence note (task 1002857, migration core_248, ADR 0309):
+// /modules/:key/enable writes a row in module_enablement_overrides and reloads
+// the in-process cache, so the toggle is both immediate on this box AND durable
+// past the next deploy. It used to write config/modules.json, which the
+// pull-deploy's `git reset --hard origin/main` then reverted unless a human
+// remembered to commit it — silently, which was the bug.
+//
+// The route still does not auto-commit, and that has not changed: an HTTP
+// handler pushing to main would bypass the ship/grade/deploy pipeline and the
+// ADR 0016 trust boundary. Durability comes from the database, where this
+// instance's live state already lives, not from a writer on main.
+//
+// Precedence, stated where the toggle is: neutral pack -> instance pack -> THIS
+// override -> env. An operator can still force a module off on one box with
+// <PREFIX>_MODULE_<KEY>, and that env knob outranks anything this route writes —
+// deliberately, because the incident lever must not need a reachable database.
 //
 // Why the review queue is a table in THIS instance's own DB (not a live
 // cross-repo call to the extracted core repo): see
 // docs/adr/0135-module-upstream-submission-interim-queue.md.
 
 const express = require('express');
-const fs = require('node:fs');
-const path = require('node:path');
 const auth = require('../auth');
 const { asyncHandler, validateOrRespond, LIMITS } = require('./_helpers');
 const loader = require('../../module-loader/loader');
@@ -53,6 +58,10 @@ const modulesLib = require('../../modules');
 // server process.
 const moduleCli = require('../../../scripts/gds/module');
 const moduleSubmissions = require('../module-submissions');
+// Named imports, not a namespace object (task 1004052 strand walk): knip cannot follow
+// property access on a CommonJS namespace, so reaching these through one made them read
+// as unused exports and tripped the dead-code ratchet that held this branch out of main.
+const { listOverrides, setOverride } = require('../module-overrides');
 
 // A packaged submission embeds every file's content (base64) — cap the total
 // so a runaway/misbuilt module can't bloat the review-queue table. Generous
@@ -75,11 +84,6 @@ function sourceRepoLabel() {
   } catch { return null; }
 }
 
-function readInstanceConfig() {
-  try { return JSON.parse(fs.readFileSync(modulesLib.INSTANCE_PATH, 'utf8')); }
-  catch (e) { if (e.code === 'ENOENT') return { modules: {} }; throw e; }
-}
-
 // The catalog model (src/module-loader/catalog.js) is the SINGLE builder behind
 // both surfaces — this route and `bongos module list` — so the hall and the
 // terminal can never disagree about who built a module or which tree it ships
@@ -108,8 +112,25 @@ module.exports = function buildModulesRouter() {
   // rank: any-builder — list every on-disk module with attribution + provenance (same read gate as the atlas/primer pages).
   router.get('/modules', auth.requireBuilder, asyncHandler('GET /modules', async (_req, res) => {
     const all = listModules();
+    // WHICH LAYER PRODUCED EACH STATE, so an operator can tell a durable override
+    // from a committed pack value from an env knob without opening a shell
+    // (task 1002857). Both reads are failure-tolerant, so a broken override table
+    // degrades this to the listing it was before rather than breaking the tab.
+    const resolvedSet = modulesLib.modules();
+    const sources = (resolvedSet && resolvedSet.sources) || {};
+    const overrideRows = await listOverrides();
+    const byKey = new Map(overrideRows.map((r) => [r.module_key, r]));
+    for (const m of all) {
+      m.enabled_source = sources[m.key] || 'default';
+      m.override = byKey.has(m.key)
+        ? { enabled: byKey.get(m.key).enabled, set_by: byKey.get(m.key).set_by_login || null, set_at: byKey.get(m.key).set_at }
+        : null;
+    }
     res.json({
       modules: all,
+      // The override scope this process runs under — two instances sharing one
+      // database differ only here, so a surprising answer is diagnosable.
+      scope: modulesLib.moduleScopeKey(),
       own_built: all.filter((m) => m.provenance === 'own').length,
       core_loaded: all.filter((m) => m.provenance === 'core').length,
       // The catalog roll-up (task 1001772): how many modules the core ships that
@@ -137,15 +158,27 @@ module.exports = function buildModulesRouter() {
         return res.fail('not_found', { status: 404, message: `No on-disk module "${key}" — only a real modules/<key>/ can be toggled.` });
       }
 
-      const cfg = readInstanceConfig();
-      if (!cfg.modules || typeof cfg.modules !== 'object') cfg.modules = {};
-      cfg.modules[key] = enabled;
-      fs.mkdirSync(path.dirname(modulesLib.INSTANCE_PATH), { recursive: true });
-      fs.writeFileSync(modulesLib.INSTANCE_PATH, JSON.stringify(cfg, null, 2) + '\n');
-      modulesLib.reload();
+      // setOverride throws if the write fails, and that is the point: a toggle
+      // that reported success while persisting nothing would be the original bug
+      // with better manners. The read path (refreshOverrides) is failure-tolerant;
+      // the write path deliberately is not.
+      const resolvedSet = await setOverride(key, enabled, { builderId: req.builder && req.builder.id });
+      const effective = resolvedSet ? resolvedSet[key] === true : enabled;
 
       console.log(`[gds] module "${key}" ${enabled ? 'enabled' : 'disabled'} by builder ${req.builder && req.builder.id}`);
-      res.json({ ok: true, key, enabled, note: 'Live on this box now. Persisting past the next deploy needs config/modules.json committed.' });
+      res.json({
+        ok: true,
+        key,
+        enabled,
+        // What the module ACTUALLY resolved to, which is not always what was asked:
+        // an env override or the spend guard outranks this write, and an operator
+        // who is not told so will re-click the toggle and blame the feature.
+        effective,
+        source: (resolvedSet && resolvedSet.sources && resolvedSet.sources[key]) || 'override',
+        note: effective === enabled
+          ? 'Live on this box now, and durable — it survives the next deploy.'
+          : `Recorded, but "${key}" still resolves to ${effective}: a higher-precedence layer (env, or the spend guard) is winning.`,
+      });
     }));
 
   // POST /api/bongos/modules/:key/submit — ADR 0107 §1 upstreaming submission.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.882'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.883'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');