@bongos/core 1.20.78 → 1.20.80

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.78",
-  "core_contract": "1.20.78",
-  "source_commit": "54fe45a4edf4789308fc09a05904110b20b555ff",
+  "core_version": "1.20.80",
+  "core_contract": "1.20.80",
+  "source_commit": "2d9219d9d076b61f42d6fab1bd14c09a0ad44977",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T20:43:40.208Z",
+  "built_at": "2026-10-01T21:17:56.014Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 575,
+    "docs_redacted": 576,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2811,
+    "functional_verbatim": 2817,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3414,
-  "tree_sha256": "f7d14f92e9dd084e4959190624762c8a22148f6700e48f0ef079e9988a92a5dc",
+  "file_count": 3421,
+  "tree_sha256": "930db69afea73a2acf5a2e95947d339e87f00d05026959754cbdbcb7f27d4ac4",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "63c9cef50cf602cac2c7b7cb24c878acd07d11d1c4354ef68d75987b9ecae150"
+      "sha256": "3b5c17644e042b58fa061e1981a0fd234b1868d25551002214d65716f8ced6ea"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "bb9b35d76798248f6e711f5b95af076cac45b1cc373ca02733aad95d3990db27"
+      "sha256": "2afaea5660bc6dea5cadae88b68b2b52cb088243da2b186d2ab09c660fd5cafb"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "89eda37c197dc32fea981b5f07bc6aaafffe67d902117ca212231dd13bef1913"
+      "sha256": "955eaa24cf1955927a3462657e9d46ca8f27b3ab14864cff794d671e52c3c19d"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "c71b82943cd6bd76f0740f6da9b44a212a3a4da3f7d7ccdc4d4c6d6e10d20802"
+      "sha256": "ad8dd5de9ff6a167f6695b5bf59e7e3fb4276f33e76a505322b907330a056ec9"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "2beca96b15c5ac7a97553c3bfd0757bf8c3ec449cc72db760cc8840f2ef68c54"
+      "sha256": "47c75a5b49baf0a5249c2d56371046b344110011463bf70b6bf643868a53ab39"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1247,7 +1247,7 @@
     {
       "path": "docs/adr/0161-publish-on-merge.md",
       "mode": "0000644",
-      "sha256": "c3da608c2b3d17ceb9208abfadd8ed218654fcc67cc545528683da8a624834a0"
+      "sha256": "25cf413de867af3aa480452339dd11ac449c0add97717bf16b8699cee3f25d1c"
     },
     {
       "path": "docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md",
@@ -2264,20 +2264,25 @@
       "mode": "0000644",
       "sha256": "f1f9153e7975f30d7a2e53f31c3bacb15a270affb9c1b119930aa0104e55c4e6"
     },
+    {
+      "path": "docs/adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md",
+      "mode": "0000644",
+      "sha256": "b78abd9c3aa4badc6a5631e55e00f76fbcdeabc603b7f1885839fe1b8d533dac"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "504490989f3f23ff00e970f7da9a6b046a7ba94b415c9114d83d660885750c0e"
+      "sha256": "88cd773536fd1397ae3b1b0f262d5c291b8762b6203c1dc1430b13e498a40311"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "c3b52f2ed9dce5b5bf72b8addc90293816837696ae06742e91e5d32ea69f5988"
+      "sha256": "1590ef5cd06ec79bb3ee7de0d113bafe11e194add5d8d452f1970cb563eb3c9c"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "94478baadf36dbd303c05548ed6d0a2ff20c1804848602aecfb148b506aa456d"
+      "sha256": "16a216722d0e6f9c6b5e89f4c15a171e97f2924ad662adf1117d607ec1895ae5"
     },
     {
       "path": "docs/architecture.md",
@@ -2812,7 +2817,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2b7d697f9a5870c16de63e84268ee995f0c1ef7aedc825cf1d7610559744677d"
+      "sha256": "f538bffbc4e360ec61b27185b921972f32880c678f8b583a9ab2eeb134119e0d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3012,7 +3017,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "0125fca7ef4c910f87a03e20ccfb06ae8a81cf5ebc8f9821e4bc3e8a8d0a7ea1"
+      "sha256": "2a5cc6de16fc8ecf3539fda190cdfe3a2883e9edc6209084f950566c1999d814"
     },
     {
       "path": "docs/recipes/redteam-patrol.md",
@@ -3067,7 +3072,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "d28d1f034a7a87164b780c7320ef36809a024bdd29e1e31a1b9e8e17bb911f49"
+      "sha256": "db22c5d184e2eccffaca9ee17af76c3c716366fede40dc445001b213a0f3df4b"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -6832,7 +6837,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "4eaad6ef027c1e2f3baa2d589a963e721d1f4c20201ed003e412953ea570ee8e"
+      "sha256": "d69e5c920cc0d32d81190ea8031556df8f48074807cd6661b5e380ebcd672ca1"
     },
     {
       "path": "modules/lifecycle/page-tweak-approve.js",
@@ -6982,7 +6987,7 @@
     {
       "path": "modules/lifecycle/routes/lifecycle.js",
       "mode": "0000644",
-      "sha256": "ddf0d0dd41ac412b7e82a541793f6cf182ef9063c91e541bb71a89a37b5a699e"
+      "sha256": "7f4bc68875ba58aa5cfeae08fc7a7bffd4fbd42f0b6ce6489a70b96cdbc2272d"
     },
     {
       "path": "modules/lifecycle/routes/mingle.js",
@@ -7114,6 +7119,11 @@
       "mode": "0000644",
       "sha256": "10de74d2e44e3027932ace7d47238f48009ce79f73ba8d3aeb610b911afe4dcd"
     },
+    {
+      "path": "modules/lifecycle/workflow-dispatch.js",
+      "mode": "0000644",
+      "sha256": "33bf8630ec7b77f1f505f30e53cd0b000f37d9c4bafb8bcd4d4425425de1a6d1"
+    },
     {
       "path": "modules/memory/CLAUDE.md",
       "mode": "0000644",
@@ -7167,7 +7177,7 @@
     {
       "path": "modules/npm-release/module.json",
       "mode": "0000644",
-      "sha256": "ede907b6b579c3213eaf45d12320a8765aebaa11adc9b534e9402271c5eb39f7"
+      "sha256": "86e060e53371276912857f975de81c94cb2566d14bcdbbdc402f27c1a65fcb3f"
     },
     {
       "path": "modules/npm-release/preview/childlog.js",
@@ -7217,13 +7227,23 @@
     {
       "path": "modules/npm-release/public/work.js",
       "mode": "0000644",
-      "sha256": "73b94334328ea385ddb06090d1a2363b0878ca7be48072ea1361ae279022177e"
+      "sha256": "ffba0707b82310100355183efe16fbd2e51f99bafd26e9b9a41deece210dc31d"
+    },
+    {
+      "path": "modules/npm-release/release.js",
+      "mode": "0000644",
+      "sha256": "f47a649af323b234795ce243777f009dc6677f92fcbd6ad6d9cccd6f8c9c4426"
     },
     {
       "path": "modules/npm-release/routes/preview.js",
       "mode": "0000644",
       "sha256": "bb2d1b5db4a13949d69177ad10bdd9d4a3e6ad77710317317e764358bc150551"
     },
+    {
+      "path": "modules/npm-release/routes/release.js",
+      "mode": "0000644",
+      "sha256": "8f8fa94eafbe428628da850f62e19b845b2098df5392d9028e6e5d30b51c3a56"
+    },
     {
       "path": "modules/npm-release/routes/task-where.js",
       "mode": "0000644",
@@ -7237,7 +7257,7 @@
     {
       "path": "modules/npm-release/work.js",
       "mode": "0000644",
-      "sha256": "5c38191935584b8a500b432ea913b4429a72a6c03277a1ff3e8fee4b5ab0a7f6"
+      "sha256": "c5b1c300c217e8c74c6c7edea367e76cb12029029f5f9c8d9cac3a92b72764bf"
     },
     {
       "path": "modules/onboarding/CLAUDE.md",
@@ -8062,7 +8082,7 @@
     {
       "path": "modules/provisioning/render-standup.js",
       "mode": "0000644",
-      "sha256": "e1ace20074d6bcb25cc457b240512925ed5b7d4cc931633082d262067fce9f8a"
+      "sha256": "51c00d712c515978cdffcde9ae2c6a170c96be931937a10d557b56de553baf67"
     },
     {
       "path": "modules/provisioning/repo-private.js",
@@ -9492,12 +9512,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f8da6c11ec17d4c4a83d5e070d3ae0c941376a527b4a9a0be7ce1903d7beb482"
+      "sha256": "65547dec9e40ab38b66301306ef0b723471fe9d66091e5fdc2bcd95985396332"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8dfe3adc1e608279f3ffee6a8cdfd3c7c32b7581395ea81bb000dc370afe0035"
+      "sha256": "5054d061aed2bf2fd2b4e1f53740d8eff0afd8376099a009b1fe34c497405565"
     },
     {
       "path": "public-docs/index.html",
@@ -9517,7 +9537,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "e70c626913df104cf096a75eb4b06ff9cabcddda470e063839a4fffd26e78407"
+      "sha256": "6cd499f6303a23c1605494af3f5ef2f3a2e934fc80b5494f952c10f88db7b841"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10242,7 +10262,7 @@
     {
       "path": "scripts/gds/init.js",
       "mode": "0000644",
-      "sha256": "14c21f1640f81fa039c59a49acb0155e5fa6eb4eb177e845ceec1f88bc067528"
+      "sha256": "f9e77db85aa1ec20f55f0e96cade7c2977863d21a4c148407deb965b436bfdc3"
     },
     {
       "path": "scripts/gds/install-git-hooks.js",
@@ -10517,7 +10537,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "1f63f4b896a235f6c4efc4889d8b94aba4118ab2d7e702d637fd3642f9de1ccc"
+      "sha256": "1804ffb4da2732babbb955ef526a7c25b8da6a2acb8c50fac164b4b0d88a04e3"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -10634,6 +10654,11 @@
       "mode": "0000644",
       "sha256": "719bbb22e46ab948bb0c82c3818d69c3ed5324abf4d904270206a93872ffca39"
     },
+    {
+      "path": "scripts/gds/release-core.js",
+      "mode": "0000644",
+      "sha256": "d39109329da8c93910935318bf76f791b0a2c266ff1da769deaa20515eaaf30f"
+    },
     {
       "path": "scripts/gds/release-notes.js",
       "mode": "0000644",
@@ -11172,7 +11197,7 @@
     {
       "path": "scripts/gds/update-channel.js",
       "mode": "0000644",
-      "sha256": "0168e8482e02d74ef59aa53f4874be6ec41e91747651a99009b56b764137bf0c"
+      "sha256": "f6b0d78ff92c9962b158bc5b36bae021c63fcc24095c7b10866f1505ee3f5232"
     },
     {
       "path": "scripts/gds/update-sweep.js",
@@ -11392,7 +11417,7 @@
     {
       "path": "src/bongos/core-update.js",
       "mode": "0000644",
-      "sha256": "27630af327d56e6eea77eb7e402086ec695f9fd02f419e48af463ed1adbfab8c"
+      "sha256": "9fa4053f230b9ee08a1b8a898256fde60814db0cc079f86f11d5e06fc70921e0"
     },
     {
       "path": "src/bongos/craft-mode.js",
@@ -11712,7 +11737,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f11189e9084e5a2b10a2767bfa8166a419fbd202e90252a628a1fc426f7102f9"
+      "sha256": "6dbb388b1873983917f182cc7220fcee056c3a1f1f07810cdb635870fe2c3f4c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12672,7 +12697,7 @@
     {
       "path": "tests/core_update_banner.mjs",
       "mode": "0000644",
-      "sha256": "f3730a99e55845f6cf03789c364c78cdf2a6cf8aa6ae2f639041c14ea3f28864"
+      "sha256": "0e09c40e79de4e1bd50c9f19651f3884838fbb5d87f48601f52793bb0dc89d06"
     },
     {
       "path": "tests/core_upgrade_door.mjs",
@@ -12687,7 +12712,7 @@
     {
       "path": "tests/core_upgrade_runner.mjs",
       "mode": "0000644",
-      "sha256": "756ddbafdf6e1d116c6984a989154c24cdbfb927572b71dc2b9dab27f82b2dab"
+      "sha256": "aa5189d9988633d0529a50844ea31c9aabb825b7a1292fbe295f48a4ef452a6e"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -14367,7 +14392,7 @@
     {
       "path": "tests/init.mjs",
       "mode": "0000644",
-      "sha256": "376da89565a6ad32788029406163bc6b5198e3279e07645256550747ec1b728a"
+      "sha256": "6549706010a545b9d387d8e3f4f4a157a5088c4292dbc288e3e7fc27f5335ead"
     },
     {
       "path": "tests/instance_config.mjs",
@@ -15004,6 +15029,11 @@
       "mode": "0000644",
       "sha256": "f326bc26e3b137dc8e17a22beeb08861181d35dc881ec1762e05377b9d9430e7"
     },
+    {
+      "path": "tests/npm_release_release.mjs",
+      "mode": "0000644",
+      "sha256": "91df29bc16dc2386da58224f5d199daef545f566f40ef90eb2f957bf8a9dded3"
+    },
     {
       "path": "tests/npm_release_where.mjs",
       "mode": "0000644",
@@ -15834,6 +15864,11 @@
       "mode": "0000644",
       "sha256": "ad53ec7d4b4002f8b349a47021081943ce74454ffd576bb91564f3b991afcbd7"
     },
+    {
+      "path": "tests/release_core.mjs",
+      "mode": "0000644",
+      "sha256": "1496a141ce8ad3c8c5186fc165a7d0c0642dd197d9b9f74386fd73313e176f81"
+    },
     {
       "path": "tests/release_notes.mjs",
       "mode": "0000644",
@@ -16862,7 +16897,7 @@
     {
       "path": "tests/update_channel.mjs",
       "mode": "0000644",
-      "sha256": "2ceed0b397697a39ee2ee46f5fed7a0e659d1f18364369d510d6b64704d99f59"
+      "sha256": "3b8edcf4d340315784594ff984b8fb165632ac6fe3b7b4ef9ab841ab6fe7e228"
     },
     {
       "path": "tests/update_channel_db.mjs",
@@ -16892,7 +16927,7 @@
     {
       "path": "tests/upgrade_migrate.mjs",
       "mode": "0000644",
-      "sha256": "d3f5b941b89ede78ebb3cd7af43467363e5d6c6d35c7ad26a2977683ecf869e7"
+      "sha256": "47048521bb37c9debc02ef5c366bfe863450eb944023cce60ba182b9640563ee"
     },
     {
       "path": "tests/upgrade_outcome.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 489 operations across 73 resource groups
+- 490 operations across 73 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -779,6 +779,8 @@ function createClient(opts = {}) {
       getNpmReleasePreviewEnter: (args) => request("GET", "/npm-release/preview/enter", { hasBody: false }, args),
       // GET /npm-release/preview/exit — rank: any-builder — GET /npm-release/preview/exit
       getNpmReleasePreviewExit: (args) => request("GET", "/npm-release/preview/exit", { hasBody: false }, args),
+      // POST /npm-release/release — rank: archon — POST /npm-release/release
+      postNpmReleaseRelease: (args) => request("POST", "/npm-release/release", { hasBody: true }, args),
       // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
       getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work

package/clients/bongos-client/index.cjs

@@ -778,6 +778,8 @@ function createClient(opts = {}) {
       getNpmReleasePreviewEnter: (args) => request("GET", "/npm-release/preview/enter", { hasBody: false }, args),
       // GET /npm-release/preview/exit — rank: any-builder — GET /npm-release/preview/exit
       getNpmReleasePreviewExit: (args) => request("GET", "/npm-release/preview/exit", { hasBody: false }, args),
+      // POST /npm-release/release — rank: archon — POST /npm-release/release
+      postNpmReleaseRelease: (args) => request("POST", "/npm-release/release", { hasBody: true }, args),
       // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
       getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work

package/clients/bongos-client/index.d.ts

@@ -401,6 +401,7 @@ export interface PostMyProjectsInvitesClientIdDeclineResponse { ok: boolean; acc
 export interface PostMyProjectsJoinRequest { origin: string; note?: string }
 export interface PostMyProjectsJoinResponse { ok: boolean; status: unknown; project: unknown; message: unknown }
 export interface PostNpmReleasePreviewRequest { version: string }
+export interface PostNpmReleaseReleaseRequest { version: string }
 export interface PostOverrideRequestsIdDecideRequest { decision: string; note?: string }
 export interface PostProjectsInviteRequest { client_id: string; github_login: string }
 export interface PostProjectsInviteResponse { invited: boolean; invite_url: unknown }
@@ -1231,6 +1232,8 @@ export interface BongosClient {
     getNpmReleasePreviewEnter(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /npm-release/preview/exit — rank: any-builder */
     getNpmReleasePreviewExit(args?: RequestArgs): Promise<ApiResponse>;
+    /** POST /npm-release/release — rank: archon */
+    postNpmReleaseRelease(args: RequestArgs & { body: PostNpmReleaseReleaseRequest }): Promise<ApiResponse>;
     /** GET /npm-release/task/{id} — rank: any-builder */
     getNpmReleaseTaskId(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /npm-release/work — rank: archon */

package/clients/bongos-client/index.mjs

@@ -775,6 +775,8 @@ export function createClient(opts = {}) {
       getNpmReleasePreviewEnter: (args) => request("GET", "/npm-release/preview/enter", { hasBody: false }, args),
       // GET /npm-release/preview/exit — rank: any-builder — GET /npm-release/preview/exit
       getNpmReleasePreviewExit: (args) => request("GET", "/npm-release/preview/exit", { hasBody: false }, args),
+      // POST /npm-release/release — rank: archon — POST /npm-release/release
+      postNpmReleaseRelease: (args) => request("POST", "/npm-release/release", { hasBody: true }, args),
       // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
       getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work

package/docs/adr/0161-publish-on-merge.md

@@ -1,6 +1,6 @@
 # 0161 — Publish on merge: every merge to core `main` auto-publishes `@bongos/core`
 
-- **Status:** Accepted
+- **Status:** Accepted. **Amended by [ADR 0361](0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md)** (task 1004298): merges publish as candidates under `next`; `latest` moves only on Release.
 - **Date:** 2026-08-08
 - **Deciders:** the owner (Archon), Claude. The owner chose this directly after reviewing the pipeline end-to-end: "any merge can publish, we can add in more complexity later."
 - **Task:** task 1002620 (BONGOS-V1, goal 1000024 — build-pipeline integrity)

package/docs/adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md

@@ -0,0 +1,59 @@
+# ADR 0361 — Merges publish as candidates; Release on /deploy decides what other projects are offered
+
+- **Status:** Accepted. Ships **inert**: candidates start only when the owner sets `PUBLISH_AS_CANDIDATE=1` (see *Arming*).
+- **Date:** 2026-10-01
+- **Task:** [task 1004298](https://cloudbongos.com/builders#/task/1004298) (goal 1000090 — BONGOS-V2), split out of [task 1002622](https://cloudbongos.com/builders#/task/1002622) §3.
+- **Deciders:** the owner. Decisions of 2026-09-25/26: nothing reaches other projects until it is released, **patches included**; the button belongs to the `npm-release` module.
+- **Amends:** [ADR 0161](0161-publish-on-merge.md) (publish on merge). Every merge still publishes; it no longer becomes what every project is offered.
+- **Builds on:** [ADR 0360](0360-bongos-follows-every-candidate-every-other-project-follows-releases.md) (the per-instance follow), [ADR 0136](0136-update-channel-subscription-policy.md) (channels).
+
+## Context
+
+Under ADR 0161 every merge to core `main` publishes a new `@bongos/core` under npm's `latest` label, and every consumer read "newest on npm" as "what you may move to". So a merge was a release to every project, minutes after it landed, with no point at which the owner said yes.
+
+ADR 0360 gave each instance a **follow**: `released` (at or below `latest`) or `candidates` (every version). Until now the two picked the same target, because `latest` was always the newest version.
+
+## Decision
+
+### D1 — Merges publish under `next`
+
+`publish.yml` publishes with `--tag next` when the repository variable `PUBLISH_AS_CANDIDATE=1`. The version is on npm, installable by exact number, and `latest` does not move. Unset, the lane publishes under `latest` exactly as before. That is what lets this change land without changing anything.
+
+### D2 — Release moves `latest`, in GitHub
+
+Release is a second job in `publish.yml` (`release`, on `workflow_dispatch` with `release_version`). It asks `scripts/gds/release-core.js` whether the version may be released, then runs `npm dist-tag add @bongos/core@<v> latest`.
+
+- **The version must be published, stable, and newer than the current release.** An older version would move every project's offer backwards. That is a rollback for everyone, and it stays a terminal act. Releasing the current release again is a no-op.
+- **It lives in `publish.yml`, not a new file.** npm's trusted publisher for `@bongos/core` names `publish.yml`. Since 2026-09-30 the same OIDC identity can move dist-tags once "Allow npm dist-tag" is ticked on that entry. A separate file would need a second trusted-publisher entry or a long-lived token, and this lane was built to be rid of the token (task 1003202).
+- **The version reaches the shell through `env`**, never `${{ }}` inside a script, and is refused unless it is `x.y.z`.
+
+### D3 — The button starts the job; the server never holds an npm credential
+
+`POST /api/bongos/npm-release/release` (`core.pin.move`, the deploy page's own atom) dispatches the release job through GitHub's API. The GitHub credential is the server's existing GitHub App; the call reaches it through a one-function port, `lifecycle.workflowDispatch`. The `npm-release` module can start a workflow and do nothing else with that credential. The route applies `releaseDecision` first, the same function the job applies again. So the button cannot promise what the job would refuse, and the job remains the gate.
+
+### D4 — The button shows the evidence
+
+The deploy page's **Release** section lists the versions this hall runs that are not released, newest first. Each shows how long it has run on this hall and whether a move to it was ever rolled back here, from the `core_upgrades` ledger. Release covers a whole version: everything merged up to it.
+
+### D5 — Every consumer offers only what is released
+
+- The update sweep (ADR 0360) already follows `released` by default.
+- The "update available" banner (`src/bongos/core-update.js`) offers versions at or below `latest`, read from the same packument. With no readable label it has no answer.
+- The platform's upgrade runner for hosted projects (`scripts/gds/provision-core-upgrade.js`) offers a project the versions its follow admits. The follow comes from its hosting shape: the `control-plane` row is the platform hall and takes candidates; every other shape takes releases (`followForShape`). It is derived, not a column, because there is exactly one platform hall. A column someone could set on a tenant would be one more way to hand a project an unreleased version.
+
+## Arming (owner steps, in this order)
+
+1. **Platform hall follows candidates.** On the control plane, set the platform's entry in `config/update-subscriptions.json` to `"follow": "candidates"` (ADR 0360). Otherwise, once D1 is on, cloudbongos.com stops updating itself.
+2. **npm:** on npmjs.com → `@bongos/core` → Settings → Trusted publishing, tick **Allow npm dist-tag** on the `publish.yml` entry.
+3. **GitHub App:** give the server's GitHub App **Actions: Read and write** on this repository, and accept the permission change on the installation.
+4. **Switch on:** set the repository Actions variable `PUBLISH_AS_CANDIDATE=1`.
+
+Until step 4, every version this hall runs is already `latest`, so the Release section reads "Nothing is waiting" and nothing else changes. A press made before steps 2–3 fails with the reason (no dist-tag permission, or the App lacks Actions: write) and moves nothing.
+
+## Consequences
+
+- Other projects stop receiving merges the moment step 4 is done. They receive the next version the owner releases, and everything merged before it.
+- The deploy page's "Running here, not released" stage fills between merges and a Release, and empties after one.
+- A version can be released only after this hall has run it, because the candidate list stops at the live version. The evidence is real, not inferred.
+- **Rejected:** a long-lived npm token in a separate release workflow (the risk task 1003202 removed). Choosing "released" by a git tag or a file in the repo (every instance already reads npm, and a second source of truth would drift). A per-instance follow column (D5).
+- **Proof:** `tests/release_core.mjs` (the rule and the workflow wiring), `tests/npm_release_release.mjs` (evidence, the press, the GitHub call, the route gate), `tests/core_update_banner.mjs` (only released versions offered), `tests/core_upgrade_runner.mjs` (the platform hall takes a candidate; a tenant is refused one), `tests/update_channel.mjs` (`followForShape`).

package/docs/adr/README.md

@@ -479,3 +479,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0358 | [**A hall wears a look, and its night takes a tint of it** ([task 1004421](https://cloudbongos.com/builders#/task/1004421), goal 1000121 — BV2.PS06; owner D2 + D8, 2026-09-30). Amends [ADR 0219](0219-a-look-is-a-branding-pack-the-style-library.md) (a look could not carry a dark ground) and DESIGN.md's pure-black rule, for halls only. **D1:** the night tint is a formula over the thirteen — the four dark grounds take 5–6% of the look's accent (src/night-tint.js), emitted after the sheet as both dark twins; no token added. **D2:** on by default, and only a chosen look turns it on — a hall with no look is unchanged. **D3:** the apex and hub stay pure black (ADR 0204). **D4:** a custom look is ONE accent for both modes, its lightness nudged until every pair the hall paints with it reads (lookAdjustAccent, client copy test-pinned). **D5:** look + night_tint join the provisioning settings vocabulary; the accent and logo address ride as companion env; the instance resolves the look from the style library. **D6:** a logo is PNG/JPEG/WebP ≤256 KB, magic-sniffed, never SVG, served content-addressed; it is the hall mark and the favicon. Rejected: per-look dark palettes, two custom accents, refusing an unreadable accent, sending the palette over env.](0358-a-hall-wears-a-look-and-its-night-takes-a-tint.md) | hall / branding / design world |
 | 0359 | [**Nobody sets a module's score by hand; a Metic+ person can ask for a re-check** ([task 1003796](https://cloudbongos.com/builders#/task/1003796) · goal 1000091, criterion `wa5-quality-assessed`). Amends [ADR 0343](0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md) D6 and [ADR 0347](0347-every-store-module-ships-a-how-to.md) D5 on the owner's ruling: there is no score override. A score only ever comes from its signals. Instead `POST /store/modules/:key/versions/:version/reassess { reason }`, gated by the new `module.assessment.rerun` atom (metic floor, granted to metic + archon by `government_021`), queues the same assessment a publish runs. A reason is required and nothing else is accepted. The delist (task 1003797) is unchanged.](0359-nobody-sets-a-module-score-by-hand-metic-can-ask-for-a-re-check.md) | module store / assessment / permissions |
 | 0360 | [**Bongos follows every candidate; every other project follows releases** ([task 1004297](https://cloudbongos.com/builders#/task/1004297), goal 1000090 — the owner's 2026-09-26 decision that the Bongos hall takes every candidate automatically). Amends ADR 0136. **D1:** a per-instance `follow` beside the channel — `released` (default: at or below the registry's `latest` label) or `candidates` (every version, the platform hall only). **D2:** released is the `latest` dist-tag, read separately; an unreadable label skips the instance, never a guess. **D3:** the timer period is the lag — 15 min declared, installed by task 1003969. **D4:** a version that failed here is held for a day per instance (recorded in the sweep's config home), while any newer version is taken at once — no restart loop at a 15-minute cadence. **D5:** the deploy page's "Upgrades on this hall" — the core_upgrades ledger, rollbacks flagged, and a published version waiting past 30 min said to be the automation stopping. Rejected: a second runner, CI pushing to the box, a hold only a human clears.](0360-bongos-follows-every-candidate-every-other-project-follows-releases.md) | update channel / deploy / core update |
+| 0361 | [**Merges publish as candidates; Release on /deploy decides what other projects are offered** ([task 1004298](https://cloudbongos.com/builders#/task/1004298), goal 1000090). Amends ADR 0161. **D1:** merges publish under `next` when `PUBLISH_AS_CANDIDATE=1` (ships inert). **D2:** a `release` job in publish.yml moves `latest` (release-core.js: published, stable, newer than the release) over the same OIDC trusted publisher — no npm token. **D3:** /deploy's Release button (`core.pin.move`) dispatches it through the one-function `lifecycle.workflowDispatch` port. **D4:** evidence beside each button — hours on this hall, ever rolled back. **D5:** the banner and the hosted-project runner offer only released versions; the control-plane row follows candidates. Arming: roster follow → npm dist-tag permission → App Actions: write → the variable.](0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md) | publish / release / update channel |

package/docs/api/openapi.json

@@ -14113,6 +14113,51 @@
         ]
       }
     },
+    "/npm-release/release": {
+      "post": {
+        "operationId": "post_npm_release_release",
+        "tags": [
+          "npm-release"
+        ],
+        "summary": "POST /npm-release/release",
+        "description": "**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/npm-release/routes/release.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostNpmReleaseReleaseRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/npm-release/task/{id}": {
       "get": {
         "operationId": "get_npm_release_task_id",
@@ -28893,6 +28938,19 @@
         ],
         "additionalProperties": false
       },
+      "PostNpmReleaseReleaseRequest": {
+        "type": "object",
+        "properties": {
+          "version": {
+            "type": "string",
+            "maxLength": 32
+          }
+        },
+        "required": [
+          "version"
+        ],
+        "additionalProperties": false
+      },
       "PostOverrideRequestsIdDecideRequest": {
         "type": "object",
         "properties": {
@@ -31293,8 +31351,8 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 489,
-  "x-schema-count": 519,
+  "x-endpoint-count": 490,
+  "x-schema-count": 520,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 347,
   "x-generated-by": "scripts/gds/gen-api-docs.js"

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 489 endpoints across 90 route files.
+> **Generated from the live route files** — the route file is authoritative. 490 endpoints across 91 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -545,7 +545,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/my-projects/invites/:clientId/decline` | `any-builder` | — | decline an invite (delete the pending row) for the caller's OWN account. |
 | POST | `/api/bongos/my-projects/join` | `any-builder` | `origin`, `note` | request to join a project. |
 
-## `npm-release` (7)
+## `npm-release` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -554,6 +554,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | DELETE | `/api/bongos/npm-release/preview` | `any-builder` | — |  |
 | GET | `/api/bongos/npm-release/preview/enter` | `any-builder` | — |  |
 | GET | `/api/bongos/npm-release/preview/exit` | `any-builder` | — |  |
+| POST | `/api/bongos/npm-release/release` | `archon` | `version` |  |
 | GET | `/api/bongos/npm-release/task/:id` | `any-builder` | — |  |
 | GET | `/api/bongos/npm-release/work` | `archon` | — | Query: days (ledger window, default 14, max 60), before + limit (history paging). |
 

package/docs/module-api-changelog.md

@@ -2813,5 +2813,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.76 with no explicit bump. run 36909904812. (task 1002620)
   1.20.78 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.77 with no explicit bump. run 36923602676. (task 1002620)
+  1.20.79 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.78 with no explicit bump. run 36924822923. (task 1002620)
+  1.20.80 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.79 with no explicit bump. run 36927627121. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/private-npm-distribution.md

@@ -57,6 +57,8 @@ npm publish ./clients/bongos-client               # real (publishConfig makes it
 
 **Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check and waits for the `integration` lane's verdict on the commit it releases (task 1004290), auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it: repo variable `PUBLISH_ON_MERGE=1`, a **trusted publisher** registered on npmjs.com for `@bongos/core` naming this repo + `publish.yml`, and the secret `RELEASE_PUSH_TOKEN` (contents:write, for the bump commit). There is deliberately **no** `NPM_TOKEN` — the lane authenticates by OIDC, and the workflow sets neither `NPM_TOKEN` nor `NODE_AUTH_TOKEN` because either one would send npm down the legacy token path and skip the OIDC exchange entirely. A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
 
+**Candidates and Release** ([ADR 0361](../adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md), task 1004298). With the repo variable `PUBLISH_AS_CANDIDATE=1`, each merge publishes under the `next` label: the platform hall runs it, and no other project is offered it. **Release** on /deploy runs `publish.yml`'s `release` job (`workflow_dispatch`, input `release_version`), which moves `latest` to that version over the same OIDC trusted publisher. It needs **Allow npm dist-tag** ticked on the `publish.yml` trusted-publisher entry, and the server's GitHub App needs **Actions: write** to start the job. From a terminal the same job runs as `gh workflow run publish.yml -f release_version=<x.y.z>`. The arming order is in the ADR.
+
 The steps below remain as the **manual fallback** (lane disarmed, npm outage, or a deliberate out-of-band release):
 
 1. **Bump `CORE_VERSION`** in [`src/module-api.js`](../../src/module-api.js) (semver; a **patch** for a fix, **minor** for additive surface — a **major** is a deliberate, human-only event) and append an entry to the release ledger [`docs/module-api-changelog.md`](../module-api-changelog.md) in the same commit ([ADR 0203](../adr/0203-doorway-changelog-out-of-module-api.md) moved that ledger out of `module-api.js`). This bump is a normal claimed task, not a release-tool side effect — the version's provenance stays in the git history + ledger.