@bongos/core 1.21.156 → 1.21.157

package/modules/government/catalog.js

@@ -223,7 +223,7 @@ const PERMISSIONS = [
   { key: 'goal.create', system: false, floor: 'metic', guards: 'POST /goals (protected scope → Archon in-handler; ADR 0086)' },
   { key: 'goal.archive', system: false, floor: 'metic', guards: 'POST /goals/:id/{archive,reopen}' },
   { key: 'goal.scope.widen', system: false, floor: 'metic', guards: 'POST /goals/:id/scope (same-tier; cross-tier = goal.scope.manage, system)' },
-  { key: 'module.enable', system: false, floor: 'metic', guards: 'POST /modules/:key/enable' },
+  { key: 'module.enable', system: false, floor: 'metic', guards: 'POST /modules/:key/enable, POST /modules/testing and POST /modules/:key/general-only (whether this project tests new module versions first, and which modules it keeps on general — task 1003802, ADR 0344 D1)' },
   { key: 'module.submit', system: false, floor: 'metic', guards: 'POST /modules/:key/submit, GET /modules/submissions' },
   // Re-run a store version's automatic assessment (task 1003796, ADR 0359). Never a
   // hand-set score: the owner ruled a person may ask for a re-check, not change the number.

package/modules/hall-ui/public/modules.html

@@ -74,6 +74,17 @@
             <p class="ov-foot" id="submit-lede">A module built here can be submitted upstream for review, so it can join the shared catalog with your name and this project credited.</p>
           </div>
 
+          <!-- Testing new versions (task 1003802, ADR 0344 D1): the PROJECT opts in,
+               once, by its admin; a module can be kept on general versions from its
+               own details. Hidden until GET /modules/testing answers. -->
+          <div class="ov-group" id="testing-group" hidden>
+            <div class="ov-group__head">
+              <span class="ov-group__name">Testing new versions</span>
+            </div>
+            <ul class="ov-rows" id="testing-grid"></ul>
+            <p class="ov-foot" id="testing-lede">A testing project gets each new version of its modules before everyone else, and what it finds feeds the module's score. It is never switched on for you. To keep one module on the versions everyone gets, open its details.</p>
+          </div>
+
           <!-- In the store — what GET /store/modules lists, each with what it is
                strong and weak at (task 1003799, ADR 0343 D4), so two modules with
                the same score can be told apart. Hidden until the store answers

package/modules/hall-ui/public/modules.js

@@ -171,9 +171,108 @@
     if (mt.removeAfter) line('removable after core', `<span class="ov-mono">${escapeHtml(String(mt.removeAfter))}</span>`);
     if (mt.note) line('note', escapeHtml(String(mt.note)));
     if (m.default != null) line('ships', m.default ? 'default on' : 'default off');
+    const versions = testingLine(m);
+    if (versions) line('new versions', versions);
     return lines.length ? `<ul class="ov-lines">${lines.join('')}</ul>` : '';
   }
 
+  // ---- testing new versions (task 1003802, ADR 0344 D1) ----
+  //
+  // GET /modules/testing says whether this project tests new versions first and
+  // which modules it keeps on general. The server owns the answer; the page shows
+  // it and sends the two switches, which take the same permission as the
+  // enable toggle (canToggle mirrors it, the server decides).
+  let testing = null;
+
+  function generalOnly(key) {
+    return !!(testing && Array.isArray(testing.general_only) && testing.general_only.includes(key));
+  }
+
+  // One module's line in its details: only while the project is testing.
+  function testingLine(m) {
+    if (!testing || !testing.tester) return '';
+    const kept = generalOnly(m.key);
+    const says = kept ? 'kept on the versions everyone gets' : 'gets new versions first';
+    if (!canToggle) return escapeHtml(says);
+    return `${escapeHtml(says)} <button type="button" class="btn-ghost btn--sm mod-general-only" data-key="${escapeHtml(m.key)}" data-on="${kept ? 'false' : 'true'}">${kept ? 'test new versions' : 'keep on general versions'}</button>`;
+  }
+
+  function testingRowHTML() {
+    const on = !!testing.tester;
+    const kept = (testing.general_only || [])
+      .map((k) => (allModules.find((m) => m.key === k) || {}).title || k);
+    const facts = [on
+      ? '<span class="fact-pill fact-pill--info">testing</span>'
+      : '<span class="ov-fact">not testing</span>'];
+    if (on && kept.length) facts.push(`<span class="ov-fact">kept on general: ${kept.map((t) => escapeHtml(t)).join(', ')}</span>`);
+    const control = canToggle
+      ? `<button type="button" class="ov-toggle mod-testing" aria-pressed="${on ? 'true' : 'false'}">${on ? 'on' : 'off'}</button>`
+      : `<span class="fact-pill ${on ? 'fact-pill--ok' : ''}" title="${escapeHtml(floor())} and above can switch this">${on ? 'on' : 'off'}</span>`;
+    return `
+      <li class="ov-row mod-row" data-key="testing">
+        <div class="ov-row__main">
+          <span class="ov-row__title">This project tests new versions first</span>
+          <div class="ov-row__facts">${facts.join('')}</div>
+        </div>
+        <div class="ov-row__right mod-row__right">${control}</div>
+      </li>`;
+  }
+
+  function renderTesting() {
+    const group = $('#testing-group');
+    const grid = $('#testing-grid');
+    if (!group || !grid || !testing) return;
+    group.hidden = false;
+    grid.innerHTML = testingRowHTML();
+  }
+
+  // Best-effort, like the store: a switch that cannot be read hides its group
+  // and costs nothing else on the page.
+  async function loadTesting() {
+    try {
+      const res = await api.request('GET', `${API}/modules/testing`);
+      if (!res.ok) return;
+      testing = res.data || null;
+      renderTesting();
+      renderRows();
+    } catch (err) {
+      console.error('[modules] testing switch failed to load', err);
+    }
+  }
+
+  async function postTesting(url, body, btn) {
+    btn.disabled = true;
+    try {
+      const res = await api.request('POST', url, { body });
+      const out = res.data || {};
+      if (!res.ok) throw new Error(out.message || `testing → ${res.status}`);
+      testing = { tester: !!out.tester, general_only: out.general_only || [] };
+      renderTesting();
+      renderRows();
+      return out;
+    } catch (err) {
+      console.error('[modules] testing change failed', err);
+      toast(err.message || 'Could not change that.', { duration: 3200 });
+      return null;
+    } finally {
+      btn.disabled = false;
+    }
+  }
+
+  async function onTesterToggle(btn) {
+    const next = btn.getAttribute('aria-pressed') !== 'true';
+    const out = await postTesting(`${API}/modules/testing`, { tester: next }, btn);
+    if (out) toast(out.note || (next ? 'Testing is on.' : 'Testing is off.'), { duration: 4200 });
+  }
+
+  async function onGeneralOnly(btn) {
+    const key = btn.dataset.key;
+    if (!key) return;
+    const on = btn.dataset.on === 'true';
+    const out = await postTesting(`${API}/modules/${encodeURIComponent(key)}/general-only`, { general_only: on }, btn);
+    if (out) toast(on ? `${key} stays on the versions everyone gets.` : `${key} gets new versions first again.`, { duration: 3200 });
+  }
+
   // The right column: ONE control. The family's grant toggle when the viewer
   // can flip it (enabled in ink, disabled faint, the accent on hover); the
   // state as a pill when they cannot. A module built here also carries its
@@ -386,6 +485,10 @@
     panel.addEventListener('click', (ev) => {
       const toggle = ev.target.closest('.mod-toggle');
       if (toggle) { onToggle(toggle); return; }
+      const tester = ev.target.closest('.mod-testing');
+      if (tester) { onTesterToggle(tester); return; }
+      const keep = ev.target.closest('.mod-general-only');
+      if (keep) { onGeneralOnly(keep); return; }
       const submit = ev.target.closest('.mod-submit');
       if (submit) onSubmit(submit);
     });
@@ -481,6 +584,7 @@
       if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
       if (!res.ok) throw new Error(`modules → ${res.status}`);
       render(res.data);
+      loadTesting();
       loadStore();
     } catch (err) {
       console.error('[modules] failed to load', err);

package/modules/hall-ui/records/catalog.md

@@ -14,3 +14,5 @@ Also gone, and the one rule in that list: `.ab-caption` takes the lede's `--meas
 **The store's modules are a third group on the same panel, read as strengths and weaknesses (task 1003799, ADR 0343 D4).** `#store-group` ("In the store") lists what `GET /store/modules` lists, hidden until that read answers with something; it loads after the modules on disk and best-effort, so a store that cannot be read costs this group and nothing else. A row is the same `.ov-row`: the overall score as a plain fact (or the `new` info pill), `strong at Tests 96, How-to 88` as a plain fact, and `weak at …` as the warn pill, because a weakness is the exception a buyer must not miss. The sentence behind each part ("Tests scored 96 out of 100, from 40 test cases.") and the parts with no data yet sit in the row's `<details class="mod-more">`, the `splitCriterion` idea: short label in the list, the detail one click away. The reading is the server's (`readParts` in `src/bongos/module-listing.js`: strong at 80 or more, weak below the listing floor, unmeasured never weak); the page re-derives nothing. Harness fixture: `store__modules.json`.
 
 **The buyer sorts the store by the part that matters to them (task 1003800, owner decision 2026-10-22).** A "Sort by" menu sits in the store group's head (`#store-sort`, `.ov-group__note`): Name, then the parts the server lists in `sort_parts`. Picking one re-reads `GET /store/modules?sort=<part>`, and the server orders the listed modules (`sortByPart` in `src/bongos/module-listing.js`: highest for that part first, a tie to the overall score then the key, a module with no score for the part last). The page never sorts the rows itself, and New modules keep name order because they are never ranked. While a part is picked, each listed row carries that part's score as a plain fact (`Reliability 91`, or `Reliability not measured yet`), so the order explains itself. The owner chose the buyer over a per-category "key part" because nothing records what a category is for, and a hidden weighting would break the score an author can check (ADR 0343 D3).
+
+**Testing new versions is a fourth group, between this project's modules and the store (task 1003802, ADR 0344 D1).** `#testing-group` holds one `.ov-row`, "This project tests new versions first": a `testing` info pill (or the plain fact `not testing`), the modules kept on general as a plain fact, and on the right the family grant toggle (`.ov-toggle.mod-testing`) for a builder holding `module.enable`, a state pill for everyone else. It is hidden until `GET /modules/testing` answers and loads best-effort, like the store. The per-module control is not a second toggle on every row: while testing is on, each module's details gain a "new versions" line (`gets new versions first` / `kept on the versions everyone gets`) with a ghost button that flips it, so the one-control-per-row rule holds and a project that is not testing sees nothing new. The lede says it is never switched on for you, because the criterion turns on the tester having chosen it. Harness fixture: `modules__testing.json` (testing on, `economy` kept on general).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.156",
+  "version": "1.21.157",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.156",
+      "version": "1.21.157",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.156",
+  "version": "1.21.157",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9970,5 +9970,11 @@
       "id": "1004387",
       "text": "The Studio's approval-queue button now carries the artist's new label, ready for the artist to approve before it goes live."
     }
+  ],
+  "1.21.157": [
+    {
+      "id": "1003802",
+      "text": "A project can now volunteer to try new versions of its modules before everyone else, and keep any single module on the normal versions."
+    }
   ]
 }

package/src/bongos/module-testing.js

@@ -0,0 +1,73 @@
+// src/bongos/module-testing.js — whether this project tests new module versions
+// first (task 1003802, criterion wa5 staged rollout, ADR 0344 D1).
+//
+// A PROJECT opts in, once, and it is the project's own admin who does it: the
+// project is what runs the module, so no builder can volunteer someone else's
+// project. A tester project gets tester-channel versions of every module it has,
+// except the modules it marked "general only". Both choices are reversible, and
+// "willing" is load-bearing: a project is never a tester by default, and a choice
+// that cannot be read reads as NOT a tester (an early version nobody chose is an
+// early victim, not a tester).
+//
+// Storage is two project_settings rows (src/bongos/project-settings.js), the same
+// durable, survives-a-deploy store the project's other knobs use, so no new table:
+//
+//   modules.tester        'on' | 'off'              absent = off
+//   modules.general_only  JSON array of module keys  absent = []
+//
+// This file records the choice and answers it. Handing a tester project tester
+// versions is task 1003805, which asks testsVersionsOf(key).
+
+const { getSetting, setSetting, SETTING_KEYS } = require('./project-settings');
+const { KEY_RE } = require('../module-loader/manifest-schema');
+
+function parseTester(raw) {
+  return raw === 'on';
+}
+
+// A stored list that will not parse, or holds something that is not a key, keeps
+// only the keys it can read: losing a "general only" mark would hand a project an
+// early version of a module it asked to keep on general.
+function parseGeneralOnly(raw) {
+  if (raw == null) return [];
+  let list;
+  try { list = JSON.parse(raw); } catch { return []; }
+  if (!Array.isArray(list)) return [];
+  return [...new Set(list.filter((k) => typeof k === 'string' && KEY_RE.test(k)))].sort();
+}
+
+// { tester, general_only, updated_at, updated_by } — updated_* from the switch row.
+async function readTesting(deps = {}) {
+  const get = deps.getSetting || getSetting;
+  const [t, g] = await Promise.all([get(SETTING_KEYS.MODULE_TESTER), get(SETTING_KEYS.MODULE_GENERAL_ONLY)]);
+  return {
+    tester: parseTester(t && t.value),
+    general_only: parseGeneralOnly(g && g.value),
+    updated_at: t ? t.updated_at : null,
+    updated_by: t && t.updated_by != null ? String(t.updated_by) : null,
+  };
+}
+
+async function setTester(on, builderId = null, deps = {}) {
+  const set = deps.setSetting || setSetting;
+  await set(SETTING_KEYS.MODULE_TESTER, on ? 'on' : 'off', builderId);
+  return readTesting(deps);
+}
+
+async function setGeneralOnly(moduleKey, on, builderId = null, deps = {}) {
+  if (!KEY_RE.test(String(moduleKey))) throw new Error(`not a module key: ${moduleKey}`);
+  const set = deps.setSetting || setSetting;
+  const now = await readTesting(deps);
+  const keys = new Set(now.general_only);
+  if (on) keys.add(moduleKey); else keys.delete(moduleKey);
+  await set(SETTING_KEYS.MODULE_GENERAL_ONLY, JSON.stringify([...keys].sort()), builderId);
+  return readTesting(deps);
+}
+
+// Whether this project takes tester-channel versions of one module. Pure over a
+// readTesting() result.
+function testsVersionsOf(testing, moduleKey) {
+  return !!(testing && testing.tester && !testing.general_only.includes(moduleKey));
+}
+
+module.exports = { readTesting, setTester, setGeneralOnly, testsVersionsOf, parseGeneralOnly };

package/src/bongos/project-settings.js

@@ -53,6 +53,9 @@ const SETTING_KEYS = {
   TWEAK_AUTOPICKUP: 'tweak.autopickup',
   TWEAK_AUTOPICKUP_CAP: 'tweak.autopickup_monthly_cap',
   SPEND_CAP: 'treasury.spend_cap_usd',
+  // Testing new module versions first (task 1003802, ADR 0344 D1): module-testing.js.
+  MODULE_TESTER: 'modules.tester',
+  MODULE_GENERAL_ONLY: 'modules.general_only',
 };
 
 // SHIP MODE (task 1004628, ADR 0369) — WHO starts a ship, never HOW it lands.

package/src/bongos/routes/modules.js

@@ -111,6 +111,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
 const { listCatalog, SORT_PARTS } = require('../module-listing');
+const { readTesting, setTester, setGeneralOnly } = require('../module-testing');
 
 // The sentence for a toggle that waits on a restart (task 1004463). 'routes' are the
 // module's pages, 'pollers' its background jobs. PURE.
@@ -333,6 +334,48 @@ module.exports = function buildModulesRouter() {
       });
     }));
 
+  // Testing new module versions first (task 1003802, ADR 0344 D1): whether THIS
+  // project gets tester-channel versions, and which modules it keeps on general.
+  // A read anyone signed in can make: the switch is meant to be visible.
+  //
+  // rank: any-builder — a read of this project's own setting; nothing changes.
+  router.get('/modules/testing', auth.requireBuilder,
+    asyncHandler('GET /modules/testing', async (_req, res) => {
+      res.set('Cache-Control', 'no-store');
+      res.json(await readTesting());
+    }));
+
+  // rank: metic+archon — the project's admin volunteers the whole project, so it
+  // takes the same permission that chooses which modules this project runs
+  // (module.enable): a builder cannot opt in a project they cannot run modules for.
+  router.post('/modules/testing', auth.requireBuilder, auth.requirePermission('module.enable'),
+    asyncHandler('POST /modules/testing', async (req, res) => {
+      if (validateOrRespond(req, res, { tester: { type: 'boolean', required: true } })) return;
+      const out = await setTester(req.body.tester, req.builder && req.builder.id);
+      log.info({ tester: out.tester, builder: req.builder && req.builder.id }, 'module testing switched');
+      res.json({
+        ok: true,
+        ...out,
+        note: out.tester
+          ? 'This project now gets new module versions first, except the modules marked general only.'
+          : 'This project is back on general versions from its next update.',
+      });
+    }));
+
+  // rank: metic+archon — same reasoning as POST /modules/testing: which versions
+  // a module arrives in is part of choosing the modules this project runs.
+  router.post('/modules/:key/general-only', auth.requireBuilder, auth.requirePermission('module.enable'),
+    asyncHandler('POST /modules/:key/general-only', async (req, res) => {
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      if (validateOrRespond(req, res, { general_only: { type: 'boolean', required: true } })) return;
+      if (!listModules().some((m) => m.key === key)) {
+        return res.fail('not_found', { status: 404, message: `This project has no module "${key}".` });
+      }
+      const out = await setGeneralOnly(key, req.body.general_only, req.builder && req.builder.id);
+      res.json({ ok: true, key, general_only_this: out.general_only.includes(key), ...out });
+    }));
+
   // POST /api/bongos/modules/:key/submit — ADR 0107 §1 upstreaming submission.
   //
   // task 1770. Body: { signed_by?: "Name <email>" }. Re-runs the §4

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.156'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.157'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_catalog_world.mjs

@@ -39,7 +39,7 @@ const noAlias = (rawCss, where) => {
 
 // ---- modules ----------------------------------------------------------------
 
-test('modules: ONE panel of family rows — the filter bar, the figure band and two groups on one .scroll (a third, the store, since task 1003799)', () => {
+test('modules: ONE panel of family rows — the filter bar, the figure band and two groups on one .scroll (the store since task 1003799, testing since task 1003802)', () => {
   const html = read('modules.html');
   assert.match(html, /<link rel="stylesheet" href="\/builders\/oversight\.css">\s*<link rel="stylesheet" href="\/builders\/modules\.css">/, 'the family sheet loads before the page sheet');
   assert.equal((html.match(/class="scroll[ "]/g) || []).length, 1, 'one panel, not three');
@@ -47,7 +47,7 @@ test('modules: ONE panel of family rows — the filter bar, the figure band and
   assert.match(html, /class="ov-figs" id="mod-figs"/, 'the figure band is the family\'s');
   assert.match(html, /<ul class="ov-rows" id="core-grid">/, 'the core catalog is a run of rows');
   assert.match(html, /<ul class="ov-rows" id="own-grid">/, 'the project\'s own modules are a run of rows');
-  assert.equal((html.match(/class="ov-group__head"/g) || []).length, 3, 'three group heads: the core, this project, the store');
+  assert.equal((html.match(/class="ov-group__head"/g) || []).length, 4, 'four group heads: the core, this project, testing, the store');
   assert.doesNotMatch(decomment(html), /mod-grid|mod-card|mod-browse|submit-scroll|class="settings-status"/, 'the card grid, the boxed search and the third panel are gone');
   assert.doesNotMatch(html, /\d+ module\(s\)/, 'the page head no longer says the numbers as prose');
 });
@@ -106,6 +106,22 @@ test('modules: the store group reads strengths and weaknesses off the server row
   assert.notDeepEqual(two[0].strengths.map((s) => s.part), two[1].strengths.map((s) => s.part), '…that are strong at different things');
 });
 
+test('modules: the project opts in to testing new versions, and can keep a module on general (task 1003802)', () => {
+  const js = read('modules.js');
+  const html = read('modules.html');
+  assert.match(html, /<div class="ov-group" id="testing-group" hidden>/, 'hidden until the switch is read');
+  assert.match(html, /It is never switched on for you\./, 'the page says a project is never a tester by default');
+  assert.match(js, /api\.request\('GET', `\$\{API\}\/modules\/testing`\)/, 'it reads GET /modules/testing');
+  assert.match(js, /`\$\{API\}\/modules\/testing`, \{ tester: next \}/, 'the switch posts an explicit true or false');
+  assert.match(js, /\/modules\/\$\{encodeURIComponent\(key\)\}\/general-only`, \{ general_only: on \}/, 'a module is kept on general by its own key');
+  assert.match(js, /class="ov-toggle mod-testing"/, 'the switch is the family grant toggle');
+  assert.match(js, /if \(!testing \|\| !testing\.tester\) return '';/, 'the per-module line appears only while the project is testing');
+  assert.match(js, /if \(!canToggle\) return escapeHtml\(says\);/, 'a builder who cannot switch it reads the state, with no dead control');
+  const fixture = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', 'modules__testing.json'), 'utf8'));
+  assert.equal(fixture.tester, true, 'the harness demos the switch on');
+  assert.ok(fixture.general_only.length >= 1, '…with a module kept on general');
+});
+
 test('modules: the buyer sorts the store by the part that matters to them (task 1003800)', () => {
   const js = read('modules.js');
   const html = read('modules.html');

package/tests/module_testing.mjs

@@ -0,0 +1,171 @@
+// tests/module_testing.mjs — a project elects to test new module versions first
+// (task 1003802, ADR 0344 D1). Two halves, no port and no real DB:
+//   - the rule: module-testing.js over an in-memory project_settings, through
+//     its deps seam — never a tester by default, reversible, "general only";
+//   - the routes: the real handlers off the real router, with pool.js replaced
+//     in the require cache (the tests/module_store_listing.mjs harness).
+//
+// Run:  node tests/module_testing.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+// ---- an in-memory project_settings, behind the real setSetting/getSetting SQL ----
+const rows = new Map();
+const pool = {
+  async query(sql, params = []) {
+    if (/FROM project_settings WHERE key = \$1/.test(sql)) {
+      const r = rows.get(params[0]);
+      return { rows: r ? [r] : [] };
+    }
+    if (/INSERT INTO project_settings/.test(sql)) {
+      const r = { key: params[0], value: params[1], updated_by: params[2], updated_at: 't' };
+      rows.set(params[0], r);
+      return { rows: [r] };
+    }
+    return { rows: [] };
+  },
+};
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => ({ ...pool, release() {} }), query: pool.query } } };
+
+const { readTesting, setTester, setGeneralOnly, testsVersionsOf, parseGeneralOnly } = require('../src/bongos/module-testing.js');
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+const { listModules } = buildModulesRouter;
+
+function handlerFor(router, method, p) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${p} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, names: stack.map((s) => s.name) };
+}
+
+async function invoke(handle, req) {
+  const res = {
+    statusCode: 200, body: undefined, headers: {},
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set(k, v) { this.headers[k] = v; return this; },
+    // Both shapes res.fail is called with: (code, { status, message }) and the
+    // validator's (code, 400, details).
+    fail(code, opts) {
+      const o = typeof opts === 'number' ? { status: opts } : opts;
+      this.statusCode = o.status; this.body = { error: code, ...o }; return this;
+    },
+  };
+  let nextErr = null;
+  await handle({ params: {}, body: {}, builder: { id: 7 }, ...req }, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+// ---------------------------------------------------------------------------
+// the rule
+// ---------------------------------------------------------------------------
+
+test('a project is never a tester by default', async () => {
+  rows.clear();
+  const t = await readTesting();
+  assert.deepEqual(t, { tester: false, general_only: [], updated_at: null, updated_by: null });
+  assert.equal(testsVersionsOf(t, 'discord'), false);
+});
+
+test('opting in is an act, and it is reversible', async () => {
+  rows.clear();
+  const on = await setTester(true, 7);
+  assert.equal(on.tester, true);
+  assert.equal(on.updated_by, '7', 'who switched it is recorded');
+  assert.equal(testsVersionsOf(on, 'discord'), true);
+  const off = await setTester(false, 7);
+  assert.equal(off.tester, false);
+  assert.equal(testsVersionsOf(off, 'discord'), false);
+});
+
+test('a module marked general only keeps general versions while the rest test', async () => {
+  rows.clear();
+  await setTester(true, 7);
+  await setGeneralOnly('economy', true, 7);
+  const t = await setGeneralOnly('discord', true, 7);
+  assert.deepEqual(t.general_only, ['discord', 'economy']);
+  assert.equal(testsVersionsOf(t, 'economy'), false);
+  assert.equal(testsVersionsOf(t, 'memory'), true);
+  const back = await setGeneralOnly('economy', false, 7);
+  assert.deepEqual(back.general_only, ['discord']);
+  assert.equal(testsVersionsOf(back, 'economy'), true);
+});
+
+test('a "general only" mark survives the switch going off and on', async () => {
+  rows.clear();
+  await setTester(true, 7);
+  await setGeneralOnly('economy', true, 7);
+  await setTester(false, 7);
+  const t = await setTester(true, 7);
+  assert.deepEqual(t.general_only, ['economy']);
+});
+
+test('an unreadable stored value reads as NOT a tester, and keeps the keys it can read', async () => {
+  rows.clear();
+  rows.set('modules.tester', { key: 'modules.tester', value: 'yes please', updated_by: null, updated_at: 't' });
+  assert.equal((await readTesting()).tester, false, 'only "on" is on');
+  assert.deepEqual(parseGeneralOnly('not json'), []);
+  assert.deepEqual(parseGeneralOnly('{"a":1}'), []);
+  assert.deepEqual(parseGeneralOnly('["economy", 4, "Bad Key", "economy", "discord"]'), ['discord', 'economy']);
+});
+
+test('setGeneralOnly refuses something that is not a module key', async () => {
+  await assert.rejects(() => setGeneralOnly('../etc', true, 7), /not a module key/);
+});
+
+// ---------------------------------------------------------------------------
+// the routes
+// ---------------------------------------------------------------------------
+
+test('GET /modules/testing: any signed-in builder can see the switch', async () => {
+  rows.clear();
+  const { handle, names } = handlerFor(buildModulesRouter(), 'get', '/modules/testing');
+  assert.equal(names.length, 2, `expected requireBuilder + handler, got ${names.join(', ')}`);
+  const res = await invoke(handle, {});
+  assert.equal(res.body.tester, false);
+  assert.equal(res.headers['Cache-Control'], 'no-store');
+});
+
+test('POST /modules/testing and /modules/:key/general-only take the module.enable permission', () => {
+  const router = buildModulesRouter();
+  for (const p of ['/modules/testing', '/modules/:key/general-only']) {
+    const { names } = handlerFor(router, 'post', p);
+    assert.equal(names.length, 3, `${p}: requireBuilder + requirePermission + handler, got ${names.join(', ')}`);
+  }
+  const src = require('node:fs').readFileSync(require.resolve('../src/bongos/routes/modules.js'), 'utf8');
+  assert.match(src, /router\.post\('\/modules\/testing', auth\.requireBuilder, auth\.requirePermission\('module\.enable'\)/);
+  assert.match(src, /router\.post\('\/modules\/:key\/general-only', auth\.requireBuilder, auth\.requirePermission\('module\.enable'\)/);
+});
+
+test('POST /modules/testing: switches on and off, and says what it means', async () => {
+  rows.clear();
+  const { handle } = handlerFor(buildModulesRouter(), 'post', '/modules/testing');
+  const on = await invoke(handle, { body: { tester: true } });
+  assert.equal(on.body.tester, true);
+  assert.match(on.body.note, /new module versions first/);
+  const off = await invoke(handle, { body: { tester: false } });
+  assert.equal(off.body.tester, false);
+  assert.match(off.body.note, /back on general versions from its next update/);
+  const bad = await invoke(handle, { body: { tester: 'on' } });
+  assert.equal(bad.statusCode, 400, 'an affirmative act is a boolean, not a string that looks like one');
+});
+
+test('POST /modules/:key/general-only: only a module this project has', async () => {
+  rows.clear();
+  const { handle } = handlerFor(buildModulesRouter(), 'post', '/modules/:key/general-only');
+  const known = listModules()[0].key;
+  const ok = await invoke(handle, { params: { key: known }, body: { general_only: true } });
+  assert.equal(ok.statusCode, 200);
+  assert.equal(ok.body.general_only_this, true);
+  assert.deepEqual(ok.body.general_only, [known]);
+  const missing = await invoke(handle, { params: { key: 'no-such-module-here' }, body: { general_only: true } });
+  assert.equal(missing.statusCode, 404);
+  const badKey = await invoke(handle, { params: { key: 'Not_A_Key' }, body: { general_only: true } });
+  assert.equal(badKey.statusCode, 400);
+});