@bongos/core 1.21.156 → 1.21.158

package/docs/page-readings.json

@@ -5,7 +5,7 @@
   "adr": "0341 D3",
   "reread": "node scripts/gds/page-reader.js --stale",
   "how": ["Generated by node scripts/gds/page-reader.js (BV2.TW04, task 1004315; ADR 0341 D3). Do not hand-edit.","One entry per page of docs/page-inventory.json. Lines are in page order: the default state first, and a line only another state shows sits where that state shows it, with its state named.","placement: placed = a docs/copy-registry.json row renders it (file, line, string_id); shared = shell text every page of the surface carries (top bar, sidebar, footer), with its row when the registry has one; unplaced = the registry cannot place it (a rewrite becomes an engineer task, ADR 0341 D4).","text keeps {…} where the registry row has a hole, or where a value the page read from its API was filled in. A string that is only such data is counted under omitted.data, not listed.","reading_hash is over the non-shared lines (key, section, text); files_hash is over the page's inventory files. --check compares files_hash only and never opens a browser.","Rendered through the hall-preview harness (hall) and the ui-design kit stub (landing, status), at 1280x800 with the clock pinned, so a reading is the fixture world's page."],
-  "counts": {"pages":46,"lines":5563,"placed":1707,"shared":398,"unplaced":3458,"omitted_data":3605},
+  "counts": {"pages":46,"lines":5568,"placed":1711,"shared":398,"unplaced":3459,"omitted_data":3606},
   "pages": [
     {
       "id": "builders:atlas",
@@ -1885,10 +1885,10 @@
       "surface": "builders",
       "title": "Modules",
       "states_read": ["browse","search-empty","lens","details","out"],
-      "files_hash": "78b02310ae1e8e04",
-      "reading_hash": "a3861c8a1816328f",
-      "counts": {"lines":57,"placed":25,"shared":8,"unplaced":24},
-      "omitted": {"data":105},
+      "files_hash": "50ce60ad3dac0401",
+      "reading_hash": "a17f501b72321b7b",
+      "counts": {"lines":62,"placed":29,"shared":8,"unplaced":25},
+      "omitted": {"data":106},
       "notes": ["details: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood"],
       "lines": [
         {"key":"L0001","section":"skip link","text":"Skip to content","placement":"shared","file":"modules/hall-ui/public/shell.js","line":872,"string_id":"87cee78ca134"},
@@ -1928,26 +1928,31 @@
         {"key":"L0035","section":"Module catalog","text":"{…} file{…}","placement":"placed","file":"modules/hall-ui/public/gate.js","line":151,"string_id":"3efa67dc6e07"},
         {"key":"L0036","section":"Module catalog","text":"sessions","placement":"placed","file":"modules/hall-ui/public/task.js","line":467,"string_id":"732b4c935e36"},
         {"key":"L0037","section":"Module catalog","text":"Built by this project","placement":"placed","file":"modules/hall-ui/public/modules.html","line":70,"string_id":"b51edc826cbe"},
-        {"key":"L0038","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":187,"string_id":"0215b2cdca8c"},
+        {"key":"L0038","section":"Module catalog","text":"submit for review","placement":"placed","file":"modules/hall-ui/public/modules.js","line":286,"string_id":"0215b2cdca8c"},
         {"key":"L0039","section":"Module catalog","text":"A module built here can be submitted upstream for review, so it can join the shared catalog with your name and this project credited.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":74,"string_id":"2e17d7e236d9"},
-        {"key":"L0040","section":"Module catalog","text":"In the store","placement":"placed","file":"modules/hall-ui/public/modules.html","line":83,"string_id":"ecfebcd52894"},
-        {"key":"L0041","section":"Module catalog","text":"Sort by","placement":"placed","file":"modules/hall-ui/public/modules.html","line":87,"string_id":"70383b194ec0"},
-        {"key":"L0042","section":"Module catalog","text":"Name","placement":"unplaced"},
-        {"key":"L0043","section":"Module catalog","text":"No store module matches that {…}.","placement":"unplaced","state":"search-empty"},
-        {"key":"L0044","section":"Module catalog","text":"scores","placement":"unplaced","occurrences":2},
-        {"key":"L0045","section":"Module catalog","text":"strong at {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":241,"string_id":"e294c3429c2e","occurrences":3},
-        {"key":"L0046","section":"Module catalog","text":"weak at {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":243,"string_id":"20318b6da94e"},
-        {"key":"L0047","section":"Module catalog","text":"A part is strong at 80 out of 100 or more, and weak below the listing floor. A part with no data yet is not counted against a module. Sort by a part to see the modules strongest at it first; a module with no score for that part goes last, and a new module is never ranked.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":90,"string_id":"e395cd11edab"},
-        {"key":"L0048","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":520,"string_id":"1883ad7f07fc"},
-        {"key":"L0049","section":"Module catalog","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":810,"string_id":"fd1903586e8e"},
-        {"key":"L0050","section":"What are you doing now?","text":"What are you doing now?","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":811,"string_id":"60853319f290"},
-        {"key":"L0051","section":"What are you doing now?","text":"Pick one. You can switch any time from the top bar.","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":812,"string_id":"4f87d5b17b54"},
-        {"key":"L0052","section":"What are you doing now?","text":"Building","placement":"unplaced"},
-        {"key":"L0053","section":"What are you doing now?","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
-        {"key":"L0054","section":"What are you doing now?","text":"Artistry","placement":"unplaced"},
-        {"key":"L0055","section":"What are you doing now?","text":"Ideating","placement":"unplaced"},
-        {"key":"L0056","section":"What are you doing now?","text":"Turn thoughts into {…}.","placement":"unplaced"},
-        {"key":"L0057","section":"What are you doing now?","text":"Ask me again next session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":815,"string_id":"fa86bf403775"}
+        {"key":"L0040","section":"Module catalog","text":"Testing new versions","placement":"placed","file":"modules/hall-ui/public/modules.html","line":82,"string_id":"d52c87fba7da"},
+        {"key":"L0041","section":"Module catalog","text":"This project tests new versions first","placement":"placed","file":"modules/hall-ui/public/modules.js","line":211,"string_id":"1116d2cad470"},
+        {"key":"L0042","section":"Module catalog","text":"testing","placement":"unplaced"},
+        {"key":"L0043","section":"Module catalog","text":"kept on general: {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":207,"string_id":"cf5047ea06d8"},
+        {"key":"L0044","section":"Module catalog","text":"A testing project gets each new version of its modules before everyone else, and what it finds feeds the module's score. It is never switched on for you. To keep one module on the versions everyone gets, open its details.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":85,"string_id":"c68c7532aa78"},
+        {"key":"L0045","section":"Module catalog","text":"In the store","placement":"placed","file":"modules/hall-ui/public/modules.html","line":94,"string_id":"ecfebcd52894"},
+        {"key":"L0046","section":"Module catalog","text":"Sort by","placement":"placed","file":"modules/hall-ui/public/modules.html","line":98,"string_id":"70383b194ec0"},
+        {"key":"L0047","section":"Module catalog","text":"Name","placement":"unplaced"},
+        {"key":"L0048","section":"Module catalog","text":"No store module matches that {…}.","placement":"unplaced","state":"search-empty"},
+        {"key":"L0049","section":"Module catalog","text":"scores","placement":"unplaced","occurrences":2},
+        {"key":"L0050","section":"Module catalog","text":"strong at {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":340,"string_id":"e294c3429c2e","occurrences":3},
+        {"key":"L0051","section":"Module catalog","text":"weak at {…}","placement":"placed","file":"modules/hall-ui/public/modules.js","line":342,"string_id":"20318b6da94e"},
+        {"key":"L0052","section":"Module catalog","text":"A part is strong at 80 out of 100 or more, and weak below the listing floor. A part with no data yet is not counted against a module. Sort by a part to see the modules strongest at it first; a module with no score for that part goes last, and a new module is never ranked.","placement":"placed","file":"modules/hall-ui/public/modules.html","line":101,"string_id":"e395cd11edab"},
+        {"key":"L0053","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":520,"string_id":"1883ad7f07fc"},
+        {"key":"L0054","section":"Module catalog","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":810,"string_id":"fd1903586e8e"},
+        {"key":"L0055","section":"What are you doing now?","text":"What are you doing now?","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":811,"string_id":"60853319f290"},
+        {"key":"L0056","section":"What are you doing now?","text":"Pick one. You can switch any time from the top bar.","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":812,"string_id":"4f87d5b17b54"},
+        {"key":"L0057","section":"What are you doing now?","text":"Building","placement":"unplaced"},
+        {"key":"L0058","section":"What are you doing now?","text":"{…} and {…}","placement":"placed","file":"modules/hall-ui/public/profile-nudge.js","line":77,"string_id":"56b00d773232","occurrences":3},
+        {"key":"L0059","section":"What are you doing now?","text":"Artistry","placement":"unplaced"},
+        {"key":"L0060","section":"What are you doing now?","text":"Ideating","placement":"unplaced"},
+        {"key":"L0061","section":"What are you doing now?","text":"Turn thoughts into {…}.","placement":"unplaced"},
+        {"key":"L0062","section":"What are you doing now?","text":"Ask me again next session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":815,"string_id":"fa86bf403775"}
       ]
     },
     {

package/modules/government/catalog.js

@@ -223,7 +223,7 @@ const PERMISSIONS = [
   { key: 'goal.create', system: false, floor: 'metic', guards: 'POST /goals (protected scope → Archon in-handler; ADR 0086)' },
   { key: 'goal.archive', system: false, floor: 'metic', guards: 'POST /goals/:id/{archive,reopen}' },
   { key: 'goal.scope.widen', system: false, floor: 'metic', guards: 'POST /goals/:id/scope (same-tier; cross-tier = goal.scope.manage, system)' },
-  { key: 'module.enable', system: false, floor: 'metic', guards: 'POST /modules/:key/enable' },
+  { key: 'module.enable', system: false, floor: 'metic', guards: 'POST /modules/:key/enable, POST /modules/testing and POST /modules/:key/general-only (whether this project tests new module versions first, and which modules it keeps on general — task 1003802, ADR 0344 D1)' },
   { key: 'module.submit', system: false, floor: 'metic', guards: 'POST /modules/:key/submit, GET /modules/submissions' },
   // Re-run a store version's automatic assessment (task 1003796, ADR 0359). Never a
   // hand-set score: the owner ruled a person may ask for a re-check, not change the number.

package/modules/hall-ui/public/modules.html

@@ -74,6 +74,17 @@
             <p class="ov-foot" id="submit-lede">A module built here can be submitted upstream for review, so it can join the shared catalog with your name and this project credited.</p>
           </div>
 
+          <!-- Testing new versions (task 1003802, ADR 0344 D1): the PROJECT opts in,
+               once, by its admin; a module can be kept on general versions from its
+               own details. Hidden until GET /modules/testing answers. -->
+          <div class="ov-group" id="testing-group" hidden>
+            <div class="ov-group__head">
+              <span class="ov-group__name">Testing new versions</span>
+            </div>
+            <ul class="ov-rows" id="testing-grid"></ul>
+            <p class="ov-foot" id="testing-lede">A testing project gets each new version of its modules before everyone else, and what it finds feeds the module's score. It is never switched on for you. To keep one module on the versions everyone gets, open its details.</p>
+          </div>
+
           <!-- In the store — what GET /store/modules lists, each with what it is
                strong and weak at (task 1003799, ADR 0343 D4), so two modules with
                the same score can be told apart. Hidden until the store answers

package/modules/hall-ui/public/modules.js

@@ -171,9 +171,108 @@
     if (mt.removeAfter) line('removable after core', `<span class="ov-mono">${escapeHtml(String(mt.removeAfter))}</span>`);
     if (mt.note) line('note', escapeHtml(String(mt.note)));
     if (m.default != null) line('ships', m.default ? 'default on' : 'default off');
+    const versions = testingLine(m);
+    if (versions) line('new versions', versions);
     return lines.length ? `<ul class="ov-lines">${lines.join('')}</ul>` : '';
   }
 
+  // ---- testing new versions (task 1003802, ADR 0344 D1) ----
+  //
+  // GET /modules/testing says whether this project tests new versions first and
+  // which modules it keeps on general. The server owns the answer; the page shows
+  // it and sends the two switches, which take the same permission as the
+  // enable toggle (canToggle mirrors it, the server decides).
+  let testing = null;
+
+  function generalOnly(key) {
+    return !!(testing && Array.isArray(testing.general_only) && testing.general_only.includes(key));
+  }
+
+  // One module's line in its details: only while the project is testing.
+  function testingLine(m) {
+    if (!testing || !testing.tester) return '';
+    const kept = generalOnly(m.key);
+    const says = kept ? 'kept on the versions everyone gets' : 'gets new versions first';
+    if (!canToggle) return escapeHtml(says);
+    return `${escapeHtml(says)} <button type="button" class="btn-ghost btn--sm mod-general-only" data-key="${escapeHtml(m.key)}" data-on="${kept ? 'false' : 'true'}">${kept ? 'test new versions' : 'keep on general versions'}</button>`;
+  }
+
+  function testingRowHTML() {
+    const on = !!testing.tester;
+    const kept = (testing.general_only || [])
+      .map((k) => (allModules.find((m) => m.key === k) || {}).title || k);
+    const facts = [on
+      ? '<span class="fact-pill fact-pill--info">testing</span>'
+      : '<span class="ov-fact">not testing</span>'];
+    if (on && kept.length) facts.push(`<span class="ov-fact">kept on general: ${kept.map((t) => escapeHtml(t)).join(', ')}</span>`);
+    const control = canToggle
+      ? `<button type="button" class="ov-toggle mod-testing" aria-pressed="${on ? 'true' : 'false'}">${on ? 'on' : 'off'}</button>`
+      : `<span class="fact-pill ${on ? 'fact-pill--ok' : ''}" title="${escapeHtml(floor())} and above can switch this">${on ? 'on' : 'off'}</span>`;
+    return `
+      <li class="ov-row mod-row" data-key="testing">
+        <div class="ov-row__main">
+          <span class="ov-row__title">This project tests new versions first</span>
+          <div class="ov-row__facts">${facts.join('')}</div>
+        </div>
+        <div class="ov-row__right mod-row__right">${control}</div>
+      </li>`;
+  }
+
+  function renderTesting() {
+    const group = $('#testing-group');
+    const grid = $('#testing-grid');
+    if (!group || !grid || !testing) return;
+    group.hidden = false;
+    grid.innerHTML = testingRowHTML();
+  }
+
+  // Best-effort, like the store: a switch that cannot be read hides its group
+  // and costs nothing else on the page.
+  async function loadTesting() {
+    try {
+      const res = await api.request('GET', `${API}/modules/testing`);
+      if (!res.ok) return;
+      testing = res.data || null;
+      renderTesting();
+      renderRows();
+    } catch (err) {
+      console.error('[modules] testing switch failed to load', err);
+    }
+  }
+
+  async function postTesting(url, body, btn) {
+    btn.disabled = true;
+    try {
+      const res = await api.request('POST', url, { body });
+      const out = res.data || {};
+      if (!res.ok) throw new Error(out.message || `testing → ${res.status}`);
+      testing = { tester: !!out.tester, general_only: out.general_only || [] };
+      renderTesting();
+      renderRows();
+      return out;
+    } catch (err) {
+      console.error('[modules] testing change failed', err);
+      toast(err.message || 'Could not change that.', { duration: 3200 });
+      return null;
+    } finally {
+      btn.disabled = false;
+    }
+  }
+
+  async function onTesterToggle(btn) {
+    const next = btn.getAttribute('aria-pressed') !== 'true';
+    const out = await postTesting(`${API}/modules/testing`, { tester: next }, btn);
+    if (out) toast(out.note || (next ? 'Testing is on.' : 'Testing is off.'), { duration: 4200 });
+  }
+
+  async function onGeneralOnly(btn) {
+    const key = btn.dataset.key;
+    if (!key) return;
+    const on = btn.dataset.on === 'true';
+    const out = await postTesting(`${API}/modules/${encodeURIComponent(key)}/general-only`, { general_only: on }, btn);
+    if (out) toast(on ? `${key} stays on the versions everyone gets.` : `${key} gets new versions first again.`, { duration: 3200 });
+  }
+
   // The right column: ONE control. The family's grant toggle when the viewer
   // can flip it (enabled in ink, disabled faint, the accent on hover); the
   // state as a pill when they cannot. A module built here also carries its
@@ -386,6 +485,10 @@
     panel.addEventListener('click', (ev) => {
       const toggle = ev.target.closest('.mod-toggle');
       if (toggle) { onToggle(toggle); return; }
+      const tester = ev.target.closest('.mod-testing');
+      if (tester) { onTesterToggle(tester); return; }
+      const keep = ev.target.closest('.mod-general-only');
+      if (keep) { onGeneralOnly(keep); return; }
       const submit = ev.target.closest('.mod-submit');
       if (submit) onSubmit(submit);
     });
@@ -481,6 +584,7 @@
       if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
       if (!res.ok) throw new Error(`modules → ${res.status}`);
       render(res.data);
+      loadTesting();
       loadStore();
     } catch (err) {
       console.error('[modules] failed to load', err);

package/modules/hall-ui/records/catalog.md

@@ -14,3 +14,5 @@ Also gone, and the one rule in that list: `.ab-caption` takes the lede's `--meas
 **The store's modules are a third group on the same panel, read as strengths and weaknesses (task 1003799, ADR 0343 D4).** `#store-group` ("In the store") lists what `GET /store/modules` lists, hidden until that read answers with something; it loads after the modules on disk and best-effort, so a store that cannot be read costs this group and nothing else. A row is the same `.ov-row`: the overall score as a plain fact (or the `new` info pill), `strong at Tests 96, How-to 88` as a plain fact, and `weak at …` as the warn pill, because a weakness is the exception a buyer must not miss. The sentence behind each part ("Tests scored 96 out of 100, from 40 test cases.") and the parts with no data yet sit in the row's `<details class="mod-more">`, the `splitCriterion` idea: short label in the list, the detail one click away. The reading is the server's (`readParts` in `src/bongos/module-listing.js`: strong at 80 or more, weak below the listing floor, unmeasured never weak); the page re-derives nothing. Harness fixture: `store__modules.json`.
 
 **The buyer sorts the store by the part that matters to them (task 1003800, owner decision 2026-10-22).** A "Sort by" menu sits in the store group's head (`#store-sort`, `.ov-group__note`): Name, then the parts the server lists in `sort_parts`. Picking one re-reads `GET /store/modules?sort=<part>`, and the server orders the listed modules (`sortByPart` in `src/bongos/module-listing.js`: highest for that part first, a tie to the overall score then the key, a module with no score for the part last). The page never sorts the rows itself, and New modules keep name order because they are never ranked. While a part is picked, each listed row carries that part's score as a plain fact (`Reliability 91`, or `Reliability not measured yet`), so the order explains itself. The owner chose the buyer over a per-category "key part" because nothing records what a category is for, and a hidden weighting would break the score an author can check (ADR 0343 D3).
+
+**Testing new versions is a fourth group, between this project's modules and the store (task 1003802, ADR 0344 D1).** `#testing-group` holds one `.ov-row`, "This project tests new versions first": a `testing` info pill (or the plain fact `not testing`), the modules kept on general as a plain fact, and on the right the family grant toggle (`.ov-toggle.mod-testing`) for a builder holding `module.enable`, a state pill for everyone else. It is hidden until `GET /modules/testing` answers and loads best-effort, like the store. The per-module control is not a second toggle on every row: while testing is on, each module's details gain a "new versions" line (`gets new versions first` / `kept on the versions everyone gets`) with a ghost button that flips it, so the one-control-per-row rule holds and a project that is not testing sees nothing new. The lede says it is never switched on for you, because the criterion turns on the tester having chosen it. Harness fixture: `modules__testing.json` (testing on, `economy` kept on general).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.156",
+  "version": "1.21.158",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.156",
+      "version": "1.21.158",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.156",
+  "version": "1.21.158",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9970,5 +9970,17 @@
       "id": "1004387",
       "text": "The Studio's approval-queue button now carries the artist's new label, ready for the artist to approve before it goes live."
     }
+  ],
+  "1.21.157": [
+    {
+      "id": "1003802",
+      "text": "A project can now volunteer to try new versions of its modules before everyone else, and keep any single module on the normal versions."
+    }
+  ],
+  "1.21.158": [
+    {
+      "id": "1003803",
+      "text": "When a module author publishes a new version, it now goes only to projects that volunteered to test, never straight to everyone."
+    }
   ]
 }

package/scripts/gds/module.js

@@ -1006,6 +1006,9 @@ async function cmdPublish(args, {
   }
   const row = res.data && res.data.version;
   log(`\n✓ Published "${key}" ${row ? row.version : sidecar.module_version} to the store${res.data && res.data.created_module ? ' — its first version, so you are its author' : ''}.`);
+  if (res.data && res.data.channel === 'tester') {
+    log('  It goes to testing projects first, and reaches every project once it has been tested (ADR 0344).');
+  }
   return 0;
 }
 

package/src/bongos/module-store.js

@@ -14,7 +14,8 @@
 //      the store_modules row on a key's first publish (the publisher becomes its
 //      author), refuse anyone else's key, refuse a delisted key (ADR 0338 D2: delisting
 //      stops what comes next), refuse a version that already exists or is not newer
-//      than the latest, then INSERT the version row. Rows are only ever INSERTed.
+//      than the latest, then INSERT the version row and put it on the tester
+//      channel (task 1003803, ADR 0344 D2). Rows are only ever INSERTed.
 //
 // If step 2 refuses, the route removes the temp file step 1 wrote, so a refused
 // publish leaves nothing behind.
@@ -164,8 +165,14 @@ function relativeArtifactPath(file, { dir = storeDir() } = {}) {
   return path.relative(dir, file).split(path.sep).join('/');
 }
 
+// Every new version, first release or update, starts on the tester channel (task
+// 1003803, ADR 0344 D2). It is not an input: a publish cannot name a channel, so no
+// omitted or mistyped flag can send an untested version to every project at once.
+// Reaching general is a separate, later act — the promotion gate (task 1003804).
+const PUBLISH_CHANNEL = 'tester';
+
 // One transaction. `db` is a pg Pool (anything with connect()). Returns
-// { ok: true, version: row, created: bool } or { ok: false, code, message, status }.
+// { ok: true, version: row, created: bool, channel } or { ok: false, code, message, status }.
 async function publishVersion(input, { db, beforeCommit } = {}) {
   const {
     key, title, description, version, coreVersion, manifest,
@@ -217,11 +224,16 @@ async function publishVersion(input, { db, beforeCommit } = {}) {
        RETURNING id, module_key, version, core_version, tree_sha256, tarball_sha256,
                  tarball_bytes, published_by, published_at`,
       [key, version, coreVersion, manifest, treeSha256, tarballSha256, bytes, relPath, builderId]);
+    // Same transaction as the version row, so no version is ever without a channel.
+    await client.query(
+      `INSERT INTO store_module_version_channels (version_id, channel, reason, set_by)
+       VALUES ($1, $2, $3, $4)`,
+      [row.id, PUBLISH_CHANNEL, 'new_version', builderId]);
     // Put the tarball in place while the row is still uncommitted: if this throws,
     // the catch below rolls the row back, so the two can never disagree.
     if (beforeCommit) await beforeCommit();
     await client.query('COMMIT');
-    return { ok: true, created, version: row };
+    return { ok: true, created, version: row, channel: PUBLISH_CHANNEL };
   } catch (e) {
     try { await client.query('ROLLBACK'); } catch { /* the connection may be gone */ }
     // Two publishes of the same version racing past the check: the UNIQUE wins.

package/src/bongos/module-testing.js

@@ -0,0 +1,73 @@
+// src/bongos/module-testing.js — whether this project tests new module versions
+// first (task 1003802, criterion wa5 staged rollout, ADR 0344 D1).
+//
+// A PROJECT opts in, once, and it is the project's own admin who does it: the
+// project is what runs the module, so no builder can volunteer someone else's
+// project. A tester project gets tester-channel versions of every module it has,
+// except the modules it marked "general only". Both choices are reversible, and
+// "willing" is load-bearing: a project is never a tester by default, and a choice
+// that cannot be read reads as NOT a tester (an early version nobody chose is an
+// early victim, not a tester).
+//
+// Storage is two project_settings rows (src/bongos/project-settings.js), the same
+// durable, survives-a-deploy store the project's other knobs use, so no new table:
+//
+//   modules.tester        'on' | 'off'              absent = off
+//   modules.general_only  JSON array of module keys  absent = []
+//
+// This file records the choice and answers it. Handing a tester project tester
+// versions is task 1003805, which asks testsVersionsOf(key).
+
+const { getSetting, setSetting, SETTING_KEYS } = require('./project-settings');
+const { KEY_RE } = require('../module-loader/manifest-schema');
+
+function parseTester(raw) {
+  return raw === 'on';
+}
+
+// A stored list that will not parse, or holds something that is not a key, keeps
+// only the keys it can read: losing a "general only" mark would hand a project an
+// early version of a module it asked to keep on general.
+function parseGeneralOnly(raw) {
+  if (raw == null) return [];
+  let list;
+  try { list = JSON.parse(raw); } catch { return []; }
+  if (!Array.isArray(list)) return [];
+  return [...new Set(list.filter((k) => typeof k === 'string' && KEY_RE.test(k)))].sort();
+}
+
+// { tester, general_only, updated_at, updated_by } — updated_* from the switch row.
+async function readTesting(deps = {}) {
+  const get = deps.getSetting || getSetting;
+  const [t, g] = await Promise.all([get(SETTING_KEYS.MODULE_TESTER), get(SETTING_KEYS.MODULE_GENERAL_ONLY)]);
+  return {
+    tester: parseTester(t && t.value),
+    general_only: parseGeneralOnly(g && g.value),
+    updated_at: t ? t.updated_at : null,
+    updated_by: t && t.updated_by != null ? String(t.updated_by) : null,
+  };
+}
+
+async function setTester(on, builderId = null, deps = {}) {
+  const set = deps.setSetting || setSetting;
+  await set(SETTING_KEYS.MODULE_TESTER, on ? 'on' : 'off', builderId);
+  return readTesting(deps);
+}
+
+async function setGeneralOnly(moduleKey, on, builderId = null, deps = {}) {
+  if (!KEY_RE.test(String(moduleKey))) throw new Error(`not a module key: ${moduleKey}`);
+  const set = deps.setSetting || setSetting;
+  const now = await readTesting(deps);
+  const keys = new Set(now.general_only);
+  if (on) keys.add(moduleKey); else keys.delete(moduleKey);
+  await set(SETTING_KEYS.MODULE_GENERAL_ONLY, JSON.stringify([...keys].sort()), builderId);
+  return readTesting(deps);
+}
+
+// Whether this project takes tester-channel versions of one module. Pure over a
+// readTesting() result.
+function testsVersionsOf(testing, moduleKey) {
+  return !!(testing && testing.tester && !testing.general_only.includes(moduleKey));
+}
+
+module.exports = { readTesting, setTester, setGeneralOnly, testsVersionsOf, parseGeneralOnly };

package/src/bongos/project-settings.js

@@ -53,6 +53,9 @@ const SETTING_KEYS = {
   TWEAK_AUTOPICKUP: 'tweak.autopickup',
   TWEAK_AUTOPICKUP_CAP: 'tweak.autopickup_monthly_cap',
   SPEND_CAP: 'treasury.spend_cap_usd',
+  // Testing new module versions first (task 1003802, ADR 0344 D1): module-testing.js.
+  MODULE_TESTER: 'modules.tester',
+  MODULE_GENERAL_ONLY: 'modules.general_only',
 };
 
 // SHIP MODE (task 1004628, ADR 0369) — WHO starts a ship, never HOW it lands.

package/src/bongos/routes/modules.js

@@ -111,6 +111,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
 const { listCatalog, SORT_PARTS } = require('../module-listing');
+const { readTesting, setTester, setGeneralOnly } = require('../module-testing');
 
 // The sentence for a toggle that waits on a restart (task 1004463). 'routes' are the
 // module's pages, 'pollers' its background jobs. PURE.
@@ -333,6 +334,48 @@ module.exports = function buildModulesRouter() {
       });
     }));
 
+  // Testing new module versions first (task 1003802, ADR 0344 D1): whether THIS
+  // project gets tester-channel versions, and which modules it keeps on general.
+  // A read anyone signed in can make: the switch is meant to be visible.
+  //
+  // rank: any-builder — a read of this project's own setting; nothing changes.
+  router.get('/modules/testing', auth.requireBuilder,
+    asyncHandler('GET /modules/testing', async (_req, res) => {
+      res.set('Cache-Control', 'no-store');
+      res.json(await readTesting());
+    }));
+
+  // rank: metic+archon — the project's admin volunteers the whole project, so it
+  // takes the same permission that chooses which modules this project runs
+  // (module.enable): a builder cannot opt in a project they cannot run modules for.
+  router.post('/modules/testing', auth.requireBuilder, auth.requirePermission('module.enable'),
+    asyncHandler('POST /modules/testing', async (req, res) => {
+      if (validateOrRespond(req, res, { tester: { type: 'boolean', required: true } })) return;
+      const out = await setTester(req.body.tester, req.builder && req.builder.id);
+      log.info({ tester: out.tester, builder: req.builder && req.builder.id }, 'module testing switched');
+      res.json({
+        ok: true,
+        ...out,
+        note: out.tester
+          ? 'This project now gets new module versions first, except the modules marked general only.'
+          : 'This project is back on general versions from its next update.',
+      });
+    }));
+
+  // rank: metic+archon — same reasoning as POST /modules/testing: which versions
+  // a module arrives in is part of choosing the modules this project runs.
+  router.post('/modules/:key/general-only', auth.requireBuilder, auth.requirePermission('module.enable'),
+    asyncHandler('POST /modules/:key/general-only', async (req, res) => {
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      if (validateOrRespond(req, res, { general_only: { type: 'boolean', required: true } })) return;
+      if (!listModules().some((m) => m.key === key)) {
+        return res.fail('not_found', { status: 404, message: `This project has no module "${key}".` });
+      }
+      const out = await setGeneralOnly(key, req.body.general_only, req.builder && req.builder.id);
+      res.json({ ok: true, key, general_only_this: out.general_only.includes(key), ...out });
+    }));
+
   // POST /api/bongos/modules/:key/submit — ADR 0107 §1 upstreaming submission.
   //
   // task 1770. Body: { signed_by?: "Name <email>" }. Re-runs the §4
@@ -426,7 +469,8 @@ module.exports = function buildModulesRouter() {
   // in one transaction (module-store.js). A key's first
   // publish makes the caller its author; after that only the author may publish,
   // a delisted key takes nothing new, and a version is published once and never
-  // changed.
+  // changed. Every new version lands on the tester channel; the body names no
+  // channel, so nothing here can skip testers (task 1003803, ADR 0344 D2).
   //
   // rank: metic+archon — it puts code in a shared store other instances install
   // from. Gate: requirePermission('module.submit') — the atom that already guards
@@ -473,7 +517,7 @@ module.exports = function buildModulesRouter() {
       if (!result.ok) return res.fail(result.code, { status: result.status, message: result.message });
 
       console.log(`[gds] module "${key}" ${v.version} published to the store by builder ${req.builder.id}`);
-      res.status(201).json({ ok: true, created_module: result.created, version: result.version });
+      res.status(201).json({ ok: true, created_module: result.created, version: result.version, channel: result.channel });
       // A new version is a new thing to judge (task 1003794, ADR 0343): queue its
       // assessment after answering, since the Security gate asks npm about its
       // dependencies and can take a minute. The queue runs one at a time and is

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.156'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.158'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_catalog_world.mjs

@@ -39,7 +39,7 @@ const noAlias = (rawCss, where) => {
 
 // ---- modules ----------------------------------------------------------------
 
-test('modules: ONE panel of family rows — the filter bar, the figure band and two groups on one .scroll (a third, the store, since task 1003799)', () => {
+test('modules: ONE panel of family rows — the filter bar, the figure band and two groups on one .scroll (the store since task 1003799, testing since task 1003802)', () => {
   const html = read('modules.html');
   assert.match(html, /<link rel="stylesheet" href="\/builders\/oversight\.css">\s*<link rel="stylesheet" href="\/builders\/modules\.css">/, 'the family sheet loads before the page sheet');
   assert.equal((html.match(/class="scroll[ "]/g) || []).length, 1, 'one panel, not three');
@@ -47,7 +47,7 @@ test('modules: ONE panel of family rows — the filter bar, the figure band and
   assert.match(html, /class="ov-figs" id="mod-figs"/, 'the figure band is the family\'s');
   assert.match(html, /<ul class="ov-rows" id="core-grid">/, 'the core catalog is a run of rows');
   assert.match(html, /<ul class="ov-rows" id="own-grid">/, 'the project\'s own modules are a run of rows');
-  assert.equal((html.match(/class="ov-group__head"/g) || []).length, 3, 'three group heads: the core, this project, the store');
+  assert.equal((html.match(/class="ov-group__head"/g) || []).length, 4, 'four group heads: the core, this project, testing, the store');
   assert.doesNotMatch(decomment(html), /mod-grid|mod-card|mod-browse|submit-scroll|class="settings-status"/, 'the card grid, the boxed search and the third panel are gone');
   assert.doesNotMatch(html, /\d+ module\(s\)/, 'the page head no longer says the numbers as prose');
 });
@@ -106,6 +106,22 @@ test('modules: the store group reads strengths and weaknesses off the server row
   assert.notDeepEqual(two[0].strengths.map((s) => s.part), two[1].strengths.map((s) => s.part), '…that are strong at different things');
 });
 
+test('modules: the project opts in to testing new versions, and can keep a module on general (task 1003802)', () => {
+  const js = read('modules.js');
+  const html = read('modules.html');
+  assert.match(html, /<div class="ov-group" id="testing-group" hidden>/, 'hidden until the switch is read');
+  assert.match(html, /It is never switched on for you\./, 'the page says a project is never a tester by default');
+  assert.match(js, /api\.request\('GET', `\$\{API\}\/modules\/testing`\)/, 'it reads GET /modules/testing');
+  assert.match(js, /`\$\{API\}\/modules\/testing`, \{ tester: next \}/, 'the switch posts an explicit true or false');
+  assert.match(js, /\/modules\/\$\{encodeURIComponent\(key\)\}\/general-only`, \{ general_only: on \}/, 'a module is kept on general by its own key');
+  assert.match(js, /class="ov-toggle mod-testing"/, 'the switch is the family grant toggle');
+  assert.match(js, /if \(!testing \|\| !testing\.tester\) return '';/, 'the per-module line appears only while the project is testing');
+  assert.match(js, /if \(!canToggle\) return escapeHtml\(says\);/, 'a builder who cannot switch it reads the state, with no dead control');
+  const fixture = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', 'modules__testing.json'), 'utf8'));
+  assert.equal(fixture.tester, true, 'the harness demos the switch on');
+  assert.ok(fixture.general_only.length >= 1, '…with a module kept on general');
+});
+
 test('modules: the buyer sorts the store by the part that matters to them (task 1003800)', () => {
   const js = read('modules.js');
   const html = read('modules.html');