@bongos/core 1.21.166 → 1.21.168

package/release-notes.json

@@ -10050,5 +10050,33 @@
       "id": "1004786",
       "text": "Settings no longer shows a broken image-generation key card on projects without the art tools. Before, builders were told their free art coverage had ended and to add a key, but the card could never load, so there was nowhere"
     }
+  ],
+  "1.21.167": [
+    {
+      "id": "1004784",
+      "text": "The city's building cards now let you decide right there. Every waiting item shows its real answers inside the card, Tab flips through a building's items and the arrows flip buildings, and a number key picks then confirms. \"De"
+    },
+    {
+      "id": "1004788",
+      "text": "One stuck task no longer stops all your other work. If a finished task is waiting on something outside you, such as a safety guard on the server or a person who must land it, it is set aside: it no longer blocks new claims, it"
+    },
+    {
+      "id": "1004776",
+      "text": "The page tweak editor now tells the artist, while they write, when a line carries a promise the product must keep, such as the Account page saying Private hides the page from everyone including its owner. The line shows what i"
+    },
+    {
+      "id": "1003804",
+      "text": "New module versions now move from testers to everyone on their own: after 7 days, or after 2 days once 5 testers installed them cleanly. Any tester error holds a version until a reviewer releases it."
+    },
+    {
+      "id": "1004782",
+      "text": "Goals no longer count abandoned work in their credit totals. Will goal drops by 241 credits of dropped tasks; across the project about 20,000 credits of abandoned estimates stop inflating goal sizes in the sky map and goal pag"
+    }
+  ],
+  "1.21.168": [
+    {
+      "id": "1004777",
+      "text": "A page tweak that sits too long now tells someone. If a round waits too long for its artist's review, that artist gets a line in Needs attention on Home. If it waits to be applied or to go live, builders who can apply it get t"
+    }
   ]
 }

package/scripts/gds/ask.js

@@ -135,11 +135,68 @@ async function check(file, deps = {}) {
   return { code: v.ok ? 0 : 1, lines: verdictLines(v) };
 }
 
+// ---------- the reword list (owner, 2026-10-23) ----------
+// A reader pressed "?" on a city card: the matter's words did not make sense.
+// `unclear` prints what waits for a rewrite (the flagged matters, or with
+// --legacy every open matter that waits on a person and has no stored card
+// yet), each with the words it has now; `put` stores the rewritten card
+// (PUT /government/asks/:matter), which closes the matter's flag.
+async function client(deps) {
+  if (deps && deps.client) return deps.client;
+  const lib = require('./cli-lib');
+  if (!lib.readSessionToken()) throw new Error('no Bongos session — run /builder-setup first');
+  return lib.cliClient();
+}
+function matterLines(m) {
+  const out = [`${m.id}  [${m.building}]${m.flag && m.flag.times > 1 ? `  flagged ${m.flag.times}x` : ''}`];
+  out.push(`  title:  ${String(m.title || '').trim()}`);
+  if (m.detail) out.push(`  detail: ${String(m.detail).replace(/\s+/g, ' ').trim().slice(0, 600)}`);
+  if (m.ask) out.push(`  card:   ${m.ask.question} (${(m.ask.options || []).map((o) => o.label).join(' / ')})`);
+  if (m.flag && m.flag.note) out.push(`  why unclear: ${m.flag.note}`);
+  if (Array.isArray(m.acts) && m.acts.length) out.push(`  acts:   ${m.acts.map((a) => a.key + (Array.isArray(a.options) && a.options.length ? '(' + a.options.map((o) => o.key).join('|') + ')' : '')).join(', ')}`);
+  return out;
+}
+async function unclear({ legacy = false, json = false } = {}, deps = {}) {
+  const api = await client(deps);
+  let list;
+  if (legacy) {
+    const r = await api.request('GET', '/government/docket');
+    if (!r || !r.ok) return { code: 1, lines: [`ask: the docket could not be read (${r && r.status}).`] };
+    list = ((r.data && r.data.matters) || []).filter((m) => m && m.state === 'needs' && !m.ask)
+      .map((m) => ({ id: m.id, building: m.building, source: m.source, title: m.title, detail: m.detail || null, ask: null, acts: m.acts || [], flag: m.unclear || null }));
+  } else {
+    const r = await api.request('GET', '/government/asks/unclear');
+    if (!r || !r.ok) return { code: 1, lines: [`ask: the reword list could not be read (${r && r.status}).`] };
+    list = (r.data && r.data.matters) || [];
+  }
+  if (json) return { code: 0, lines: [JSON.stringify(list, null, 2)] };
+  if (!list.length) return { code: 0, lines: [legacy ? 'ask: every open matter already carries a card.' : 'ask: nothing on the reword list.'] };
+  const lines = [`${list.length} ${legacy ? 'open matter(s) with no card yet' : 'matter(s) flagged as unclear'}:`, ''];
+  list.forEach((m) => { lines.push(...matterLines(m), ''); });
+  lines.push('Write each one a card (node scripts/gds/ask.js template), check it, then: node scripts/gds/ask.js put <matter-id> <file>');
+  return { code: 0, lines };
+}
+async function put(matterId, file, deps = {}) {
+  let body;
+  try { body = readJson(file); } catch (e) { return { code: 2, lines: [`ask: could not read the card as JSON (${e.message}).`] }; }
+  const local = asks.checkAsk(askOf(body));
+  if (!local.ok) return { code: 1, lines: verdictLines({ ok: false, ask: null, errors: local.errors, where: 'local' }) };
+  const api = await client(deps);
+  const r = await api.request('PUT', '/government/asks/' + encodeURIComponent(matterId), { body: { ask: askOf(body) } });
+  if (r && r.ok && r.data && r.data.ok) return { code: 0, lines: [`ask: saved the card on ${matterId}; its "?" flag is closed.`, '', ...verdictLines({ ok: true, ask: r.data.ask, where: 'server' })] };
+  const err = r && r.data && r.data.error;
+  return { code: 1, lines: [`ask: ${matterId} was not saved (${r && r.status}${err ? ' ' + err.code : ''}). ${err && err.message ? err.message : ''}`.trim()] };
+}
+
 const USAGE = [
   'usage:',
   '  node scripts/gds/ask.js template          print a blank card to fill in',
   '  node scripts/gds/ask.js check <file|->    check a card; on a pass, print it as a person reads it',
   '      --local                               check with the rules here, without the server',
+  '  node scripts/gds/ask.js unclear           the reword list: matters a reader flagged with "?"',
+  '      --legacy                              instead: every open matter on a person with no card yet',
+  '      --json                                as JSON',
+  '  node scripts/gds/ask.js put <matter> <file>  store a rewritten card on a matter (closes its flag)',
 ].join('\n');
 
 async function main(argv = process.argv.slice(2)) {
@@ -153,6 +210,16 @@ async function main(argv = process.argv.slice(2)) {
     console.log(r.lines.join('\n'));
     return r.code;
   }
+  if (cmd === 'unclear') {
+    const r = await unclear({ legacy: argv.includes('--legacy'), json: argv.includes('--json') });
+    console.log(r.lines.join('\n'));
+    return r.code;
+  }
+  if (cmd === 'put' && argv[1] && argv[2]) {
+    const r = await put(argv[1], argv[2]);
+    console.log(r.lines.join('\n'));
+    return r.code;
+  }
   console.error(USAGE);
   return 2;
 }
@@ -161,4 +228,4 @@ if (require.main === module) {
   main().then((code) => { process.exitCode = code; }, (e) => { console.error(`ask: ${e && e.message}`); process.exitCode = 1; });
 }
 
-module.exports = { TEMPLATE, askOf, checkedAsk, postWithAsk, verdictLines, serverVerdict, check, main };
+module.exports = { TEMPLATE, askOf, checkedAsk, postWithAsk, verdictLines, serverVerdict, check, unclear, put, main };

package/scripts/gds/claim.js

@@ -369,7 +369,10 @@ function claimFailureGuidance({ code, message, d }, r, taskId, ctx) {
   // posture) and this surface dropped it on the floor. Name the owed tasks, then
   // print the server's menu.
   if (code === 'REBASE_REQUIRED') {
-    const owed = (d.rebaseTasks || d.rebase_tasks || []).slice(0, MAX_LISTED_TASKS);
+    // task 1004788: only the fixable ones gate; set-aside ones are listed apart.
+    const all = (d.rebaseTasks || d.rebase_tasks || []);
+    const owed = all.filter((t) => !t.waiting).slice(0, MAX_LISTED_TASKS);
+    const waiting = all.filter((t) => t.waiting).slice(0, MAX_LISTED_TASKS);
     lines.push(owed.length
       ? `Your queue is gated — ${owed.length} confirmed task(s) are waiting on your rebase:`
       : 'Your queue is gated — a confirmed task is waiting on your rebase.');
@@ -377,6 +380,8 @@ function claimFailureGuidance({ code, message, d }, r, taskId, ctx) {
       lines.push(`  - task ${t.id}${t.title ? `  ${clip(t.title)}` : ''}`);
       if (t.reason) lines.push(`      flagged: ${clip(t.reason)}`);
     }
+    if (waiting.length) lines.push('  Waiting, not on you (set aside; they land on their own):');
+    for (const t of waiting) lines.push(`  - task ${t.id}${t.title ? `  ${clip(t.title)}` : ''} — ${clip(t.waits_on || t.reason || 'outside you')}`);
     lines.push(`  ${clip(d.hint, 600) || 'Clear it with /strand-fix N, or rebase the branch and re-ship — or /builder-release it to give up on one.'}`);
     return { lines, exit: QUEUE_GATED_EXIT };
   }

package/scripts/gds/copy-apply.js

@@ -598,6 +598,8 @@ async function batchMain({ taskId, batchFile, dryRun, pageId = null, now = () =>
     log(`    -  ${a.before}`);
     log(`    +  ${a.after}`);
   }
+  // task 1004776: the submit's guarded-line warnings, so whoever applies sees them too.
+  for (const w of batch.warnings || []) log(`  ${w.key} WARNING: no longer says what it must: ${w.must_still_say}${w.guarded_by ? ` (guarded by ${w.guarded_by})` : ''}`);
   for (const x of result.refused) {
     log(`  ${x.key} REFUSED (${x.code})${x.detail && x.detail.what_this_means ? `: ${x.detail.what_this_means}` : ''}`);
     log(`    line: ${JSON.stringify(x.before)}`);

package/src/bongos/module-promotion.js

@@ -0,0 +1,219 @@
+'use strict';
+
+// src/bongos/module-promotion.js — the promotion gate: when a module version on
+// the tester channel moves to general, and when it is held (task 1003804, ADR 0344
+// D3; owner decisions 2026-10-23 recorded on the task).
+//
+// THE RULE, in the order it is applied:
+//   1. A version only ever moves while its Security gate has passed and its own
+//      tests pass (ADR 0343). Tests pass = every test file passed (score 100), or
+//      the module declares no tests (`no_data` is not a fail). Anything else —
+//      failed, pending, not yet run — waits; it is never held for it.
+//   2. HOLD: any tester reports a failed install, or any runtime error, on the
+//      version. A held version stays on tester until a Metic+ person releases it
+//      (`module.delist`, owner 2026-10-23) or a newer version replaces it.
+//   3. EARLY: from day 2 on tester, 5 or more holders reported a clean install and
+//      nobody reported a problem.
+//   4. SEVEN DAYS: on tester for 7 days. This applies whether or not any tester
+//      picked it up, so a module nobody volunteers for still gets updated — a
+//      version is only ever held on evidence, never for lack of testers.
+//
+// Every report on a tester-channel version comes from a tester, because only
+// testers are handed one (task 1003805), so the reports are counted as they are.
+//
+// A move is a NEW store_module_version_channels row (core_276), never an update:
+// set_by NULL when the sweep moves it, the person when a person releases it, and a
+// short reason code. decidePromotion is the whole rule and is pure, so the tests
+// drive it directly; sweepPromotions and releaseHeld are the two writers.
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const PROMOTE_AFTER_DAYS = 7;
+const EARLY_AFTER_DAYS = 2;
+const EARLY_CLEAN_INSTALLS = 5;
+const SWEEP_LIMIT = 200;
+
+const REASONS = Object.freeze({
+  AFTER_7_DAYS: 'promoted_after_7_days',
+  EARLY: 'promoted_early_clean_installs',
+  HELD: 'held_tester_errors',
+  RELEASED: 'released_by_person',
+});
+
+function poolOf(db) { return db || require('./pool').pool; }
+
+// Did the ADR 0343 checks pass? signals: the current row per part.
+function checksPass({ security, tests } = {}) {
+  if (!security || security.outcome !== 'passed') return false;
+  if (!tests) return false;
+  if (tests.outcome === 'no_data') return true;
+  return tests.outcome === 'scored' && Number(tests.score) === 100;
+}
+
+// The rule. evidence: { onTesterSince, held, security, tests, cleanInstalls,
+// failedInstalls, runtimeErrors }. Returns { action: 'promote'|'hold'|'wait',
+// reason, days_on_tester, ... } — the same object an author reads.
+function decidePromotion(evidence, now = new Date()) {
+  const since = new Date(evidence.onTesterSince);
+  const days = Math.max(0, (now.getTime() - since.getTime()) / DAY_MS);
+  const base = {
+    days_on_tester: Math.floor(days),
+    clean_installs: evidence.cleanInstalls || 0,
+    failed_installs: evidence.failedInstalls || 0,
+    runtime_errors: evidence.runtimeErrors || 0,
+    checks_passed: checksPass(evidence),
+    general_on: new Date(since.getTime() + PROMOTE_AFTER_DAYS * DAY_MS).toISOString(),
+  };
+  if (evidence.held) return { action: 'wait', reason: 'held_until_released', ...base };
+  if (base.failed_installs > 0 || base.runtime_errors > 0) return { action: 'hold', reason: REASONS.HELD, ...base };
+  if (!base.checks_passed) return { action: 'wait', reason: 'checks_not_passed', ...base };
+  if (days >= PROMOTE_AFTER_DAYS) return { action: 'promote', reason: REASONS.AFTER_7_DAYS, ...base };
+  if (days >= EARLY_AFTER_DAYS && base.clean_installs >= EARLY_CLEAN_INSTALLS) {
+    return { action: 'promote', reason: REASONS.EARLY, ...base };
+  }
+  return { action: 'wait', reason: 'waiting_for_time_or_installs', ...base };
+}
+
+// The evidence for every version currently on tester (optionally one version),
+// bounded. onTesterSince is when it reached tester (its first tester row since
+// it was last off tester — in practice its publish), held is whether its current
+// row is a hold.
+async function readTesterEvidence({ db, versionId = null, limit = SWEEP_LIMIT } = {}) {
+  const pool = poolOf(db);
+  const { rows } = await pool.query(
+    // One probe per version into idx_store_module_version_channels_current (its
+    // newest row, LIMIT 1), never a DISTINCT ON over every version's whole move
+    // history: the work grows with versions, not with how often they moved.
+    `SELECT v.id AS version_id, v.module_key, v.version, cur.reason AS current_reason,
+            (SELECT min(t.set_at) FROM store_module_version_channels t
+              WHERE t.version_id = v.id AND t.channel = 'tester') AS on_tester_since,
+            (SELECT count(*) FROM module_install_reports r WHERE r.version_id = v.id AND r.ok)::int AS clean_installs,
+            (SELECT count(*) FROM module_install_reports r WHERE r.version_id = v.id AND NOT r.ok)::int AS failed_installs,
+            (SELECT coalesce(sum(e.error_count), 0) FROM module_runtime_error_counts e WHERE e.version_id = v.id)::int AS runtime_errors
+       FROM store_module_versions v
+       CROSS JOIN LATERAL (
+         SELECT c.channel, c.reason FROM store_module_version_channels c
+          WHERE c.version_id = v.id ORDER BY c.set_at DESC, c.id DESC LIMIT 1
+       ) cur
+      WHERE cur.channel = 'tester' AND ($1::bigint IS NULL OR v.id = $1)
+      ORDER BY v.id
+      LIMIT $2`, [versionId, limit]);
+  if (!rows.length) return [];
+  const { rows: signals } = await pool.query(
+    `SELECT DISTINCT ON (version_id, part) version_id, part, outcome, score
+       FROM module_assessment_signals
+      WHERE version_id = ANY($1) AND part IN ('security', 'tests')
+      ORDER BY version_id, part, measured_at DESC, id DESC`, [rows.map((r) => r.version_id)]);
+  const parts = new Map();
+  for (const s of signals) {
+    const k = String(s.version_id);
+    if (!parts.has(k)) parts.set(k, {});
+    parts.get(k)[s.part] = s;
+  }
+  return rows.map((r) => ({
+    versionId: r.version_id,
+    moduleKey: r.module_key,
+    version: r.version,
+    onTesterSince: r.on_tester_since,
+    currentReason: r.current_reason,
+    held: r.current_reason === REASONS.HELD,
+    cleanInstalls: r.clean_installs,
+    failedInstalls: r.failed_installs,
+    runtimeErrors: r.runtime_errors,
+    security: (parts.get(String(r.version_id)) || {}).security || null,
+    tests: (parts.get(String(r.version_id)) || {}).tests || null,
+  }));
+}
+
+// Insert the move only if the version's current row is still the one we read, so
+// a sweep racing a release (or another sweep) writes at most one move.
+async function insertMove(pool, { versionId, channel, reason, setBy = null, fromReason }) {
+  const { rowCount } = await pool.query(
+    `INSERT INTO store_module_version_channels (version_id, channel, reason, set_by)
+     SELECT $1, $2, $3, $4
+      WHERE (SELECT c.reason FROM store_module_version_channels c
+              WHERE c.version_id = $1 ORDER BY c.set_at DESC, c.id DESC LIMIT 1) = $5`,
+    [versionId, channel, reason, setBy, fromReason]);
+  return rowCount === 1;
+}
+
+// One pass: promote or hold every version on tester the rule says to. Returns
+// { promoted: [...], held: [...] }. Per-version failures are isolated.
+async function sweepPromotions({ db, now = new Date(), log = null } = {}) {
+  const pool = poolOf(db);
+  const out = { promoted: [], held: [] };
+  const evidence = await readTesterEvidence({ db: pool });
+  for (const e of evidence) {
+    const d = decidePromotion(e, now);
+    if (d.action === 'wait') continue;
+    try {
+      const channel = d.action === 'promote' ? 'general' : 'tester';
+      const moved = await insertMove(pool, { versionId: e.versionId, channel, reason: d.reason, fromReason: e.currentReason });
+      if (!moved) continue;
+      const entry = { version_id: String(e.versionId), module_key: e.moduleKey, version: e.version, reason: d.reason };
+      (d.action === 'promote' ? out.promoted : out.held).push(entry);
+      if (log) log.info(entry, `${e.moduleKey} ${e.version}: ${d.reason}`);
+    } catch (err) {
+      if (log) log.warn({ versionId: e.versionId, err: err.message }, 'promotion move failed; the next sweep retries');
+    }
+  }
+  return out;
+}
+
+// Where one version stands against the rule, for its author. null when the
+// version has no channel row.
+async function readStanding(versionId, { db, now = new Date() } = {}) {
+  const pool = poolOf(db);
+  const { rows } = await pool.query(
+    `SELECT channel, reason, set_by, set_at FROM store_module_version_channels
+      WHERE version_id = $1 ORDER BY set_at DESC, id DESC LIMIT 1`, [versionId]);
+  if (!rows.length) return null;
+  const cur = rows[0];
+  const standing = {
+    channel: cur.channel,
+    reason: cur.reason,
+    set_at: cur.set_at,
+    moved_by: cur.set_by == null ? 'system' : String(cur.set_by),
+    rule: RULE_TEXT,
+  };
+  if (cur.channel !== 'tester') return standing;
+  const [e] = await readTesterEvidence({ db: pool, versionId });
+  if (!e) return standing;
+  return { ...standing, next: decidePromotion(e, now) };
+}
+
+// A Metic+ person releases a HELD version to general. Only a held version: a
+// version still waiting for its time is the rule's to move, not a person's.
+async function releaseHeld(versionId, builderId, { db } = {}) {
+  const pool = poolOf(db);
+  const moved = await insertMove(pool, {
+    versionId, channel: 'general', reason: REASONS.RELEASED, setBy: builderId, fromReason: REASONS.HELD,
+  });
+  if (!moved) {
+    return { ok: false, code: 'not_held', status: 409, message: 'Only a version held on the tester channel can be released by a person. Others move on their own after seven days.' };
+  }
+  return { ok: true, channel: 'general', reason: REASONS.RELEASED };
+}
+
+const RULE_TEXT = `A new version goes to testers first. It reaches everyone after ${PROMOTE_AFTER_DAYS} days, `
+  + `or after ${EARLY_AFTER_DAYS} days once ${EARLY_CLEAN_INSTALLS} or more testers installed it cleanly, `
+  + 'as long as its security check and its own tests pass. Any failed tester install or runtime error '
+  + 'holds it on testers until a reviewer releases it.';
+
+// The in-process sweep, started by src/platform-server.js after listen (never by
+// a test). Hourly is plenty for a rule counted in days. MODULE_PROMOTION_DISABLED=1
+// switches it off.
+const SWEEP_MS = 60 * 60 * 1000;
+let timer = null;
+
+function start({ env = process.env, log = require('./logger').logger.child({ src: 'module-promotion' }) } = {}) {
+  if (env.MODULE_PROMOTION_DISABLED === '1' || timer) return false;
+  const run = () => sweepPromotions({ log }).catch((err) => log.warn({ err: err.message }, 'promotion sweep failed'));
+  setTimeout(run, 30_000).unref();
+  timer = setInterval(run, SWEEP_MS);
+  timer.unref();
+  return true;
+}
+
+module.exports = {
+  PROMOTE_AFTER_DAYS, EARLY_AFTER_DAYS, EARLY_CLEAN_INSTALLS, decidePromotion, sweepPromotions, readStanding, releaseHeld, start,
+};

package/src/bongos/route-rank-check.js

@@ -245,6 +245,9 @@ const EXPECTED_RANKS = {
   // Delisting a store module (task 1003797, ADR 0338 D2) stops every new install of
   // it for every instance, so it is pinned to its own atom.
   'POST /store/modules/:key/delist': 'perm:module.delist',
+  // Releasing a version the promotion gate held on tester (task 1003804) hands it to
+  // every project; the owner put it on the delist atom (2026-10-23), so it is pinned.
+  'POST /store/modules/:key/versions/:version/release': 'perm:module.delist',
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed
@@ -320,6 +323,10 @@ const GOVERNMENT_PINS = {
   'POST /government/asks/check': 'perm:board.vote.cast',
   'PUT /government/asks/:matterId': 'perm:board.vote.cast',
   'POST /government/asks/:matterId/pass': 'perm:board.vote.cast',
+  // the reword list (owner 2026-10-23): a reader flags a card it cannot follow,
+  // a session reads the open flags; both under the docket's own atom
+  'POST /government/asks/:matterId/unclear': 'perm:board.vote.cast',
+  'GET /government/asks/unclear': 'perm:board.vote.cast',
   // task 1004564: a proposer withdraws their own open sitting before any vote —
   // the proposer's half of putting one up, so the same atom. The proposer-only
   // and no-votes walls are in withdrawItem (board-withdraw.js) and its write.

package/src/bongos/routes/me.js

@@ -184,6 +184,15 @@ module.exports = function buildMeRouter() {
     // same GET /me -> Conductor path, deliberately not a second mechanism.
     // default-on, so present in prod; null when the module is off.
     const specialities = seams.resolveOptional('specialities');
+    // task 1004777: stuck page tweaks this builder should be told about, through
+    // the copy-desk PORT (core never imports the module, ADR 0093). Started here so
+    // it runs beside the fan-out below; [] when copy-desk is off or the read fails.
+    const stuckPageTweaksP = (async () => {
+      try {
+        const port = seams.resolveOptional('copy-desk.stuckPageTweaksFor');
+        return typeof port === 'function' ? await port(req.builder.id, req.builder.rank) : [];
+      } catch (_) { return []; }
+    })();
     const [
       builder, activeClaims, estVsActual, unlocked, lockedWithProgress, streakInfo,
       recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, cliAuthed,
@@ -593,6 +602,8 @@ module.exports = function buildMeRouter() {
         openTaskRecommendations: taskRecommendationCount,
         // task 1003178 (C08): open mingle introductions waiting on this builder.
         openMingleIntroductions: mingleIntroductionCount,
+        // task 1004777: one Needs-attention line per stuck page tweak.
+        stuckPageTweaks: await stuckPageTweaksP,
       }) : [],
     };
     // Module→core contribution seam (BV1.R42, ADR 0083). Let each enabled module

package/src/bongos/routes/modules.js

@@ -112,6 +112,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 const { listOverrides, setOverride } = require('../module-overrides');
 const { listCatalog, SORT_PARTS } = require('../module-listing');
 const { readTesting, setTester, setGeneralOnly } = require('../module-testing');
+const { readStanding, releaseHeld } = require('../module-promotion');
 
 // The sentence for a toggle that waits on a restart (task 1004463). 'routes' are the
 // module's pages, 'pollers' its background jobs. PURE.
@@ -578,6 +579,51 @@ module.exports = function buildModulesRouter() {
       res.json({ ok: true, module_key: key, status: r.module.status, delisted_at: r.module.delisted_at });
     }));
 
+  // GET /api/bongos/store/modules/:key/versions/:version/channel — where a version
+  // stands on the promotion gate (task 1003804, ADR 0344 D3): its current channel,
+  // who moved it there and why, the rule in plain words, and on tester the numbers
+  // the rule reads and what it is waiting for. Any signed-in builder may read it, so
+  // an author is never left guessing why a version has not reached everyone.
+  router.get('/store/modules/:key/versions/:version/channel', auth.requireBuilder,
+    asyncHandler('GET /store/modules/:key/versions/:version/channel', async (req, res) => {
+      const { key, version } = req.params;
+      if (!KEY_RE.test(key) || !parseVersion(version)) {
+        return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      }
+      const r = await resolveReadable(key, version);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      const standing = await readStanding(r.version.id);
+      if (!standing) return res.fail('version_has_no_channel', { status: 404, message: `${key} ${version} has no release channel recorded.` });
+      res.set('Cache-Control', 'no-store');
+      res.json({ module_key: key, version, ...standing });
+    }));
+
+  // POST /api/bongos/store/modules/:key/versions/:version/release — a Metic+ person
+  // releases a version the promotion gate HELD on tester (a tester reported a failed
+  // install or errors) to general (task 1003804). Gated on module.delist: the owner
+  // ruled (2026-10-23) the people who may take a module out of the store are the ones
+  // who may let a held version out, with no new permission. Only a held version: one
+  // still waiting for its time is the rule's to move. A reason is required; the audit
+  // middleware records it with who released it, and set_by on the new channel row.
+  router.post('/store/modules/:key/versions/:version/release', auth.requireBuilder, auth.requirePermission('module.delist'),
+    asyncHandler('POST /store/modules/:key/versions/:version/release', async (req, res) => {
+      if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 2000 } })) return;
+      const { key, version } = req.params;
+      if (!KEY_RE.test(key) || !parseVersion(version)) {
+        return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      }
+      const reason = String(req.body?.reason || '').trim();
+      if (!reason) {
+        return res.fail('reason_required', { status: 400, message: 'Say why this held version is safe for everyone, in reason.' });
+      }
+      const r = await resolveReadable(key, version);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      const out = await releaseHeld(r.version.id, req.builder.id);
+      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
+      log.info({ versionId: r.version.id, builderId: req.builder.id }, `${key} ${version} released from hold to general`);
+      res.json({ ok: true, module_key: key, version, channel: out.channel, reason: out.reason });
+    }));
+
   // GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the
   // read side of the entitlement record (task 1003813, ADR 0338 D1). Own-scoped
   // like /me/sessions: the holder is ALWAYS the caller (holder_kind 'builder',

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.166'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.168'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/platform-server.js

@@ -420,6 +420,11 @@ if (require.main === module) {
       // starts the pollers never writes the tally or spawns the sender.
       try { startErrorTally(); startErrorReports(); }
       catch (e) { logger.warn({ err: e.message }, 'module error tally did not start; module error counts are not kept'); }
+      // The store's promotion gate (task 1003804): an hourly sweep moves tester-channel
+      // versions to general, or holds them, by ADR 0344 D3's rule. Here, not in
+      // startBackgroundServices(), so a test that starts the pollers writes no channel row.
+      try { const { start: startPromotionSweep } = require('./bongos/module-promotion'); startPromotionSweep(); }
+      catch (e) { logger.warn({ err: e.message }, 'module promotion sweep did not start; tester versions will not move to general'); }
     });
   })().catch((err) => {
     // THE AWAIT ABOVE MUST NOT SOFTEN A FATAL BOOT (task 1002857, caught by

package/tests/claim_gate_ci_unblock.mjs

@@ -13,6 +13,10 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
+// task 1004788: fixable strands gate only at REBASE_GATE_LIMIT (default 3). This
+// suite's fake builder owes ONE, and what it pins is the P1-infra exemption from
+// a gate that IS shut, so the limit is set to 1 to keep the gate shut.
+process.env.REBASE_GATE_LIMIT = '1';
 
 let passed = 0;
 let failed = 0;

package/tests/claim_gate_rebase.mjs

@@ -14,6 +14,9 @@ import { strict as assert } from 'node:assert';
 const require = createRequire(import.meta.url);
 const { Pool } = require('pg');
 
+// Cases 1-7 predate task 1004788 and pin the gate's original single-strand shape,
+// so they run with the limit at 1; cases 8-10 move it back to the default (3).
+process.env.REBASE_GATE_LIMIT = '1';
 const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
 try {
   await pool.query('SELECT 1');
@@ -32,13 +35,16 @@ const VER = 'ZZZ-CG', WORKER = 90000201, STALLED = 90000201, FRESH = 90000202;
 const AGED = 90000203, FRESH2 = 90000204, AGED_OTHER = 90000205;
 // task 1004370 — the CI-unblock exemption.
 const CIFIX = 90000206;
+// task 1004788 — the set-aside and the limit.
+const GUARDED = 90000207, FRESH3 = 90000208, FIX1 = 90000209, FIX2 = 90000210, FIX3 = 90000211;
+const ALL_IDS = [90000201, 90000202, 90000203, 90000204, 90000205, 90000206, 90000207, 90000208, 90000209, 90000210, 90000211];
 const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
 
 async function cleanup() {
   await q(`DELETE FROM builder_achievements WHERE builder_id=$1`, [WORKER]).catch(() => {});
-  await q(`DELETE FROM credit_log WHERE builder_id=$1 OR task_id = ANY($2::bigint[])`, [WORKER, [STALLED, FRESH, AGED, FRESH2, AGED_OTHER, CIFIX]]).catch(() => {});
-  await q(`DELETE FROM claims WHERE task_id = ANY($1::bigint[])`, [[STALLED, FRESH, AGED, FRESH2, AGED_OTHER, CIFIX]]).catch(() => {});
-  await q(`DELETE FROM tasks WHERE id = ANY($1::bigint[])`, [[STALLED, FRESH, AGED, FRESH2, AGED_OTHER, CIFIX]]).catch(() => {});
+  await q(`DELETE FROM credit_log WHERE builder_id=$1 OR task_id = ANY($2::bigint[])`, [WORKER, ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM claims WHERE task_id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
+  await q(`DELETE FROM tasks WHERE id = ANY($1::bigint[])`, [ALL_IDS]).catch(() => {});
   await q(`DELETE FROM builders WHERE id=$1`, [WORKER]).catch(() => {});
   await q(`DELETE FROM versions WHERE id=$1`, [VER]).catch(() => {});
 }
@@ -151,6 +157,53 @@ try {
   ok((await db.needsRebaseTasksForBuilder(String(WORKER))).some((t) => Number(t.id) === AGED_OTHER),
     'and the owed rebase is still reported: the exemption lets one claim through, it clears nothing');
 
+  // ---------------------------------------------------------------------------
+  // task 1004788 — one stuck land must not block every claim. A strand parked on
+  // a SERVER-SIDE guard is set aside (never gates, still reported); fixable
+  // strands gate only once REBASE_GATE_LIMIT pile up; and the batch dry run and
+  // the batch claim ask the same question as claimTask.
+  // ---------------------------------------------------------------------------
+  // 8) Limit still 1, AGED_OTHER (fixable) cleared: a server-guard strand alone does not gate.
+  await q(`UPDATE tasks SET status='shipped', needs_rebase=false WHERE id=$1`, [AGED_OTHER]);
+  await q(`UPDATE claims SET released_at = now() WHERE task_id = ANY($1::bigint[]) AND released_at IS NULL`, [[CIFIX]]);
+  await seedStrand(GUARDED, 'strand:branch_modifies_executed_code:.gitattributes', 1);
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind) VALUES ($1,$2,'fresh3','ready',10,'feature')`, [FRESH3, VER]);
+  const claim3 = await db.claimTask({ taskId: String(FRESH3), builderId: String(WORKER), worktreeName: 'cg-fresh3' });
+  ok(claim3 && Number(claim3.task_id) === FRESH3, 'a confirmed task parked on a server-side guard does not refuse a new claim');
+  ok((await db.needsRebaseTasksForBuilder(String(WORKER))).some((t) => Number(t.id) === GUARDED),
+    'the set-aside task is still reported as owed, never dropped');
+  await q(`UPDATE claims SET released_at = now() WHERE task_id = $1 AND released_at IS NULL`, [FRESH3]);
+  await q(`UPDATE tasks SET status='ready' WHERE id=$1`, [FRESH3]);
+
+  // 9) Default limit (3): one and two fixable strands do not gate; the third does.
+  delete process.env.REBASE_GATE_LIMIT;
+  await seedStrand(FIX1, 'strand:unresolvable_conflict:docs/x.json', 1);
+  await seedStrand(FIX2, 'strand:pr_not_landed', 1);
+  const v2 = await db.validateClaimBatch({ taskIds: [FRESH3], builderId: String(WORKER) });
+  ok(!JSON.stringify(v2).includes('REBASE_REQUIRED'), 'two fixable strands (+ one set aside) do not gate the dry run');
+  const claim4 = await db.claimTask({ taskId: String(FRESH3), builderId: String(WORKER), worktreeName: 'cg-fresh3b' });
+  ok(claim4 && Number(claim4.task_id) === FRESH3, 'two fixable strands do not refuse a claim');
+  await q(`UPDATE claims SET released_at = now() WHERE task_id = $1 AND released_at IS NULL`, [FRESH3]);
+  await q(`UPDATE tasks SET status='ready' WHERE id=$1`, [FRESH3]);
+
+  await seedStrand(FIX3, 'strand:pr_not_landed', 1);
+  let threw3 = null;
+  try { await db.claimTask({ taskId: String(FRESH3), builderId: String(WORKER), worktreeName: 'cg-fresh3c' }); } catch (e) { threw3 = e; }
+  ok(threw3 && threw3.code === 'REBASE_REQUIRED', 'fixable strands at the limit still refuse');
+  const named = (threw3.rebaseTasks || []);
+  ok(named.filter((t) => !t.waiting).map((t) => Number(t.id)).sort().join() === [FIX1, FIX2, FIX3].sort().join(),
+    'the refusal names exactly the fixable tasks as gating');
+  ok(named.some((t) => t.waiting && Number(t.id) === GUARDED && /server-side guard/.test(t.waits_on)),
+    'and lists the set-aside one as waiting, with what it waits on');
+
+  // 10) The batch dry run and the batch claim agree with claimTask.
+  const v3 = await db.validateClaimBatch({ taskIds: [FRESH3], builderId: String(WORKER) });
+  ok(JSON.stringify(v3).includes('REBASE_REQUIRED'), 'the batch dry run refuses exactly when claimTask does');
+  let batchOut = null, batchErr = null;
+  try { batchOut = await db.claimTasksBatch({ taskIds: [FRESH3], builderId: String(WORKER), worktreePrefix: 'cg-b' }); } catch (e) { batchErr = e; }
+  ok(JSON.stringify(batchOut || batchErr).includes('REBASE_REQUIRED'), 'the batch claim refuses too');
+  ok((await q(`SELECT status FROM tasks WHERE id=$1`, [FRESH3]))[0].status === 'ready', 'and claims nothing');
+
   console.log(`\nclaim_gate_rebase (ADR 0120 part 3): ${pass} passed, 0 failed`);
 } catch (e) {
   console.error('claim_gate_rebase.mjs FAILED:', e.stack || e.message);

package/tests/copy_desk_page_editor.mjs

@@ -104,7 +104,7 @@ try {
       ['L0004', 'greeting', 'Your desk is quiet today', 'engineer'],
       ['L0005', 'footer', 'Resume where you left off', null],
     ]);
-    assert.deepEqual(r.body.notes, { shared: 'changes this on every page', engineer: 'goes to an engineer' });
+    assert.deepEqual(r.body.notes, { shared: 'changes this on every page', engineer: 'goes to an engineer', guarded: 'must still say' });
     assert.equal(r.body.round, null);
     assert.equal(r.body.draft, null);
     assert.deepEqual(r.body.counter, { changed: 0, total: 5 });