@bongos/core 1.21.167 → 1.21.169

package/scripts/gds/ask.js

@@ -135,11 +135,68 @@ async function check(file, deps = {}) {
   return { code: v.ok ? 0 : 1, lines: verdictLines(v) };
 }
 
+// ---------- the reword list (owner, 2026-10-23) ----------
+// A reader pressed "?" on a city card: the matter's words did not make sense.
+// `unclear` prints what waits for a rewrite (the flagged matters, or with
+// --legacy every open matter that waits on a person and has no stored card
+// yet), each with the words it has now; `put` stores the rewritten card
+// (PUT /government/asks/:matter), which closes the matter's flag.
+async function client(deps) {
+  if (deps && deps.client) return deps.client;
+  const lib = require('./cli-lib');
+  if (!lib.readSessionToken()) throw new Error('no Bongos session — run /builder-setup first');
+  return lib.cliClient();
+}
+function matterLines(m) {
+  const out = [`${m.id}  [${m.building}]${m.flag && m.flag.times > 1 ? `  flagged ${m.flag.times}x` : ''}`];
+  out.push(`  title:  ${String(m.title || '').trim()}`);
+  if (m.detail) out.push(`  detail: ${String(m.detail).replace(/\s+/g, ' ').trim().slice(0, 600)}`);
+  if (m.ask) out.push(`  card:   ${m.ask.question} (${(m.ask.options || []).map((o) => o.label).join(' / ')})`);
+  if (m.flag && m.flag.note) out.push(`  why unclear: ${m.flag.note}`);
+  if (Array.isArray(m.acts) && m.acts.length) out.push(`  acts:   ${m.acts.map((a) => a.key + (Array.isArray(a.options) && a.options.length ? '(' + a.options.map((o) => o.key).join('|') + ')' : '')).join(', ')}`);
+  return out;
+}
+async function unclear({ legacy = false, json = false } = {}, deps = {}) {
+  const api = await client(deps);
+  let list;
+  if (legacy) {
+    const r = await api.request('GET', '/government/docket');
+    if (!r || !r.ok) return { code: 1, lines: [`ask: the docket could not be read (${r && r.status}).`] };
+    list = ((r.data && r.data.matters) || []).filter((m) => m && m.state === 'needs' && !m.ask)
+      .map((m) => ({ id: m.id, building: m.building, source: m.source, title: m.title, detail: m.detail || null, ask: null, acts: m.acts || [], flag: m.unclear || null }));
+  } else {
+    const r = await api.request('GET', '/government/asks/unclear');
+    if (!r || !r.ok) return { code: 1, lines: [`ask: the reword list could not be read (${r && r.status}).`] };
+    list = (r.data && r.data.matters) || [];
+  }
+  if (json) return { code: 0, lines: [JSON.stringify(list, null, 2)] };
+  if (!list.length) return { code: 0, lines: [legacy ? 'ask: every open matter already carries a card.' : 'ask: nothing on the reword list.'] };
+  const lines = [`${list.length} ${legacy ? 'open matter(s) with no card yet' : 'matter(s) flagged as unclear'}:`, ''];
+  list.forEach((m) => { lines.push(...matterLines(m), ''); });
+  lines.push('Write each one a card (node scripts/gds/ask.js template), check it, then: node scripts/gds/ask.js put <matter-id> <file>');
+  return { code: 0, lines };
+}
+async function put(matterId, file, deps = {}) {
+  let body;
+  try { body = readJson(file); } catch (e) { return { code: 2, lines: [`ask: could not read the card as JSON (${e.message}).`] }; }
+  const local = asks.checkAsk(askOf(body));
+  if (!local.ok) return { code: 1, lines: verdictLines({ ok: false, ask: null, errors: local.errors, where: 'local' }) };
+  const api = await client(deps);
+  const r = await api.request('PUT', '/government/asks/' + encodeURIComponent(matterId), { body: { ask: askOf(body) } });
+  if (r && r.ok && r.data && r.data.ok) return { code: 0, lines: [`ask: saved the card on ${matterId}; its "?" flag is closed.`, '', ...verdictLines({ ok: true, ask: r.data.ask, where: 'server' })] };
+  const err = r && r.data && r.data.error;
+  return { code: 1, lines: [`ask: ${matterId} was not saved (${r && r.status}${err ? ' ' + err.code : ''}). ${err && err.message ? err.message : ''}`.trim()] };
+}
+
 const USAGE = [
   'usage:',
   '  node scripts/gds/ask.js template          print a blank card to fill in',
   '  node scripts/gds/ask.js check <file|->    check a card; on a pass, print it as a person reads it',
   '      --local                               check with the rules here, without the server',
+  '  node scripts/gds/ask.js unclear           the reword list: matters a reader flagged with "?"',
+  '      --legacy                              instead: every open matter on a person with no card yet',
+  '      --json                                as JSON',
+  '  node scripts/gds/ask.js put <matter> <file>  store a rewritten card on a matter (closes its flag)',
 ].join('\n');
 
 async function main(argv = process.argv.slice(2)) {
@@ -153,6 +210,16 @@ async function main(argv = process.argv.slice(2)) {
     console.log(r.lines.join('\n'));
     return r.code;
   }
+  if (cmd === 'unclear') {
+    const r = await unclear({ legacy: argv.includes('--legacy'), json: argv.includes('--json') });
+    console.log(r.lines.join('\n'));
+    return r.code;
+  }
+  if (cmd === 'put' && argv[1] && argv[2]) {
+    const r = await put(argv[1], argv[2]);
+    console.log(r.lines.join('\n'));
+    return r.code;
+  }
   console.error(USAGE);
   return 2;
 }
@@ -161,4 +228,4 @@ if (require.main === module) {
   main().then((code) => { process.exitCode = code; }, (e) => { console.error(`ask: ${e && e.message}`); process.exitCode = 1; });
 }
 
-module.exports = { TEMPLATE, askOf, checkedAsk, postWithAsk, verdictLines, serverVerdict, check, main };
+module.exports = { TEMPLATE, askOf, checkedAsk, postWithAsk, verdictLines, serverVerdict, check, unclear, put, main };

package/scripts/gds/claim.js

@@ -369,7 +369,10 @@ function claimFailureGuidance({ code, message, d }, r, taskId, ctx) {
   // posture) and this surface dropped it on the floor. Name the owed tasks, then
   // print the server's menu.
   if (code === 'REBASE_REQUIRED') {
-    const owed = (d.rebaseTasks || d.rebase_tasks || []).slice(0, MAX_LISTED_TASKS);
+    // task 1004788: only the fixable ones gate; set-aside ones are listed apart.
+    const all = (d.rebaseTasks || d.rebase_tasks || []);
+    const owed = all.filter((t) => !t.waiting).slice(0, MAX_LISTED_TASKS);
+    const waiting = all.filter((t) => t.waiting).slice(0, MAX_LISTED_TASKS);
     lines.push(owed.length
       ? `Your queue is gated — ${owed.length} confirmed task(s) are waiting on your rebase:`
       : 'Your queue is gated — a confirmed task is waiting on your rebase.');
@@ -377,6 +380,8 @@ function claimFailureGuidance({ code, message, d }, r, taskId, ctx) {
       lines.push(`  - task ${t.id}${t.title ? `  ${clip(t.title)}` : ''}`);
       if (t.reason) lines.push(`      flagged: ${clip(t.reason)}`);
     }
+    if (waiting.length) lines.push('  Waiting, not on you (set aside; they land on their own):');
+    for (const t of waiting) lines.push(`  - task ${t.id}${t.title ? `  ${clip(t.title)}` : ''} — ${clip(t.waits_on || t.reason || 'outside you')}`);
     lines.push(`  ${clip(d.hint, 600) || 'Clear it with /strand-fix N, or rebase the branch and re-ship — or /builder-release it to give up on one.'}`);
     return { lines, exit: QUEUE_GATED_EXIT };
   }

package/scripts/gds/copy-apply.js

@@ -598,6 +598,8 @@ async function batchMain({ taskId, batchFile, dryRun, pageId = null, now = () =>
     log(`    -  ${a.before}`);
     log(`    +  ${a.after}`);
   }
+  // task 1004776: the submit's guarded-line warnings, so whoever applies sees them too.
+  for (const w of batch.warnings || []) log(`  ${w.key} WARNING: no longer says what it must: ${w.must_still_say}${w.guarded_by ? ` (guarded by ${w.guarded_by})` : ''}`);
   for (const x of result.refused) {
     log(`  ${x.key} REFUSED (${x.code})${x.detail && x.detail.what_this_means ? `: ${x.detail.what_this_means}` : ''}`);
     log(`    line: ${JSON.stringify(x.before)}`);

package/src/bongos/module-promotion.js

@@ -0,0 +1,219 @@
+'use strict';
+
+// src/bongos/module-promotion.js — the promotion gate: when a module version on
+// the tester channel moves to general, and when it is held (task 1003804, ADR 0344
+// D3; owner decisions 2026-10-23 recorded on the task).
+//
+// THE RULE, in the order it is applied:
+//   1. A version only ever moves while its Security gate has passed and its own
+//      tests pass (ADR 0343). Tests pass = every test file passed (score 100), or
+//      the module declares no tests (`no_data` is not a fail). Anything else —
+//      failed, pending, not yet run — waits; it is never held for it.
+//   2. HOLD: any tester reports a failed install, or any runtime error, on the
+//      version. A held version stays on tester until a Metic+ person releases it
+//      (`module.delist`, owner 2026-10-23) or a newer version replaces it.
+//   3. EARLY: from day 2 on tester, 5 or more holders reported a clean install and
+//      nobody reported a problem.
+//   4. SEVEN DAYS: on tester for 7 days. This applies whether or not any tester
+//      picked it up, so a module nobody volunteers for still gets updated — a
+//      version is only ever held on evidence, never for lack of testers.
+//
+// Every report on a tester-channel version comes from a tester, because only
+// testers are handed one (task 1003805), so the reports are counted as they are.
+//
+// A move is a NEW store_module_version_channels row (core_276), never an update:
+// set_by NULL when the sweep moves it, the person when a person releases it, and a
+// short reason code. decidePromotion is the whole rule and is pure, so the tests
+// drive it directly; sweepPromotions and releaseHeld are the two writers.
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const PROMOTE_AFTER_DAYS = 7;
+const EARLY_AFTER_DAYS = 2;
+const EARLY_CLEAN_INSTALLS = 5;
+const SWEEP_LIMIT = 200;
+
+const REASONS = Object.freeze({
+  AFTER_7_DAYS: 'promoted_after_7_days',
+  EARLY: 'promoted_early_clean_installs',
+  HELD: 'held_tester_errors',
+  RELEASED: 'released_by_person',
+});
+
+function poolOf(db) { return db || require('./pool').pool; }
+
+// Did the ADR 0343 checks pass? signals: the current row per part.
+function checksPass({ security, tests } = {}) {
+  if (!security || security.outcome !== 'passed') return false;
+  if (!tests) return false;
+  if (tests.outcome === 'no_data') return true;
+  return tests.outcome === 'scored' && Number(tests.score) === 100;
+}
+
+// The rule. evidence: { onTesterSince, held, security, tests, cleanInstalls,
+// failedInstalls, runtimeErrors }. Returns { action: 'promote'|'hold'|'wait',
+// reason, days_on_tester, ... } — the same object an author reads.
+function decidePromotion(evidence, now = new Date()) {
+  const since = new Date(evidence.onTesterSince);
+  const days = Math.max(0, (now.getTime() - since.getTime()) / DAY_MS);
+  const base = {
+    days_on_tester: Math.floor(days),
+    clean_installs: evidence.cleanInstalls || 0,
+    failed_installs: evidence.failedInstalls || 0,
+    runtime_errors: evidence.runtimeErrors || 0,
+    checks_passed: checksPass(evidence),
+    general_on: new Date(since.getTime() + PROMOTE_AFTER_DAYS * DAY_MS).toISOString(),
+  };
+  if (evidence.held) return { action: 'wait', reason: 'held_until_released', ...base };
+  if (base.failed_installs > 0 || base.runtime_errors > 0) return { action: 'hold', reason: REASONS.HELD, ...base };
+  if (!base.checks_passed) return { action: 'wait', reason: 'checks_not_passed', ...base };
+  if (days >= PROMOTE_AFTER_DAYS) return { action: 'promote', reason: REASONS.AFTER_7_DAYS, ...base };
+  if (days >= EARLY_AFTER_DAYS && base.clean_installs >= EARLY_CLEAN_INSTALLS) {
+    return { action: 'promote', reason: REASONS.EARLY, ...base };
+  }
+  return { action: 'wait', reason: 'waiting_for_time_or_installs', ...base };
+}
+
+// The evidence for every version currently on tester (optionally one version),
+// bounded. onTesterSince is when it reached tester (its first tester row since
+// it was last off tester — in practice its publish), held is whether its current
+// row is a hold.
+async function readTesterEvidence({ db, versionId = null, limit = SWEEP_LIMIT } = {}) {
+  const pool = poolOf(db);
+  const { rows } = await pool.query(
+    // One probe per version into idx_store_module_version_channels_current (its
+    // newest row, LIMIT 1), never a DISTINCT ON over every version's whole move
+    // history: the work grows with versions, not with how often they moved.
+    `SELECT v.id AS version_id, v.module_key, v.version, cur.reason AS current_reason,
+            (SELECT min(t.set_at) FROM store_module_version_channels t
+              WHERE t.version_id = v.id AND t.channel = 'tester') AS on_tester_since,
+            (SELECT count(*) FROM module_install_reports r WHERE r.version_id = v.id AND r.ok)::int AS clean_installs,
+            (SELECT count(*) FROM module_install_reports r WHERE r.version_id = v.id AND NOT r.ok)::int AS failed_installs,
+            (SELECT coalesce(sum(e.error_count), 0) FROM module_runtime_error_counts e WHERE e.version_id = v.id)::int AS runtime_errors
+       FROM store_module_versions v
+       CROSS JOIN LATERAL (
+         SELECT c.channel, c.reason FROM store_module_version_channels c
+          WHERE c.version_id = v.id ORDER BY c.set_at DESC, c.id DESC LIMIT 1
+       ) cur
+      WHERE cur.channel = 'tester' AND ($1::bigint IS NULL OR v.id = $1)
+      ORDER BY v.id
+      LIMIT $2`, [versionId, limit]);
+  if (!rows.length) return [];
+  const { rows: signals } = await pool.query(
+    `SELECT DISTINCT ON (version_id, part) version_id, part, outcome, score
+       FROM module_assessment_signals
+      WHERE version_id = ANY($1) AND part IN ('security', 'tests')
+      ORDER BY version_id, part, measured_at DESC, id DESC`, [rows.map((r) => r.version_id)]);
+  const parts = new Map();
+  for (const s of signals) {
+    const k = String(s.version_id);
+    if (!parts.has(k)) parts.set(k, {});
+    parts.get(k)[s.part] = s;
+  }
+  return rows.map((r) => ({
+    versionId: r.version_id,
+    moduleKey: r.module_key,
+    version: r.version,
+    onTesterSince: r.on_tester_since,
+    currentReason: r.current_reason,
+    held: r.current_reason === REASONS.HELD,
+    cleanInstalls: r.clean_installs,
+    failedInstalls: r.failed_installs,
+    runtimeErrors: r.runtime_errors,
+    security: (parts.get(String(r.version_id)) || {}).security || null,
+    tests: (parts.get(String(r.version_id)) || {}).tests || null,
+  }));
+}
+
+// Insert the move only if the version's current row is still the one we read, so
+// a sweep racing a release (or another sweep) writes at most one move.
+async function insertMove(pool, { versionId, channel, reason, setBy = null, fromReason }) {
+  const { rowCount } = await pool.query(
+    `INSERT INTO store_module_version_channels (version_id, channel, reason, set_by)
+     SELECT $1, $2, $3, $4
+      WHERE (SELECT c.reason FROM store_module_version_channels c
+              WHERE c.version_id = $1 ORDER BY c.set_at DESC, c.id DESC LIMIT 1) = $5`,
+    [versionId, channel, reason, setBy, fromReason]);
+  return rowCount === 1;
+}
+
+// One pass: promote or hold every version on tester the rule says to. Returns
+// { promoted: [...], held: [...] }. Per-version failures are isolated.
+async function sweepPromotions({ db, now = new Date(), log = null } = {}) {
+  const pool = poolOf(db);
+  const out = { promoted: [], held: [] };
+  const evidence = await readTesterEvidence({ db: pool });
+  for (const e of evidence) {
+    const d = decidePromotion(e, now);
+    if (d.action === 'wait') continue;
+    try {
+      const channel = d.action === 'promote' ? 'general' : 'tester';
+      const moved = await insertMove(pool, { versionId: e.versionId, channel, reason: d.reason, fromReason: e.currentReason });
+      if (!moved) continue;
+      const entry = { version_id: String(e.versionId), module_key: e.moduleKey, version: e.version, reason: d.reason };
+      (d.action === 'promote' ? out.promoted : out.held).push(entry);
+      if (log) log.info(entry, `${e.moduleKey} ${e.version}: ${d.reason}`);
+    } catch (err) {
+      if (log) log.warn({ versionId: e.versionId, err: err.message }, 'promotion move failed; the next sweep retries');
+    }
+  }
+  return out;
+}
+
+// Where one version stands against the rule, for its author. null when the
+// version has no channel row.
+async function readStanding(versionId, { db, now = new Date() } = {}) {
+  const pool = poolOf(db);
+  const { rows } = await pool.query(
+    `SELECT channel, reason, set_by, set_at FROM store_module_version_channels
+      WHERE version_id = $1 ORDER BY set_at DESC, id DESC LIMIT 1`, [versionId]);
+  if (!rows.length) return null;
+  const cur = rows[0];
+  const standing = {
+    channel: cur.channel,
+    reason: cur.reason,
+    set_at: cur.set_at,
+    moved_by: cur.set_by == null ? 'system' : String(cur.set_by),
+    rule: RULE_TEXT,
+  };
+  if (cur.channel !== 'tester') return standing;
+  const [e] = await readTesterEvidence({ db: pool, versionId });
+  if (!e) return standing;
+  return { ...standing, next: decidePromotion(e, now) };
+}
+
+// A Metic+ person releases a HELD version to general. Only a held version: a
+// version still waiting for its time is the rule's to move, not a person's.
+async function releaseHeld(versionId, builderId, { db } = {}) {
+  const pool = poolOf(db);
+  const moved = await insertMove(pool, {
+    versionId, channel: 'general', reason: REASONS.RELEASED, setBy: builderId, fromReason: REASONS.HELD,
+  });
+  if (!moved) {
+    return { ok: false, code: 'not_held', status: 409, message: 'Only a version held on the tester channel can be released by a person. Others move on their own after seven days.' };
+  }
+  return { ok: true, channel: 'general', reason: REASONS.RELEASED };
+}
+
+const RULE_TEXT = `A new version goes to testers first. It reaches everyone after ${PROMOTE_AFTER_DAYS} days, `
+  + `or after ${EARLY_AFTER_DAYS} days once ${EARLY_CLEAN_INSTALLS} or more testers installed it cleanly, `
+  + 'as long as its security check and its own tests pass. Any failed tester install or runtime error '
+  + 'holds it on testers until a reviewer releases it.';
+
+// The in-process sweep, started by src/platform-server.js after listen (never by
+// a test). Hourly is plenty for a rule counted in days. MODULE_PROMOTION_DISABLED=1
+// switches it off.
+const SWEEP_MS = 60 * 60 * 1000;
+let timer = null;
+
+function start({ env = process.env, log = require('./logger').logger.child({ src: 'module-promotion' }) } = {}) {
+  if (env.MODULE_PROMOTION_DISABLED === '1' || timer) return false;
+  const run = () => sweepPromotions({ log }).catch((err) => log.warn({ err: err.message }, 'promotion sweep failed'));
+  setTimeout(run, 30_000).unref();
+  timer = setInterval(run, SWEEP_MS);
+  timer.unref();
+  return true;
+}
+
+module.exports = {
+  PROMOTE_AFTER_DAYS, EARLY_AFTER_DAYS, EARLY_CLEAN_INSTALLS, decidePromotion, sweepPromotions, readStanding, releaseHeld, start,
+};

package/src/bongos/module-store.js

@@ -256,12 +256,34 @@ function isFreePrice(priceRow) {
   return priceRow.price_cents === 0 || priceRow.price_credits === 0;
 }
 
+// The release channels a project is handed versions from (task 1003805, ADR 0344
+// D1/D2): a project that tests this module gets tester AND general versions, every
+// other project general only. 'withdrawn' is never in either list, so a withdrawn
+// version is never handed out (a copy already installed keeps working, ADR 0338 D2).
+function servedChannels(tester) {
+  return tester ? ['tester', 'general'] : ['general'];
+}
+
+// A version's current channel is its newest store_module_version_channels row
+// (core_276): a move is a new row, never an update. One probe per version into
+// idx_store_module_version_channels_current. `idCol` is the outer query's version
+// id column, and only these two literals are accepted, so no text reaches the SQL.
+const VERSION_ID_COLS = new Set(['store_module_versions.id', 'v.id']);
+function currentChannelSql(idCol) {
+  if (!VERSION_ID_COLS.has(idCol)) throw new Error(`currentChannelSql: unexpected column ${idCol}`);
+  return `(SELECT c.channel FROM store_module_version_channels c
+           WHERE c.version_id = ${idCol} ORDER BY c.set_at DESC, c.id DESC LIMIT 1)`;
+}
+
 // Resolve what an acquire of `key` (optionally at an exact `version`) would hand
 // over. Refuses an unknown or delisted module (ADR 0338 D2: a delisted module takes
 // no new acquisitions and serves no further versions) and an unknown version. With
 // no version asked for, the newest published version (semver order, not text).
+// `channels` (from servedChannels) limits it to versions currently on those
+// channels — the newest one there, or a refusal for an exact version that is not;
+// null skips the channel check (recording a version already placed).
 // Returns { ok: true, module, version, price, free } or { ok: false, status, code, message }.
-async function resolveAcquirable(key, { version = null, db } = {}) {
+async function resolveAcquirable(key, { version = null, channels = null, db } = {}) {
   const pool = db || require('./pool').pool;
   const refuse = (status, code, message) => ({ ok: false, status, code, message });
   const { rows: [mod] } = await pool.query(
@@ -270,16 +292,28 @@ async function resolveAcquirable(key, { version = null, db } = {}) {
   if (mod.status === 'delisted') return refuse(409, 'module_delisted', `"${key}" is delisted: it can no longer be acquired or downloaded (ADR 0338 D2).`);
   const { rows: versions } = await pool.query(
     `SELECT id, module_key, version, core_version, tree_sha256, tarball_sha256, tarball_bytes,
-            artifact_path, published_at
+            artifact_path, published_at, ${currentChannelSql('store_module_versions.id')} AS channel
        FROM store_module_versions WHERE module_key = $1`, [key]);
+  const served = (r) => !channels || channels.includes(r.channel);
   let row;
   if (version) {
     row = versions.find((r) => r.version === version);
     if (!row) return refuse(404, 'version_not_found', `"${key}" has no published version ${version}.`);
+    if (!served(row)) {
+      return refuse(409, 'version_not_on_channel', row.channel === 'withdrawn'
+        ? `"${key}" ${version} was withdrawn: it is no longer handed out.`
+        : `"${key}" ${version} is still with testers, and this project takes general versions of it.`);
+    }
   } else {
-    row = versions.filter((r) => parseVersion(r.version))
+    row = versions.filter((r) => parseVersion(r.version) && served(r))
       .sort((a, b) => cmp(parseVersion(a.version), parseVersion(b.version))).pop();
-    if (!row) return refuse(404, 'no_versions', `"${key}" has no published version yet.`);
+    if (!row) {
+      if (!versions.length) return refuse(404, 'no_versions', `"${key}" has no published version yet.`);
+      const testing = versions.some((r) => r.channel === 'tester');
+      return refuse(404, 'no_versions_on_channel', testing
+        ? `"${key}" has no version on the channel this project takes yet: its newest is still with testers.`
+        : `"${key}" has no version this project can be handed: every version was withdrawn.`);
+    }
   }
   const { rows: [price] } = await pool.query(
     `SELECT price_cents, price_credits, set_at FROM store_module_prices
@@ -321,21 +355,25 @@ async function publishedVersionSet(keys, { db } = {}) {
 // takes no entitlement and refuses nothing, so a delisted module still answers,
 // with its status, and the caller says it gets no further versions (ADR 0338 D2).
 // A key the store does not know is simply absent. One query for the whole list.
-// Returns { [key]: { version, core_version, status } }.
-async function latestVersions(keys, { db } = {}) {
+// `channelsFor(key)` (servedChannels per module) counts only versions on the
+// channels this project takes, so upgrade reports what update would hand over
+// (task 1003805); a key with nothing on them is absent too.
+// Returns { [key]: { version, core_version, status, channel } }.
+async function latestVersions(keys, { db, channelsFor = null } = {}) {
   if (!keys.length) return {};
   const pool = db || require('./pool').pool;
   const { rows } = await pool.query(
-    `SELECT v.module_key, v.version, v.core_version, m.status
+    `SELECT v.module_key, v.version, v.core_version, m.status, ${currentChannelSql('v.id')} AS channel
        FROM store_module_versions v JOIN store_modules m ON m.module_key = v.module_key
       WHERE v.module_key = ANY($1)`, [keys]);
   const out = {};
   for (const r of rows) {
     const next = parseVersion(r.version);
     if (!next) continue;
+    if (channelsFor && !channelsFor(r.module_key).includes(r.channel)) continue;
     const have = out[r.module_key];
     if (have && cmp(parseVersion(have.version), next) >= 0) continue;
-    out[r.module_key] = { version: r.version, core_version: r.core_version, status: r.status };
+    out[r.module_key] = { version: r.version, core_version: r.core_version, status: r.status, channel: r.channel };
   }
   return out;
 }
@@ -383,6 +421,6 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
-  isFreePrice, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
+  isFreePrice, servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
   delistModule, delistedKeySet, storeDir, storeDirFor, migrateLegacyStore,
 };

package/src/bongos/route-rank-check.js

@@ -245,6 +245,9 @@ const EXPECTED_RANKS = {
   // Delisting a store module (task 1003797, ADR 0338 D2) stops every new install of
   // it for every instance, so it is pinned to its own atom.
   'POST /store/modules/:key/delist': 'perm:module.delist',
+  // Releasing a version the promotion gate held on tester (task 1003804) hands it to
+  // every project; the owner put it on the delist atom (2026-10-23), so it is pinned.
+  'POST /store/modules/:key/versions/:version/release': 'perm:module.delist',
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed
@@ -320,6 +323,10 @@ const GOVERNMENT_PINS = {
   'POST /government/asks/check': 'perm:board.vote.cast',
   'PUT /government/asks/:matterId': 'perm:board.vote.cast',
   'POST /government/asks/:matterId/pass': 'perm:board.vote.cast',
+  // the reword list (owner 2026-10-23): a reader flags a card it cannot follow,
+  // a session reads the open flags; both under the docket's own atom
+  'POST /government/asks/:matterId/unclear': 'perm:board.vote.cast',
+  'GET /government/asks/unclear': 'perm:board.vote.cast',
   // task 1004564: a proposer withdraws their own open sitting before any vote —
   // the proposer's half of putting one up, so the same atom. The proposer-only
   // and no-votes walls are in withdrawItem (board-withdraw.js) and its write.

package/src/bongos/routes/me.js

@@ -184,6 +184,15 @@ module.exports = function buildMeRouter() {
     // same GET /me -> Conductor path, deliberately not a second mechanism.
     // default-on, so present in prod; null when the module is off.
     const specialities = seams.resolveOptional('specialities');
+    // task 1004777: stuck page tweaks this builder should be told about, through
+    // the copy-desk PORT (core never imports the module, ADR 0093). Started here so
+    // it runs beside the fan-out below; [] when copy-desk is off or the read fails.
+    const stuckPageTweaksP = (async () => {
+      try {
+        const port = seams.resolveOptional('copy-desk.stuckPageTweaksFor');
+        return typeof port === 'function' ? await port(req.builder.id, req.builder.rank) : [];
+      } catch (_) { return []; }
+    })();
     const [
       builder, activeClaims, estVsActual, unlocked, lockedWithProgress, streakInfo,
       recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, cliAuthed,
@@ -593,6 +602,8 @@ module.exports = function buildMeRouter() {
         openTaskRecommendations: taskRecommendationCount,
         // task 1003178 (C08): open mingle introductions waiting on this builder.
         openMingleIntroductions: mingleIntroductionCount,
+        // task 1004777: one Needs-attention line per stuck page tweak.
+        stuckPageTweaks: await stuckPageTweaksP,
       }) : [],
     };
     // Module→core contribution seam (BV1.R42, ADR 0083). Let each enabled module

package/src/bongos/routes/modules.js

@@ -96,7 +96,7 @@ const moduleAssessVersion = require('../../../scripts/gds/module-assess-version'
 const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } = require('../module-entitlements');
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
-  resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
+  servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
   delistModule, delistedKeySet, migrateLegacyStore,
 } = require('../module-store');
 const {
@@ -111,7 +111,19 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
 const { listCatalog, SORT_PARTS } = require('../module-listing');
-const { readTesting, setTester, setGeneralOnly } = require('../module-testing');
+const { readTesting, setTester, setGeneralOnly, testsVersionsOf } = require('../module-testing');
+const { readStanding, releaseHeld } = require('../module-promotion');
+
+// The channels this project takes, per module (task 1003805, ADR 0344 D1/D2): a
+// tester project gets tester and general versions, except of a module it marked
+// "general only"; everyone else gets general. A choice that cannot be read reads as
+// NOT a tester (module-testing.js), so it hands out general, never tester.
+async function projectChannels() {
+  let testing = null;
+  try { testing = await readTesting(); }
+  catch (e) { log.warn({ err: e.message }, 'tester choice unreadable; serving general versions'); }
+  return (key) => servedChannels(testsVersionsOf(testing, key));
+}
 
 // The sentence for a toggle that waits on a restart (task 1004463). 'routes' are the
 // module's pages, 'pollers' its background jobs. PURE.
@@ -578,6 +590,51 @@ module.exports = function buildModulesRouter() {
       res.json({ ok: true, module_key: key, status: r.module.status, delisted_at: r.module.delisted_at });
     }));
 
+  // GET /api/bongos/store/modules/:key/versions/:version/channel — where a version
+  // stands on the promotion gate (task 1003804, ADR 0344 D3): its current channel,
+  // who moved it there and why, the rule in plain words, and on tester the numbers
+  // the rule reads and what it is waiting for. Any signed-in builder may read it, so
+  // an author is never left guessing why a version has not reached everyone.
+  router.get('/store/modules/:key/versions/:version/channel', auth.requireBuilder,
+    asyncHandler('GET /store/modules/:key/versions/:version/channel', async (req, res) => {
+      const { key, version } = req.params;
+      if (!KEY_RE.test(key) || !parseVersion(version)) {
+        return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      }
+      const r = await resolveReadable(key, version);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      const standing = await readStanding(r.version.id);
+      if (!standing) return res.fail('version_has_no_channel', { status: 404, message: `${key} ${version} has no release channel recorded.` });
+      res.set('Cache-Control', 'no-store');
+      res.json({ module_key: key, version, ...standing });
+    }));
+
+  // POST /api/bongos/store/modules/:key/versions/:version/release — a Metic+ person
+  // releases a version the promotion gate HELD on tester (a tester reported a failed
+  // install or errors) to general (task 1003804). Gated on module.delist: the owner
+  // ruled (2026-10-23) the people who may take a module out of the store are the ones
+  // who may let a held version out, with no new permission. Only a held version: one
+  // still waiting for its time is the rule's to move. A reason is required; the audit
+  // middleware records it with who released it, and set_by on the new channel row.
+  router.post('/store/modules/:key/versions/:version/release', auth.requireBuilder, auth.requirePermission('module.delist'),
+    asyncHandler('POST /store/modules/:key/versions/:version/release', async (req, res) => {
+      if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 2000 } })) return;
+      const { key, version } = req.params;
+      if (!KEY_RE.test(key) || !parseVersion(version)) {
+        return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      }
+      const reason = String(req.body?.reason || '').trim();
+      if (!reason) {
+        return res.fail('reason_required', { status: 400, message: 'Say why this held version is safe for everyone, in reason.' });
+      }
+      const r = await resolveReadable(key, version);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      const out = await releaseHeld(r.version.id, req.builder.id);
+      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
+      log.info({ versionId: r.version.id, builderId: req.builder.id }, `${key} ${version} released from hold to general`);
+      res.json({ ok: true, module_key: key, version, channel: out.channel, reason: out.reason });
+    }));
+
   // GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the
   // read side of the entitlement record (task 1003813, ADR 0338 D1). Own-scoped
   // like /me/sessions: the holder is ALWAYS the caller (holder_kind 'builder',
@@ -621,9 +678,12 @@ module.exports = function buildModulesRouter() {
   // here changes what runs on this instance (install never enables; the CLI places
   // files on the CALLER's checkout).
   //
-  // Channels: every version is on the general channel until the channel table
-  // (task 1003815) and "install honours the channel" (task 1003805) land; those
-  // add the channel check to step 1 and step 2, beside the entitlement check.
+  // Channels (task 1003805, ADR 0344): steps 1 and 2 hand out only versions on a
+  // channel this project takes (projectChannels) — with no version asked for, the
+  // newest there. Install and update share step 1, so both honour it. A project
+  // that stops testing keeps the tester version it has; its next update is the
+  // newest general one, and update only moves forward, so nothing rolls back.
+  // Step 3 records what was already placed, so it does not re-check the channel.
   router.post('/store/modules/:key/acquire', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquire', async (req, res) => {
       const { key } = req.params;
@@ -635,7 +695,7 @@ module.exports = function buildModulesRouter() {
       if (wanted != null && !parseVersion(String(wanted))) {
         return res.fail('bad_version', { status: 400, message: 'A version is exact X.Y.Z.' });
       }
-      const r = await resolveAcquirable(key, { version: wanted || null });
+      const r = await resolveAcquirable(key, { version: wanted || null, channels: (await projectChannels())(key) });
       if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
 
       const holder = { moduleKey: key, holderKind: 'builder', holderRef: String(req.builder.id) };
@@ -660,7 +720,7 @@ module.exports = function buildModulesRouter() {
         tarball_sha256: v.tarball_sha256,
         tree_sha256: v.tree_sha256,
         tarball_bytes: Number(v.tarball_bytes),
-        channel: 'general',
+        channel: v.channel,
         entitlement: held.entitlement,
       });
     }));
@@ -671,7 +731,7 @@ module.exports = function buildModulesRouter() {
       if (!KEY_RE.test(key) || !parseVersion(version)) {
         return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
       }
-      const r = await resolveAcquirable(key, { version });
+      const r = await resolveAcquirable(key, { version, channels: (await projectChannels())(key) });
       if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
       const held = await checkEntitlement({ moduleKey: key, holderKind: 'builder', holderRef: String(req.builder.id) });
       if (!held.entitled) {
@@ -755,7 +815,9 @@ module.exports = function buildModulesRouter() {
 
   // The newest published version of each named module — what `bongos upgrade`
   // compares an instance's installed store modules against to report the updates
-  // available (task 1003787). `?keys=a,b,c`, at most STORE_LATEST_MAX_KEYS.
+  // available (task 1003787). `?keys=a,b,c`, at most STORE_LATEST_MAX_KEYS. Only
+  // versions on a channel this project takes count (task 1003805), so it reports
+  // exactly what `bongos module update` would hand over.
   //
   // rank: any-builder — a read of public store metadata (version numbers and the
   // core range each needs, the same facts the how-to page shows). It takes no
@@ -768,7 +830,7 @@ module.exports = function buildModulesRouter() {
       if (!keys.length || keys.length > STORE_LATEST_MAX_KEYS || !keys.every((k) => KEY_RE.test(k))) {
         return res.fail('bad_request', { status: 400, message: `keys is a comma-separated list of 1 to ${STORE_LATEST_MAX_KEYS} module keys (lowercase kebab-case).` });
       }
-      const latest = await latestVersions(keys);
+      const latest = await latestVersions(keys, { channelsFor: await projectChannels() });
       res.set('Cache-Control', 'no-store');
       res.json({ latest });
     }));