@bongos/core 1.21.168 → 1.21.169

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.168",
-  "core_contract": "1.21.168",
-  "source_commit": "81ee30904d575050d008bd2cc16c8ecb8ef9df18",
+  "core_version": "1.21.169",
+  "core_contract": "1.21.169",
+  "source_commit": "8b02f41534160e6504eabfe51100a2495d211974",
   "source_ref": "HEAD",
-  "built_at": "2026-10-23T16:53:45.959Z",
+  "built_at": "2026-10-23T17:05:22.541Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 609,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3192,
+    "functional_verbatim": 3193,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3830,
-  "tree_sha256": "249eab6a2df12b3cd7c9f4a9f0268db4ba0aa3947e9e29064ee37bd8ea110968",
+  "file_count": 3831,
+  "tree_sha256": "bac0beb6098d17b2b1f50303ea3e9fdee6fe962ca9b7670f43b1770dac79c7de",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2387,12 +2387,12 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "9505031bf22d91c4700dc34091784bfdce71eedec8f6ad4b5d88e860a4773f19"
+      "sha256": "01aa4a0660af5c27d90556aa30b440fb1236caeb75ea3ce2f0020437bbe11542"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "3850775c198edeece6ac5497a9f5788421a8082e21edb496a4b00a3fc7a6eb3d"
+      "sha256": "37dc2e5faa441c7300026b5d70bbfc05ff19639c12eae38fa2e4f3c4dcf7e899"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2927,12 +2927,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "182a1cf009b33b4a55c20b9a33fb0067c655d68b2bed6666a34b61777706d802"
+      "sha256": "2167306eca652743c7e6f345a0837ff342db271856e3ce08a6cd87f216cf4b23"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "dfb54888224c2d4735bd6411873fa7b1f4ebe3e95b2ce308ca83036289c7bb80"
+      "sha256": "9e3a88916b780e0ae8c842bebfe892f513a61e2a234ab32dd7480873bd7de94f"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -10602,12 +10602,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "49f0cefbacf1b7d854acc23f63b04804bbf3858ebec63aab8beb5a11e6ec42a1"
+      "sha256": "34102111462f50e10260246a90a52182e37c80d0ccd3bec9e803ebff646eb732"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6f48dbfc47a83cbcaf089d56c4dede80cf6f965d9b15279341cf1a270672da08"
+      "sha256": "12da6d57d97df3fa29bde1ad54891bbd8adb1a36cfcd1841a793a6b37ea24edb"
     },
     {
       "path": "public-docs/index.html",
@@ -10627,7 +10627,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "204380206f47e8b2456888adf61061ce51458d8183cfdfc6d5efd1bc54e33661"
+      "sha256": "fab9655657d0c99fa95529dde44fcdfac9fc830520286ba1b6f9682477e45992"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12762,7 +12762,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "fb6fdff53de296e7b8d981082013d57f65f1e89ae234a7d417e6e455578b94a3"
+      "sha256": "695c8f111d0cc1a3410128881c9624746df991c8e6017ae8df4ea1480cbf8239"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -12927,7 +12927,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "b76ae847ba4929ef1390e7600e425d89069a34e8e389d1a6a374bb18346db198"
+      "sha256": "7ac9ce1a3d82549db000176970670d551a3c9b61994dc68d1f122b346dfb0878"
     },
     {
       "path": "src/bongos/routes/my-passkeys.js",
@@ -13017,7 +13017,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e76395a143e487f9d4e7d0c6e0127be41c489d0d9b85b468cd37325dbe6c7ef1"
+      "sha256": "af3d3d00ecdd47a62cd383271cf2f606d0c695cd8ba189269764fd4108c0485d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -16644,6 +16644,11 @@
       "mode": "0000644",
       "sha256": "ba408278116825c7acc4889aca4dd03cab08a6c5c1c0bddfe361997e72fca38c"
     },
+    {
+      "path": "tests/module_channel_install.mjs",
+      "mode": "0000644",
+      "sha256": "b1e6c6f0481fad0dc1f760f33c393b31884f37e9beee357b52c231a4c65a8b7b"
+    },
     {
       "path": "tests/module_cli.mjs",
       "mode": "0000644",
@@ -16782,7 +16787,7 @@
     {
       "path": "tests/module_upgrade_updates.mjs",
       "mode": "0000644",
-      "sha256": "7260dabcf71a69d4ce41609e8a88c94c112fdda354f774dadf0a2648f4feacaf"
+      "sha256": "580f672c411c83c4ddc60308409f208ba3f00894c9112add59b94c65b95d6feb"
     },
     {
       "path": "tests/modules.mjs",

package/docs/api/openapi.json

@@ -23275,7 +23275,7 @@
           "store"
         ],
         "summary": "GET /store/modules/latest",
-        "description": "The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to report the updates available (task 1003787). `?keys=a,b,c`, at most STORE_LATEST_MAX_KEYS. rank: any-builder — a read of public store metadata (version numbers and the core range each needs, the same facts the how-to page shows). It takes no entitlement and changes nothing, unlike acquire; a key the store does not know is simply absent from the answer.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to report the updates available (task 1003787). `?keys=a,b,c`, at most STORE_LATEST_MAX_KEYS. Only versions on a channel this project takes count (task 1003805), so it reports exactly what `bongos module update` would hand over. rank: any-builder — a read of public store metadata (version numbers and the core range each needs, the same facts the how-to page shows). It takes no entitlement and changes nothing, unlike acquire; a key the store does not know is simply absent from the answer.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/modules.js",
         "responses": {
@@ -23313,7 +23313,7 @@
           "store"
         ],
         "summary": "POST /store/modules/:key/acquire",
-        "description": "---- install: acquire → download → record (task 1003785, ADR 0338 D1) ---- The server end of `bongos module install`. Three steps, so the store never records a version as acquired that the caller did not verify and place: 1. POST acquire — resolve the version, and take the entitlement: a free module (no price, or a zero price) is granted here with source 'free'; a priced one needs the buy action, which is area 8's (tasks 1003788/1003789) and answers 402 until then. 2. GET tarball — served only to a LIVE entitlement holder, never for a delisted module (ADR 0338 D2: no further versions served). 3. POST acquired — the CLI has verified the bytes with verifyModuleArtifact and placed them; recordAcquired stamps the exact version. Own-scoped like the entitlement reads: the holder is always the caller (holder_kind 'builder'), never named in the request, so requireBuilder is the gate — any signed-in builder may take a free module for themselves, and nothing here changes what runs on this instance (install never enables; the CLI places files on the CALLER's checkout). Channels: every version is on the general channel until the channel table (task 1003815) and \"install honours the channel\" (task 1003805) land; those add the channel check to step 1 and step 2, beside the entitlement check.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "---- install: acquire → download → record (task 1003785, ADR 0338 D1) ---- The server end of `bongos module install`. Three steps, so the store never records a version as acquired that the caller did not verify and place: 1. POST acquire — resolve the version, and take the entitlement: a free module (no price, or a zero price) is granted here with source 'free'; a priced one needs the buy action, which is area 8's (tasks 1003788/1003789) and answers 402 until then. 2. GET tarball — served only to a LIVE entitlement holder, never for a delisted module (ADR 0338 D2: no further versions served). 3. POST acquired — the CLI has verified the bytes with verifyModuleArtifact and placed them; recordAcquired stamps the exact version. Own-scoped like the entitlement reads: the holder is always the caller (holder_kind 'builder'), never named in the request, so requireBuilder is the gate — any signed-in builder may take a free module for themselves, and nothing here changes what runs on this instance (install never enables; the CLI places files on the CALLER's checkout). Channels (task 1003805, ADR 0344): steps 1 and 2 hand out only versions on a channel this project takes (projectChannels) — with no version asked for, the newest there. Install and update share step 1, so both honour it. A project that stops testing keeps the tester version it has; its next update is the newest general one, and update only moves forward, so nothing rolls back. Step 3 records what was already placed, so it does not re-check the channel.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/modules.js",
         "parameters": [

package/docs/architecture.md

@@ -271,6 +271,8 @@ store_module_version_channels(id, version_id FK store_module_versions, channel F
               reason short code, set_by builder | NULL (system), set_at)
               -- history; newest row per version is current. Pre-existing versions were
               -- backfilled to general ('predates_staged_rollout').
+              -- idx_store_module_version_channels_current (version_id, set_at DESC, id DESC):
+              -- "current channel" is one index probe per version, never a table scan.
 ```
 
 Module entitlements (migration `core_259`, task 1003813 — who holds which module, at which version; the record install, update and the telemetry signals consult; it records ownership, never payment — area 8 owns money):

package/docs/module-api-changelog.md

@@ -3173,5 +3173,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.166 with no explicit bump. run 39986992124. (task 1002620)
   1.21.168 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.167 with no explicit bump. run 39990468332. (task 1002620)
+  1.21.169 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.168 with no explicit bump. run 39992064615. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/modules-contract.md

@@ -407,7 +407,7 @@ Run `bongos upgrade` to confirm coreVersion compatibility, then `node scripts/gd
 - Install never enables. Switch the module on from the hall's Modules tab.
 - **Every version's how-to is a page** (task 1004366). `GET /store/modules/:key/versions/:version/howto` reads the `HOWTO.md` from that version's own stored tarball, after the same hash check install runs, and returns it as text; the hall shows it at `/builders/modules?howto=<key>&version=<X.Y.Z>`, rendered through the hall's escaping markdown reader (`md-reader.js`) because the file is author-written. Any signed-in builder can read it without holding the module; a delisted module's how-to reads only for people who hold it. "Save as PDF" is the browser's own print, with a print sheet that keeps only the document. The optional `howto.artifactUrl` shows as "Also available as a Claude page". Install prints the link, and a Modules-tab row links it when the module on disk is a published store version. A version published before the gate has none and answers 404 `howto_missing`.
 - A module already on disk, in the instance's `modules/` or bundled with the core, is refused; moving one to a newer version is `update`. A module this core cannot mount is refused before download.
-- A delisted module cannot be acquired or downloaded. Channels are not checked yet: install and update hand out a version whatever its channel until task 1003805 lands.
+- A delisted module cannot be acquired or downloaded. **Install and update honour the channel** (task 1003805, [ADR 0344](adr/0344-a-tester-is-a-project-that-opts-in-once.md) D1/D2): a project that tests a module (`testsVersionsOf`) is handed the newest version on `tester` or `general`, every other project the newest on `general`, and nobody a `withdrawn` one (`servedChannels` in `src/bongos/module-store.js`). The acquire answer names the version's `channel`. Asking for an exact version off the project's channels, or downloading it, is refused with `version_not_on_channel` (409); a module with nothing on them yet answers `no_versions_on_channel` (404). `GET /store/modules/latest`, which `bongos upgrade` reads, counts only versions on those channels, so it reports what `bongos module update` would hand over. A project that stops testing keeps the tester version it has; its next update is the newest general one, and update only moves forward, so nothing is rolled back. Recording a version already placed (`POST …/acquired`) does not re-check the channel.
 
 `bongos module update <key> [--version X.Y.Z]` moves an installed store module forward through the same three calls, so a paid module and a free one take one identical path, and a module you already hold is never charged again (`tests/module_update.mjs` fails if a price-conditional branch appears).
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.168",
+  "version": "1.21.169",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.168",
+      "version": "1.21.169",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.168",
+  "version": "1.21.169",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10078,5 +10078,11 @@
       "id": "1004777",
       "text": "A page tweak that sits too long now tells someone. If a round waits too long for its artist's review, that artist gets a line in Needs attention on Home. If it waits to be applied or to go live, builders who can apply it get t"
     }
+  ],
+  "1.21.169": [
+    {
+      "id": "1003805",
+      "text": "Projects that test new module versions now actually get them first, and everyone else only gets versions that have passed testing. Turning testing off keeps what you have and moves you to the tested versions from your next upd"
+    }
   ]
 }

package/src/bongos/module-store.js

@@ -256,12 +256,34 @@ function isFreePrice(priceRow) {
   return priceRow.price_cents === 0 || priceRow.price_credits === 0;
 }
 
+// The release channels a project is handed versions from (task 1003805, ADR 0344
+// D1/D2): a project that tests this module gets tester AND general versions, every
+// other project general only. 'withdrawn' is never in either list, so a withdrawn
+// version is never handed out (a copy already installed keeps working, ADR 0338 D2).
+function servedChannels(tester) {
+  return tester ? ['tester', 'general'] : ['general'];
+}
+
+// A version's current channel is its newest store_module_version_channels row
+// (core_276): a move is a new row, never an update. One probe per version into
+// idx_store_module_version_channels_current. `idCol` is the outer query's version
+// id column, and only these two literals are accepted, so no text reaches the SQL.
+const VERSION_ID_COLS = new Set(['store_module_versions.id', 'v.id']);
+function currentChannelSql(idCol) {
+  if (!VERSION_ID_COLS.has(idCol)) throw new Error(`currentChannelSql: unexpected column ${idCol}`);
+  return `(SELECT c.channel FROM store_module_version_channels c
+           WHERE c.version_id = ${idCol} ORDER BY c.set_at DESC, c.id DESC LIMIT 1)`;
+}
+
 // Resolve what an acquire of `key` (optionally at an exact `version`) would hand
 // over. Refuses an unknown or delisted module (ADR 0338 D2: a delisted module takes
 // no new acquisitions and serves no further versions) and an unknown version. With
 // no version asked for, the newest published version (semver order, not text).
+// `channels` (from servedChannels) limits it to versions currently on those
+// channels — the newest one there, or a refusal for an exact version that is not;
+// null skips the channel check (recording a version already placed).
 // Returns { ok: true, module, version, price, free } or { ok: false, status, code, message }.
-async function resolveAcquirable(key, { version = null, db } = {}) {
+async function resolveAcquirable(key, { version = null, channels = null, db } = {}) {
   const pool = db || require('./pool').pool;
   const refuse = (status, code, message) => ({ ok: false, status, code, message });
   const { rows: [mod] } = await pool.query(
@@ -270,16 +292,28 @@ async function resolveAcquirable(key, { version = null, db } = {}) {
   if (mod.status === 'delisted') return refuse(409, 'module_delisted', `"${key}" is delisted: it can no longer be acquired or downloaded (ADR 0338 D2).`);
   const { rows: versions } = await pool.query(
     `SELECT id, module_key, version, core_version, tree_sha256, tarball_sha256, tarball_bytes,
-            artifact_path, published_at
+            artifact_path, published_at, ${currentChannelSql('store_module_versions.id')} AS channel
        FROM store_module_versions WHERE module_key = $1`, [key]);
+  const served = (r) => !channels || channels.includes(r.channel);
   let row;
   if (version) {
     row = versions.find((r) => r.version === version);
     if (!row) return refuse(404, 'version_not_found', `"${key}" has no published version ${version}.`);
+    if (!served(row)) {
+      return refuse(409, 'version_not_on_channel', row.channel === 'withdrawn'
+        ? `"${key}" ${version} was withdrawn: it is no longer handed out.`
+        : `"${key}" ${version} is still with testers, and this project takes general versions of it.`);
+    }
   } else {
-    row = versions.filter((r) => parseVersion(r.version))
+    row = versions.filter((r) => parseVersion(r.version) && served(r))
       .sort((a, b) => cmp(parseVersion(a.version), parseVersion(b.version))).pop();
-    if (!row) return refuse(404, 'no_versions', `"${key}" has no published version yet.`);
+    if (!row) {
+      if (!versions.length) return refuse(404, 'no_versions', `"${key}" has no published version yet.`);
+      const testing = versions.some((r) => r.channel === 'tester');
+      return refuse(404, 'no_versions_on_channel', testing
+        ? `"${key}" has no version on the channel this project takes yet: its newest is still with testers.`
+        : `"${key}" has no version this project can be handed: every version was withdrawn.`);
+    }
   }
   const { rows: [price] } = await pool.query(
     `SELECT price_cents, price_credits, set_at FROM store_module_prices
@@ -321,21 +355,25 @@ async function publishedVersionSet(keys, { db } = {}) {
 // takes no entitlement and refuses nothing, so a delisted module still answers,
 // with its status, and the caller says it gets no further versions (ADR 0338 D2).
 // A key the store does not know is simply absent. One query for the whole list.
-// Returns { [key]: { version, core_version, status } }.
-async function latestVersions(keys, { db } = {}) {
+// `channelsFor(key)` (servedChannels per module) counts only versions on the
+// channels this project takes, so upgrade reports what update would hand over
+// (task 1003805); a key with nothing on them is absent too.
+// Returns { [key]: { version, core_version, status, channel } }.
+async function latestVersions(keys, { db, channelsFor = null } = {}) {
   if (!keys.length) return {};
   const pool = db || require('./pool').pool;
   const { rows } = await pool.query(
-    `SELECT v.module_key, v.version, v.core_version, m.status
+    `SELECT v.module_key, v.version, v.core_version, m.status, ${currentChannelSql('v.id')} AS channel
        FROM store_module_versions v JOIN store_modules m ON m.module_key = v.module_key
       WHERE v.module_key = ANY($1)`, [keys]);
   const out = {};
   for (const r of rows) {
     const next = parseVersion(r.version);
     if (!next) continue;
+    if (channelsFor && !channelsFor(r.module_key).includes(r.channel)) continue;
     const have = out[r.module_key];
     if (have && cmp(parseVersion(have.version), next) >= 0) continue;
-    out[r.module_key] = { version: r.version, core_version: r.core_version, status: r.status };
+    out[r.module_key] = { version: r.version, core_version: r.core_version, status: r.status, channel: r.channel };
   }
   return out;
 }
@@ -383,6 +421,6 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
-  isFreePrice, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
+  isFreePrice, servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
   delistModule, delistedKeySet, storeDir, storeDirFor, migrateLegacyStore,
 };

package/src/bongos/routes/modules.js

@@ -96,7 +96,7 @@ const moduleAssessVersion = require('../../../scripts/gds/module-assess-version'
 const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } = require('../module-entitlements');
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
-  resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
+  servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
   delistModule, delistedKeySet, migrateLegacyStore,
 } = require('../module-store');
 const {
@@ -111,9 +111,20 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
 const { listCatalog, SORT_PARTS } = require('../module-listing');
-const { readTesting, setTester, setGeneralOnly } = require('../module-testing');
+const { readTesting, setTester, setGeneralOnly, testsVersionsOf } = require('../module-testing');
 const { readStanding, releaseHeld } = require('../module-promotion');
 
+// The channels this project takes, per module (task 1003805, ADR 0344 D1/D2): a
+// tester project gets tester and general versions, except of a module it marked
+// "general only"; everyone else gets general. A choice that cannot be read reads as
+// NOT a tester (module-testing.js), so it hands out general, never tester.
+async function projectChannels() {
+  let testing = null;
+  try { testing = await readTesting(); }
+  catch (e) { log.warn({ err: e.message }, 'tester choice unreadable; serving general versions'); }
+  return (key) => servedChannels(testsVersionsOf(testing, key));
+}
+
 // The sentence for a toggle that waits on a restart (task 1004463). 'routes' are the
 // module's pages, 'pollers' its background jobs. PURE.
 function restartNote(waits, enabled) {
@@ -667,9 +678,12 @@ module.exports = function buildModulesRouter() {
   // here changes what runs on this instance (install never enables; the CLI places
   // files on the CALLER's checkout).
   //
-  // Channels: every version is on the general channel until the channel table
-  // (task 1003815) and "install honours the channel" (task 1003805) land; those
-  // add the channel check to step 1 and step 2, beside the entitlement check.
+  // Channels (task 1003805, ADR 0344): steps 1 and 2 hand out only versions on a
+  // channel this project takes (projectChannels) — with no version asked for, the
+  // newest there. Install and update share step 1, so both honour it. A project
+  // that stops testing keeps the tester version it has; its next update is the
+  // newest general one, and update only moves forward, so nothing rolls back.
+  // Step 3 records what was already placed, so it does not re-check the channel.
   router.post('/store/modules/:key/acquire', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquire', async (req, res) => {
       const { key } = req.params;
@@ -681,7 +695,7 @@ module.exports = function buildModulesRouter() {
       if (wanted != null && !parseVersion(String(wanted))) {
         return res.fail('bad_version', { status: 400, message: 'A version is exact X.Y.Z.' });
       }
-      const r = await resolveAcquirable(key, { version: wanted || null });
+      const r = await resolveAcquirable(key, { version: wanted || null, channels: (await projectChannels())(key) });
       if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
 
       const holder = { moduleKey: key, holderKind: 'builder', holderRef: String(req.builder.id) };
@@ -706,7 +720,7 @@ module.exports = function buildModulesRouter() {
         tarball_sha256: v.tarball_sha256,
         tree_sha256: v.tree_sha256,
         tarball_bytes: Number(v.tarball_bytes),
-        channel: 'general',
+        channel: v.channel,
         entitlement: held.entitlement,
       });
     }));
@@ -717,7 +731,7 @@ module.exports = function buildModulesRouter() {
       if (!KEY_RE.test(key) || !parseVersion(version)) {
         return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
       }
-      const r = await resolveAcquirable(key, { version });
+      const r = await resolveAcquirable(key, { version, channels: (await projectChannels())(key) });
       if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
       const held = await checkEntitlement({ moduleKey: key, holderKind: 'builder', holderRef: String(req.builder.id) });
       if (!held.entitled) {
@@ -801,7 +815,9 @@ module.exports = function buildModulesRouter() {
 
   // The newest published version of each named module — what `bongos upgrade`
   // compares an instance's installed store modules against to report the updates
-  // available (task 1003787). `?keys=a,b,c`, at most STORE_LATEST_MAX_KEYS.
+  // available (task 1003787). `?keys=a,b,c`, at most STORE_LATEST_MAX_KEYS. Only
+  // versions on a channel this project takes count (task 1003805), so it reports
+  // exactly what `bongos module update` would hand over.
   //
   // rank: any-builder — a read of public store metadata (version numbers and the
   // core range each needs, the same facts the how-to page shows). It takes no
@@ -814,7 +830,7 @@ module.exports = function buildModulesRouter() {
       if (!keys.length || keys.length > STORE_LATEST_MAX_KEYS || !keys.every((k) => KEY_RE.test(k))) {
         return res.fail('bad_request', { status: 400, message: `keys is a comma-separated list of 1 to ${STORE_LATEST_MAX_KEYS} module keys (lowercase kebab-case).` });
       }
-      const latest = await latestVersions(keys);
+      const latest = await latestVersions(keys, { channelsFor: await projectChannels() });
       res.set('Cache-Control', 'no-store');
       res.json({ latest });
     }));

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.168'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.169'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/module_channel_install.mjs

@@ -0,0 +1,112 @@
+// tests/module_channel_install.mjs — install and update honour the channel a
+// project is on (task 1003805, ADR 0344 D1/D2, ADR 0338 D2).
+//
+// WHY. The channels exist (core_276) and new versions land on tester (task
+// 1003803), but until acquire reads them, every project got the newest version
+// whatever its channel. These pin the rule: a tester project gets the newest on
+// tester or general, everyone else the newest on general, nobody a withdrawn one,
+// and `bongos upgrade` reports the same version update would hand over. Run
+// against a fake pg client; the routes are pinned in their source.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { servedChannels, resolveAcquirable, latestVersions } = require('../src/bongos/module-store.js');
+const { testsVersionsOf } = require('../src/bongos/module-testing.js');
+
+const row = (version, channel) => ({ id: 1, module_key: 'weather', version, channel, core_version: '^1.0.0', tarball_sha256: 'a'.repeat(64), tree_sha256: 'b'.repeat(64), tarball_bytes: 10, artifact_path: `weather/weather-${version}.tgz` });
+
+function fakeDb(versions) {
+  return {
+    async query(sql) {
+      if (sql.includes('FROM store_modules ')) return { rows: [{ module_key: 'weather', status: 'listed' }] };
+      if (sql.includes('FROM store_module_versions')) return { rows: versions };
+      if (sql.includes('FROM store_module_prices')) return { rows: [] };
+      throw new Error(`unhandled: ${sql}`);
+    },
+  };
+}
+const SHELF = [row('1.0.0', 'general'), row('1.1.0', 'general'), row('1.2.0', 'tester'), row('2.0.0', 'withdrawn')];
+const GENERAL = servedChannels(false);
+const TESTER = servedChannels(true);
+
+test('a tester project takes tester and general versions, everyone else general, nobody withdrawn', () => {
+  assert.deepEqual(TESTER, ['tester', 'general']);
+  assert.deepEqual(GENERAL, ['general']);
+  for (const c of [TESTER, GENERAL]) assert.ok(!c.includes('withdrawn'));
+});
+
+test('"general only" keeps a tester project on general for that one module', () => {
+  const testing = { tester: true, general_only: ['weather'] };
+  assert.deepEqual(servedChannels(testsVersionsOf(testing, 'weather')), GENERAL);
+  assert.deepEqual(servedChannels(testsVersionsOf(testing, 'clock')), TESTER);
+  assert.deepEqual(servedChannels(testsVersionsOf(null, 'clock')), GENERAL, 'an unreadable choice is not a tester');
+});
+
+test('with no version asked for, each project gets the newest on its own channels', async () => {
+  const general = await resolveAcquirable('weather', { channels: GENERAL, db: fakeDb(SHELF) });
+  assert.equal(general.version.version, '1.1.0');
+  assert.equal(general.version.channel, 'general');
+  const tester = await resolveAcquirable('weather', { channels: TESTER, db: fakeDb(SHELF) });
+  assert.equal(tester.version.version, '1.2.0', 'the newer withdrawn 2.0.0 is never handed out');
+  assert.equal(tester.version.channel, 'tester');
+});
+
+test('an exact version off the project\'s channels is refused, never handed over', async () => {
+  const early = await resolveAcquirable('weather', { version: '1.2.0', channels: GENERAL, db: fakeDb(SHELF) });
+  assert.equal(early.ok, false);
+  assert.equal(early.code, 'version_not_on_channel');
+  assert.match(early.message, /testers/);
+  const gone = await resolveAcquirable('weather', { version: '2.0.0', channels: TESTER, db: fakeDb(SHELF) });
+  assert.equal(gone.code, 'version_not_on_channel');
+  assert.match(gone.message, /withdrawn/);
+  assert.equal((await resolveAcquirable('weather', { version: '1.0.0', channels: GENERAL, db: fakeDb(SHELF) })).ok, true);
+});
+
+test('a module whose only version is still with testers has nothing for a general project yet', async () => {
+  const r = await resolveAcquirable('weather', { channels: GENERAL, db: fakeDb([row('1.0.0', 'tester')]) });
+  assert.equal(r.code, 'no_versions_on_channel');
+  assert.equal(r.status, 404);
+  assert.match(r.message, /testers/);
+  const gone = await resolveAcquirable('weather', { channels: TESTER, db: fakeDb([row('1.0.0', 'withdrawn')]) });
+  assert.equal(gone.code, 'no_versions_on_channel');
+  assert.match(gone.message, /withdrawn/);
+});
+
+test('no channels means no channel check — recording a version already placed', async () => {
+  const r = await resolveAcquirable('weather', { version: '2.0.0', db: fakeDb(SHELF) });
+  assert.equal(r.ok, true);
+});
+
+test('upgrade reports the newest version on the channels this project takes', async () => {
+  const db = { async query() { return { rows: SHELF.map((r) => ({ ...r, status: 'listed' })) }; } };
+  const general = await latestVersions(['weather'], { db, channelsFor: () => GENERAL });
+  assert.equal(general.weather.version, '1.1.0');
+  const tester = await latestVersions(['weather'], { db, channelsFor: () => TESTER });
+  assert.equal(tester.weather.version, '1.2.0');
+  assert.equal(tester.weather.channel, 'tester');
+  const none = await latestVersions(['weather'], { db, channelsFor: () => ['nothing'] });
+  assert.deepEqual(none, {});
+});
+
+test('the acquire, download and latest routes ask the project\'s channels; recording does not', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  const route = (decl) => {
+    const start = src.indexOf(decl);
+    assert.ok(start !== -1, decl);
+    return src.slice(start, src.indexOf('}));', start));
+  };
+  const acquire = route("router.post('/store/modules/:key/acquire'");
+  assert.match(acquire, /resolveAcquirable\(key, \{ version: wanted \|\| null, channels: \(await projectChannels\(\)\)\(key\) \}\)/);
+  assert.match(acquire, /channel: v\.channel,/);
+  assert.doesNotMatch(acquire, /channel: 'general'/);
+  assert.match(route("router.get('/store/modules/:key/versions/:version/tarball'"), /channels: \(await projectChannels\(\)\)\(key\)/);
+  assert.match(route("router.get('/store/modules/latest'"), /latestVersions\(keys, \{ channelsFor: await projectChannels\(\) \}\)/);
+  assert.doesNotMatch(route("router.post('/store/modules/:key/acquired'"), /channels/);
+});

package/tests/module_upgrade_updates.mjs

@@ -24,7 +24,7 @@ const pool = {
       return {
         rows: state.versions
           .filter((v) => params[0].includes(v.module_key) && state.modules[v.module_key])
-          .map((v) => ({ ...v, status: state.modules[v.module_key].status })),
+          .map((v) => ({ channel: 'general', ...v, status: state.modules[v.module_key].status })),
       };
     }
     return { rows: [] };
@@ -236,7 +236,7 @@ test('the route is open to any signed-in builder: requireBuilder and no permissi
 test('the route answers the newest version per key, in semver order', async () => {
   const r = await ask('weather');
   assert.equal(r.statusCode, 200, JSON.stringify(r.body));
-  assert.deepEqual(r.body.latest.weather, { version: '1.10.0', core_version: '^1.2.0', status: 'listed' });
+  assert.deepEqual(r.body.latest.weather, { version: '1.10.0', core_version: '^1.2.0', status: 'listed', channel: 'general' });
   assert.equal(r.headers['Cache-Control'], 'no-store');
 });