@bongos/core 1.21.172 → 1.21.173

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.172",
-  "core_contract": "1.21.172",
-  "source_commit": "a5b5fc89c2bddcd402af46f6271b80c329759d8f",
+  "core_version": "1.21.173",
+  "core_contract": "1.21.173",
+  "source_commit": "fb74ac25169bf2ab96aceb07fb4efd45efd018b2",
   "source_ref": "HEAD",
-  "built_at": "2026-10-23T17:54:54.483Z",
+  "built_at": "2026-10-23T18:08:17.265Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 609,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3193,
+    "functional_verbatim": 3194,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3831,
-  "tree_sha256": "3f3467a2aa833a4abbd6faf317d2656fb98738368a7376cdd163964d5f34a529",
+  "file_count": 3832,
+  "tree_sha256": "526ec0b1a53ccf907d7663008fe0804338804fe2018aaca9eb10ef323fd162bb",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2177,7 +2177,7 @@
     {
       "path": "docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md",
       "mode": "0000644",
-      "sha256": "db41e62093dd09e5ed3f9bb4628c98ea0255b487bb5b94191bbb4adc0651636b"
+      "sha256": "35f757210a8f2279da301ac294d4939f78e7976fc6ac50db894a2eb973341636"
     },
     {
       "path": "docs/adr/0344-a-tester-is-a-project-that-opts-in-once.md",
@@ -2387,7 +2387,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "01aa4a0660af5c27d90556aa30b440fb1236caeb75ea3ce2f0020437bbe11542"
+      "sha256": "d6fa7d73228ff1d2420ca0201047511d8ffcc54c8243d34b245b765aa594964b"
     },
     {
       "path": "docs/architecture.md",
@@ -2412,12 +2412,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "eec10b588ffe284a8e52e0f5e167b24ffee253b336454d980906d1d299f789c2"
+      "sha256": "5aac1b2e54ab9a0ef16cdb1eeef22c797933d08ee7bd40f21c052bc415b21f73"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f537f321c123a47d6c8a7e026293bac969b79ab648462f1fbaa51929c8282584"
+      "sha256": "5171c48da53a029424585fa32da23cb78fc8ee99f17a07df8bf9186c73fd6b4f"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2927,12 +2927,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "af6395d2e0df7248fff770ebe525441b4af0ba73ff474328bfb69ace36f3180b"
+      "sha256": "5373b4a333b0d0ce97ed2516d107a395b532cedce60e682e0d9be33bb3eb9e3b"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "73757f66afb17289933edd12b20e0c8d903b37d74a004a622826adf09742401f"
+      "sha256": "4aa9233a5d700f046ec30f6f37c282cb1a97db7873899d19226cb702be4b7ecb"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -3017,7 +3017,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "4a1fa9bbf1b952ebabc5587a38f634de6fdee2678ba6b9c8ef6a6e0862dff820"
+      "sha256": "a2c08ff05348d995ef43ec6a24da479c28f8a1e19343e4d1176e1f7f6cca3929"
     },
     {
       "path": "docs/project-context.template.md",
@@ -9727,7 +9727,7 @@
     {
       "path": "modules/public-landing/public/index.html",
       "mode": "0000644",
-      "sha256": "3f5f17cb00337d9dfb0e96ae00f8ad64ba2a0495d4addef0a02d81dcc76b67fd"
+      "sha256": "88a9131f1bd1876bc049898d4185b76f699eb73d3eeb8866ff8f1f7577300d7f"
     },
     {
       "path": "modules/public-landing/public/index.probes.json",
@@ -10602,12 +10602,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "11e80d0bbd4cbe40847b4b7b3185243caca27ca1eb62a23d16af9244aedf7d5f"
+      "sha256": "b223fa39f36866db4ba70f3dc764eb58397f8fbbe42172c15836fb775bf8ff9e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ac557c163c39ef7b845595788a40b41a256fa82143a06632ac9a0805479a8285"
+      "sha256": "6bcb32ea5c5595fdedd41e360311f9afebbbc1b15977e2336d28e56ff07d3e10"
     },
     {
       "path": "public-docs/index.html",
@@ -10627,7 +10627,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "a0f68aef51f5fbd8e741303c53f90c1342c0c9cc19f99d8c9de37fce33edb894"
+      "sha256": "3a1a03d0f50336977ef9dadfcf5a39dd261a2c526b85bc08da58e61b0ad54c84"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12622,7 +12622,7 @@
     {
       "path": "src/bongos/auth-github.js",
       "mode": "0000644",
-      "sha256": "9c6c67956fc3f16e0e3da71237ff875592bd9933cbab74337522ed871d0487e2"
+      "sha256": "68cfb2207be1faa76b6f0f2bb26a47045f5f38a6b4b0a00cf08c62dd00c0d581"
     },
     {
       "path": "src/bongos/auth-idp.js",
@@ -12737,7 +12737,7 @@
     {
       "path": "src/bongos/module-listing.js",
       "mode": "0000644",
-      "sha256": "2f2ac4e04af85579c9c2bfd6e6b8e880cff46cadf49ad3791948c9bca03c8d72"
+      "sha256": "8d08e9bed1b5320e2762d65173fb67671253d1adc29084a9223ad204b7572d06"
     },
     {
       "path": "src/bongos/module-overrides.js",
@@ -12867,7 +12867,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "39673ba55974dc86bb4aa04e68c8315dcca6144270847e396074b7e5eb4bdc6d"
+      "sha256": "71af24af695acdb8ff03bb457359ac06bb29d69ec8f50691c8a2479f8090373a"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -12927,7 +12927,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "7ac9ce1a3d82549db000176970670d551a3c9b61994dc68d1f122b346dfb0878"
+      "sha256": "37a089df1c2907dc989e1d77ad5cb8ad9783ca4adfc4cfc2704b57d44dbce41e"
     },
     {
       "path": "src/bongos/routes/my-passkeys.js",
@@ -13017,7 +13017,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d91f9c6725d2c369f3af694a4e9b1ecada83994a2208961414c7814f0bf65b48"
+      "sha256": "8be0183cf9a8f427c7df2f5cd015730dab2ae93dd5fe1965e71101902a27e0fb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13459,6 +13459,11 @@
       "mode": "0000644",
       "sha256": "e4c3309248873ac816ecf9111cc08e4c9e3e6c318a2e925434f1cc490c71b734"
     },
+    {
+      "path": "tests/auth_switch_account.mjs",
+      "mode": "0000644",
+      "sha256": "3826cfb52ee2977bb9ba77312b098a8d466b58420a2cb8234587911d219ae46a"
+    },
     {
       "path": "tests/auth_web_recovery.mjs",
       "mode": "0000644",
@@ -16737,7 +16742,7 @@
     {
       "path": "tests/module_store_listing.mjs",
       "mode": "0000644",
-      "sha256": "be639096f82a9750e25b57c7612e94754b6109ef13507144be9ceb384628eb91"
+      "sha256": "5afd95a04dc8e22e91dc8d5a7091d76add5d917a39ee5172cf7024ee7797c3eb"
     },
     {
       "path": "tests/module_store_publish.mjs",
@@ -18522,7 +18527,7 @@
     {
       "path": "tests/speciality_injection.mjs",
       "mode": "0000644",
-      "sha256": "9de6fbffd858190096bc22d556ccae101a6206adeee05bb146bd2a0a1a59d15c"
+      "sha256": "d39e4aac82bd721df57148114717f8a32aca4d70566d9bbd8242e843088c13ac"
     },
     {
       "path": "tests/speciality_offer_ui.mjs",

package/docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md

@@ -98,3 +98,13 @@ the floor. Below the bar is not listed at all. Authors read the rule in
   and the owner wants buyers to see that.
 - **Counting a missing part as zero.** It would punish every new module for data it couldn't
   have yet.
+
+## Implementation note — the ranking (task 1003808, 2026-10-23)
+
+The owner chose **quality first, price breaks ties**, with an optional buyer-set maximum price.
+Above the floor, `GET /store/modules` ranks listed modules by overall score; between equal
+scores the free module comes first, then the lowest cash price, then the lowest credit price,
+then the key (`rankListed` in `src/bongos/module-listing.js`). Price only orders what the score
+could not separate, so D6 holds: price still never enters the score. `?max_cents=` /
+`?max_credits=` filter out modules over the buyer's cap; they never reorder. New versions stay
+unranked (owner, 2026-10-01). Sorting by one part (task 1003800) replaces this order when asked.

package/docs/api/openapi.json

@@ -23244,7 +23244,7 @@
           "store"
         ],
         "summary": "GET /store/modules",
-        "description": "The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each listed module's newest version, if it passed the Security gate and scores at or above the floor, or under \"new\" if it has no real-world data yet. Below the bar is not listed at all. The floor is fixed in module-listing.js and returned here. `?sort=<part>` orders the listed modules by the part a buyer cares about (task 1003800, sortByPart); the parts it accepts come back as sort_parts. rank: any-builder — a read of public store metadata, like /store/modules/latest: no entitlement taken, nothing changed.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each listed module's newest version, if it passed the Security gate and scores at or above the floor, or under \"new\" if it has no real-world data yet. Below the bar is not listed at all. The floor is fixed in module-listing.js and returned here. `?sort=<part>` orders the listed modules by the part a buyer cares about (task 1003800, sortByPart); the parts it accepts come back as sort_parts. Without it the listed modules are ranked quality first, price breaking ties (task 1003808, rankListed); `?max_cents=` / `?max_credits=` leave out modules that cost more. rank: any-builder — a read of public store metadata, like /store/modules/latest: no entitlement taken, nothing changed.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/modules.js",
         "responses": {