@bongos/core 1.21.172 → 1.21.174

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.172",
-  "core_contract": "1.21.172",
-  "source_commit": "a5b5fc89c2bddcd402af46f6271b80c329759d8f",
+  "core_version": "1.21.174",
+  "core_contract": "1.21.174",
+  "source_commit": "adfd7c27e23529361ee07bbaf4ef49077e4111d1",
   "source_ref": "HEAD",
-  "built_at": "2026-10-23T17:54:54.483Z",
+  "built_at": "2026-10-23T18:25:19.708Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 609,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3193,
+    "functional_verbatim": 3196,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3831,
-  "tree_sha256": "3f3467a2aa833a4abbd6faf317d2656fb98738368a7376cdd163964d5f34a529",
+  "file_count": 3834,
+  "tree_sha256": "caab1743d1725c9a840734341335be349f8c978cf2d458f1ba9effab69975d30",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2177,7 +2177,7 @@
     {
       "path": "docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md",
       "mode": "0000644",
-      "sha256": "db41e62093dd09e5ed3f9bb4628c98ea0255b487bb5b94191bbb4adc0651636b"
+      "sha256": "35f757210a8f2279da301ac294d4939f78e7976fc6ac50db894a2eb973341636"
     },
     {
       "path": "docs/adr/0344-a-tester-is-a-project-that-opts-in-once.md",
@@ -2387,7 +2387,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "01aa4a0660af5c27d90556aa30b440fb1236caeb75ea3ce2f0020437bbe11542"
+      "sha256": "d6fa7d73228ff1d2420ca0201047511d8ffcc54c8243d34b245b765aa594964b"
     },
     {
       "path": "docs/architecture.md",
@@ -2412,12 +2412,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "eec10b588ffe284a8e52e0f5e167b24ffee253b336454d980906d1d299f789c2"
+      "sha256": "c75fc40e23e292f5f95de5218c44861ea53ef2d0f691afbd2e8c3383c3e77a09"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f537f321c123a47d6c8a7e026293bac969b79ab648462f1fbaa51929c8282584"
+      "sha256": "16a9f7fc63e3c592067ed0286a9faaf52fc7c07fb88d0eb5b1e9ef966822b741"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2927,12 +2927,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "af6395d2e0df7248fff770ebe525441b4af0ba73ff474328bfb69ace36f3180b"
+      "sha256": "8c7c1a18bb466eb86c4e6ed6d7b39b433111e99562b04f444671c455bb96ac62"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "73757f66afb17289933edd12b20e0c8d903b37d74a004a622826adf09742401f"
+      "sha256": "4aa9233a5d700f046ec30f6f37c282cb1a97db7873899d19226cb702be4b7ecb"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -3017,7 +3017,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "4a1fa9bbf1b952ebabc5587a38f634de6fdee2678ba6b9c8ef6a6e0862dff820"
+      "sha256": "9ec7d9542b85b8232622692dbe007a852da947e6f674172b2aa51f961acf17d4"
     },
     {
       "path": "docs/project-context.template.md",
@@ -4517,7 +4517,7 @@
     {
       "path": "modules/copy-desk/routes/copy-desk.js",
       "mode": "0000644",
-      "sha256": "2f88b12c9a8ce90f5a153407cb492d342dd6beda43f8b21c1e15a42cb2d8f899"
+      "sha256": "c29c4015b09ed16ee0ae929077f077f4490b33e5a8055f9d331e097e1aabcf97"
     },
     {
       "path": "modules/copy-desk/skills/tweak/SKILL.md",
@@ -5652,7 +5652,7 @@
     {
       "path": "modules/hall-ui/public/city-decide.js",
       "mode": "0000644",
-      "sha256": "dff181b388393cca09bc7ab4c2949eff95c63c2795fef0f8348f49a3387b5c59"
+      "sha256": "de7085b284e4ed6bfd8f5703074934ec962697ae1d9cf9d7e31ec3ef81952fc2"
     },
     {
       "path": "modules/hall-ui/public/city-draw.js",
@@ -5667,12 +5667,12 @@
     {
       "path": "modules/hall-ui/public/city.css",
       "mode": "0000644",
-      "sha256": "2b4bebeeef82ec53a21bbcff83925b185e81afa356a889722ab8bd2206c162bd"
+      "sha256": "bc2b6e59862ada8af0fc125ccff4f875c916ca5624d46d5fb1493a8d849c154c"
     },
     {
       "path": "modules/hall-ui/public/city.html",
       "mode": "0000644",
-      "sha256": "e20c167df8c5f7e630ba394ab5e39f274de8aed428f3d41f2fa987c8b340047d"
+      "sha256": "48d8eacaf02f0f6da2959da09f0d56245d718ef26efe2753012dee0f0b64bcb1"
     },
     {
       "path": "modules/hall-ui/public/city.js",
@@ -7154,6 +7154,11 @@
       "mode": "0000644",
       "sha256": "e7c7db8a6faf50f3b75cb26ac33caa8357c462293e64318212ace69b0b654507"
     },
+    {
+      "path": "modules/lifecycle/artist-review-goal.js",
+      "mode": "0000644",
+      "sha256": "e2e9318d76c337b6339b0685cd2585c9d58cd13c7ec1bac8186e614a60a31be4"
+    },
     {
       "path": "modules/lifecycle/autopickup-files.js",
       "mode": "0000644",
@@ -7292,12 +7297,12 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "710e4c97c0b67a3b258d6997ba9dc485e42bb57a0988777c0f10f8391b952489"
+      "sha256": "29b4ced94d5fc5721dcb0c17ecbd9171b90e5444f0c526f3d8498f6e99b22fc6"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
       "mode": "0000644",
-      "sha256": "7ffd6ca56a6621a933abf854589e836260cd749c6148a278542ab4ae89eb6b13"
+      "sha256": "e5328df4be96e980fd22486f441f0f2a47abe5572a1b34ae47caed96965dadc9"
     },
     {
       "path": "modules/lifecycle/db.js",
@@ -7577,7 +7582,7 @@
     {
       "path": "modules/lifecycle/page-tweak-claim.js",
       "mode": "0000644",
-      "sha256": "4b9f9c23161a961381857a01fc810ce1b960e2b89b74e616fa17d34a403b592f"
+      "sha256": "a3adde93c8bdef716f68aa09b9c60a81fa55f65520980d9686447db95647eecf"
     },
     {
       "path": "modules/lifecycle/page-tweak-hold.js",
@@ -7592,7 +7597,7 @@
     {
       "path": "modules/lifecycle/page-tweak-write.js",
       "mode": "0000644",
-      "sha256": "a13c01e96c5ae09837b9d599a66b23765f6d6f16cc29b11ca897da4f497d0b0d"
+      "sha256": "c6b5cb868778d1043029c0f17640caa4e2124e13783319e33cbdb56b0135ba45"
     },
     {
       "path": "modules/lifecycle/pg-constraint-fail.js",
@@ -9727,7 +9732,7 @@
     {
       "path": "modules/public-landing/public/index.html",
       "mode": "0000644",
-      "sha256": "3f5f17cb00337d9dfb0e96ae00f8ad64ba2a0495d4addef0a02d81dcc76b67fd"
+      "sha256": "88a9131f1bd1876bc049898d4185b76f699eb73d3eeb8866ff8f1f7577300d7f"
     },
     {
       "path": "modules/public-landing/public/index.probes.json",
@@ -10602,12 +10607,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "11e80d0bbd4cbe40847b4b7b3185243caca27ca1eb62a23d16af9244aedf7d5f"
+      "sha256": "0a8aad85242c815483d937f464a70e0635a6f82f3e0bbd1d53e0007c4f391599"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ac557c163c39ef7b845595788a40b41a256fa82143a06632ac9a0805479a8285"
+      "sha256": "d875bd84ad023a7e1a802a045ae88ef86e835f82ebd527db9ec1a82134a72e31"
     },
     {
       "path": "public-docs/index.html",
@@ -10627,7 +10632,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "a0f68aef51f5fbd8e741303c53f90c1342c0c9cc19f99d8c9de37fce33edb894"
+      "sha256": "23c78c80dcbd8687b941dbae2186b92c9c5842b381dbbc7549cb8780b6cf7cb5"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12622,7 +12627,7 @@
     {
       "path": "src/bongos/auth-github.js",
       "mode": "0000644",
-      "sha256": "9c6c67956fc3f16e0e3da71237ff875592bd9933cbab74337522ed871d0487e2"
+      "sha256": "68cfb2207be1faa76b6f0f2bb26a47045f5f38a6b4b0a00cf08c62dd00c0d581"
     },
     {
       "path": "src/bongos/auth-idp.js",
@@ -12737,7 +12742,7 @@
     {
       "path": "src/bongos/module-listing.js",
       "mode": "0000644",
-      "sha256": "2f2ac4e04af85579c9c2bfd6e6b8e880cff46cadf49ad3791948c9bca03c8d72"
+      "sha256": "8d08e9bed1b5320e2762d65173fb67671253d1adc29084a9223ad204b7572d06"
     },
     {
       "path": "src/bongos/module-overrides.js",
@@ -12867,7 +12872,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "39673ba55974dc86bb4aa04e68c8315dcca6144270847e396074b7e5eb4bdc6d"
+      "sha256": "71af24af695acdb8ff03bb457359ac06bb29d69ec8f50691c8a2479f8090373a"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -12927,7 +12932,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "7ac9ce1a3d82549db000176970670d551a3c9b61994dc68d1f122b346dfb0878"
+      "sha256": "37a089df1c2907dc989e1d77ad5cb8ad9783ca4adfc4cfc2704b57d44dbce41e"
     },
     {
       "path": "src/bongos/routes/my-passkeys.js",
@@ -13017,7 +13022,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d91f9c6725d2c369f3af694a4e9b1ecada83994a2208961414c7814f0bf65b48"
+      "sha256": "2a6426c050bd5aad4518c4ff3613fac041993deb0eebc6cab7d79184ff120159"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13374,6 +13379,11 @@
       "mode": "0000644",
       "sha256": "370b54d4e323e144ef8f9e382b873a4ff803b7727844c0e2d6b9e5cdfeb0fbe1"
     },
+    {
+      "path": "tests/artist_review_goal.mjs",
+      "mode": "0000644",
+      "sha256": "ce9b9035338a7dbfb316277ac3d881bb7c36560f93d50dd811ea8f6b2ce2ec7c"
+    },
     {
       "path": "tests/asset_version.mjs",
       "mode": "0000644",
@@ -13459,6 +13469,11 @@
       "mode": "0000644",
       "sha256": "e4c3309248873ac816ecf9111cc08e4c9e3e6c318a2e925434f1cc490c71b734"
     },
+    {
+      "path": "tests/auth_switch_account.mjs",
+      "mode": "0000644",
+      "sha256": "3826cfb52ee2977bb9ba77312b098a8d466b58420a2cb8234587911d219ae46a"
+    },
     {
       "path": "tests/auth_web_recovery.mjs",
       "mode": "0000644",
@@ -13987,7 +14002,7 @@
     {
       "path": "tests/copy_desk_page_claim.mjs",
       "mode": "0000644",
-      "sha256": "af6cdac77b90aad511a603757e12d7ffefaa7fdbcdd14aefd70ad49e3cd193fe"
+      "sha256": "f8bf52b346895367eca47dc9b0d169439296f908c504e7b3dc25f3e76a62250b"
     },
     {
       "path": "tests/copy_desk_page_docx.mjs",
@@ -14012,7 +14027,7 @@
     {
       "path": "tests/copy_desk_page_submit.mjs",
       "mode": "0000644",
-      "sha256": "7f5d5b9b9054b5dc6a066253af93864e8ea1332ca32b8300f217832d6640cabf"
+      "sha256": "c21159c1d8dcf82128120362232f72d4c7d6cf0bdc8726517788f5c6b18f5bd2"
     },
     {
       "path": "tests/copy_guarded_lines.mjs",
@@ -14637,7 +14652,7 @@
     {
       "path": "tests/fixtures/page-ledger.mjs",
       "mode": "0000644",
-      "sha256": "b36096f0bc3f6ea645c5e29e8bc1c769d7fb78fa8cd6d4985ab573a5a3cb0e88"
+      "sha256": "b0a8f277883957ea314ad6efd16fc3109729726a75c28136bdd890c1570749b1"
     },
     {
       "path": "tests/fixtures/session-506-digest.json",
@@ -15552,7 +15567,7 @@
     {
       "path": "tests/hall_city_rewording.mjs",
       "mode": "0000644",
-      "sha256": "93fc45e48ecf65029f5eaae33b001474bf4fc147becc3df3a7fcd56288d350d5"
+      "sha256": "88dc75df0b62ed23ff0aa110d6fa3eb362ccc05e8ac6c0999dcc064c315e6962"
     },
     {
       "path": "tests/hall_city_switchboard.mjs",
@@ -16737,7 +16752,7 @@
     {
       "path": "tests/module_store_listing.mjs",
       "mode": "0000644",
-      "sha256": "be639096f82a9750e25b57c7612e94754b6109ef13507144be9ceb384628eb91"
+      "sha256": "5afd95a04dc8e22e91dc8d5a7091d76add5d917a39ee5172cf7024ee7797c3eb"
     },
     {
       "path": "tests/module_store_publish.mjs",
@@ -18522,7 +18537,7 @@
     {
       "path": "tests/speciality_injection.mjs",
       "mode": "0000644",
-      "sha256": "9de6fbffd858190096bc22d556ccae101a6206adeee05bb146bd2a0a1a59d15c"
+      "sha256": "d39e4aac82bd721df57148114717f8a32aca4d70566d9bbd8242e843088c13ac"
     },
     {
       "path": "tests/speciality_offer_ui.mjs",
@@ -18712,7 +18727,7 @@
     {
       "path": "tests/task_goal_required.mjs",
       "mode": "0000644",
-      "sha256": "073581d9a97095666ee2ed7ebb0a6b280f3e8ea1efc53015c2f77eb5d08c4975"
+      "sha256": "5bf5deb47453f3ec5a64251137d731f5974c712ada11b9dbedde91469421c6a4"
     },
     {
       "path": "tests/task_lib.mjs",

package/docs/adr/0343-a-module-score-is-a-security-gate-then-an-average-of-visible-parts.md

@@ -98,3 +98,13 @@ the floor. Below the bar is not listed at all. Authors read the rule in
   and the owner wants buyers to see that.
 - **Counting a missing part as zero.** It would punish every new module for data it couldn't
   have yet.
+
+## Implementation note — the ranking (task 1003808, 2026-10-23)
+
+The owner chose **quality first, price breaks ties**, with an optional buyer-set maximum price.
+Above the floor, `GET /store/modules` ranks listed modules by overall score; between equal
+scores the free module comes first, then the lowest cash price, then the lowest credit price,
+then the key (`rankListed` in `src/bongos/module-listing.js`). Price only orders what the score
+could not separate, so D6 holds: price still never enters the score. `?max_cents=` /
+`?max_credits=` filter out modules over the buyer's cap; they never reorder. New versions stay
+unranked (owner, 2026-10-01). Sorting by one part (task 1003800) replaces this order when asked.

package/docs/api/openapi.json

@@ -23244,7 +23244,7 @@
           "store"
         ],
         "summary": "GET /store/modules",
-        "description": "The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each listed module's newest version, if it passed the Security gate and scores at or above the floor, or under \"new\" if it has no real-world data yet. Below the bar is not listed at all. The floor is fixed in module-listing.js and returned here. `?sort=<part>` orders the listed modules by the part a buyer cares about (task 1003800, sortByPart); the parts it accepts come back as sort_parts. rank: any-builder — a read of public store metadata, like /store/modules/latest: no entitlement taken, nothing changed.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each listed module's newest version, if it passed the Security gate and scores at or above the floor, or under \"new\" if it has no real-world data yet. Below the bar is not listed at all. The floor is fixed in module-listing.js and returned here. `?sort=<part>` orders the listed modules by the part a buyer cares about (task 1003800, sortByPart); the parts it accepts come back as sort_parts. Without it the listed modules are ranked quality first, price breaking ties (task 1003808, rankListed); `?max_cents=` / `?max_credits=` leave out modules that cost more. rank: any-builder — a read of public store metadata, like /store/modules/latest: no entitlement taken, nothing changed.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/modules.js",
         "responses": {