@bongos/core 1.21.172 → 1.21.174

package/modules/lifecycle/artist-review-goal.js

@@ -0,0 +1,103 @@
+// modules/lifecycle/artist-review-goal.js — every version's ARTIST REVIEW goal
+// (task 1004819). The home for copywriting and Artist Studio work: page tweak
+// rounds, the engineer tasks a round leaves behind, and copy proposals.
+//
+// Owner direction (2026-10-23): all of that work sits under one ongoing goal, and
+// every version carries one, with two standing done-when criteria (below). Before
+// this the studio's create paths passed allowCatchAll, and a version with no
+// "<version> — general" goal (BONGOS-V2) filed every round with no goal at all.
+//
+// ensureMaintenanceGoal's shape (db-goals.js), with two differences worth knowing:
+//   - it is matched by TITLE, not a flag. Nothing decides anything from this goal
+//     being the artist one except where new studio work lands, so a column (and a
+//     migration) would buy nothing a hand-titled goal could abuse;
+//   - it is NOT exempt from the version-close count. Its criteria are meant to
+//     hold the version open until every page has been reviewed.
+// A 'planning' version takes one too, so createVersion can give a new version
+// its goal at birth; a closed version never does.
+//
+// Runs on the caller's client (deps.client) when given, so the goal, its criteria
+// and the task that needed them commit together or not at all; otherwise in a
+// transaction of its own.
+
+const api = require('../../src/module-api');
+
+const { pool, withTx } = api;
+
+const OPEN_TO_WORK = new Set(['planning', 'building']);
+
+const ARTIST_REVIEW_CRITERIA = Object.freeze([
+  Object.freeze({
+    criterion_id: 'artist-every-page-reviewed',
+    criterion_md: 'Every page in the page inventory has had at least one artist review (a shipped tweak round) of its words before the version closes.',
+  }),
+  Object.freeze({
+    criterion_id: 'artist-pages-simple-to-use',
+    criterion_md: 'Every page is simple for a user to read and use: plain words, one clear next step, nothing a newcomer has to decode. An artist signs this off per page.',
+  }),
+]);
+
+function artistReviewGoalTitle(versionId) {
+  return `${versionId} — artist review`;
+}
+
+async function ensureArtistReviewGoal(versionId, deps = {}) {
+  if (versionId == null) return null;
+  if (deps.client) return findOrCreate(versionId, deps.client);
+  // No caller transaction (a copy proposal): open one, or the advisory lock below
+  // would release the moment it is taken and two writers could both insert.
+  const txPool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  return withTx((client) => findOrCreate(versionId, client), { pool: txPool });
+}
+
+async function findOrCreate(versionId, exec) {
+  const title = artistReviewGoalTitle(versionId);
+
+  const { rows: vRows } = await exec.query(`SELECT status FROM versions WHERE id = $1`, [versionId]);
+  if (!vRows[0] || !OPEN_TO_WORK.has(vRows[0].status)) return null;
+
+  // No unique constraint on (version_id, title), so two studio writes in the same
+  // second would both insert without this. Released at COMMIT/ROLLBACK.
+  await exec.query(`SELECT pg_advisory_xact_lock(hashtext($1))`, [title]);
+
+  const { rows: found } = await exec.query(
+    `SELECT id, version_id, title FROM goals WHERE version_id = $1 AND title = $2 ORDER BY id LIMIT 1`,
+    [versionId, title]
+  );
+  if (found[0]) {
+    // A goal of this title made by hand (POST /goals) before the first studio
+    // write still gets the two standing criteria; ones already there are kept.
+    await seedCriteria(exec, versionId, found[0].id);
+    return found[0];
+  }
+
+  const { rows: made } = await exec.query(
+    `INSERT INTO goals (version_id, title, description, scope_modules, status, created_by, sort_order)
+     SELECT $1, $2, $3, $4, 'open', NULL, COALESCE(MAX(sort_order) + 1, 0)
+       FROM goals WHERE version_id = $1
+     RETURNING id, version_id, title`,
+    [versionId, title,
+      'The ongoing home for copywriting and Artist Studio work in this version: page tweak rounds, ' +
+      'the engineer tasks they leave, and copy proposals. Every version carries one (task 1004819).',
+      []]
+  );
+  const goal = made[0] || null;
+  if (!goal) return null;
+  await seedCriteria(exec, versionId, goal.id);
+  return goal;
+}
+
+async function seedCriteria(exec, versionId, goalId) {
+  let order = 0;
+  for (const c of ARTIST_REVIEW_CRITERIA) {
+    order += 1;
+    await exec.query(
+      `INSERT INTO done_when_criteria (version_id, criterion_id, criterion_md, goal_id, sort_order)
+       SELECT $1, $2, $3, $4, COALESCE(MAX(sort_order), 0) + $5 FROM done_when_criteria WHERE version_id = $1
+       ON CONFLICT (version_id, criterion_id) DO NOTHING`,
+      [versionId, c.criterion_id, c.criterion_md, goalId, order]
+    );
+  }
+}
+
+module.exports = { ensureArtistReviewGoal, artistReviewGoalTitle, ARTIST_REVIEW_CRITERIA };

package/modules/lifecycle/db-tasks.js

@@ -21,6 +21,7 @@ const { executorFor } = require('./db-executor.js');
 const { isReservedCriterionSlug } = require('./criterion-ref.js');
 const { resolveWriteDiscipline, WRITABLE_DISCIPLINES } = require('./task-classifier.js');
 const { gateOnSpecTask } = require('./goal-spec-task.js');
+const { ensureArtistReviewGoal } = require('./artist-review-goal.js');
 
 // -------------------------------------------------------------------------
 // Tasks
@@ -158,6 +159,11 @@ async function createTask({
   // copy-desk. Grep for it before adding a third: the answer is almost always
   // to name a goal instead.
   allowCatchAll = false,
+  // task 1004819: copywriting / Artist Studio work. With no goalId it lands in
+  // the version's artist review goal (created on first use, artist-review-goal.js)
+  // rather than the catch-all; the catch-all is only the fallback for a version
+  // that cannot take one.
+  artistReview = false,
 }, deps = {}) { // deps.client enlists this INSERT in the CALLER'S transaction (task 1003065, BV1.R01); the argument for it is at modules/ideas/inbox.js routeIdeaToGoal
   // task 1677 / ADR 0096 (2026-06-28): creation is now the PRIMARY reward-assignment
   // point — every task is born with a fair drachmae value, not just at promote/claim.
@@ -196,8 +202,18 @@ async function createTask({
   // opt-ins can name a real goal. Owner's call, recorded here so the remaining
   // gap is not mistaken for an oversight.
   let goalIdEffective = goalId;
+  if (goalIdEffective == null && artistReview === true && !deps.client) {
+    // No caller transaction (a copy proposal): run the whole create in one, so the
+    // goal it may create and the task commit together or not at all.
+    return api.withTx((client) => createTask(arguments[0], { ...deps, client }),
+      { pool: (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool });
+  }
+  if (goalIdEffective == null && artistReview === true) {
+    const artistGoal = await ensureArtistReviewGoal(versionId, { client: deps.client });
+    if (artistGoal) goalIdEffective = artistGoal.id;
+  }
   if (goalIdEffective == null) {
-    if (allowCatchAll !== true) {
+    if (allowCatchAll !== true && artistReview !== true) {
       throw new Error(
         'createTask: goalId is required — every task belongs to a goal (BV1.R11). ' +
         'A vector that genuinely cannot name one yet must pass allowCatchAll: true, ' +

package/modules/lifecycle/db-versions.js

@@ -20,6 +20,7 @@ const { executorFor, inTransaction } = require('./db-executor.js');
 // (fitness pins the count). createVersion needs it to seed a version's FIRST goal
 // in the same transaction — task 1003701.
 const { createGoal } = require('./db-goals.js');
+const { ensureArtistReviewGoal } = require('./artist-review-goal.js');
 const { cancelPendingMembershipRequests } = require('./goal-close-sweep.js');
 
 async function listVersions() {
@@ -214,7 +215,10 @@ async function createVersion({ id, name, status = 'planning', scopeDocPath = nul
       if (cr[0]) createdCriteria.push(cr[0]);
       i++;
     }
-    return { version, goal: goal || null, criteria: createdCriteria };
+    // task 1004819: every version is born with its artist review goal and its two
+    // standing criteria, on the same client, so they roll back with the version.
+    const artistReviewGoal = await ensureArtistReviewGoal(id, { client });
+    return { version, goal: goal || null, criteria: createdCriteria, artistReviewGoal };
   }, { pool: txPool });
 }
 

package/modules/lifecycle/page-tweak-claim.js

@@ -156,9 +156,9 @@ async function webClaimPageTweak({ pageId, builderId, versionId = null, round },
     const n = Math.max(rounds.length, ...rounds.map((t) => roundNumber(t.source_ref))) + 1;
     const task = await createTask({
       versionId,
-      // ADR 0341 D2: a round lands in the building version's catch-all goal,
-      // exactly as a copy proposal does. Declared out loud (BV1.R11).
-      allowCatchAll: true,
+      // ADR 0341 D2, task 1004819: a round lands in the building version's
+      // artist review goal, exactly as a copy proposal does.
+      artistReview: true,
       title: round.title(n),
       description: round.description(n),
       status: 'ready',

package/modules/lifecycle/page-tweak-write.js

@@ -35,6 +35,7 @@
 'use strict';
 
 const api = require('../../src/module-api');
+const { ensureArtistReviewGoal } = require('./artist-review-goal.js');
 const db = require('./db');
 
 function activePoolFor(deps) {
@@ -139,14 +140,21 @@ async function submitPageTweak({ taskId, builderId, versionId = null, freeze },
       );
       for (const f of found) if (!existing.has(f.source_ref)) existing.set(f.source_ref, String(f.id));
     }
+    // The version's artist review goal, resolved ONCE for the whole loop (task
+    // 1004819) rather than once per line: the version cannot change mid-submit.
+    const roundVersionId = versionId != null ? versionId : held.task.version_id;
+    const artistGoal = wanted.some((u) => !existing.has(u.sourceRef))
+      ? await ensureArtistReviewGoal(roundVersionId, { client }) : null;
     const filed = [];
     for (const u of wanted) {
       if (existing.has(u.sourceRef)) { filed.push({ id: existing.get(u.sourceRef), key: u.key, created: false }); continue; }
       const t = await createTask({
-        versionId: versionId != null ? versionId : held.task.version_id,
-        // The building version's catch-all goal, declared out loud (BV1.R11),
-        // exactly as the round itself and a copy proposal land.
-        allowCatchAll: true,
+        versionId: roundVersionId,
+        // The version's artist review goal (task 1004819), exactly as the
+        // round itself and a copy proposal land; artistReview is the fallback
+        // should the goal above not resolve.
+        goalId: artistGoal ? artistGoal.id : null,
+        artistReview: true,
         title: u.title,
         description: u.description,
         // BACKLOG (ADR 0341 D4): an engineer's triage decides when, and the

package/modules/public-landing/public/index.html

@@ -173,6 +173,10 @@ main:focus{outline:none;box-shadow:none}
 .signin{background:color-mix(in srgb,var(--ink) 92%,var(--bg));color:var(--bg);border:0;
   text-transform:lowercase;font-weight:500;padding:0 26px}
 .signin:hover{background:var(--ink);color:var(--bg)}
+/* the second-account door: an outline beside the filled one, so sign-in stays the first door */
+.newacct{background:transparent;border:1px solid color-mix(in srgb,var(--ink) 40%,transparent);
+  text-transform:lowercase;font-weight:500;margin-right:8px}
+.newacct:hover{border-color:var(--ink)}
 
 /* the menu bands (.menuBand — .band is this page's content sections): not floating cards. Full width on the card ground, closed by one hairline, a LAYER
    over the page under the bar — the page does not reflow (owner, 2026-08-28; task 1003332). Cells in a
@@ -495,7 +499,8 @@ body{
   .trig{font-size:13.5px}
   .who-name{display:none}
   .pill{min-height:42px;font-size:13.5px}
-  .signin{padding:0 16px}
+  .signin,.newacct{padding:0 14px}
+  .newacct{margin-right:6px}
   .bandIn{padding:0 12px 16px}
   .bandRow{grid-template-columns:1fr;gap:0}
   .bandT{font-size:20px}
@@ -686,6 +691,9 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
     <button class="trig" type="button" id="projTrig" data-menu="projects" aria-expanded="false" aria-controls="menuProjects">Projects<svg class="cv" viewBox="0 0 20 20" aria-hidden="true"><path d="m5.6 8 4.4 4.4L14.4 8"/></svg></button>
     <!-- the identity slot: the sign-in door signed out; the chip (the profile trigger) once
          the session resolves — swapped client-side, never a wrong-state flash -->
+    <!-- a second account (task 1004789): switch=1 makes GitHub show its account picker
+         instead of silently re-using whoever is logged in there; stays when signed in -->
+    <a class="pill newacct" href="/api/bongos/auth/web/start?return=/&amp;repos=1&amp;switch=1" title="Sign in with a different GitHub account">New account</a>
     <span class="whoSlot" id="who">
       <a class="pill signin" href="/api/bongos/auth/web/start?return=/&amp;repos=1">Sign in</a>
     </span>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.172",
+  "version": "1.21.174",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.172",
+      "version": "1.21.174",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.172",
+  "version": "1.21.174",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10106,5 +10106,29 @@
       "id": "1004670",
       "text": "The Studio now shows which pages have the most words to write: a short list of the five pages with the most text, each with how many lines it has and whether it has been tweaked, linked straight to the editor. The suggested ne"
     }
+  ],
+  "1.21.173": [
+    {
+      "id": "1004789",
+      "text": "The home page now has a \"New account\" button next to Sign in. It opens GitHub's account picker, so you can sign in with a different GitHub account and get a second Cloud Bongos account. The password screen stays as it is."
+    },
+    {
+      "id": "1004817",
+      "text": "When one builder works two tasks at once in two separate copies of the project, each working session now gets only the expert guidance for its own task. Before, an artist task and an engineering task running side by side both"
+    },
+    {
+      "id": "1003808",
+      "text": "The module store now ranks the best-scoring modules first, uses price only to break ties (free first), and lets buyers hide anything above a price they set."
+    }
+  ],
+  "1.21.174": [
+    {
+      "id": "1004791",
+      "text": "The city's cards no longer cut off their words. Long questions show in full, answer buttons say their whole answer, and a \"Full text\" link on each card opens everything the item says when there is more to read. Long goal names"
+    },
+    {
+      "id": "1004819",
+      "text": "Every version now has an artist review goal, holding all copywriting and Artist Studio work, with two standing checks: every page reviewed by an artist before the version closes, and every page simple to read and use. New page"
+    }
   ]
 }

package/src/bongos/auth-github.js

@@ -234,7 +234,7 @@ async function pollDeviceFlow(deviceCode, userAgent) {
 // Web Flow (browser)
 // -------------------------------------------------------------------------
 
-function buildAuthorizeUrl(state, redirectUri, { repos = false } = {}) {
+function buildAuthorizeUrl(state, redirectUri, { repos = false, switchAccount = false } = {}) {
   const creds = loadGithubCreds();
   if (!creds) throw new Error('GitHub OAuth credentials not configured');
   const u = new URL('https://github.com/login/oauth/authorize');
@@ -244,6 +244,11 @@ function buildAuthorizeUrl(state, redirectUri, { repos = false } = {}) {
   // other caller gets identity-only. scopeForWebFlow keeps that decision in one place.
   u.searchParams.set('scope', scopeForWebFlow({ repos }));
   u.searchParams.set('state', state);
+  // `switchAccount:true` (the home page's "New account" button, task 1004789):
+  // GitHub otherwise silently re-uses whoever is logged in to github.com in this
+  // browser, so a second account could never be reached. select_account makes
+  // GitHub show its account picker, with "Use a different account".
+  if (switchAccount) u.searchParams.set('prompt', 'select_account');
   return u.toString();
 }
 

package/src/bongos/module-listing.js

@@ -126,6 +126,54 @@ function sortByPart(entries, part) {
   });
 }
 
+// ---------------------------------------------------------------------------
+// The ranking: quality first, price breaks ties (task 1003808, owner 2026-10-23)
+// ---------------------------------------------------------------------------
+//
+// Above the floor, the default order of `listed` is the rule an author and a buyer
+// can both check in one sentence:
+//
+//   highest overall score first; between equal scores the cheaper module first
+//   (free first, then the lowest cash price, then the lowest credit price); then
+//   the key.
+//
+// Price never buys a better place: it only orders modules the score could not tell
+// apart (price is never an input to the score, ADR 0343 D6). A buyer may also set a
+// maximum price, which leaves out what costs more — a filter, not a ranking.
+const RANKING = 'Highest overall score first; between equal scores, free modules and then the cheapest come first.';
+
+// A module's current price row ({ price_cents, price_credits } or none) as the
+// catalog shows it. No row is free (isFreePrice, module-store.js); 0 in either
+// currency is free; null means not offered in that currency (core_257). Pure.
+function priceOf(row) {
+  const cents = row && row.price_cents != null ? Number(row.price_cents) : null;
+  const credits = row && row.price_credits != null ? Number(row.price_credits) : null;
+  return { cents, credits, free: !row || cents === 0 || credits === 0 };
+}
+
+// Within a buyer's maximum ({ cents, credits }, either may be null): a free module
+// always is; a priced one is when it is offered at or under a cap the buyer set. Pure.
+function withinMaxPrice(price, max) {
+  if (!max || (max.cents == null && max.credits == null)) return true;
+  if (price.free) return true;
+  return (max.cents != null && price.cents != null && price.cents <= max.cents)
+    || (max.credits != null && price.credits != null && price.credits <= max.credits);
+}
+
+// The default order of `listed`, per RANKING. Returns a new array. Pure.
+function rankListed(entries) {
+  const cheap = (n) => (n == null ? Infinity : n);
+  return [...entries].sort((a, b) => {
+    const pa = a.price || priceOf(null);
+    const pb = b.price || priceOf(null);
+    return ((b.overall ?? -1) - (a.overall ?? -1))
+      || (Number(pb.free) - Number(pa.free))
+      || (cheap(pa.cents) - cheap(pb.cents))
+      || (cheap(pa.credits) - cheap(pb.credits))
+      || a.key.localeCompare(b.key);
+  });
+}
+
 // The newest version row per module key, in semver order (a version that does not
 // parse is skipped, as latestVersions does in module-store.js).
 function newestPerModule(rows) {
@@ -140,13 +188,14 @@ function newestPerModule(rows) {
   return [...out.values()];
 }
 
-// The catalog: { floor, sort, sort_parts, listed: [...], new: [...] }, each entry
-// { key, title, version, published_at, overall, is_new, parts, strengths, weaknesses,
-// unmeasured } (the last four from readParts). Excluded versions are left
-// out entirely: a module below the bar is not listed at all. Both lists are in key
-// order unless `sort` names a part, which orders `listed` by sortByPart; ranking
-// is a separate task (1003808) and does not happen here.
-async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null } = {}) {
+// The catalog: { floor, ranking, sort, sort_parts, max_price, listed: [...], new: [...] },
+// each entry { key, title, version, published_at, price, overall, is_new, parts,
+// strengths, weaknesses, unmeasured } (the last four from readParts). Excluded
+// versions are left out entirely: a module below the bar is not listed at all, and
+// neither is one over the buyer's `maxPrice`. `listed` is in rankListed order unless
+// `sort` names a part, which orders it by sortByPart; `new` is never ranked and
+// stays in key order.
+async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null, maxPrice = null } = {}) {
   const pool = db || require('./pool').pool;
   const { rows: versions } = await pool.query(
     `SELECT m.module_key, m.title, v.id AS version_id, v.version, v.published_at
@@ -162,6 +211,15 @@ async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null } = {}) {
         ORDER BY version_id, computed_at DESC, id DESC`, [newest.map((r) => r.version_id)]);
     for (const s of rows) scores.set(String(s.version_id), s);
   }
+  const prices = new Map();
+  if (newest.length) {
+    const { rows } = await pool.query(
+      `SELECT DISTINCT ON (module_key) module_key, price_cents, price_credits
+         FROM store_module_prices
+        WHERE module_key = ANY($1)
+        ORDER BY module_key, set_at DESC, id DESC`, [newest.map((r) => r.module_key)]);
+    for (const p of rows) prices.set(p.module_key, p);
+  }
   // Each version's current result per part: the newest row per (version, part),
   // the read idx_module_assessment_signals_current exists for (core_265).
   const signals = new Map();
@@ -177,19 +235,26 @@ async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null } = {}) {
       signals.get(k).push(s);
     }
   }
-  const out = { floor, sort: sort || null, sort_parts: SORT_PARTS, listed: [], new: [] };
+  const max = maxPrice && (maxPrice.cents != null || maxPrice.credits != null)
+    ? { cents: maxPrice.cents ?? null, credits: maxPrice.credits ?? null } : null;
+  const out = { floor, ranking: RANKING, sort: sort || null, sort_parts: SORT_PARTS, max_price: max, listed: [], new: [] };
   for (const r of newest.sort((a, b) => a.module_key.localeCompare(b.module_key))) {
     const score = scores.get(String(r.version_id)) || null;
     const { placement } = placeVersion(score, floor);
     if (placement === 'excluded') continue;
+    const price = priceOf(prices.get(r.module_key));
+    if (!withinMaxPrice(price, max)) continue;
     out[placement].push({
-      key: r.module_key, title: r.title, version: r.version, published_at: r.published_at,
+      key: r.module_key, title: r.title, version: r.version, published_at: r.published_at, price,
       overall: placement === 'new' ? null : score.overall, is_new: placement === 'new',
       ...readParts(signals.get(String(r.version_id)) || [], { floor }),
     });
   }
-  if (sort) out.listed = sortByPart(out.listed, sort);
+  out.listed = sort ? sortByPart(out.listed, sort) : rankListed(out.listed);
   return out;
 }
 
-module.exports = { QUALITY_FLOOR, STRONG_AT, SORT_PARTS, placeVersion, readParts, sortByPart, listCatalog };
+module.exports = {
+  QUALITY_FLOOR, STRONG_AT, SORT_PARTS, RANKING, placeVersion, readParts, sortByPart,
+  priceOf, withinMaxPrice, rankListed, listCatalog,
+};

package/src/bongos/routes/auth.js

@@ -697,6 +697,9 @@ module.exports = function buildAuthRouter() {
       return sendAuthNotConfigured(res);
     }
     const wantsRepos = req.query.repos === '1' || req.query.repos === 'true';
+    // ?switch=1 — sign in as a DIFFERENT GitHub account (task 1004789): show
+    // GitHub's account picker instead of re-using the one logged in there.
+    const wantsSwitch = req.query.switch === '1' || req.query.switch === 'true';
     // A sign-in begun on a satellite hub host (builders./status.) restarts on
     // the canonical host (task 1004357). The handshake cookies are host-only now,
     // and the callback always lands on the canonical host, so a state cookie set
@@ -708,13 +711,14 @@ module.exports = function buildAuthRouter() {
       const back = raw.startsWith('/') ? `https://${host}${raw}` : raw;
       const params = new URLSearchParams({ return: back });
       if (wantsRepos) params.set('repos', '1');
+      if (wantsSwitch) params.set('switch', '1');
       return res.redirect(`${WEB_REDIRECT_ORIGIN.replace(/\/+$/, '')}${apiBase(req)}/auth/web/start?${params}`);
     }
     // Already signed in on the canonical host and headed for a satellite hub
     // host (a builder who signed in on the apex, then opened builders.): no
     // GitHub round-trip, just hand that host its copy. A repo-scope sign-in
     // still goes to GitHub — it exists to ask for the broader grant.
-    if (!wantsRepos) {
+    if (!wantsRepos && !wantsSwitch) {
       const target = safeReturnTo(req.query.return);
       if (target && !target.startsWith('/')) {
         try {
@@ -774,7 +778,7 @@ module.exports = function buildAuthRouter() {
     // way — the callback validates it identically, so the hub leg is CSRF-protected too.
     res.redirect(auth.idpConfigured()
       ? auth.buildIdpAuthorizeUrl(state, redirectUri)
-      : auth.buildAuthorizeUrl(state, redirectUri, { repos: wantsRepos }));
+      : auth.buildAuthorizeUrl(state, redirectUri, { repos: wantsRepos, switchAccount: wantsSwitch }));
   });
 
   // GET /auth/web/handoff?code=&return= — the far side of the one-time session

package/src/bongos/routes/modules.js

@@ -841,6 +841,9 @@ module.exports = function buildModulesRouter() {
   // is not listed at all. The floor is fixed in module-listing.js and returned here.
   // `?sort=<part>` orders the listed modules by the part a buyer cares about
   // (task 1003800, sortByPart); the parts it accepts come back as sort_parts.
+  // Without it the listed modules are ranked quality first, price breaking ties
+  // (task 1003808, rankListed); `?max_cents=` / `?max_credits=` leave out modules
+  // that cost more.
   //
   // rank: any-builder — a read of public store metadata, like /store/modules/latest:
   // no entitlement taken, nothing changed.
@@ -852,7 +855,18 @@ module.exports = function buildModulesRouter() {
         const names = SORT_PARTS.map((p) => `${p.title} (${p.part})`).join(', ');
         return res.fail('bad_request', { status: 400, message: `The store can be sorted by one part of the score: ${names}.` });
       }
-      const listing = await listCatalog({ sort });
+      // An optional maximum price (task 1003808): ?max_cents= and/or ?max_credits=,
+      // each a whole number of at least 0. Free modules always pass.
+      const maxPrice = {};
+      for (const [param, field] of [['max_cents', 'cents'], ['max_credits', 'credits']]) {
+        const v = req.query && req.query[param];
+        if (v == null || v === '') continue;
+        if (typeof v !== 'string' || !/^\d{1,9}$/.test(v)) {
+          return res.fail('bad_request', { status: 400, message: `${param} is a maximum price: a whole number, 0 or more.` });
+        }
+        maxPrice[field] = Number(v);
+      }
+      const listing = await listCatalog({ sort, maxPrice });
       res.set('Cache-Control', 'no-store');
       res.json(listing);
     }));

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.172'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.174'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/artist_review_goal.mjs

@@ -0,0 +1,119 @@
+// tests/artist_review_goal.mjs
+//
+// Every version's ARTIST REVIEW goal (task 1004819): the find-or-create behind
+// createTask's `artistReview` switch and createVersion. DB-free: a recording fake
+// client stands in for Postgres, and the statement order is the contract — the
+// version gate before anything else, the advisory lock before the read, and the
+// two standing criteria written only when the goal is new.
+//
+// Run:  node tests/artist_review_goal.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const { ensureArtistReviewGoal, artistReviewGoalTitle, ARTIST_REVIEW_CRITERIA } = require('../modules/lifecycle/artist-review-goal.js');
+const { createTask } = require('../modules/lifecycle/db.js');
+
+const { test, summary } = makeRunner();
+const norm = (s) => String(s).replace(/\s+/g, ' ').trim();
+
+// One version, at most one goal: the fake answers like the tables would.
+function fakeClient({ status = 'building', goal = null } = {}) {
+  const queries = [];
+  const state = { goal, criteria: [], tasks: [] };
+  const client = {
+    queries, state,
+    async query(sql, params = []) {
+      const q = norm(sql);
+      queries.push({ sql: q, params });
+      if (/^(BEGIN|COMMIT|ROLLBACK)$/.test(q)) return { rows: [] };
+      if (/^SELECT status FROM versions WHERE id = \$1/.test(q)) return { rows: status ? [{ status }] : [] };
+      if (/pg_advisory_xact_lock/.test(q)) return { rows: [] };
+      if (/^SELECT id, version_id, title FROM goals WHERE version_id = \$1 AND title = \$2/.test(q)) {
+        return { rows: state.goal && state.goal.title === params[1] ? [state.goal] : [] };
+      }
+      if (/^INSERT INTO goals/.test(q)) { state.goal = { id: 91, version_id: params[0], title: params[1] }; return { rows: [state.goal] }; }
+      if (/^INSERT INTO done_when_criteria/.test(q)) { state.criteria.push({ id: params[1], goal: params[3] }); return { rows: [] }; }
+      if (/^SELECT scope_modules FROM goals WHERE id = \$1/.test(q)) return { rows: [{ scope_modules: [] }] };
+      if (/^INSERT INTO tasks/.test(q)) { const t = { id: 1, goal_id: params[22] }; state.tasks.push(t); return { rows: [t] }; }
+      return { rows: [] };
+    },
+    release() {},
+  };
+  return client;
+}
+
+await test('the title is the version plus " — artist review" (em dash)', () => {
+  assert.equal(artistReviewGoalTitle('BONGOS-V3'), 'BONGOS-V3 — artist review');
+  assert.deepEqual(ARTIST_REVIEW_CRITERIA.map((c) => c.criterion_id), ['artist-every-page-reviewed', 'artist-pages-simple-to-use']);
+});
+
+await test('a new goal is made with its two criteria, after the version gate and the lock', async () => {
+  const c = fakeClient();
+  const g = await ensureArtistReviewGoal('BONGOS-V3', { client: c });
+  assert.equal(g.title, 'BONGOS-V3 — artist review');
+  const order = c.queries.map((q) => q.sql.split(' ').slice(0, 3).join(' '));
+  const at = (re) => c.queries.findIndex((q) => re.test(q.sql));
+  assert.ok(at(/FROM versions/) < at(/pg_advisory_xact_lock/), 'the version is checked first');
+  assert.ok(at(/pg_advisory_xact_lock/) < at(/FROM goals WHERE version_id/), 'the lock is taken before the read');
+  assert.equal(c.queries.find((q) => /pg_advisory_xact_lock/.test(q.sql)).params[0], 'BONGOS-V3 — artist review', 'locked on the title');
+  assert.deepEqual(c.state.criteria, [{ id: 'artist-every-page-reviewed', goal: 91 }, { id: 'artist-pages-simple-to-use', goal: 91 }]);
+  assert.ok(/ON CONFLICT \(version_id, criterion_id\) DO NOTHING/.test(c.queries.find((q) => /INSERT INTO done_when_criteria/.test(q.sql)).sql),
+    'a criterion already on the version is left alone', order);
+});
+
+await test('an existing goal is reused, never duplicated, and still carries the two criteria', async () => {
+  // A goal of this title made by hand before the first studio write is found,
+  // and its criteria are seeded (ON CONFLICT DO NOTHING keeps any already there).
+  const c = fakeClient({ goal: { id: 1000134, version_id: 'BONGOS-V2', title: 'BONGOS-V2 — artist review' } });
+  const g = await ensureArtistReviewGoal('BONGOS-V2', { client: c });
+  assert.equal(g.id, 1000134);
+  assert.equal(c.queries.some((q) => /^INSERT INTO goals/.test(q.sql)), false, 'no second goal');
+  assert.deepEqual(c.state.criteria, [{ id: 'artist-every-page-reviewed', goal: 1000134 }, { id: 'artist-pages-simple-to-use', goal: 1000134 }]);
+});
+
+await test('a closed or missing version gets no goal, and nothing is locked or written', async () => {
+  for (const status of ['shipped', null]) {
+    const c = fakeClient({ status });
+    assert.equal(await ensureArtistReviewGoal('V0', { client: c }), null);
+    assert.equal(c.queries.length, 1, 'only the version read ran');
+  }
+  const planning = fakeClient({ status: 'planning' });
+  assert.ok(await ensureArtistReviewGoal('V4', { client: planning }), 'a planning version takes one, so a new version is born with it');
+});
+
+await test('with no caller transaction it opens its own, so the lock means something', async () => {
+  const c = fakeClient();
+  const pool = { connect: async () => c, query: (...a) => c.query(...a) };
+  await ensureArtistReviewGoal('BONGOS-V3', { pool });
+  const sqls = c.queries.map((q) => q.sql);
+  assert.equal(sqls[0], 'BEGIN');
+  assert.equal(sqls.at(-1), 'COMMIT');
+});
+
+await test('createTask with artistReview lands in the goal; without one the catch-all still answers', async () => {
+  const c = fakeClient();
+  await createTask({ versionId: 'BONGOS-V3', title: 'Tweak: Home (builders:home)', discipline: 'artist', artistReview: true }, { client: c });
+  assert.equal(c.state.tasks[0].goal_id, 91, 'the studio task names the artist review goal');
+  await assert.rejects(
+    () => createTask({ versionId: 'BONGOS-V3', title: 'plain', discipline: 'engineer' }, { client: fakeClient() }),
+    /goalId is required/, 'an ordinary goal-less create still throws');
+});
+
+await test('a create with no caller transaction (a copy proposal) puts goal and task in ONE transaction', async () => {
+  const c = fakeClient();
+  const pool = { connect: async () => c, query: () => { throw new Error('nothing may run outside the transaction'); } };
+  await createTask({ versionId: 'BONGOS-V3', title: 'Reword the Home heading', discipline: 'artist', artistReview: true }, { pool });
+  const sqls = c.queries.map((q) => q.sql);
+  const begins = sqls.filter((q) => q === 'BEGIN').length;
+  assert.equal(begins, 1, 'exactly one transaction');
+  assert.ok(sqls.indexOf('BEGIN') < sqls.findIndex((q) => /^INSERT INTO goals/.test(q)), 'the goal is made inside it');
+  assert.ok(sqls.findIndex((q) => /^INSERT INTO tasks/.test(q)) < sqls.lastIndexOf('COMMIT'), 'and the task too, before the one COMMIT');
+  assert.equal(c.state.tasks[0].goal_id, 91);
+});
+
+summary();