@bongos/core 1.21.77 → 1.21.79

package/src/bongos/module-usage-reports.js

@@ -0,0 +1,112 @@
+// src/bongos/module-usage-reports.js — take in the counts real installs report
+// about a store module version: did the install work, and how many runtime
+// errors it threw on a day (task 1003793, ADR 0343 D1; tables core_273).
+//
+// WHY a separate intake. Install and Reliability are the parts of a module's
+// score an author cannot fake, because they come from other people's installs.
+// That makes them telemetry about someone else's setup, so the owner set the
+// privacy posture up front (Will, 2026-10-01): COUNTS ONLY, ON BY DEFAULT, WITH
+// AN OPT-OUT. This file is where that posture is enforced, at the server, so it
+// holds whatever client sends the report:
+//   - a report is a yes/no plus a short error CODE, or a whole-number daily
+//     count — there is no field for error text, paths or user data;
+//   - a holder that has switched reporting off is dropped at intake, before
+//     anything is written.
+// Scoring the reports into signal rows is module-assess-installs.js's job.
+//
+// Every function takes { db } (a pg Pool or anything with query()) so tests run
+// against a fake client, the way module-entitlements.js does.
+
+const ERROR_CODE_RE = /^[a-z][a-z0-9_]{0,39}$/; // same rule as core_273's CHECK
+const DAY_RE = /^\d{4}-\d{2}-\d{2}$/;
+const MAX_DAILY_ERRORS = 1_000_000;
+// How far back a daily count may be sent. Matches the window Reliability is
+// scored over (module-assess-installs.js), so nothing is stored that never counts.
+const ERROR_DAY_WINDOW = 30;
+
+function poolOf(db) { return db || require('./pool').pool; }
+
+// Does this holder have usage reporting switched off? No row = on (the default).
+async function isOptedOut({ holderKind, holderRef }, { db } = {}) {
+  const { rows } = await poolOf(db).query(
+    'SELECT 1 FROM module_usage_report_optouts WHERE holder_kind = $1 AND holder_ref = $2',
+    [holderKind, holderRef]);
+  return rows.length > 0;
+}
+
+// Switch a holder's reporting on or off. Idempotent either way.
+async function setReporting({ holderKind, holderRef, enabled }, { db } = {}) {
+  const pool = poolOf(db);
+  if (enabled) {
+    await pool.query('DELETE FROM module_usage_report_optouts WHERE holder_kind = $1 AND holder_ref = $2',
+      [holderKind, holderRef]);
+  } else {
+    await pool.query(
+      `INSERT INTO module_usage_report_optouts (holder_kind, holder_ref) VALUES ($1, $2)
+       ON CONFLICT (holder_kind, holder_ref) DO NOTHING`, [holderKind, holderRef]);
+  }
+  return { enabled: !!enabled };
+}
+
+// Check a report's shape. Returns null when fine, else { code, message } — the
+// route turns that into a 400. Pure.
+function installReportError({ ok, errorCode }) {
+  if (typeof ok !== 'boolean') return { code: 'bad_report', message: 'ok is true or false.' };
+  if (ok && errorCode != null) return { code: 'bad_report', message: 'A working install carries no error code.' };
+  if (!ok && !ERROR_CODE_RE.test(String(errorCode || ''))) {
+    return { code: 'bad_error_code', message: 'A failed install carries a short lowercase code (letters, digits, _), never a message.' };
+  }
+  return null;
+}
+
+// Check a daily error count. `today` is a YYYY-MM-DD string (UTC) so tests can pin it. Pure.
+function errorCountError({ day, count }, { today = new Date().toISOString().slice(0, 10) } = {}) {
+  if (!Number.isInteger(count) || count < 0 || count > MAX_DAILY_ERRORS) {
+    return { code: 'bad_count', message: `count is a whole number from 0 to ${MAX_DAILY_ERRORS}.` };
+  }
+  if (!DAY_RE.test(String(day || '')) || Number.isNaN(Date.parse(`${day}T00:00:00Z`))) {
+    return { code: 'bad_day', message: 'day is a date, YYYY-MM-DD.' };
+  }
+  const ageDays = (Date.parse(`${today}T00:00:00Z`) - Date.parse(`${day}T00:00:00Z`)) / 86_400_000;
+  if (ageDays < 0) return { code: 'bad_day', message: 'day cannot be in the future.' };
+  if (ageDays > ERROR_DAY_WINDOW) return { code: 'bad_day', message: `day must be within the last ${ERROR_DAY_WINDOW} days.` };
+  return null;
+}
+
+// Record a holder's latest install or update attempt of a version — it REPLACES
+// their previous one, so retries never grow the table or outweigh other holders.
+// Resolves { recorded: true } or { recorded: false, reason: 'opted_out' }.
+// Validate with installReportError first.
+async function recordInstallReport({ versionId, holderKind, holderRef, ok, errorCode = null }, { db } = {}) {
+  const pool = poolOf(db);
+  if (await isOptedOut({ holderKind, holderRef }, { db: pool })) return { recorded: false, reason: 'opted_out' };
+  await pool.query(
+    `INSERT INTO module_install_reports (version_id, holder_kind, holder_ref, ok, error_code)
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (version_id, holder_kind, holder_ref)
+     DO UPDATE SET ok = EXCLUDED.ok, error_code = EXCLUDED.error_code, reported_at = now()`,
+    [versionId, holderKind, holderRef, ok, ok ? null : errorCode]);
+  return { recorded: true };
+}
+
+// Record a version's runtime error count for one holder on one day. A second
+// report for the same day REPLACES the count (the sender counts the whole day),
+// so a retried send never doubles it. Validate with errorCountError first.
+async function recordErrorCount({ versionId, holderKind, holderRef, day, count }, { db } = {}) {
+  const pool = poolOf(db);
+  if (await isOptedOut({ holderKind, holderRef }, { db: pool })) return { recorded: false, reason: 'opted_out' };
+  await pool.query(
+    `INSERT INTO module_runtime_error_counts (version_id, holder_kind, holder_ref, day, error_count)
+     VALUES ($1, $2, $3, $4, $5)
+     ON CONFLICT (version_id, holder_kind, holder_ref, day)
+     DO UPDATE SET error_count = EXCLUDED.error_count, reported_at = now()`,
+    [versionId, holderKind, holderRef, day, count]);
+  return { recorded: true };
+}
+
+module.exports = {
+  ERROR_CODE_RE, ERROR_DAY_WINDOW,
+  isOptedOut, setReporting,
+  installReportError, errorCountError,
+  recordInstallReport, recordErrorCount,
+};

package/src/bongos/routes/modules.js

@@ -38,6 +38,13 @@
 //   POST /store/modules/:key/delist
 //                               Metic+ takes a module out of the store; holders
 //                               keep it (task 1003797, ADR 0338 D2).
+//   POST /store/modules/:key/versions/:version/install-report
+//   POST /store/modules/:key/versions/:version/error-count
+//   GET|POST /store/usage-reporting
+//                               counts real installs report — did an install work,
+//                               runtime errors per day — scored into the Install and
+//                               Reliability parts, and the caller's own switch to
+//                               stop reporting (task 1003793, ADR 0343 D1).
 //
 // Read is open to any signed-in builder (same gate as the atlas/primer pages);
 // every write (enable/disable, submit) is metic+archon, same rank as
@@ -90,6 +97,10 @@ const {
   resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
   delistModule, delistedKeySet,
 } = require('../module-store');
+const {
+  isOptedOut, setReporting, installReportError, errorCountError, recordInstallReport, recordErrorCount,
+} = require('../module-usage-reports');
+const { recordInstallSignals } = require('../../../scripts/gds/module-assess-installs');
 const { KEY_RE } = require('../../module-loader/manifest-schema');
 const { parseVersion } = require('../../module-loader/semver');
 const log = require('../logger').logger.child({ src: 'modules' });
@@ -726,6 +737,91 @@ module.exports = function buildModulesRouter() {
       res.json({ ok: true, entitlement: out.entitlement });
     }));
 
+  // ---- usage reports: the Install and Reliability parts (task 1003793, ADR 0343 D1) ----
+  //
+  // Real installs report counts back so a module is scored on what happens when
+  // other people run it. Owner's privacy posture (2026-10-01): counts only, on by
+  // default, with an opt-out — enforced in src/bongos/module-usage-reports.js, which
+  // drops a report from a holder who switched reporting off before anything is
+  // written. Own-scoped like /acquired: the holder is always the caller, never
+  // named in the request, so requireBuilder is the gate, and only a LIVE holder of
+  // the module may report on it. Each accepted report re-scores the two parts.
+  async function reportTarget(req, res) {
+    const { key, version } = req.params;
+    if (!KEY_RE.test(key) || !parseVersion(version)) {
+      res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      return null;
+    }
+    const r = await resolveReadable(key, version);
+    if (!r.ok) { res.fail(r.code, { status: r.status, message: r.message }); return null; }
+    const holder = { holderKind: 'builder', holderRef: String(req.builder.id) };
+    const held = await checkEntitlement({ moduleKey: key, ...holder });
+    if (!held.entitled) {
+      res.fail('not_entitled', { status: 403, message: `You do not hold "${key}", so you cannot report on it.` });
+      return null;
+    }
+    return { versionId: r.version.id, ...holder };
+  }
+
+  // Re-score after an accepted report, once the response is sent so the reporter
+  // never waits on it. A scoring failure never loses the report; the next report
+  // re-scores from the same stored rows.
+  function rescore(versionId) {
+    setImmediate(() => {
+      recordInstallSignals(versionId).catch((e) => {
+        log.warn({ err: e.message, versionId }, 'install/reliability re-score failed; the report is kept');
+      });
+    });
+  }
+
+  router.post('/store/modules/:key/versions/:version/install-report', auth.requireBuilder,
+    asyncHandler('POST /store/modules/:key/versions/:version/install-report', async (req, res) => {
+      if (validateOrRespond(req, res, {
+        ok: { type: 'boolean', required: true },
+        error_code: { type: 'string', maxLength: 40 },
+      })) return;
+      const report = { ok: req.body.ok, errorCode: req.body.error_code == null ? null : req.body.error_code };
+      const bad = installReportError(report);
+      if (bad) return res.fail(bad.code, { status: 400, message: bad.message });
+      const t = await reportTarget(req, res);
+      if (!t) return;
+      const out = await recordInstallReport({ ...t, ...report });
+      res.json({ ok: true, recorded: out.recorded, ...(out.reason ? { reason: out.reason } : {}) });
+      if (out.recorded) rescore(t.versionId);
+    }));
+
+  router.post('/store/modules/:key/versions/:version/error-count', auth.requireBuilder,
+    asyncHandler('POST /store/modules/:key/versions/:version/error-count', async (req, res) => {
+      if (validateOrRespond(req, res, {
+        day: { type: 'string', required: true, maxLength: 10 },
+        count: { type: 'integer', required: true },
+      })) return;
+      const report = { day: req.body.day, count: req.body.count };
+      const bad = errorCountError(report);
+      if (bad) return res.fail(bad.code, { status: 400, message: bad.message });
+      const t = await reportTarget(req, res);
+      if (!t) return;
+      const out = await recordErrorCount({ ...t, ...report });
+      res.json({ ok: true, recorded: out.recorded, ...(out.reason ? { reason: out.reason } : {}) });
+      if (out.recorded) rescore(t.versionId);
+    }));
+
+  // The caller's own reporting switch (Settings → Profile and privacy). On unless
+  // they turned it off.
+  router.get('/store/usage-reporting', auth.requireBuilder,
+    asyncHandler('GET /store/usage-reporting', async (req, res) => {
+      const off = await isOptedOut({ holderKind: 'builder', holderRef: String(req.builder.id) });
+      res.set('Cache-Control', 'no-store');
+      res.json({ enabled: !off });
+    }));
+
+  router.post('/store/usage-reporting', auth.requireBuilder,
+    asyncHandler('POST /store/usage-reporting', async (req, res) => {
+      if (validateOrRespond(req, res, { enabled: { type: 'boolean', required: true } })) return;
+      const out = await setReporting({ holderKind: 'builder', holderRef: String(req.builder.id), enabled: req.body.enabled });
+      res.json({ ok: true, enabled: out.enabled });
+    }));
+
   return router;
 };
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.77'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.79'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/goal_map_page.mjs

@@ -413,7 +413,7 @@ await test('a goal title never becomes markup — in the ledger, the panel or th
 
 await test('Sky sits directly under Goals in the nav, member-gated, at the URL Goals links to', () => {
   const shell = read('shell.js');
-  const item = shell.indexOf("{ id: 'goal-map', label: 'Sky', icon: 'goals', href: '/goal-map', gate: 'member' }");
+  const item = shell.indexOf("{ id: 'goal-map', label: 'Sky', icon: 'sky', href: '/goal-map', gate: 'member' }");
   assert.ok(item > -1, 'the nav item, with the slot the map was denied (ADR 0227 §11)');
   const goals = shell.indexOf("{ id: 'goals', label: 'Goals'"); const work = shell.indexOf("{ id: 'work', label: 'Tasks'");
   assert.ok(goals > -1 && goals < item && item < work, 'under Goals, above Tasks');

package/tests/goal_plan_with_claude.mjs

@@ -0,0 +1,41 @@
+// tests/goal_plan_with_claude.mjs — the goal page's "Plan with Claude" hand-off (task 1004587, ADR 0366 D4).
+//
+// Run:  node --test tests/goal_plan_with_claude.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+globalThis.location = { hostname: 'builders.example.com', origin: 'https://builders.example.com' };
+const { buildPlanPromptForGoal, buildPromptForTask } = require('../modules/hall-ui/public/task-lib.js');
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+
+const goal = { id: 42, title: 'Ship the thing' };
+const spec = { id: 900, title: 'Spec goal 42: its scope', description: 'Do the interview.', source_ref: 'goal-42-spec' };
+const other = { id: 901, title: 'Other', description: 'x', source_ref: null };
+
+test('with an unshipped spec task the prompt is that task\'s', () => {
+  assert.equal(buildPlanPromptForGoal(goal, [other, spec]), buildPromptForTask(spec));
+});
+
+test('another goal\'s spec task is not this goal\'s', () => {
+  const p = buildPlanPromptForGoal(goal, [{ ...spec, source_ref: 'goal-43-spec' }]);
+  assert.match(p, /\/goal-create/);
+});
+
+test('without a spec task the prompt asks for /goal-create against the goal', () => {
+  const p = buildPlanPromptForGoal(goal, [other]);
+  assert.match(p, /\/goal-create/);
+  assert.match(p, /goal 42/);
+  assert.match(p, /#\/goal\/42/);
+  assert.equal(buildPlanPromptForGoal(goal, undefined), p);
+});
+
+test('the button is on the goal page and copies the goal prompt', () => {
+  const r = src('modules/hall-ui/public/goals-render.js');
+  const pg = src('modules/hall-ui/public/goals-page.js');
+  assert.match(r, /id="goal-plan-btn"/);
+  assert.ok(pg.includes('buildPlanPromptForGoal(g, state.work.todo)'));
+});

package/tests/hall_commands.mjs

@@ -156,7 +156,7 @@ test('the page is wired: nav entry in Docs, sign-in gated, both reads, no hand-t
   assert.match(js, /\/api\/bongos\/cli\/commands/);
   assert.ok(!/data-skill=|data-verb=|\/builder-ship|bongos claim/.test(page), 'the HTML names no command — the rows are generated');
   const shell = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
-  assert.match(shell, /id: 'commands', label: 'Commands', icon: 'docs', href: '\/commands', gate: 'signed'/);
+  assert.match(shell, /id: 'commands', label: 'Commands', icon: 'commands', href: '\/commands', gate: 'signed'/);
   const serveInternal = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
   assert.match(serveInternal.match(/const SIGNEDIN_BUILDERS_PAGE_RE =\s*(\/.*\/);/)[1], /\|commands\)/);
 });

package/tests/hall_nav.mjs

@@ -683,3 +683,45 @@ test('the badge is styled for BOTH shapes of the rail', () => {
   const drawer = css.slice(css.indexOf('html.drawer-open .app-sidebar'));
   assert.match(drawer, /\.nav-item__badge \{ top: 50%/, 'the mobile drawer position');
 });
+
+// task 1004626: ONE GLYPH PER TAB. The rail is an icon strip until it opens,
+// so at rest the icon is the tab's only name. Nine Government tabs once wore
+// one shield and every Docs tab one page — the owner's word was "very
+// confusing". Read off the RENDERED markup, so a fallback or a render bug that
+// paints two tabs alike reds here even if the NAV keys differ.
+test('every sidebar tab draws its own icon — no two tabs share a glyph', () => {
+  const html = boot().sidebarHtml;
+  const items = [...html.matchAll(/<a class="nav-item" id="nav-([^"]+)"[^>]*><svg class="nav-icon"[^>]*>([\s\S]*?)<\/svg>/g)]
+    .map((m) => ({ id: m[1], glyph: m[2] }));
+  assert.ok(items.length >= 20, `the nav items were actually located (${items.length})`);
+  const seen = new Map();
+  for (const { id, glyph } of items) {
+    assert.ok(glyph.trim(), `nav item ${id} draws a glyph (an unknown icon key renders an empty frame)`);
+    assert.ok(!seen.has(glyph), `nav items ${seen.get(glyph)} and ${id} draw the same icon`);
+    seen.set(glyph, id);
+  }
+});
+
+test('every NAV icon key is declared in ICONS, used once, and no two ICONS draw alike', () => {
+  const nav = SRC.slice(SRC.indexOf('var NAV = ['), SRC.indexOf('var NAV_COLLAPSE_KEY'));
+  const keys = [...nav.matchAll(/icon: '([^']+)'/g)].map((m) => m[1]);
+  assert.ok(keys.length >= 20, 'the NAV icon keys were actually located');
+  const block = SRC.slice(SRC.indexOf('var ICONS = {'), SRC.indexOf('function icon('));
+  const icons = new Map([...block.matchAll(/^\s+([a-z]+): '(.*)',$/gm)].map((m) => [m[1], m[2]]));
+  assert.ok(icons.size >= keys.length, 'the ICONS entries were actually located');
+  for (const k of keys) assert.ok(icons.has(k), `NAV icon '${k}' exists in ICONS`);
+  assert.equal(new Set(keys).size, keys.length, `no icon key is used by two tabs: ${keys.filter((k, i) => keys.indexOf(k) !== i).join(', ')}`);
+  const markup = [...icons.values()];
+  assert.equal(new Set(markup).size, markup.length, 'no two ICONS entries draw the same markup');
+});
+
+// task 1004639: glyph path data is shipped verbatim, and the release packager's
+// leak scan reads four numbers chained on dots as a leaked address. The first
+// thinking glyph chained four that way and refused the whole core release, so a new
+// glyph separates its numbers with spaces wherever four would otherwise chain.
+test('no glyph path data reads as an IP address to the release leak scan', () => {
+  const block = SRC.slice(SRC.indexOf('var ICONS = {'), SRC.indexOf('function icon('));
+  assert.ok(block.includes('thinking:'), 'the ICONS block was actually located');
+  const hits = block.match(/\d+\.\d+\.\d+\.\d+/g) || [];
+  assert.deepEqual(hits, [], 'separate the numbers with spaces so no four chain on dots');
+});

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-08-city-tab/);
+    assert.match(HTML, /shell\.js\?v=2026-10-08-glyph-fix/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);

package/tests/module_assess_installs.mjs

@@ -0,0 +1,272 @@
+// tests/module_assess_installs.mjs — the Install and Reliability parts of a module's
+// assessment, from what real installs report (task 1003793, ADR 0343 D1; core_273).
+//
+// No database, no network: the scorers are pure, the intake and the re-score run
+// against a regex-dispatching fake pool that throws on any SQL it does not expect
+// (ADR 0216 fail-loud), and the CLI runs against a fake store built from a REAL
+// packed tarball. The owner's privacy posture — counts only, on by default, with an
+// opt-out — is held from three sides: the intake's validators, the migration's
+// columns and CHECKs, and the opt-out dropping a report before anything is written.
+//
+// Run:  node tests/module_assess_installs.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { MIN_HOLDERS, assessInstall, assessReliability, recordInstallSignals } = require('../scripts/gds/module-assess-installs.js');
+const reports = require('../src/bongos/module-usage-reports.js');
+const { ERROR_CODE_RE } = require('../src/bongos/module-usage-reports.js');
+const { cmdInstall } = require('../scripts/gds/module.js');
+const { packModule, verifyModuleArtifact } = require('../scripts/gds/module-artifact.js');
+
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
+
+// ---- the scorers (pure) ----
+
+test('Install: no reports is no_data, never a zero', () => {
+  const s = assessInstall([]);
+  assert.equal(s.outcome, 'no_data');
+  assert.equal(s.score, null);
+  assert.equal(s.sample_size, 0);
+});
+
+test(`Install: fewer than ${MIN_HOLDERS} holders is pending, so one friend cannot set the number`, () => {
+  const s = assessInstall([{ ok: true }, { ok: true }]);
+  assert.equal(s.outcome, 'pending');
+  assert.equal(s.score, null);
+  assert.equal(s.sample_size, 2);
+  assert.match(s.reason, /2 of the 3 installs needed/);
+});
+
+test('Install: the share of holders whose latest install worked, with the failure codes counted', () => {
+  const s = assessInstall([
+    { ok: true }, { ok: true }, { ok: true },
+    { ok: false, error_code: 'verify_failed' }, { ok: false, error_code: 'place_failed' }, { ok: false, error_code: 'place_failed' },
+  ]);
+  assert.equal(s.outcome, 'scored');
+  assert.equal(s.score, 50);
+  assert.equal(s.sample_size, 6);
+  assert.equal(s.reason, '3 of 6 installs worked');
+  assert.deepEqual(s.detail.failed_codes, { verify_failed: 1, place_failed: 2 });
+});
+
+test('Reliability: the share of holder-days with zero errors; sample_size counts holders, not days', () => {
+  const days = [
+    { holder_kind: 'builder', holder_ref: '1', error_count: 0 },
+    { holder_kind: 'builder', holder_ref: '1', error_count: 4 },
+    { holder_kind: 'builder', holder_ref: '2', error_count: 0 },
+    { holder_kind: 'builder', holder_ref: '3', error_count: 0 },
+  ];
+  const s = assessReliability(days);
+  assert.equal(s.outcome, 'scored');
+  assert.equal(s.score, 75);
+  assert.equal(s.sample_size, 3);
+  assert.equal(s.detail.errors, 4);
+  assert.equal(assessReliability([]).outcome, 'no_data');
+  assert.equal(assessReliability(days.slice(0, 3)).outcome, 'pending', 'two holders is not enough');
+});
+
+// ---- the intake: counts only ----
+
+test('an install report is a yes/no plus a short code — never a message', () => {
+  assert.equal(reports.installReportError({ ok: true, errorCode: null }), null);
+  assert.equal(reports.installReportError({ ok: false, errorCode: 'verify_failed' }), null);
+  assert.equal(reports.installReportError({ ok: 'yes' }).code, 'bad_report');
+  assert.equal(reports.installReportError({ ok: true, errorCode: 'x' }).code, 'bad_report', 'a working install carries no code');
+  assert.equal(reports.installReportError({ ok: false, errorCode: null }).code, 'bad_error_code');
+  for (const smuggled of ['Error: ENOENT /home/me/x', 'Verify Failed', 'a'.repeat(41), 'path/to', 'x y']) {
+    assert.equal(reports.installReportError({ ok: false, errorCode: smuggled }).code, 'bad_error_code', smuggled);
+  }
+});
+
+test('a daily error count is a whole number for a recent, non-future day', () => {
+  const today = '2026-10-08';
+  assert.equal(reports.errorCountError({ day: '2026-10-08', count: 0 }, { today }), null);
+  assert.equal(reports.errorCountError({ day: '2026-09-08', count: 3 }, { today }), null, '30 days back is the edge');
+  assert.equal(reports.errorCountError({ day: '2026-09-07', count: 3 }, { today }).code, 'bad_day');
+  assert.equal(reports.errorCountError({ day: '2026-10-09', count: 3 }, { today }).code, 'bad_day');
+  assert.equal(reports.errorCountError({ day: 'yesterday', count: 3 }, { today }).code, 'bad_day');
+  assert.equal(reports.errorCountError({ day: '2026-10-08', count: 1.5 }, { today }).code, 'bad_count');
+  assert.equal(reports.errorCountError({ day: '2026-10-08', count: -1 }, { today }).code, 'bad_count');
+});
+
+// A fake pool that answers only the SQL it is told to, and records every call.
+function fakeDb(handlers) {
+  const calls = [];
+  return {
+    calls,
+    async query(sql, params) {
+      calls.push({ sql, params });
+      for (const [re, fn] of handlers) if (re.test(sql)) return fn(params);
+      throw new Error(`unexpected SQL: ${sql.slice(0, 80)}`);
+    },
+  };
+}
+
+test('opted out: the report is dropped before anything is written', async () => {
+  const db = fakeDb([[/FROM module_usage_report_optouts/, () => ({ rows: [{ '?column?': 1 }] })]]);
+  const holder = { holderKind: 'builder', holderRef: '7' };
+  assert.deepEqual(await reports.recordInstallReport({ versionId: 1, ...holder, ok: true }, { db }), { recorded: false, reason: 'opted_out' });
+  assert.deepEqual(await reports.recordErrorCount({ versionId: 1, ...holder, day: '2026-10-08', count: 2 }, { db }), { recorded: false, reason: 'opted_out' });
+  assert.ok(!db.calls.some((c) => /INSERT/.test(c.sql)), 'no INSERT ran');
+});
+
+test('on by default: no opt-out row means the report is recorded; a same-day count replaces, never adds', async () => {
+  const db = fakeDb([
+    [/FROM module_usage_report_optouts/, () => ({ rows: [] })],
+    [/INSERT INTO module_install_reports/, () => ({ rows: [] })],
+    [/INSERT INTO module_runtime_error_counts/, () => ({ rows: [] })],
+  ]);
+  const holder = { holderKind: 'builder', holderRef: '7' };
+  assert.deepEqual(await reports.recordInstallReport({ versionId: 1, ...holder, ok: false, errorCode: 'verify_failed' }, { db }), { recorded: true });
+  const install = db.calls.find((c) => /module_install_reports/.test(c.sql)).sql;
+  assert.match(install, /ON CONFLICT \(version_id, holder_kind, holder_ref\)\s*DO UPDATE SET ok = EXCLUDED\.ok/,
+    "a retry replaces the holder's row, never adds one");
+  await reports.recordErrorCount({ versionId: 1, ...holder, day: '2026-10-08', count: 2 }, { db });
+  const upsert = db.calls.find((c) => /module_runtime_error_counts/.test(c.sql)).sql;
+  assert.match(upsert, /DO UPDATE SET error_count = EXCLUDED\.error_count/);
+});
+
+test('the switch: off writes an opt-out row, on deletes it', async () => {
+  const db = fakeDb([
+    [/INSERT INTO module_usage_report_optouts/, () => ({ rows: [] })],
+    [/DELETE FROM module_usage_report_optouts/, () => ({ rows: [] })],
+  ]);
+  assert.deepEqual(await reports.setReporting({ holderKind: 'builder', holderRef: '7', enabled: false }, { db }), { enabled: false });
+  assert.deepEqual(await reports.setReporting({ holderKind: 'builder', holderRef: '7', enabled: true }, { db }), { enabled: true });
+  assert.deepEqual(db.calls.map((c) => c.sql.trim().split(/\s+/)[0]), ['INSERT', 'DELETE']);
+});
+
+// ---- the re-score ----
+
+function scoringDb({ latest, days, current = [] }) {
+  return fakeDb([
+    [/FROM module_install_reports r/, () => ({ rows: latest })],
+    [/FROM module_runtime_error_counts r/, () => ({ rows: days })],
+    [/part IN \('install', 'reliability'\)/, () => ({ rows: current })],
+    [/INSERT INTO module_assessment_signals/, () => ({ rows: [] })],
+    [/SELECT DISTINCT ON \(part\) id, part, outcome, score, sample_size/, () => ({ rows: [] })],
+    [/FROM module_assessment_scores/, () => ({ rows: [] })],
+    [/INSERT INTO module_assessment_scores/, (p) => ({ rows: [{ id: 1, version_id: p[0], formula: p[4] }] })],
+  ]);
+}
+
+test('re-score: the module author is never counted, and each holder is one row (their latest attempt)', async () => {
+  const db = scoringDb({ latest: [], days: [] });
+  await recordInstallSignals(5, { db });
+  for (const table of ['module_install_reports', 'module_runtime_error_counts']) {
+    const sql = db.calls.find((c) => c.sql.includes(`FROM ${table} r`)).sql;
+    assert.match(sql, /NOT \(r\.holder_kind = 'builder' AND r\.holder_ref = m\.author_id::text\)/, `${table} excludes the author`);
+  }
+  const install = db.calls.find((c) => c.sql.includes('FROM module_install_reports r')).sql;
+  assert.doesNotMatch(install, /DISTINCT ON|ORDER BY/, 'one row per holder already, so no history scan');
+});
+
+test('re-score: writes a signal row only for a part whose result moved, then re-composes', async () => {
+  const latest = [{ ok: true }, { ok: true }, { ok: false, error_code: 'place_failed' }];
+  const db = scoringDb({
+    latest, days: [],
+    current: [{ part: 'reliability', outcome: 'no_data', score: null, sample_size: 0 }],
+  });
+  const res = await recordInstallSignals(5, { db });
+  assert.deepEqual(res.written, ['install'], 'reliability is unchanged, so no new row');
+  const insert = db.calls.find((c) => /INSERT INTO module_assessment_signals/.test(c.sql));
+  assert.deepEqual(insert.params.slice(0, 5), [5, 'install', 'scored', 67, 3]);
+  assert.ok(db.calls.some((c) => /INSERT INTO module_assessment_scores/.test(c.sql)), 'the overall score re-composed');
+
+  const again = scoringDb({ latest, days: [], current: [
+    { part: 'install', outcome: 'scored', score: 67, sample_size: 3 },
+    { part: 'reliability', outcome: 'no_data', score: null, sample_size: 0 },
+  ] });
+  const res2 = await recordInstallSignals(5, { db: again });
+  assert.deepEqual(res2.written, []);
+  assert.ok(!again.calls.some((c) => /INSERT/.test(c.sql)), 'nothing moved, nothing written');
+});
+
+// ---- the migration: there is nowhere to put anything but counts ----
+
+test('core_273: three additive tables whose columns hold counts and codes only', () => {
+  const sql = read('migrations/core_273_module_install_reports.sql');
+  const DDL = sql.replace(/--.*$/gm, '');
+  for (const t of ['module_install_reports', 'module_runtime_error_counts', 'module_usage_report_optouts']) {
+    assert.match(DDL, new RegExp(`CREATE TABLE IF NOT EXISTS ${t} \\(`), t);
+  }
+  assert.match(DDL, /error_code\s+text CHECK \(error_code ~ '\^\[a-z\]\[a-z0-9_\]\{0,39\}\$'\)/, 'the code is held to the same rule as the intake');
+  assert.equal(String(ERROR_CODE_RE), '/^[a-z][a-z0-9_]{0,39}$/', 'intake and CHECK agree');
+  assert.match(DDL, /CHECK \(\(ok AND error_code IS NULL\) OR \(NOT ok AND error_code IS NOT NULL\)\)/);
+  assert.match(DDL, /PRIMARY KEY \(version_id, holder_kind, holder_ref, day\)/, 'one count per holder per day');
+  assert.match(DDL, /PRIMARY KEY \(version_id, holder_kind, holder_ref\)\n\);/, 'one install row per holder per version: grows with holders, never with retries');
+  const textCols = [...DDL.matchAll(/^\s+(\w+)\s+text\b/gm)].map((m) => m[1]).sort();
+  assert.deepEqual([...new Set(textCols)], ['error_code', 'holder_kind', 'holder_ref'], 'no free-text column for a message or a path');
+  assert.doesNotMatch(DDL, /\b(DROP|ALTER)\b|^\s*(UPDATE|DELETE)\b/m, 'additive only');
+  assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('core_273_module_install_reports'\)/);
+});
+
+// ---- the routes and the settings switch, pinned in their source ----
+
+test('the report routes are own-scoped, need a live holder, and re-score after an accepted report', () => {
+  const src = read('src/bongos/routes/modules.js');
+  for (const p of ['/store/modules/:key/versions/:version/install-report', '/store/modules/:key/versions/:version/error-count', '/store/usage-reporting']) {
+    assert.match(src, new RegExp(`router\\.(post|get)\\('${p.replace(/[/:]/g, (c) => `\\${c}`)}', auth\\.requireBuilder`), p);
+  }
+  assert.match(src, /holderKind: 'builder', holderRef: String\(req\.builder\.id\)/);
+  assert.match(src, /if \(!held\.entitled\) \{\s*res\.fail\('not_entitled'/);
+  assert.match(src, /res\.json\(\{ ok: true, recorded: out\.recorded[^\n]*\n\s*if \(out\.recorded\) rescore\(t\.versionId\);/, 're-scores after answering');
+  assert.match(src, /function rescore\(versionId\) \{\s*setImmediate\(/, 'the re-score is off the request path');
+});
+
+test('Settings carries the opt-out, on by default, saved through the store route', () => {
+  const html = read('modules/hall-ui/public/settings.html');
+  const js = read('modules/hall-ui/public/settings-usage-reports.js');
+  assert.match(html, /<section class="scroll" id="usage-reports-scroll"[^>]*data-group="preferences" hidden>/);
+  assert.match(html, /<script src="\/builders\/settings-usage-reports\.js\?v=[^"]+"><\/script>/);
+  assert.match(js, /api\.request\('GET', `\$\{API\}\/store\/usage-reporting`\)/);
+  assert.match(js, /api\.request\('POST', `\$\{API\}\/store\/usage-reporting`, \{ body: \{ enabled: value === 'on' \} \}\)/);
+  assert.match(js, /render\(res\.data\.enabled !== false\)/, 'anything but an explicit false reads as on');
+});
+
+// ---- the CLI: a failed install is reported with a code, never a message ----
+
+test('install: a tarball that fails verification is reported as verify_failed', async () => {
+  const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-installs-'));
+  const manifest = { key: 'weather', title: 'Weather', description: 'Shows the weather.', version: '1.2.0', coreVersion: '^1.0.0', contributes: {} };
+  fs.mkdirSync(path.join(src, 'weather'), { recursive: true });
+  fs.writeFileSync(path.join(src, 'weather', 'module.json'), JSON.stringify(manifest));
+  const { tgz } = packModule('weather', { modulesDir: src, now: () => new Date('2026-10-01T00:00:00Z'), modeOf: () => '644' });
+  const v = await verifyModuleArtifact(tgz, { key: 'weather' });
+  const calls = [];
+  const request = async (method, urlPath, opts = {}) => {
+    calls.push({ method, urlPath, json: opts.json });
+    if (urlPath.endsWith('/acquire')) {
+      return { ok: true, status: 200, data: { version: v.version, core_version: v.coreVersion, tarball_sha256: v.tarballSha256, tree_sha256: v.treeSha256 } };
+    }
+    if (urlPath.endsWith('/tarball')) return { ok: true, status: 200, buf: Buffer.from('not a tarball') };
+    if (urlPath.endsWith('/install-report')) return { ok: true, status: 200, data: { ok: true, recorded: true } };
+    throw new Error(`unexpected ${method} ${urlPath}`);
+  };
+  const out = [];
+  const code = await cmdInstall(['weather'], { log: (m) => out.push(m), errlog: (m) => out.push(m), modulesDir: fs.mkdtempSync(path.join(os.tmpdir(), 'mod-dest-')), roots: [], request, core: '1.19.0' });
+  assert.equal(code, 1);
+  const report = calls.find((c) => c.urlPath.endsWith('/install-report'));
+  assert.equal(report.urlPath, '/store/modules/weather/versions/1.2.0/install-report');
+  assert.deepEqual(report.json, { ok: false, error_code: 'verify_failed' }, 'a code, never the message');
+});
+
+test('install: a store that refuses or cannot be reached is not the module\'s fault, so nothing is reported', async () => {
+  const calls = [];
+  const request = async (method, urlPath) => {
+    calls.push(urlPath);
+    if (urlPath.endsWith('/acquire')) return { ok: false, status: 402, data: { error: { code: 'payment_required' } } };
+    throw new Error(`unexpected ${urlPath}`);
+  };
+  const code = await cmdInstall(['weather'], { log() {}, errlog() {}, modulesDir: fs.mkdtempSync(path.join(os.tmpdir(), 'mod-dest-')), roots: [], request });
+  assert.equal(code, 1);
+  assert.deepEqual(calls, ['/store/modules/weather/acquire']);
+});