@bongos/core 1.23.1 → 1.23.3

package/src/bongos/module-subcategories.js

@@ -0,0 +1,316 @@
+'use strict';
+
+// src/bongos/module-subcategories.js — the store's sub-categories and the queue that
+// approves them (task 1004355, ADR 0342 D3; tables: core_280).
+//
+// A module sits under one of eight fixed parents and, once approved, one narrow
+// sub-category: the comparable set the cap of ten and the ranking count within (D2).
+// The author names a sub-category in module.json (`category: { parent, sub }`); a
+// key the store has never seen under that parent is PROPOSED at publish and is not
+// live until a Metic+ person approves it (optionally renaming it) or merges it into
+// an existing one (`module.subcategory.review`). Until then the module is listed
+// under its parent only and counts toward no cap.
+//
+// Where a module sits lives in store_module_categories, apart from the published
+// manifest (which never changes), so a merge can move modules without touching a
+// version. A merged row keeps a pointer to where it went, so a later publish naming
+// the old key lands on the right sub-category instead of proposing it again.
+
+const { CATEGORY_PARENTS } = require('../module-loader/manifest-schema');
+
+// How many pending proposals one queue read returns, oldest first. Each is compared
+// against every live sub-category for near-duplicates, so the read is bounded by
+// this times the live count; the rest wait for the next page of decisions.
+const QUEUE_LIMIT = 100;
+
+// The label a proposal starts with: its key in words ("stripe-payments" → "Stripe
+// payments"). The approver can rename it; the author never types a free-text label.
+function labelFromKey(subKey) {
+  const words = String(subKey || '').split('-').filter(Boolean).join(' ');
+  return words ? words[0].toUpperCase() + words.slice(1) : '';
+}
+
+// A label as a sub key: lowercase kebab-case, the shape manifest-schema checks.
+function subKeyFromLabel(label) {
+  return String(label || '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').replace(/^[^a-z]+/, '');
+}
+
+// ---------------------------------------------------------------------------
+// Near-duplicates — the point of the queue (ADR 0342 D3)
+// ---------------------------------------------------------------------------
+//
+// "Stripe", "Stripe payments" and "Payments (Stripe)" must sit beside each other in
+// front of the approver. Two names are near when their significant words overlap by
+// at least half (Jaccard over word sets, a plural "s" dropped) or, as whole strings,
+// are within two edits of each other (a typo: "stirpe"). Filler words never count.
+const FILLER = new Set(['and', 'the', 'of', 'for', 'a', 'an', 'to', 'with', 'in', 'on']);
+
+function nameWords(name) {
+  return new Set(String(name || '').toLowerCase().split(/[^a-z0-9]+/)
+    .filter((w) => w && !FILLER.has(w))
+    .map((w) => (w.length > 3 && w.endsWith('s') ? w.slice(0, -1) : w)));
+}
+
+function editDistance(a, b) {
+  if (Math.abs(a.length - b.length) > 2) return 3;
+  let prev = Array.from({ length: b.length + 1 }, (_, j) => j);
+  for (let i = 1; i <= a.length; i++) {
+    const cur = [i];
+    for (let j = 1; j <= b.length; j++) {
+      cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    }
+    prev = cur;
+  }
+  return prev[b.length];
+}
+
+function isNear(a, b) {
+  return wordsNear(nameWords(a), nameWords(b));
+}
+
+// Two word sets are near when they share at least half their words (Jaccard), or,
+// joined, are within two edits of each other.
+function wordsNear(wa, wb) {
+  if (!wa.size || !wb.size) return false;
+  let shared = 0;
+  for (const w of wa) if (wb.has(w)) shared++;
+  if (shared / (wa.size + wb.size - shared) >= 0.5) return true;
+  const ja = [...wa].sort().join('');
+  const jb = [...wb].sort().join('');
+  return ja.length >= 4 && jb.length >= 4 && editDistance(ja, jb) <= 2;
+}
+
+// For each of `pending`, every other live (proposed or approved) sub-category whose
+// key or label is near its own, across all parents (an author may have picked the
+// wrong parent). Word sets are built once per row, not once per comparison. Pure.
+// Rows carry id, parent, sub_key, label, status.
+function nearDuplicatesFor(pending, rows) {
+  const live = (rows || []).filter((o) => o.status !== 'merged')
+    .map((o) => ({ o, names: [nameWords(o.sub_key), nameWords(o.label)] }));
+  const byId = new Map(live.map((x) => [String(x.o.id), x]));
+  return new Map(pending.map((row) => {
+    const mine = byId.get(String(row.id))?.names || [nameWords(row.sub_key), nameWords(row.label)];
+    const near = live
+      .filter((x) => String(x.o.id) !== String(row.id) && mine.some((m) => x.names.some((n) => wordsNear(m, n))))
+      .map(({ o }) => ({ id: o.id, parent: o.parent, sub_key: o.sub_key, label: o.label, status: o.status }));
+    return [String(row.id), near];
+  }));
+}
+
+// ---------------------------------------------------------------------------
+// Publish: record where the module sits, proposing a new sub-category
+// ---------------------------------------------------------------------------
+
+// Runs on the publish transaction's client (module-store.js publishVersion), so a
+// version never lands without its category or the other way round. `category` is
+// module.json's block, already shape-checked; absent → nothing changes (a version
+// that names no category leaves the module where it was). Returns what the author
+// is told, or null.
+async function recordPublishCategory(client, { key, category, builderId }) {
+  if (!category || !category.parent) return null;
+  const { parent, sub } = category;
+  if (!sub) {
+    await upsertModuleCategory(client, key, parent, null);
+    return { parent, sub: null, status: null, live: false };
+  }
+  await client.query(
+    `INSERT INTO store_subcategories (parent, sub_key, label, proposed_by)
+     VALUES ($1, $2, $3, $4)
+     ON CONFLICT (parent, sub_key) DO NOTHING`,
+    [parent, sub, labelFromKey(sub), builderId]);
+  let row = await subcategoryByKey(client, parent, sub);
+  // One step is enough: a merge re-points every earlier merge at its new target
+  // (mergeSubcategory), so merged_into always names a live row.
+  if (row && row.status === 'merged') row = await subcategoryById(client, row.merged_into);
+  if (!row || row.status === 'merged') {
+    await upsertModuleCategory(client, key, parent, null);
+    return { parent, sub: null, status: null, live: false };
+  }
+  await upsertModuleCategory(client, key, row.parent, row.id);
+  return {
+    parent: row.parent, sub: row.sub_key, label: row.label, status: row.status,
+    live: row.status === 'approved', named: sub,
+  };
+}
+
+async function upsertModuleCategory(client, key, parent, subcategoryId) {
+  await client.query(
+    `INSERT INTO store_module_categories (module_key, parent, subcategory_id)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (module_key) DO UPDATE
+       SET parent = EXCLUDED.parent, subcategory_id = EXCLUDED.subcategory_id, updated_at = now()`,
+    [key, parent, subcategoryId]);
+}
+
+const SUB_COLUMNS = 'id, parent, sub_key, label, status, proposed_by, decided_by, decided_at, merged_into, created_at';
+
+async function subcategoryByKey(exec, parent, subKey) {
+  const { rows: [row] } = await exec.query(
+    `SELECT ${SUB_COLUMNS} FROM store_subcategories WHERE parent = $1 AND sub_key = $2`, [parent, subKey]);
+  return row || null;
+}
+
+async function subcategoryById(exec, id, { lock = false } = {}) {
+  const { rows: [row] } = await exec.query(
+    `SELECT ${SUB_COLUMNS} FROM store_subcategories WHERE id = $1${lock ? ' FOR UPDATE' : ''}`, [id]);
+  return row || null;
+}
+
+// ---------------------------------------------------------------------------
+// Reads
+// ---------------------------------------------------------------------------
+
+// The approved sub-categories, grouped under the eight parents: what an author picks
+// from. Any builder may read it.
+async function listSubcategories({ db } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rows } = await pool.query(
+    `SELECT id, parent, sub_key, label FROM store_subcategories
+      WHERE status = 'approved' ORDER BY parent, label`);
+  return {
+    parents: Object.entries(CATEGORY_PARENTS).map(([parent, title]) => ({
+      parent, title,
+      subcategories: rows.filter((r) => r.parent === parent).map((r) => ({ id: r.id, sub_key: r.sub_key, label: r.label })),
+    })),
+  };
+}
+
+// The Metic+ queue: every pending proposal, oldest first, with the modules that
+// named it and the near-duplicate names beside it.
+async function reviewQueue({ db } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rows } = await pool.query(
+    `SELECT ${SUB_COLUMNS} FROM store_subcategories WHERE status <> 'merged' ORDER BY created_at, id`);
+  const proposed = rows.filter((r) => r.status === 'proposed');
+  const pending = proposed.slice(0, QUEUE_LIMIT);
+  const modules = new Map();
+  if (pending.length) {
+    const { rows: mods } = await pool.query(
+      `SELECT module_key, subcategory_id FROM store_module_categories
+        WHERE subcategory_id = ANY($1) ORDER BY module_key`, [pending.map((r) => r.id)]);
+    for (const m of mods) {
+      const k = String(m.subcategory_id);
+      if (!modules.has(k)) modules.set(k, []);
+      modules.get(k).push(m.module_key);
+    }
+  }
+  const near = nearDuplicatesFor(pending, rows);
+  return {
+    total: proposed.length,
+    more: proposed.length > pending.length,
+    proposals: pending.map((r) => ({
+      id: r.id, parent: r.parent, parent_title: CATEGORY_PARENTS[r.parent] || r.parent,
+      sub_key: r.sub_key, label: r.label, proposed_by: r.proposed_by, proposed_at: r.created_at,
+      modules: modules.get(String(r.id)) || [],
+      near: near.get(String(r.id)) || [],
+    })),
+  };
+}
+
+// Where each of `keys` sits now: Map key → { parent, parent_title, sub, label,
+// status, live }. `live` is true only under an approved sub-category, the only kind
+// the cap and ranking count within (ADR 0342 D2, D3). A key with no row is absent.
+async function readModuleCategories(keys, { db } = {}) {
+  const out = new Map();
+  if (!keys || !keys.length) return out;
+  const pool = db || require('./pool').pool;
+  const { rows } = await pool.query(
+    `SELECT c.module_key, c.parent, s.sub_key, s.label, s.status
+       FROM store_module_categories c
+       LEFT JOIN store_subcategories s ON s.id = c.subcategory_id
+      WHERE c.module_key = ANY($1)`, [keys]);
+  for (const r of rows) {
+    out.set(r.module_key, {
+      parent: r.parent, parent_title: CATEGORY_PARENTS[r.parent] || r.parent,
+      sub: r.sub_key || null, label: r.label || null, status: r.status || null,
+      live: r.status === 'approved',
+    });
+  }
+  return out;
+}
+
+// ---------------------------------------------------------------------------
+// Decisions — approve (optionally renamed) and merge
+// ---------------------------------------------------------------------------
+
+async function inTx(db, fn) {
+  const pool = db || require('./pool').pool;
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const out = await fn(client);
+    await client.query(out && out.ok === false ? 'ROLLBACK' : 'COMMIT');
+    return out;
+  } catch (e) {
+    try { await client.query('ROLLBACK'); } catch { /* the connection may be gone */ }
+    throw e;
+  } finally {
+    client.release();
+  }
+}
+
+const refuse = (status, code, message) => ({ ok: false, status, code, message });
+
+// Approve a proposal, optionally under a new label and/or key. A rename onto a key
+// that already exists under the same parent is refused: that is a merge.
+async function approveSubcategory(id, { label = null, subKey = null, builderId }, { db } = {}) {
+  return inTx(db, async (client) => {
+    const row = await subcategoryById(client, id, { lock: true });
+    if (!row) return refuse(404, 'subcategory_not_found', `No sub-category ${id}.`);
+    if (row.status !== 'proposed') return refuse(409, 'subcategory_decided', `"${row.label}" is already ${row.status}.`);
+    const newLabel = label != null ? String(label).trim() : row.label;
+    if (!newLabel || newLabel.length > 80) return refuse(400, 'bad_label', 'A label is 1 to 80 characters.');
+    const newKey = subKey != null ? String(subKey) : (label != null ? subKeyFromLabel(newLabel) : row.sub_key);
+    if (!/^[a-z][a-z0-9-]*$/.test(newKey)) return refuse(400, 'bad_sub_key', 'A sub-category key is lowercase kebab-case.');
+    if (newKey !== row.sub_key) {
+      const clash = await subcategoryByKey(client, row.parent, newKey);
+      if (clash) return refuse(409, 'subcategory_exists', `"${newKey}" already exists under ${row.parent} — merge into it instead (POST /store/subcategories/${row.id}/merge { into: ${clash.id} }).`);
+    }
+    const renamed = newKey !== row.sub_key || newLabel !== row.label;
+    const { rows: [done] } = await client.query(
+      `UPDATE store_subcategories
+          SET status = 'approved', label = $2, sub_key = $3, decided_by = $4, decided_at = now()
+        WHERE id = $1 RETURNING ${SUB_COLUMNS}`,
+      [row.id, newLabel, newKey, builderId]);
+    return { ok: true, subcategory: done, renamed };
+  });
+}
+
+// Merge a sub-category (proposed, or an approved duplicate) into an approved one.
+// Every module that sat under it moves to the target, parent included, and any
+// earlier merge into it is re-pointed so a chain stays one step.
+async function mergeSubcategory(id, { into, builderId }, { db } = {}) {
+  return inTx(db, async (client) => {
+    if (String(id) === String(into)) return refuse(400, 'merge_into_self', 'A sub-category cannot be merged into itself.');
+    // Both rows locked in one statement, in id order, so two opposite merges at once
+    // wait on each other instead of deadlocking.
+    const { rows: locked } = await client.query(
+      `SELECT ${SUB_COLUMNS} FROM store_subcategories WHERE id = ANY($1) ORDER BY id FOR UPDATE`,
+      [[String(id), String(into)]]);
+    const row = locked.find((x) => String(x.id) === String(BigInt(id)));
+    const target = locked.find((x) => String(x.id) === String(BigInt(into)));
+    if (!row) return refuse(404, 'subcategory_not_found', `No sub-category ${id}.`);
+    if (row.status === 'merged') return refuse(409, 'subcategory_decided', `"${row.label}" is already merged.`);
+    if (!target) return refuse(404, 'subcategory_not_found', `No sub-category ${into} to merge into.`);
+    // Compared by the rows found, not the raw ids: "05" and "5" are the same row.
+    if (String(target.id) === String(row.id)) return refuse(400, 'merge_into_self', 'A sub-category cannot be merged into itself.');
+    if (target.status !== 'approved') return refuse(409, 'merge_target_not_approved', `Merge into an approved sub-category; "${target.label}" is ${target.status}.`);
+    await client.query(
+      `UPDATE store_subcategories
+          SET status = 'merged', merged_into = $2, decided_by = $3, decided_at = now()
+        WHERE id = $1`,
+      [row.id, target.id, builderId]);
+    await client.query('UPDATE store_subcategories SET merged_into = $2 WHERE merged_into = $1', [row.id, target.id]);
+    const { rows: moved } = await client.query(
+      `UPDATE store_module_categories SET subcategory_id = $2, parent = $3, updated_at = now()
+        WHERE subcategory_id = $1 RETURNING module_key`,
+      [row.id, target.id, target.parent]);
+    return { ok: true, merged: { id: row.id, sub_key: row.sub_key, label: row.label }, into: target, moved: moved.map((m) => m.module_key).sort() };
+  });
+}
+
+module.exports = {
+  isNear,
+  recordPublishCategory, listSubcategories, reviewQueue, readModuleCategories,
+  approveSubcategory, mergeSubcategory,
+};

package/src/bongos/route-rank-check.js

@@ -242,6 +242,11 @@ const EXPECTED_RANKS = {
   // Re-running a store version's assessment (task 1003796, ADR 0359) spends a Docs
   // grader call and re-opens the Security gate, so it is pinned to its own atom.
   'POST /store/modules/:key/versions/:version/reassess': 'perm:module.assessment.rerun',
+  // Approving, renaming or merging a store sub-category (task 1004355, ADR 0342 D3)
+  // decides which modules compete for the same ten slots, so it is pinned to its own atom.
+  'GET /store/subcategories/queue': 'perm:module.subcategory.review',
+  'POST /store/subcategories/:id/approve': 'perm:module.subcategory.review',
+  'POST /store/subcategories/:id/merge': 'perm:module.subcategory.review',
   // Delisting a store module (task 1003797, ADR 0338 D2) stops every new install of
   // it for every instance, so it is pinned to its own atom.
   'POST /store/modules/:key/delist': 'perm:module.delist',

package/src/bongos/routes/modules.js

@@ -111,6 +111,7 @@ const log = require('../logger').logger.child({ src: 'modules' });
 // as unused exports and tripped the dead-code ratchet that held this branch out of main.
 const { listOverrides, setOverride } = require('../module-overrides');
 const { listCatalog, readListing, SORT_PARTS } = require('../module-listing');
+const { listSubcategories, reviewQueue, approveSubcategory, mergeSubcategory } = require('../module-subcategories');
 const { readTesting, setTester, setGeneralOnly, testsVersionsOf } = require('../module-testing');
 const { readStanding, releaseHeld } = require('../module-promotion');
 
@@ -522,6 +523,7 @@ module.exports = function buildModulesRouter() {
           bytes: v.bytes,
           artifactPath: relativeArtifactPath(staged.final),
           builderId: req.builder.id,
+          category: v.moduleJson.category,
         }, { beforeCommit: () => commitArtifact(staged) });
       } finally {
         await removeArtifact(staged.tmp);
@@ -529,7 +531,7 @@ module.exports = function buildModulesRouter() {
       if (!result.ok) return res.fail(result.code, { status: result.status, message: result.message });
 
       console.log(`[gds] module "${key}" ${v.version} published to the store by builder ${req.builder.id}`);
-      res.status(201).json({ ok: true, created_module: result.created, version: result.version, channel: result.channel });
+      res.status(201).json({ ok: true, created_module: result.created, version: result.version, channel: result.channel, category: result.category || null });
       // A new version is a new thing to judge (task 1003794, ADR 0343): queue its
       // assessment after answering, since the Security gate asks npm about its
       // dependencies and can take a minute. The queue runs one at a time and is
@@ -891,6 +893,58 @@ module.exports = function buildModulesRouter() {
       res.json(listing);
     }));
 
+  // GET /api/bongos/store/subcategories — the approved sub-categories under each of
+  // the eight parents (task 1004355, ADR 0342 D3): what an author names in
+  // module.json's `category.sub`. A key not on this list is proposed at publish.
+  //
+  // rank: any-builder — public store metadata; nothing changed.
+  router.get('/store/subcategories', auth.requireBuilder,
+    asyncHandler('GET /store/subcategories', async (_req, res) => {
+      res.set('Cache-Control', 'private, max-age=60'); // changes only when a reviewer decides
+      res.json(await listSubcategories());
+    }));
+
+  // GET /api/bongos/store/subcategories/queue — the proposals waiting on a Metic+
+  // decision, oldest first, each with the modules that named it and the
+  // near-duplicate names beside it ("Stripe" next to "Stripe payments"), since
+  // stopping near-duplicates is the point of the queue (ADR 0342 D3).
+  router.get('/store/subcategories/queue', auth.requireBuilder, auth.requirePermission('module.subcategory.review'),
+    asyncHandler('GET /store/subcategories/queue', async (_req, res) => {
+      res.set('Cache-Control', 'no-store');
+      res.json(await reviewQueue());
+    }));
+
+  // POST /api/bongos/store/subcategories/:id/approve { label?, sub_key? } — make a
+  // proposal live, optionally renamed first. A rename onto a key that already
+  // exists under the parent is refused with the merge to run instead.
+  router.post('/store/subcategories/:id/approve', auth.requireBuilder, auth.requirePermission('module.subcategory.review'),
+    asyncHandler('POST /store/subcategories/:id/approve', async (req, res) => {
+      if (validateOrRespond(req, res, { label: { type: 'string', maxLength: 80 }, sub_key: { type: 'string', maxLength: 80 } })) return;
+      const id = String(req.params.id);
+      if (!/^\d{1,18}$/.test(id)) return res.fail('bad_request', { status: 400, message: 'A sub-category id is a whole number.' });
+      const r = await approveSubcategory(id, { label: req.body?.label ?? null, subKey: req.body?.sub_key ?? null, builderId: req.builder.id });
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      log.info({ id, builderId: req.builder.id }, `sub-category ${r.subcategory.parent}/${r.subcategory.sub_key} approved`);
+      res.json(r);
+    }));
+
+  // POST /api/bongos/store/subcategories/:id/merge { into } — fold a proposal (or an
+  // approved duplicate) into an approved sub-category. Every module under it moves
+  // to the target.
+  router.post('/store/subcategories/:id/merge', auth.requireBuilder, auth.requirePermission('module.subcategory.review'),
+    asyncHandler('POST /store/subcategories/:id/merge', async (req, res) => {
+      if (validateOrRespond(req, res, { into: {} })) return;  // bigint as number or string; validated below
+      const id = String(req.params.id);
+      const into = req.body?.into == null ? '' : String(req.body.into);
+      if (!/^\d{1,18}$/.test(id) || !/^\d{1,18}$/.test(into)) {
+        return res.fail('bad_request', { status: 400, message: 'Name the sub-category to merge into by id, in into.' });
+      }
+      const r = await mergeSubcategory(id, { into, builderId: req.builder.id });
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      log.info({ id, into, moved: r.moved.length, builderId: req.builder.id }, `sub-category ${r.merged.sub_key} merged into ${r.into.sub_key}`);
+      res.json(r);
+    }));
+
   router.post('/store/modules/:key/acquired', auth.requireBuilder,
     asyncHandler('POST /store/modules/:key/acquired', async (req, res) => {
       const { key } = req.params;

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.1'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.3'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/module-loader/manifest-schema.js

@@ -55,8 +55,9 @@
 //                                       //   never a silent pass.
 //     "category": {                     // OPTIONAL. Where the module is browsed and ranked (ADR 0342).
 //       "parent": "money",              //   REQUIRED in-block: one of the eight CATEGORY_PARENTS keys.
-//       "sub":    "stripe-payments"     //   OPTIONAL. An approved sub-category key — the comparable set
-//     },                                //   the store's cap of ten counts within; absent while pending.
+//       "sub":    "stripe-payments"     //   OPTIONAL. A sub-category key — the comparable set the store's
+//     },                                //   cap of ten counts within. One the store has not approved is
+//                                       //   PROPOSED at publish and is not live until Metic+ approves it.
 //     "howto": {                        // OPTIONAL. Extras beside the module's HOWTO.md (ADR 0347 D3).
 //       "artifactUrl": "https://claude.ai/…" //   A Claude page with the same how-to, shown as an extra,
 //     },                                //   never graded and never required — the file is the how-to.
@@ -354,7 +355,7 @@ function validateManifest(obj) {
       if (!isStr(c.parent)) E(`category.parent: required — one of ${parents.join(', ')}`);
       else if (!parents.includes(c.parent)) E(`category.parent: "${c.parent}" is not one of ${parents.join(', ')} (ADR 0342 D1)`);
       if ('sub' in c && (!isStr(c.sub) || !KEY_RE.test(c.sub))) {
-        E('category.sub: must be a sub-category key (lowercase kebab-case) when present — leave it out while a new one is pending approval');
+        E('category.sub: must be a sub-category key (lowercase kebab-case) when present — a new one is proposed at publish');
       }
     }
   }

package/tests/deploy_divergence_line.mjs

@@ -357,7 +357,10 @@ test('liveIncludes reads inclusion by release when the live commit is not in thi
   assert.equal(liveIncludes({ coreVersion: olderV }, newer, 'HEAD'), false, 'an older release does not');
   assert.equal(liveIncludes({ coreVersion: olderV }, older, 'HEAD'), true);
   // A commit between the two bumps is carried by the NEWER one only.
-  const between = gitOut(['rev-list', '--max-count=1', '--no-merges', `${older}..${newer}~1`]);
+  // --ancestry-path: a commit on a side branch merged in between the two bumps is
+  // in the range but is not descended from the older bump, so the older release's
+  // position says nothing about it (a release commit merged in from main did this).
+  const between = gitOut(['rev-list', '--max-count=1', '--no-merges', '--ancestry-path', `${older}..${newer}~1`]);
   if (between) {
     assert.equal(liveIncludes({ coreVersion: olderV }, between, 'HEAD'), false, 'not yet: the older release predates it');
     assert.equal(liveIncludes({ coreVersion: newerV }, between, 'HEAD'), true, 'the next bump carries it');

package/tests/module_store_instance_root.mjs

@@ -6,7 +6,7 @@
 // same bug in the task-visuals store.
 //
 // This builds a real consumer tree in a temp dir: a fake installed core package
-// carrying the REAL src/bongos/module-store.js, with its three core requires
+// carrying the REAL src/bongos/module-store.js, with its four core requires
 // re-exporting the real files, then proves, through that installed copy:
 //   1. the store is the instance's var/module-store, not inside the package;
 //   2. a published tarball survives the package being deleted and reinstalled,
@@ -52,6 +52,7 @@ function installCore() {
   fs.writeFileSync(path.join(CORE, 'src', 'module-loader', 'semver.js'), reexport(REAL('module-loader', 'semver.js')));
   fs.writeFileSync(path.join(CORE, 'src', 'module-loader', 'manifest-schema.js'), reexport(REAL('module-loader', 'manifest-schema.js')));
   fs.writeFileSync(path.join(CORE, 'src', 'instance-config.js'), reexport(REAL('instance-config.js')));
+  fs.writeFileSync(path.join(CORE, 'src', 'bongos', 'module-subcategories.js'), reexport(REAL('bongos', 'module-subcategories.js')));
 }
 // A fresh require of the INSTALLED copy (a restarted server).
 function loadInstalled() {