@bongos/core 1.23.4 → 1.23.6

package/docs/api/openapi.json

@@ -505,7 +505,7 @@
           "access-requests"
         ],
         "summary": "GET /access-requests/status",
-        "description": "GET /access-requests/status?github_login=X — PUBLIC. The `bongos login` CLI polls this after filing a request: the device flow's not_approved is TERMINAL (the device_code is spent), so the CLI can't re-poll the flow — it polls this instead, then restarts sign-in once admitted. Exposes nothing the public POST above doesn't already reveal through its 409s (already_member / already_approved). status ∈ member | invited | expired | pending | dismissed | none; admitted = member||invited. `expired` is an invite past its 30 days (task 1002969): the door is shut, and the CLI stops waiting rather than polling a door that will not open. rank: public — a would-be builder is by definition outside the system. Declared BEFORE `GET /access-requests` so the literal `/status` path is matched as its own route (not swallowed as a query on the list route). RATE-LIMITED (task 1003339 / ADR 0209). Public + unthrottled, this was a login→membership oracle an attacker could script at line rate to learn who builds here. accountExistenceReadRateLimit is the doorway's SHARED 120/60s per-IP budget: core's GET /auth/web/admission-status (the boolean twin of this answer) mounts the very same instance, so the two cannot be alternated for double the rate. The limiter runs before the queries, so a refused probe costs no DB work. Whether the ANSWER should also collapse — so a caller who is not the subject cannot tell pending/dismissed/none apart — is the owner's call and is filed as a blocker, not decided here.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /access-requests/status?github_login=X — PUBLIC. The `bongos login` CLI polls this after filing a request: the device flow's not_approved is TERMINAL (the device_code is spent), so the CLI can't re-poll the flow — it polls this instead, then restarts sign-in once admitted. Exposes nothing the public POST above doesn't already reveal through its 409s (already_member / already_approved). status ∈ member | invited | not_admitted; admitted = member||invited (ADR 0217 D4, task 1003359). `not_admitted` covers pending, declined, a lapsed invite and no request at all, so a caller who is not the subject cannot learn that someone applied here or was turned down. It does NOT close the membership oracle — `admitted` still answers that, and the limiter below is what bounds enumeration. A lapsed invite answering `not_admitted` rather than `expired` amends ADR 0356 D4. rank: public — a would-be builder is by definition outside the system. Declared BEFORE `GET /access-requests` so the literal `/status` path is matched as its own route (not swallowed as a query on the list route). RATE-LIMITED (task 1003339 / ADR 0209). Public + unthrottled, this was a login→membership oracle an attacker could script at line rate to learn who builds here. accountExistenceReadRateLimit is the doorway's SHARED 120/60s per-IP budget: core's GET /auth/web/admission-status (the boolean twin of this answer) mounts the very same instance, so the two cannot be alternated for double the rate. The limiter runs before the queries, so a refused probe costs no DB work.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/onboarding/routes/access-requests.js",
         "responses": {
@@ -1656,7 +1656,7 @@
           "auth"
         ],
         "summary": "GET /auth/web/admission-status",
-        "description": "GET /auth/web/admission-status?login=X — the probe renderAccessPendingPage polls (task 1002097). Answers ONE question: would this login be admitted right now? It mirrors the real gate via auth.webAdmissionStatus so the page can never invite someone in the gate would refuse. rank: public — it must be reachable by a visitor with no session (that is the entire situation it exists for). It grants nothing: admission still runs through the normal sign-in, and this only reads state. WHAT IT LEAKS, stated plainly (task 1002430 — an earlier version of this comment claimed the opposite and was wrong). Returning only a boolean does NOT make it non-enumerable: with open enrollment off, and for any login that is not the configured firstAdmin, `admitted:true` means that login is a member or has been invited. That reveals account existence to an unauthenticated caller. IT IS NOW THROTTLED (task 1003339 / ADR 0209). It used to say \"NOT throttled\" here, and that was true: rateLimitMiddleware returns early for non-write methods, so GETs bypassed it entirely and the page's 3s poll bounded the honest client, not an attacker. accountExistenceReadRateLimit below is the ceiling — 120 reads/60s per IP, and the SAME instance is mounted on the onboarding module's GET /access-requests/status, which is this route's strictly richer twin (member|invited|pending|dismissed|none plus its own `admitted`). One budget across both, because they are one oracle: hardening either alone would accomplish nothing, and giving each its own budget would just let an enumerator alternate for double the rate. WHAT IS STILL OPEN and is deliberately NOT decided here: whether the answer itself should collapse, so a caller who is not the subject cannot tell pending/dismissed/none apart from a bare \"not admitted\". That changes what a real invited user sees during onboarding, so it is the owner's call — filed as a blocker against task 1003339, not settled by a comment in this file. That endpoint is also why this one exists: it models neither the firstAdmin bypass nor open enrollment, so it reports the OWNER as 'none' forever — the exact case this page has to resolve.\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "GET /auth/web/admission-status?login=X — the probe renderAccessPendingPage polls (task 1002097). Answers ONE question: would this login be admitted right now? It mirrors the real gate via auth.webAdmissionStatus so the page can never invite someone in the gate would refuse. rank: public — it must be reachable by a visitor with no session (that is the entire situation it exists for). It grants nothing: admission still runs through the normal sign-in, and this only reads state. WHAT IT LEAKS, stated plainly (task 1002430 — an earlier version of this comment claimed the opposite and was wrong). Returning only a boolean does NOT make it non-enumerable: with open enrollment off, and for any login that is not the configured firstAdmin, `admitted:true` means that login is a member or has been invited. That reveals account existence to an unauthenticated caller. IT IS NOW THROTTLED (task 1003339 / ADR 0209). It used to say \"NOT throttled\" here, and that was true: rateLimitMiddleware returns early for non-write methods, so GETs bypassed it entirely and the page's 3s poll bounded the honest client, not an attacker. accountExistenceReadRateLimit below is the ceiling — 120 reads/60s per IP, and the SAME instance is mounted on the onboarding module's GET /access-requests/status, which is this route's strictly richer twin (member|invited|not_admitted plus its own `admitted`). One budget across both, because they are one oracle: hardening either alone would accomplish nothing, and giving each its own budget would just let an enumerator alternate for double the rate. That twin once told pending/declined/none apart too; it collapsed to `not_admitted` on the owner's call (ADR 0217 D4, task 1003359). That endpoint is also why this one exists: it models neither the firstAdmin bypass nor open enrollment, so it reports the OWNER as 'not_admitted' forever — the exact case this page has to resolve.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/auth.js",
         "responses": {
@@ -23827,6 +23827,72 @@
         ]
       }
     },
+    "/store/modules/{key}/price": {
+      "post": {
+        "operationId": "post_store_modules_key_price",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/modules/:key/price",
+        "description": "POST /api/bongos/store/modules/:key/price — the module's author sets its price (task 1004894, criterion wa5-module-economy). Body: { cents?, credits? }, each a whole number of 0 or more, or null for \"not offered in that currency\"; at least one is given, and 0 in either is free. Appends a row to the price history; the newest is what the catalog shows and what acquire charges. A paid price may be set before buying exists (owner, 2026-10-26): the catalog marks it not yet buyable. Price never moves the score (ADR 0343 D6). The audit middleware records who changed it and to what. rank: metic+archon — the same gate as publishing (module.submit), plus the author check inside setPrice: only the person who published the module prices it.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.submit"
+        ],
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreModulesKeyPriceRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostStoreModulesKeyPriceResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/{key}/versions": {
       "post": {
         "operationId": "post_store_modules_key_versions",
@@ -24344,6 +24410,81 @@
         ]
       }
     },
+    "/store/modules/{key}/versions/{version}/withdraw": {
+      "post": {
+        "operationId": "post_store_modules_key_versions_version_withdraw",
+        "tags": [
+          "store"
+        ],
+        "summary": "POST /store/modules/:key/versions/:version/withdraw",
+        "description": "POST /api/bongos/store/modules/:key/versions/:version/withdraw — a Metic+ person takes one version back (task 1004895, criterion wa5-staged-rollout). The store stops handing it out: acquire, install, update and the update check skip it, and the newest version still served is offered instead. A project that already runs it keeps it, and `bongos upgrade` and the hall's Modules tab tell it the version was withdrawn, with the reason. Withdrawing the only served version is allowed; acquire then says nothing can be handed out. A reason is required: it is kept on the channel row (core_281) and shown to holders, and the audit middleware also records it with who asked. The permission is module.delist, the one that already guards delist and release.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.delist` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "src/bongos/routes/modules.js",
+        "x-permissions": [
+          "module.delist"
+        ],
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          },
+          {
+            "name": "version",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `version`."
+          }
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostStoreModulesKeyVersionsVersionWithdrawRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostStoreModulesKeyVersionsVersionWithdrawResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/subcategories": {
       "get": {
         "operationId": "get_store_subcategories",
@@ -29679,10 +29820,12 @@
       "GetStoreModulesLatestResponse": {
         "type": "object",
         "properties": {
-          "latest": {}
+          "latest": {},
+          "withdrawn": {}
         },
         "required": [
-          "latest"
+          "latest",
+          "withdrawn"
         ]
       },
       "GetStoreUsageReportingResponse": {
@@ -35978,6 +36121,31 @@
           "delisted_at"
         ]
       },
+      "PostStoreModulesKeyPriceRequest": {
+        "type": "object",
+        "properties": {
+          "cents": {},
+          "credits": {}
+        },
+        "additionalProperties": false
+      },
+      "PostStoreModulesKeyPriceResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "module_key": {},
+          "previous": {},
+          "price": {}
+        },
+        "required": [
+          "ok",
+          "module_key",
+          "previous",
+          "price"
+        ]
+      },
       "PostStoreModulesKeyVersionsResponse": {
         "type": "object",
         "properties": {
@@ -36090,6 +36258,35 @@
           "reason"
         ]
       },
+      "PostStoreModulesKeyVersionsVersionWithdrawRequest": {
+        "type": "object",
+        "properties": {
+          "reason": {
+            "type": "string",
+            "maxLength": 2000
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostStoreModulesKeyVersionsVersionWithdrawResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "module_key": {},
+          "version": {},
+          "channel": {},
+          "reason": {}
+        },
+        "required": [
+          "ok",
+          "module_key",
+          "version",
+          "channel",
+          "reason"
+        ]
+      },
       "PostStoreSubcategoriesIdApproveRequest": {
         "type": "object",
         "properties": {
@@ -37186,9 +37383,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 582,
-  "x-schema-count": 624,
+  "x-endpoint-count": 584,
+  "x-schema-count": 628,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 404,
+  "x-response-schemas": 406,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 582 endpoints across 98 route files.
+> **Generated from the live route files** — the route file is authoritative. 584 endpoints across 98 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -863,7 +863,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (22)
+## `store` (24)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -874,6 +874,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/store/modules/:key/delist` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out of the store (task 1003797, ADR 0338 D2). |
 | GET | `/api/bongos/store/modules/:key/entitlement` | `any-builder` | — |  |
 | GET | `/api/bongos/store/modules/:key/listing` | `any-builder` | — | GET /api/bongos/store/modules/:key/listing — whether one module is in the catalog and why (task 1003810): the reason in a sentence, what … |
+| POST | `/api/bongos/store/modules/:key/price` | `metic+archon` | `cents`, `credits` | POST /api/bongos/store/modules/:key/price — the module's author sets its price (task 1004894, criterion wa5-module-economy). |
 | POST | `/api/bongos/store/modules/:key/versions` | `metic+archon` | _undocumented_ | POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). |
 | GET | `/api/bongos/store/modules/:key/versions/:version/channel` | `any-builder` | — | GET /api/bongos/store/modules/:key/versions/:version/channel — where a version stands on the promotion gate (task 1003804, ADR 0344 D3): … |
 | POST | `/api/bongos/store/modules/:key/versions/:version/error-count` | `any-builder` | `day`, `count` |  |
@@ -882,6 +883,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/store/modules/:key/versions/:version/reassess` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/versions/:version/reassess — a Metic+ person asks for a published version's assessment to run again: … |
 | POST | `/api/bongos/store/modules/:key/versions/:version/release` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/versions/:version/release — a Metic+ person releases a version the promotion gate HELD on tester (a t… |
 | GET | `/api/bongos/store/modules/:key/versions/:version/tarball` | `any-builder` | — |  |
+| POST | `/api/bongos/store/modules/:key/versions/:version/withdraw` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/versions/:version/withdraw — a Metic+ person takes one version back (task 1004895, criterion wa5-stag… |
 | GET | `/api/bongos/store/modules/latest` | `any-builder` | — | The newest published version of each named module — what `bongos upgrade` compares an instance's installed store modules against to repor… |
 | GET | `/api/bongos/store/subcategories` | `any-builder` | — | GET /api/bongos/store/subcategories — the approved sub-categories under each of the eight parents (task 1004355, ADR 0342 D3): what an au… |
 | POST | `/api/bongos/store/subcategories/:id/approve` | `metic+archon` | `label`, `sub_key` | POST /api/bongos/store/subcategories/:id/approve { label?, sub_key? } — make a proposal live, optionally renamed first. |

package/docs/copy-inventory.md

@@ -4,13 +4,13 @@
 > Deterministic on a given tree — regenerate and commit rather than hand-editing.
 > Machine-readable twin: [`copy-registry.json`](copy-registry.json).
 
-**2735 strings** across 3 surfaces · 2323 distinct pieces of copy · 2735 certain, 0 heuristic · 239 shown in more than one place.
+**2737 strings** across 3 surfaces · 2325 distinct pieces of copy · 2737 certain, 0 heuristic · 239 shown in more than one place.
 
 ## Surfaces
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 153 | 1916 |
+| `builders-hall` | `modules/hall-ui/public` | 153 | 1918 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 91 |
 | `landing` | `modules/public-landing/public` | 9 | 728 |
 
@@ -78,7 +78,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e08628967f2f` | 3x | Project settings | modules/hall-ui/public/project-settings.html:15, modules/hall-ui/public/project-settings.html:15, modules/hall-ui/public/project-settings.html:26 |
 | … | | _199 more in the JSON registry_ | |
 
-## `builders-hall` — 1916 strings
+## `builders-hall` — 1918 strings
 
 | id | conf | text | where |
 |---|---|---|---|
@@ -362,7 +362,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `71da00d47492` | certain | Could not invite: {…} | `modules/hall-ui/public/watch.js:344` |
 | `90691bceaf68` | certain | Could not load | `modules/hall-ui/public/task.js:1038` |
 | `589a4cfc5442` | certain | Could not load idea {…}. | `modules/hall-ui/public/ideas.js:1019` |
-| `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:593` |
+| `192c893fc64e` | certain | Could not load modules. | `modules/hall-ui/public/modules.js:602` |
 | `9912c3835136` | certain | Could not load requests — reload to try again. | `modules/hall-ui/public/collab.js:845` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:504` |
 | `7775fec0fa85` | certain | Could not load sessions. | `modules/hall-ui/public/sessions.js:542` |
@@ -383,7 +383,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `64f9d51f0fa2` | certain | Could not load your settings. | `modules/hall-ui/public/settings.js:1208` |
 | `de244c45d916` | certain | Could not load {…} | `modules/hall-ui/public/task.js:1031` |
 | `2366356926b4` | certain | Could not mark the primer just now. Try again. | `modules/hall-ui/public/primer.js:259` |
-| `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:570` |
+| `753987b5da13` | certain | Could not reach the submit endpoint. | `modules/hall-ui/public/modules.js:579` |
 | `6f500726f0ac` | certain | Could not read the report: {…} | `modules/hall-ui/public/watch.js:768` |
 | `21c2f33168a3` | certain | Could not read this project's deploy state: {…} | `modules/hall-ui/public/deploy.js:636` |
 | `21a782f1af26` | certain | Could not read what this would bring in: {…}. The check below still applies. | `modules/hall-ui/public/deploy.js:542` |
@@ -813,7 +813,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `90623fec4cfa` | certain | No page is open. | `modules/hall-ui/public/tweak-editor.js:565` |
 | `1a46c31343cb` | certain | No projects are hosted here yet. | `modules/hall-ui/public/fleet-costs.js:69` |
 | `9f73b3f3dad0` | certain | No rank floor — any builder can claim this task | `modules/hall-ui/public/task-lib.js:77` |
-| `4ffd939755e0` | certain | No real-world data yet, so it is listed but not ranked. | `modules/hall-ui/public/modules.js:334` |
+| `4ffd939755e0` | certain | No real-world data yet, so it is listed but not ranked. | `modules/hall-ui/public/modules.js:343` |
 | `722d107d7a90` | certain | No render is attached to this page yet. /tweak attaches them when it applies a page; until then there is nothi | `modules/hall-ui/public/approval-queue.js:136` |
 | `3fd0c6fcb92e` | certain | No request and no invite needed. Sign in with GitHub, and a step-by-step guide takes you the rest of the way. | `modules/hall-ui/public/hall-render.js:283` |
 | `2947c1ddea9a` | certain | No running box to deploy. | `modules/hall-ui/public/deploy.js:720` |
@@ -885,7 +885,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `43626cff7071` | certain | Nothing of that kind in your sky. | `modules/hall-ui/public/sky-panel.js:123` |
 | `b05a5f8cb074` | certain | Nothing personal is sent. | `modules/hall-ui/public/my-agents.js:452` |
 | `ad9a17a8a5eb` | certain | Nothing shipped yet. | `modules/hall-ui/public/profile.js:292` |
-| `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:531` |
+| `f326632f2013` | certain | Nothing to submit — every module here ships with the core. | `modules/hall-ui/public/modules.js:540` |
 | `27c0d872db2d` | certain | Nothing you have typed above is lost by opening this. | `modules/hall-ui/public/ideas.html:155` |
 | `26a07b64f49d` | certain | Now running core {…} | `modules/hall-ui/public/deploy.js:400` |
 | `21cb60a8a96a` | certain | Now running core {…} — but GitHub was not updated. | `modules/hall-ui/public/deploy.js:390` |
@@ -1235,7 +1235,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `da9da6e866bd` | certain | Take it offline | `modules/hall-ui/public/project-settings.html:59` |
 | `aa8da34fe237` | certain | Take the next page, or pick one from the studio. | `modules/hall-ui/public/tweak-editor.js:566` |
 | `fc53e250e86f` | certain | Take this page | `modules/hall-ui/public/paintbrush.js:116` |
-| `8b3cdb88b0f4` | certain | Taken out of the store. Your copy keeps working, but it will get no more updates. | `modules/hall-ui/public/modules.js:125` |
+| `8b3cdb88b0f4` | certain | Taken out of the store. Your copy keeps working, but it will get no more updates. | `modules/hall-ui/public/modules.js:134` |
 | `e604fc3ace79` | certain | Task # | `modules/hall-ui/public/blockers.js:138` |
 | `a0f384b022fd` | certain | Task dependencies | `modules/hall-ui/public/goals.html:195` |
 | `91576eb7c880` | certain | Task dependency forest — scrolls sideways inside this box | `modules/hall-ui/public/goal-forest-render.js:186` |
@@ -1400,7 +1400,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e97b2d549f10` | certain | This project is hosted on {…}, and that is where it is taken offline or removed. Both links below open this pr | `modules/hall-ui/public/project-settings.js:298` |
 | `fcd43f045614` | certain | This project is upgraded on the server that runs it: | `modules/hall-ui/public/settings-software-update.js:121` |
 | `53e287924841` | certain | This project runs on a server that {…} looks after, so they install its updates. Ask them for this one and the | `modules/hall-ui/public/settings-software-update.js:100` |
-| `1116d2cad470` | certain | This project tests new versions first | `modules/hall-ui/public/modules.js:211` |
+| `1116d2cad470` | certain | This project tests new versions first | `modules/hall-ui/public/modules.js:220` |
 | `3c8aaec39c40` | certain | This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies | `modules/hall-ui/public/deploy.js:599` |
 | `b9ed9a5f38dd` | certain | This round changed no lines. | `modules/hall-ui/public/approval-queue.js:150` |
 | `09256febc32d` | certain | This sentence has {…} {…} where a value is dropped in when it is shown. | `modules/hall-ui/public/copy-desk.js:422` |
@@ -1649,7 +1649,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1e6212a16397` | certain | decisions made today | `modules/hall-ui/public/street.html:71` |
 | `4adbb8da9999` | certain | default ({…}) | `modules/hall-ui/public/settings-render.js:64` |
 | `4a287afb0892` | certain | default for your rank | `modules/hall-ui/public/settings.js:424` |
-| `953f99598871` | certain | delisted · no more updates | `modules/hall-ui/public/modules.js:125` |
+| `953f99598871` | certain | delisted · no more updates | `modules/hall-ui/public/modules.js:134` |
 | `563e03d200c6` | certain | designed, task-tracked, not yet built | `modules/hall-ui/public/diagrams.html:40` |
 | `a3fd52d9513b` | certain | document{…} you added · learned | `modules/hall-ui/public/settings-specialities.js:322` |
 | `fcec9cad1c69` | certain | download .docx | `modules/hall-ui/public/tweak-editor.html:65` |
@@ -1699,7 +1699,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c0c1d07e2829` | certain | is the authority and production; | `modules/hall-ui/public/diagrams.html:71` |
 | `6b530a7007bc` | certain | jump to a goal or a thought | `modules/hall-ui/public/goal-map.html:84` |
 | `6b530a7007bc` | certain | jump to a goal or a thought | `modules/hall-ui/public/thinking.html:92` |
-| `cf5047ea06d8` | certain | kept on general: {…} | `modules/hall-ui/public/modules.js:207` |
+| `cf5047ea06d8` | certain | kept on general: {…} | `modules/hall-ui/public/modules.js:216` |
 | `9328033a890a` | certain | land every shuttle | `modules/hall-ui/public/sky-interaction.js:45` |
 | `9018bf6e99eb` | certain | last used {…} · signed in {…} | `modules/hall-ui/public/settings-sessions.js:46` |
 | `b4b8d57ab043` | certain | lists them there. | `modules/hall-ui/public/commands.html:42` |
@@ -1727,11 +1727,11 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7b5ad068dc26` | certain | not graded | `modules/hall-ui/public/hall-render.js:349` |
 | `01a3d68d80c1` | certain | not graded (grader outage) | `modules/hall-ui/public/builders.js:544` |
 | `d43b9bbb8d4d` | certain | not graded (quality lens unavailable) | `modules/hall-ui/public/builders.js:546` |
-| `380177c47d89` | certain | not measured yet | `modules/hall-ui/public/modules.js:351` |
+| `380177c47d89` | certain | not measured yet | `modules/hall-ui/public/modules.js:360` |
 | `c04e4491af67` | certain | not now | `modules/hall-ui/public/studio.html:110` |
 | `3916a3dc8e98` | certain | not started | `modules/hall-ui/public/roadmap.js:120` |
 | `3916a3dc8e98` | certain | not started | `modules/hall-ui/public/roadmap.js:311` |
-| `6d28ca6a61bf` | certain | not testing | `modules/hall-ui/public/modules.js:206` |
+| `6d28ca6a61bf` | certain | not testing | `modules/hall-ui/public/modules.js:215` |
 | `b4d87a62ec85` | certain | nothing by that name — or not explored yet | `modules/hall-ui/public/sky-interaction.js:138` |
 | `8ca0a499ec86` | certain | nothing recorded yet · {…} | `modules/hall-ui/public/profile-charts.js:302` |
 | `6a040d3dbd48` | certain | nothing waits on you. | `modules/hall-ui/public/street.html:105` |
@@ -1771,7 +1771,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9eca058c6ad2` | certain | release a thought — one line | `modules/hall-ui/public/goal-map.html:90` |
 | `9eca058c6ad2` | certain | release a thought — one line | `modules/hall-ui/public/thinking.html:98` |
 | `d4bb81532896` | certain | repro steps, context, anything that helps… | `modules/hall-ui/public/ideas.html:80` |
-| `299dd9d33f53` | certain | restart it | `modules/hall-ui/public/modules.js:141` |
+| `299dd9d33f53` | certain | restart it | `modules/hall-ui/public/modules.js:150` |
 | `58b4e7a48d86` | certain | reviews from before Tweak Mode | `modules/hall-ui/public/studio.html:143` |
 | `0d677ab4868a` | certain | reviews written on the live site | `modules/hall-ui/public/studio.html:138` |
 | `f37f5043f81b` | certain | ring {…} of {…} · {…} | `modules/hall-ui/public/sky-interaction.js:34` |
@@ -1794,8 +1794,8 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `c8c2551006dc` | certain | skip the tour | `modules/hall-ui/public/goal-map.html:121` |
 | `c8c2551006dc` | certain | skip the tour | `modules/hall-ui/public/thinking.html:122` |
 | `1e737a57eb20` | certain | start governing | `modules/hall-ui/public/city.html:99` |
-| `e294c3429c2e` | certain | strong at {…} | `modules/hall-ui/public/modules.js:340` |
-| `0215b2cdca8c` | certain | submit for review | `modules/hall-ui/public/modules.js:286` |
+| `e294c3429c2e` | certain | strong at {…} | `modules/hall-ui/public/modules.js:349` |
+| `0215b2cdca8c` | certain | submit for review | `modules/hall-ui/public/modules.js:295` |
 | `43e6f1592ae3` | certain | submit it in the editor | `modules/hall-ui/public/studio.js:868` |
 | `9ec19e32f86f` | certain | submit page | `modules/hall-ui/public/tweak-editor.html:68` |
 | `da30b952a60b` | certain | system / unattributed | `modules/hall-ui/public/goals-page.js:284` |
@@ -1859,9 +1859,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `969577b937d6` | certain | versions in flight | `modules/hall-ui/public/roadmap.js:321` |
 | `8cd3cc4005fc` | certain | via goal | `modules/hall-ui/public/dom-utils.js:450` |
 | `18cf722bdd7e` | certain | waiting · | `modules/hall-ui/public/sky-interaction.js:128` |
-| `354861d3c2ce` | certain | waits for a restart | `modules/hall-ui/public/modules.js:139` |
+| `354861d3c2ce` | certain | waits for a restart | `modules/hall-ui/public/modules.js:148` |
 | `35be9e0923da` | certain | walks the whole path in plain language. | `modules/hall-ui/public/hall-render.js:841` |
-| `20318b6da94e` | certain | weak at {…} | `modules/hall-ui/public/modules.js:342` |
+| `20318b6da94e` | certain | weak at {…} | `modules/hall-ui/public/modules.js:351` |
 | `db42054582ed` | certain | wells · | `modules/hall-ui/public/sky-interaction.js:129` |
 | `17705daf7b85` | certain | what counts as passing | `modules/hall-ui/public/government.html:53` |
 | `96a8971a5c44` | certain | what got un-stuck | `modules/hall-ui/public/blockers.js:131` |
@@ -1878,6 +1878,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `143f77e2b782` | certain | why these are the same | `modules/hall-ui/public/task-detail.js:571` |
 | `ec7c228cb4ce` | certain | why this isn’t worth doing | `modules/hall-ui/public/task-detail.js:622` |
 | `98297cf0fa4d` | certain | with help from {…} | `modules/hall-ui/public/builders.js:754` |
+| `caa8962d20c8` | certain | withdrawn · update when a fix is out | `modules/hall-ui/public/modules.js:127` |
 | `80707a00b301` | certain | would lock | `modules/hall-ui/public/my-agents.js:383` |
 | `95cdbd063b62` | certain | would lock none | `modules/hall-ui/public/my-agents.js:384` |
 | `dd7f7d6a97fe` | certain | your share this month | `modules/hall-ui/public/street.html:91` |
@@ -1892,10 +1893,11 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `de5b58a187c6` | certain | {…} Change that profile and this follows it. | `modules/hall-ui/public/settings-render.js:65` |
 | `e4b36621d4f1` | certain | {…} Nothing needs doing — this page shows the result when it lands. | `modules/hall-ui/public/deploy.js:222` |
 | `6c08bfe92e2b` | certain | {…} This project is invite-only: the {…} invites each builder, and there is nothing to apply for here. | `modules/hall-ui/public/hall-render.js:292` |
+| `8ebfbca38e77` | certain | {…} Your copy keeps working; update when a newer version is out. | `modules/hall-ui/public/modules.js:127` |
 | `c5623d60015d` | certain | {…} Your standing is {…}. | `modules/hall-ui/public/hall-render.js:854` |
 | `a91e1e702d4d` | certain | {…} achieved, {…} in progress, {…} not started of {…} goals | `modules/hall-ui/public/roadmap.js:73` |
-| `a65d371b5cb3` | certain | {…} and above can enable or disable a module | `modules/hall-ui/public/modules.js:284` |
-| `36258a270517` | certain | {…} and above can switch this | `modules/hall-ui/public/modules.js:210` |
+| `a65d371b5cb3` | certain | {…} and above can enable or disable a module | `modules/hall-ui/public/modules.js:293` |
+| `36258a270517` | certain | {…} and above can switch this | `modules/hall-ui/public/modules.js:219` |
 | `56b00d773232` | certain | {…} and {…} | `modules/hall-ui/public/profile-nudge.js:77` |
 | `788ff11f1135` | certain | {…} awarded | `modules/hall-ui/public/task.js:475` |
 | `9d160147b34a` | certain | {…} criteria · since {…} | `modules/hall-ui/public/roadmap.js:176` |
@@ -1906,7 +1908,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `55b949873848` | certain | {…} is in. | `modules/hall-ui/public/tweak-editor.js:568` |
 | `80b4aa799a4b` | certain | {…} is writing this page now. You can read it, download it, or take another page from the studio. | `modules/hall-ui/public/tweak-editor.js:319` |
 | `830d2be6f859` | certain | {…} line | `modules/hall-ui/public/tweak-editor.js:235` |
-| `92469c4757f1` | certain | {…} not measured yet | `modules/hall-ui/public/modules.js:325` |
+| `92469c4757f1` | certain | {…} not measured yet | `modules/hall-ui/public/modules.js:334` |
 | `73c1372b43d9` | certain | {…} of {…} | `modules/hall-ui/public/sky-panel.js:120` |
 | `cc5106af4b35` | certain | {…} of {…} criteria satisfied | `modules/hall-ui/public/goals-lib.js:32` |
 | `cc5106af4b35` | certain | {…} of {…} criteria satisfied | `modules/hall-ui/public/goals-render.js:701` |
@@ -1929,14 +1931,14 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1a8a6267e490` | certain | {…} unfinished task{…} — say what happens to each | `modules/hall-ui/public/goals-render.js:1032` |
 | `2f75f69cdb2f` | certain | {…} {…} changed | `modules/hall-ui/public/profile-crafts.js:216` |
 | `8186b562553a` | certain | {…} {…} waiting | `modules/hall-ui/public/work.js:431` |
-| `a9216af9b05e` | certain | {…} {…} — how-to | `modules/hall-ui/public/modules.js:646` |
+| `a9216af9b05e` | certain | {…} {…} — how-to | `modules/hall-ui/public/modules.js:655` |
 | `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/watch.js:514` |
 | `0d4016a5531c` | certain | {…} {…}{…} | `modules/hall-ui/public/work.js:276` |
 | `b3757ba3bb46` | certain | {…} · Stored encrypted; never shown again after saving. | `modules/hall-ui/public/settings.js:878` |
 | `a6e4ed98fbea` | certain | {…} · revoke it any time under Active sessions. | `modules/hall-ui/public/settings.js:810` |
 | `d73256fbc395` | certain | {…} · who votes, and how it {…} | `modules/hall-ui/public/board-room.js:480` |
 | `1ac723849449` | certain | {…} · {…}{…} | `modules/hall-ui/public/sky-interaction.js:33` |
-| `ddd2bfc1fb60` | certain | {…} — how to use it | `modules/hall-ui/public/modules.js:648` |
+| `ddd2bfc1fb60` | certain | {…} — how to use it | `modules/hall-ui/public/modules.js:657` |
 | `085f93f3f775` | certain | {…} — see all standings | `modules/hall-ui/public/hall-render.js:80` |
 | `7609b97aec22` | certain | {…}% complete | `modules/hall-ui/public/hall-render.js:741` |
 | `2a2728a4ec4f` | certain | {…}% of tasks complete | `modules/hall-ui/public/roadmap.js:63` |
@@ -1950,7 +1952,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1e275ee0299c` | certain | {…}s only | `modules/hall-ui/public/government.js:1067` |
 | `97e27ab169ae` | certain | {…}{…} session{…} across {…} builder{…}. | `modules/hall-ui/public/sessions.js:443` |
 | `3d74668f69e5` | certain | {…}{…} · {…} | `modules/hall-ui/public/task.js:655` |
-| `1026fd5f68b7` | certain | · version | `modules/hall-ui/public/modules.js:651` |
+| `1026fd5f68b7` | certain | · version | `modules/hall-ui/public/modules.js:660` |
 | `a6ae9cbdee30` | certain | — all builders — | `modules/hall-ui/public/builders.js:698` |
 | `729d4ce22b99` | certain | — any — | `modules/hall-ui/public/hall-widgets.js:173` |
 | `d2c30a1ee74e` | certain | — decide — | `modules/hall-ui/public/goals-render.js:996` |