@bongos/core 1.24.24 → 1.24.25

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.24",
-  "core_contract": "1.24.24",
-  "source_commit": "18d2aee4a5e5be6233f9598d64f4b5f99bfb5c79",
+  "core_version": "1.24.25",
+  "core_contract": "1.24.25",
+  "source_commit": "dee2639f5053216958a0024b2e6af6d54c9b4628",
   "source_ref": "HEAD",
-  "built_at": "2026-11-03T01:18:44.066Z",
+  "built_at": "2026-11-03T22:09:15.437Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 632,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 4499,
-  "tree_sha256": "964ede2546fdb0e28e85daf8ebd98ca1d3eb5b2a8df16cb2e38e1e18fe23e0ae",
+  "tree_sha256": "5e0b2f24b44dcffe4bd7a9d82e6024bddd12a6be61dc609c02447cb82ba6fc1f",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -3002,7 +3002,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "fe84d1e80dbc3ac6840e4bd8729ad2fe0828cf3d246c54052b804772e9689adc"
+      "sha256": "abd56f3acf0eed7e0ed62297e2bc5774c165f608c36163d9b3a015429fb9e4cd"
     },
     {
       "path": "docs/modules-contract.md",
@@ -11767,12 +11767,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b7a74553a15e3b2a0e569ded78a5b48a61621131805b9994de96868a8f580cd7"
+      "sha256": "52a5166b00e8a5761186ca4689a2481d5ee305cf937c40739b2c8357e90510db"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6b7d576d2ecb55b9c9315d7424fc2044766cfaa7a1c27f3ee66520c985e6ddd0"
+      "sha256": "14f054f72fe8d56472d2dc94d3f5de9f68e0246533ea992519ff8e03f1628d2d"
     },
     {
       "path": "public-docs/index.html",
@@ -11792,7 +11792,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "ac6239f92750e39fde341f15d5797dfe8f9c85611060d4a1e06893700d3ebb52"
+      "sha256": "d7dc47351e474cd55f6c2a089146540e628a02976d308c8bcaf4bdf9462f74eb"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -15392,7 +15392,7 @@
     {
       "path": "src/bongos/package-registry.js",
       "mode": "0000644",
-      "sha256": "47f7872dd523e166246a5207431256a08b80e2faaa861ae9bca368f61b7af3d8"
+      "sha256": "a7a61e07e2aae983fd0a87f748fd4277bed136bb3062b4aabd5d7416dffdefd9"
     },
     {
       "path": "src/bongos/passkeys.js",
@@ -15517,7 +15517,7 @@
     {
       "path": "src/bongos/routes/core-update.js",
       "mode": "0000644",
-      "sha256": "3fbb1b2302a21569de90e3b264b47d6b3bf3c2b73c0a45d65649ed25d326ec48"
+      "sha256": "dbb6cc64939a87b3f6c79727d90e3a9948c2c04e650235a3f1d3446c36716685"
     },
     {
       "path": "src/bongos/routes/feedback.js",
@@ -15637,7 +15637,7 @@
     {
       "path": "src/bongos/software-update.js",
       "mode": "0000644",
-      "sha256": "77e29f45a383f7e188cf0aa6e0d873f9d6bb02acc955df9312353a11cdfeb002"
+      "sha256": "4805e1c822f1a55cf38fec99af788cc3654f67f9aaa2830fbf853f75583c1244"
     },
     {
       "path": "src/bongos/task-needs.js",
@@ -15682,7 +15682,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "addc0ff10b81034f6258ddd7c2784fcbf9f3e3808ad152a5a27d1b27999b2be3"
+      "sha256": "f7b0423511136930dafb0f695c664c581cf2ac50b94c9b1dbd763e455f00a9ce"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -21772,7 +21772,7 @@
     {
       "path": "tests/software_update.mjs",
       "mode": "0000644",
-      "sha256": "0f3b40a9560dc3f8ae7ee84e517316a4b4dce9de47554e443f804942a18909a6"
+      "sha256": "6fe6bb1ebb12a0d2ab06ec98f54f79f9fb91d1c526d7a38bfae2a716a9b35d0f"
     },
     {
       "path": "tests/sound_player.mjs",

package/docs/module-api-changelog.md

@@ -3304,5 +3304,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.22 with no explicit bump. run 41370306880. (task 1002620)
   1.24.24 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.23 with no explicit bump. run 41558735984. (task 1002620)
+  1.24.25 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.24 with no explicit bump. run 41727989005. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.24",
+  "version": "1.24.25",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.24",
+      "version": "1.24.25",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.24",
+  "version": "1.24.25",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11065,5 +11065,11 @@
       "id": "1004908",
       "text": "Contractors are now only paid once a signed NDA is on file and the payment processor has collected their tax details; if either is missing the payment waits and the person is told why. Bongos never stores tax numbers."
     }
+  ],
+  "1.24.25": [
+    {
+      "id": "1004593",
+      "text": "A hosted project's Settings page no longer offers an unreleased version; it now offers exactly what the Upgrade page offers."
+    }
   ]
 }

package/src/bongos/package-registry.js

@@ -255,7 +255,8 @@ async function cached(slot, fresh, load, t) {
  *   registry — `{ ok, versions, published, latest, newest }` or `{ ok:false, error }`
  *   notes    — the newest version's release notes, `{ ok, version, notes }` or
  *              `{ ok:false, version, error }`; `{ ok:false, skipped }` when the caller
- *              already holds notes that reach the newest version (`haveNotesFor`).
+ *              already holds notes that reach the newest version, or needs none
+ *              (`haveNotesFor(newest, registry)`).
  *
  * `get` swaps the HTTPS transport and `store`/`now` the cache, so tests drive the real
  * parsing and failure paths rather than a stub standing in front of them.
@@ -267,7 +268,7 @@ async function readRegistry({ pkg, haveNotesFor = () => false, get = https.get,
     () => fetchPackument({ pkg, get, origin }), t);
   if (!registry.ok) return { registry, notes: { ok: false, error: 'the registry could not be read' } };
   const version = registry.newest;
-  if (haveNotesFor(version)) return { registry, notes: { ok: false, skipped: true, version } };
+  if (haveNotesFor(version, registry)) return { registry, notes: { ok: false, skipped: true, version } };
   const ns = store.notes;
   if (ns.version !== version) { ns.version = version; ns.value = null; ns.at = 0; }
   const notes = await cached(ns, (s) => s.value.ok || t - s.at < RETRY_AFTER_MS,

package/src/bongos/routes/core-update.js

@@ -31,6 +31,7 @@ const { asyncHandler } = require('./_helpers');
 const auth = require('../auth');
 const { readCoreUpdate, readCoreUpgrades } = require('../core-update');
 const { readSoftwareUpdate } = require('../software-update');
+const { followForShape } = require('../../../scripts/bongos/update-channel.js');
 const seams = require('../../module-seams');
 const { loadIdpConfig } = require('../auth-config');
 const upgradeRequest = require('../upgrade-request');
@@ -88,6 +89,13 @@ function updateDoor({ provisioning, idp, hubUpgradeUrl }) {
   return url ? { kind: 'hub', url } : { kind: 'cli', url: null };
 }
 
+// WHICH PUBLISHED VERSIONS THIS HALL MAY BE OFFERED (task 1004593, ADR 0361 D5): the hall that
+// runs the door is the platform's own, the one project that takes every candidate; every other
+// project follows releases, as the runner and /deploy offer them. followForShape is the runner's.
+function followFor(door) {
+  return followForShape(door && door.kind === 'local' ? 'control-plane' : null);
+}
+
 function safeHubUpgradeUrl() {
   try { return require('../../instance-config').resolveEnv('HUB_UPGRADE_URL') || null; } catch { return null; }
 }
@@ -327,12 +335,12 @@ function buildCoreUpdateRouter({
     asyncHandler('GET /software-update', async (req, res) => {
       let running = null;
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
+      const door = updateDoor(doorInputs());
       // canUpdate does not depend on the rule, so it runs beside the rule read, not after it.
       const [update, can] = await Promise.all([
-        resolveChannel(selfChannel).then(async ({ channel, source }) => ({ ...(await softwareUpdate({ running, channel })), channel_source: source })),
+        resolveChannel(selfChannel).then(async ({ channel, source }) => ({ ...(await softwareUpdate({ running, channel, follow: followFor(door) })), channel_source: source })),
         canUpdate(req),
       ]);
-      const door = updateDoor(doorInputs());
       const ask = await readAsk({ update, door, deps: askDeps() });
       const held = await safeHold(upgradeHold, { running, offered: update && update.reading === 'ok' ? update.offered : null });
       // The history only for a viewer who holds core.pin.move (see safeMoved's gate note).
@@ -357,8 +365,8 @@ function buildCoreUpdateRouter({
         let running = null;
         try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
         const { channel } = await resolveChannel(selfChannel);
-        const update = await softwareUpdate({ running, channel });
         const door = updateDoor(doorInputs());
+        const update = await softwareUpdate({ running, channel, follow: followFor(door) });
         const deps = askDeps();
         return upgradeRequest.requestUpgrade({
           host: deps.host,

package/src/bongos/software-update.js

@@ -22,6 +22,12 @@
 // /deploy, via the provisioning.selfUpdateChannel seam — task 1004535), else the runner's
 // default. The banner (core-update.js) is handed the same rule, so the two cannot disagree.
 //
+// ONLY WHAT THIS PROJECT'S FOLLOW ADMITS IS OFFERED (task 1004593, ADR 0361 D5). Merges publish
+// as candidates above the registry's `latest` label; a project that follows releases is offered
+// nothing above it, through `versionsForFollow`, the function the runner and the banner use.
+// Before this the panel offered a candidate that /deploy then said did not exist. The route
+// names the follow: candidates only on the platform's own hall.
+//
 // A READING, NEVER A GUESS. `reading` is 'ok' only when the registry answered; "up to date"
 // is `offered: null` on an ok reading and nothing else. Notes that could not be read say so,
 // and a version whose notes are missing is shown as missing rather than as empty.
@@ -30,6 +36,8 @@ const {
   CORE_PKG,
   DEFAULT_CHANNEL,
   normalizeChannel,
+  normalizeFollow,
+  versionsForFollow,
   resolveChannelTarget,
   compareSemver,
 } = require('../../scripts/bongos/update-channel.js');
@@ -62,22 +70,29 @@ function entriesFor(notes, version) {
   return out;
 }
 
+/** The published versions `follow` admits, oldest first; [] when a release follower has no label. */
+function admittedVersions(follow, registry) {
+  return versionsForFollow({ follow, available: registry.versions, released: registry.latest });
+}
+
 /**
  * The panel's whole answer, from one registry reading. PURE — no clock, no I/O.
  *
  * `registry` and `notes` are package-registry.js's `readRegistry` result. Versions in the
- * update are the published ones above `running` and at or below `offered`, newest first.
+ * update are the admitted ones above `running` and at or below `offered`, newest first, and
+ * `newest` is the newest admitted version, so a candidate is never named to a release follower.
  */
-function softwareUpdateVerdict({ running, channel, registry, notes, checkedAt }) {
+function softwareUpdateVerdict({ running, channel, follow, registry, notes, checkedAt }) {
   const ch = normalizeChannel(channel == null ? DEFAULT_CHANNEL : channel);
-  const base = { checked_at: checkedAt, running: running || null, channel: ch };
-  if (!running || !VERSION_RE.test(String(running))) {
-    return { ...base, reading: 'no_answer', error: 'this project could not name the version it runs', offered: null, newest: null, whats_new: null };
-  }
-  if (!registry || !registry.ok) {
-    return { ...base, reading: 'no_answer', error: (registry && registry.error) || 'the registry could not be read', offered: null, newest: null, whats_new: null };
-  }
-  const offered = resolveChannelTarget({ installed: running, channel: ch, available: registry.versions }) || null;
+  const fol = normalizeFollow(follow);
+  const base = { checked_at: checkedAt, running: running || null, channel: ch, follow: fol };
+  const noAnswer = (error) => ({ ...base, reading: 'no_answer', error, offered: null, newest: null, whats_new: null });
+  if (!running || !VERSION_RE.test(String(running))) return noAnswer('this project could not name the version it runs');
+  if (!registry || !registry.ok) return noAnswer((registry && registry.error) || 'the registry could not be read');
+  const admitted = admittedVersions(fol, registry);
+  // No label, no answer: the runner moves a release follower on nothing it cannot call released.
+  if (!admitted.length) return noAnswer('the registry does not say which version is released');
+  const offered = resolveChannelTarget({ installed: running, channel: ch, available: admitted }) || null;
   const published = registry.published || {};
   const answer = {
     ...base,
@@ -85,12 +100,12 @@ function softwareUpdateVerdict({ running, channel, registry, notes, checkedAt })
     error: null,
     offered,
     offered_published_at: offered ? published[offered] || null : null,
-    newest: registry.newest || null,
+    newest: admitted.reduce((a, v) => (compareSemver(v, a) > 0 ? v : a)),
     whats_new: null,
   };
   if (!offered) return answer;
 
-  const inUpdate = registry.versions
+  const inUpdate = admitted
     .filter((v) => compareSemver(v, running) > 0 && compareSemver(v, offered) <= 0)
     .sort((a, b) => compareSemver(b, a));
   const shown = inUpdate.slice(0, VERSIONS_MAX);
@@ -115,14 +130,19 @@ function softwareUpdateVerdict({ running, channel, registry, notes, checkedAt })
  * `get`/`now`/`store` pass through to the registry reader, so a test drives the real
  * packument parsing, the real tarball stream and the real cache rather than a stub.
  */
-async function readSoftwareUpdate({ running, channel, get, now = Date.now, store } = {}) {
+async function readSoftwareUpdate({ running, channel, follow, get, now = Date.now, store } = {}) {
   const t = now();
+  const fol = normalizeFollow(follow);
   const { registry, notes } = await readRegistry({
     pkg: CORE_PKG, get, now, store,
-    // Nothing to describe when nothing newer is published: skip the download.
-    haveNotesFor: (newest) => !VERSION_RE.test(String(running || '')) || compareSemver(newest, running) <= 0,
+    // Nothing to describe when nothing this project could take is newer: skip the download.
+    haveNotesFor: (_newest, facts) => {
+      if (!VERSION_RE.test(String(running || ''))) return true;
+      const admitted = admittedVersions(fol, facts);
+      return !admitted.some((v) => compareSemver(v, running) > 0);
+    },
   });
-  return softwareUpdateVerdict({ running, channel, registry, notes, checkedAt: new Date(t).toISOString() });
+  return softwareUpdateVerdict({ running, channel, follow: fol, registry, notes, checkedAt: new Date(t).toISOString() });
 }
 
 module.exports = { readSoftwareUpdate };

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.24'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.25'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/software_update.mjs

@@ -39,11 +39,12 @@ const NOTES = {
   '1.20.0': [{ id: 200, text: 'The start of a new line.' }],
 };
 
-/** A registry that answers the packument and the NEWEST version's tarball. */
-function registry({ versions = VERSIONS, notes = NOTES, pkStatus = 200, tgzStatus = 200, tgz } = {}) {
+/** A registry that answers the packument and the NEWEST version's tarball. `latest` is the
+ *  release label (ADR 0361): every version above it is a candidate. */
+function registry({ versions = VERSIONS, notes = NOTES, pkStatus = 200, tgzStatus = 200, tgz, latest } = {}) {
   const newest = versions[versions.length - 1];
   return fakeHttpsGet({
-    [PACKUMENT_URL]: { status: pkStatus, body: npmPackument({ versions, latest: newest, times: TIMES }) },
+    [PACKUMENT_URL]: { status: pkStatus, body: npmPackument({ versions, latest: latest === undefined ? newest : latest, times: TIMES }) },
     [tgzUrl(newest)]: { status: tgzStatus, body: tgz || npmTarball({ notes }) },
   });
 }
@@ -148,6 +149,44 @@ test('a project far behind lists the newest forty and counts the rest', async ()
   assert.equal(u.whats_new.versions[0].version, '1.19.51');
 });
 
+// ---- released vs candidate (task 1004593, ADR 0361 D5) --------------------------------
+// The live defect, 2026-10-06, uattest (1.21.66, patch): npm `latest` was 1.21.66 and 1.21.69
+// sat above it as a candidate. Settings offered 1.21.69; /deploy and the banner offered
+// nothing. A project that follows releases must be offered what the runner would move it to.
+
+test('a project that follows releases is offered nothing above the release label', async () => {
+  const reg = registry({ latest: '1.19.11' });
+  const u = await read('1.19.10', reg);
+  assert.equal(u.reading, 'ok');
+  assert.equal(u.follow, 'released', 'no follow given: the default, exactly as the runner');
+  assert.equal(u.offered, '1.19.11', '1.19.12 and 1.19.13 are candidates, never offered here');
+  assert.equal(u.newest, '1.19.11', 'and the newest it reports is the newest it could take, not a candidate');
+  assert.deepEqual(u.whats_new.versions.map((v) => v.version), ['1.19.11'], 'what\'s new stops at the offer');
+});
+
+test('the uattest case: running the released version with only candidates above it is up to date', async () => {
+  const reg = registry({ latest: '1.19.10' });
+  const u = await read('1.19.10', reg);
+  assert.equal(u.reading, 'ok');
+  assert.equal(u.offered, null, 'Settings now agrees with /deploy: nothing it can take');
+  assert.equal(u.whats_new, null);
+  assert.deepEqual(reg.asked, [PACKUMENT_URL], 'and nothing is downloaded for a version it will never offer');
+});
+
+test('the platform\'s own hall follows candidates and is offered them', async () => {
+  const u = await read('1.19.10', registry({ latest: '1.19.10' }), { follow: 'candidates' });
+  assert.equal(u.follow, 'candidates');
+  assert.equal(u.offered, '1.19.13');
+  assert.equal(u.newest, '1.20.0');
+});
+
+test('a registry with no release label is no answer for a release follower — never "up to date"', async () => {
+  const u = await read('1.19.10', registry({ latest: null }));
+  assert.equal(u.reading, 'no_answer');
+  assert.match(u.error, /released/);
+  assert.equal(u.offered, null);
+});
+
 test('a second look within minutes asks the registry nothing new', async () => {
   const reg = registry();
   const store = fresh();
@@ -510,6 +549,25 @@ test('the REAL default reads the provisioning.selfUpdateChannel port — and wit
   }
 });
 
+test('the route hands the reader the follow of the hall it serves: candidates only where the door runs (task 1004593)', async () => {
+  const cases = [
+    [{ provisioning: true, idp: null }, 'candidates', 'the platform\'s own hall, the one project that takes every candidate'],
+    [{ provisioning: false, idp: { origin: 'https://cloudbongos.com', clientId: 'uattest' } }, 'released', 'a hosted project'],
+    [{ provisioning: false, idp: null }, 'released', 'a self-hosted instance'],
+  ];
+  for (const [inputs, want, what] of cases) {
+    let seen;
+    const r = await drive({ softwareUpdate: async (a) => { seen = a; return STUB_UPDATE; }, canUpdate: async () => true, doorInputs: () => inputs });
+    assert.equal(r.status, 200, what);
+    assert.equal(seen.follow, want, what);
+  }
+});
+
+test('[source] the upgrade request asks with the same follow as the panel (task 1004593)', () => {
+  const seg = ROUTE_SRC.slice(ROUTE_SRC.indexOf("'/software-update/request'"), ROUTE_SRC.indexOf("'/project/manage-link'"));
+  assert.match(seg, /softwareUpdate\(\{ running, channel, follow: followFor\(door\) \}\)/, 'the version asked for is one the runner would take');
+});
+
 test('[source] the port the route reads is the port the provisioning module registers and declares (task 1004535)', () => {
   const port = 'provisioning.selfUpdateChannel';
   const route = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/core-update.js'), 'utf8');