@bongos/core 1.24.6 → 1.24.8

package/src/bongos/project-settings.js

@@ -52,6 +52,9 @@ const SETTING_KEYS = {
   SHIP_MODE: 'ship.mode',
   TWEAK_AUTOPICKUP: 'tweak.autopickup',
   TWEAK_AUTOPICKUP_CAP: 'tweak.autopickup_monthly_cap',
+  // Per-rank caps (task 1005003): one row per live rank, this prefix + the rank
+  // (rankCapKey). An empty value means the rank follows the project cap.
+  TWEAK_AUTOPICKUP_RANK_CAP_PREFIX: 'tweak.autopickup_rank_cap.',
   SPEND_CAP: 'treasury.spend_cap_usd',
   // Testing new module versions first (task 1003802, ADR 0344 D1): module-testing.js.
   MODULE_TESTER: 'modules.tester',
@@ -292,9 +295,10 @@ function describeShipMode(resolved) {
 // (modules/lifecycle/autopickup.js); this file only resolves the numbers.
 const AUTOPICKUP_MODES = Object.freeze(['off', 'on']);
 const DEFAULT_AUTOPICKUP = 'off';
-// 20 rounds: a grade costs the project a few dollars, so 20 is a bounded, legible
-// monthly spend at about the level of one active artist (ADR 0371 D5).
-const DEFAULT_AUTOPICKUP_CAP = 20;
+// 200 rounds: the owner's decision on task 1004971 (2026-10-29, Q7), raising ADR
+// 0371 D5's first figure of 20. A project can set its own number, and a cap per
+// builder rank (task 1005003); this is only the answer for a project that has not.
+const DEFAULT_AUTOPICKUP_CAP = 200;
 // Past 1000 the cap is an off switch typed as a big number; that should be asked
 // for out loud, the same reasoning as MAX_ROT_DAYS.
 const MAX_AUTOPICKUP_CAP = 1000;
@@ -318,6 +322,16 @@ function parseAutopickupCap(raw) {
 
 // One knob through its parser: { value, source, invalid }. Never throws; an
 // unreadable database answers the default, the resolveShipMode posture.
+// `row` is the already-read row (or undefined); parseRow never touches the DB.
+function parseRow(key, row, parse, pick, fallback) {
+  if (row && row.value != null && row.value !== '') {
+    const got = parse(row.value);
+    if (pick(got) != null) return { value: pick(got), source: 'project_settings', invalid: null };
+    return { value: fallback, source: 'default', invalid: { where: `project_settings['${key}']`, raw: String(row.value), reason: got.reason } };
+  }
+  return { value: fallback, source: 'default', invalid: null };
+}
+
 async function resolveOne(key, parse, pick, fallback) {
   let row = null;
   try {
@@ -326,31 +340,60 @@ async function resolveOne(key, parse, pick, fallback) {
     logger.error(`project_settings read failed; falling back to the default ${key}: ${err && err.message}`);
     return { value: fallback, source: 'default', invalid: null };
   }
-  if (row && row.value != null && row.value !== '') {
-    const got = parse(row.value);
-    if (pick(got) != null) return { value: pick(got), source: 'project_settings', invalid: null };
-    return { value: fallback, source: 'default', invalid: { where: `project_settings['${key}']`, raw: String(row.value), reason: got.reason } };
-  }
-  return { value: fallback, source: 'default', invalid: null };
+  return parseRow(key, row, parse, pick, fallback);
+}
+
+// rankCapKey(rank) — the row holding one rank's own cap (task 1005003). ONE ROW
+// PER RANK, deliberately: setting or clearing a rank is a single upsert, so two
+// people editing two different ranks at once can never overwrite each other (a
+// shared JSON object would be read-modify-write and lose one edit). An empty
+// value means "no cap of its own" (the null-is-meaningful rule above).
+function rankCapKey(rank) {
+  return `${SETTING_KEYS.TWEAK_AUTOPICKUP_RANK_CAP_PREFIX}${rank}`;
 }
 
-// resolveTweakAutopickup() — { mode, cap, source: { mode, cap }, invalid: [...] }.
-// mode is always 'off' or 'on', cap always a usable positive integer.
+// resolveTweakAutopickup() — { mode, cap, rank_caps, source: { mode, cap },
+// invalid: [...] }. mode is always 'off' or 'on', cap always a usable positive
+// integer, rank_caps always an object of live-ladder rank → cap (empty when no rank
+// has its own). Every row is read in ONE query; each rank cap goes through
+// parseAutopickupCap, the project cap's own parser, so the two cannot disagree.
 async function resolveTweakAutopickup() {
-  const m = await resolveOne(SETTING_KEYS.TWEAK_AUTOPICKUP, parseAutopickup, (g) => g.mode, DEFAULT_AUTOPICKUP);
-  const c = await resolveOne(SETTING_KEYS.TWEAK_AUTOPICKUP_CAP, parseAutopickupCap, (g) => g.cap, DEFAULT_AUTOPICKUP_CAP);
+  // Lazy: the ladder is the kernel's one copy (tests/rank_tier_single_source.mjs).
+  const ladder = require('./db-kernel').LIVE_RANK_LADDER;
+  const keys = [SETTING_KEYS.TWEAK_AUTOPICKUP, SETTING_KEYS.TWEAK_AUTOPICKUP_CAP, ...ladder.map(rankCapKey)];
+  let byKey = new Map();
+  try {
+    const { rows } = await pool.query('SELECT key, value FROM project_settings WHERE key = ANY($1::text[])', [keys]);
+    byKey = new Map(rows.map((row) => [row.key, row]));
+  } catch (err) {
+    logger.error(`project_settings read failed; falling back to the default tweak auto-pickup settings: ${err && err.message}`);
+  }
+  const m = parseRow(SETTING_KEYS.TWEAK_AUTOPICKUP, byKey.get(SETTING_KEYS.TWEAK_AUTOPICKUP), parseAutopickup, (g) => g.mode, DEFAULT_AUTOPICKUP);
+  const c = parseRow(SETTING_KEYS.TWEAK_AUTOPICKUP_CAP, byKey.get(SETTING_KEYS.TWEAK_AUTOPICKUP_CAP), parseAutopickupCap, (g) => g.cap, DEFAULT_AUTOPICKUP_CAP);
+  const rankCaps = {};
+  const invalid = [m.invalid, c.invalid];
+  for (const rank of ladder) {
+    const r = parseRow(rankCapKey(rank), byKey.get(rankCapKey(rank)), parseAutopickupCap, (g) => g.cap, null);
+    if (r.value != null) rankCaps[rank] = r.value;
+    invalid.push(r.invalid);
+  }
   return {
     mode: m.value,
     cap: c.value,
+    rank_caps: rankCaps,
     source: { mode: m.source, cap: c.source },
-    invalid: [m.invalid, c.invalid].filter(Boolean),
+    invalid: invalid.filter(Boolean),
   };
 }
 
 function describeTweakAutopickup(resolved) {
   const r = resolved || {};
   if (r.mode !== 'on') return 'Off: a submitted page waits until a person runs /tweak for it.';
-  return `On: a running Autobongos runner applies submitted pages on its own, up to ${r.cap} a month. The artist still approves every one.`;
+  const ranks = Object.entries(r.rank_caps || {});
+  const byRank = ranks.length
+    ? ` Some builder ranks have their own limit: ${ranks.map(([rank, n]) => `${rank} ${n}`).join(', ')}.`
+    : '';
+  return `On: a running Autobongos runner applies submitted pages on its own, up to ${r.cap} a month.${byRank} The artist still approves every one.`;
 }
 
 // THE SPEND CAP (task 1004712, ADR 0379). The owner's ruling: there is NO spend
@@ -416,6 +459,7 @@ module.exports = {
   MAX_AUTOPICKUP_CAP,
   parseAutopickup,
   parseAutopickupCap,
+  rankCapKey,
   resolveTweakAutopickup,
   describeTweakAutopickup,
   MAX_SPEND_CAP_USD,

package/src/bongos/serve-internal.js

@@ -1329,6 +1329,7 @@ function mountInternalSurfaces(app) {
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;
+  const MARKET_WATCH_PAGE_RE = /^\/builders\/market-watch(?:-[a-z]+)?(?:\.html)?\/?$/; // task 1004941: every read behind them is requireBuilder
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     // Cheap early-out: only /builders/* paths can ever be gated, so skip the
@@ -1342,7 +1343,7 @@ function mountInternalSurfaces(app) {
     // behind the proxy's path normalization.
     const norm = path.posix.normalize(req.path);
     if (SIGNEDIN_BUILDERS_PAGE_RE.test(norm) || SIGNEDIN_BUILDERS_PREFIX_RE.test(norm)
-      || TASK_DETAIL_PAGE_RE.test(norm) || IDEA_DETAIL_PAGE_RE.test(norm)) {
+      || TASK_DETAIL_PAGE_RE.test(norm) || IDEA_DETAIL_PAGE_RE.test(norm) || MARKET_WATCH_PAGE_RE.test(norm)) {
       return gdsAuth.requireBuilderPage(req, res, next);
     }
     next();

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.6'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.8'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autopickup_cap.mjs

@@ -2,7 +2,8 @@
 // (task 1004677 / BV2.TW19a, ADR 0371 D3, D5, D6).
 //
 // Pinned here (DB-free; the race lives in tests/autopickup_cap_db.mjs):
-//   1. the two parsers and the resolver: off by default, cap 20 by default, an
+//   1. the parsers and the resolver: off by default, cap 200 by default (task
+//      1005003; it was 20), per-rank caps read from one JSON row, an
 //      unusable stored value reported and never thrown, a dead DB answers defaults;
 //   2. the refusal ladder: not a tweak, switch off, round limit, monthly cap, and the
 //      lock is taken BEFORE either count;
@@ -35,7 +36,12 @@ async function withPool(query, fn) {
   pool.query = query;
   try { return await fn(); } finally { pool.query = saved; }
 }
-const settingsRows = (map) => async (_sql, [key]) => ({ rows: key in map ? [{ key, value: map[key] }] : [] });
+// Answers both the single-key read (getSetting) and the one-query batch read
+// (key = ANY($1)) that resolveTweakAutopickup makes.
+const settingsRows = (map) => async (_sql, [key]) => {
+  const keys = Array.isArray(key) ? key : [key];
+  return { rows: keys.filter((k) => k in map).map((k) => ({ key: k, value: map[k] })) };
+};
 
 // ---- 1. the setting ---------------------------------------------------------
 
@@ -50,11 +56,11 @@ test('the parsers accept exactly off|on and a whole positive cap', () => {
   assert.match(parseAutopickupCap('100000').reason, /out of range/);
 });
 
-test('an untouched project is off with a cap of 20', async () => {
+test('an untouched project is off with a cap of 200 and no rank caps', async () => {
   assert.equal(DEFAULT_AUTOPICKUP, 'off');
-  assert.equal(DEFAULT_AUTOPICKUP_CAP, 20);
+  assert.equal(DEFAULT_AUTOPICKUP_CAP, 200);
   const r = await withPool(settingsRows({}), () => resolveTweakAutopickup());
-  assert.deepEqual(r, { mode: 'off', cap: 20, source: { mode: 'default', cap: 'default' }, invalid: [] });
+  assert.deepEqual(r, { mode: 'off', cap: 200, rank_caps: {}, source: { mode: 'default', cap: 'default' }, invalid: [] });
   assert.match(describeTweakAutopickup(r), /waits until a person/);
 });
 
@@ -63,7 +69,7 @@ test('stored values are read; an unusable one is reported and falls back', async
     () => resolveTweakAutopickup());
   assert.equal(r.mode, 'on');
   assert.equal(r.source.mode, 'project_settings');
-  assert.equal(r.cap, 20);
+  assert.equal(r.cap, 200);
   assert.equal(r.invalid.length, 1);
   assert.equal(r.invalid[0].raw, 'lots');
   assert.match(describeTweakAutopickup({ mode: 'on', cap: 7 }), /up to 7 a month/);
@@ -72,7 +78,7 @@ test('stored values are read; an unusable one is reported and falls back', async
 test('a database that cannot be read answers the defaults', async () => {
   const r = await withPool(async () => { throw new Error('db down'); }, () => resolveTweakAutopickup());
   assert.equal(r.mode, 'off');
-  assert.equal(r.cap, 20);
+  assert.equal(r.cap, 200);
 });
 
 // ---- 2. the refusal ladder --------------------------------------------------
@@ -128,7 +134,7 @@ test('the monthly cap refuses at the cap and admits below it', async () => {
 test('claimTask runs the gate before the insert, and names the column only on a marked claim', () => {
   const src = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'db-claims.js'), 'utf8');
   const body = src.slice(src.indexOf('async function claimTask('), src.indexOf('async function claimTasksBatch'));
-  const gate = body.indexOf('autoPickupRefusal(client, task, autoPickupSettings)');
+  const gate = body.indexOf('autoPickupRefusal(client, task, autoPickupSettings, builderRank)');
   const insert = body.indexOf('INSERT INTO claims');
   assert.ok(gate > 0 && insert > gate, 'the gate runs inside the transaction, before the insert');
   assert.match(body.slice(gate, insert), /if \(refusal\) throw refusal;/, 'a refusal stops the claim');
@@ -155,15 +161,19 @@ const fakeRes = () => ({
   json(p) { this.payload = p; return this; },
 });
 
-function buildRouter({ used = 4 } = {}) {
+function buildRouter({ used = 4, rankCaps = {} } = {}) {
   const ps = api.projectSettings;
   const saved = { resolve: ps.resolveTweakAutopickup, set: ps.set };
   const writes = [];
-  const state = { mode: 'off', cap: 20 };
+  const state = { mode: 'off', cap: 20, rank_caps: { ...rankCaps } };
   ps.resolveTweakAutopickup = async () => ({ ...state, source: { mode: 'default', cap: 'default' }, invalid: [] });
   ps.set = async (key, value, by) => {
     writes.push({ key, value, by });
-    if (key === 'tweak.autopickup') state.mode = value; else state.cap = value;
+    if (key === 'tweak.autopickup') state.mode = value;
+    else if (key.startsWith('tweak.autopickup_rank_cap.')) {
+      const rank = key.slice('tweak.autopickup_rank_cap.'.length);
+      if (value === '') delete state.rank_caps[rank]; else state.rank_caps[rank] = value;
+    } else state.cap = value;
   };
   const autopickup = require('../modules/lifecycle/autopickup.js');
   const savedCount = autopickup.countThisMonth;
@@ -234,3 +244,185 @@ test('core_275 is additive: one nullable column, recorded in schema_migrations',
   assert.doesNotMatch(sql, /NOT NULL|DROP /);
   assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('core_275_claims_auto_pickup'\)/);
 });
+
+// ---- 5. the cap per project and per builder rank (task 1005003) ------------
+
+const { rankCapKey } = require('../src/bongos/project-settings.js');
+const { effectiveCap } = require('../modules/lifecycle/autopickup.js');
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+
+test('a project override and a rank override are both read, in ONE query', async () => {
+  assert.equal(rankCapKey('xenos'), 'tweak.autopickup_rank_cap.xenos');
+  let queries = 0;
+  const rows = settingsRows({
+    [SETTING_KEYS.TWEAK_AUTOPICKUP]: 'on',
+    [SETTING_KEYS.TWEAK_AUTOPICKUP_CAP]: '40',
+    'tweak.autopickup_rank_cap.xenos': '5',
+    'tweak.autopickup_rank_cap.archon': '80',
+    'tweak.autopickup_rank_cap.metic': '', // cleared: follows the project cap
+    'tweak.autopickup_rank_cap.olympian': '9', // off the live ladder: never read
+  });
+  const r = await withPool(async (sql, params) => { queries += 1; return rows(sql, params); }, () => resolveTweakAutopickup());
+  assert.equal(queries, 1, 'mode, cap and every rank cap come back in one round trip');
+  assert.equal(r.cap, 40);
+  assert.deepEqual(r.rank_caps, { xenos: 5, archon: 80 });
+  assert.deepEqual(r.invalid, []);
+  assert.equal(describeTweakAutopickup(r),
+    'On: a running Autobongos runner applies submitted pages on its own, up to 40 a month. Some builder ranks have their own limit: xenos 5, archon 80. The artist still approves every one.');
+
+  const bad = await withPool(settingsRows({ 'tweak.autopickup_rank_cap.xenos': '-1' }), () => resolveTweakAutopickup());
+  assert.deepEqual(bad.rank_caps, {}, 'an unusable rank row falls back to the project cap');
+  assert.equal(bad.invalid.length, 1);
+  assert.equal(bad.invalid[0].where, "project_settings['tweak.autopickup_rank_cap.xenos']");
+});
+
+test('the effective cap is the rank\'s own cap, else the project cap', () => {
+  const s = { mode: 'on', cap: 200, rank_caps: { xenos: 5 } };
+  assert.deepEqual(effectiveCap(s, 'xenos'), { cap: 5, from: 'rank' });
+  assert.deepEqual(effectiveCap(s, 'metic'), { cap: 200, from: 'project' });
+  assert.deepEqual(effectiveCap(s, null), { cap: 200, from: 'project' });
+  assert.deepEqual(effectiveCap({ cap: 200 }, 'xenos'), { cap: 200, from: 'project' }, 'no rank caps at all');
+});
+
+test('the default cap of 200 admits round 199 and refuses at 200', async () => {
+  const s = { mode: 'on', cap: DEFAULT_AUTOPICKUP_CAP, rank_caps: {} };
+  assert.equal(await autoPickupRefusal(fakeClient({ month: 199 }), tweak, s, 'metic'), null);
+  const r = await autoPickupRefusal(fakeClient({ month: 200 }), tweak, s, 'metic');
+  assert.equal(r.code, 'AUTO_PICKUP_CAP_REACHED');
+  assert.equal(r.cap, 200);
+  assert.equal(r.cap_from, 'project');
+  assert.equal(r.message, 'Auto-pickup has used this month\'s 200 rounds, so submitted pages wait for a person until next month.');
+});
+
+test('a rank override replaces the project cap for that rank only, both ways', async () => {
+  const s = { mode: 'on', cap: 50, rank_caps: { xenos: 10, archon: 80 } };
+  // lower than the project cap: refuses a xenos runner where a metic one is admitted
+  const lower = await autoPickupRefusal(fakeClient({ month: 10 }), tweak, s, 'xenos');
+  assert.equal(lower.code, 'AUTO_PICKUP_CAP_REACHED');
+  assert.equal(lower.cap, 10);
+  assert.equal(lower.cap_from, 'rank');
+  assert.match(lower.message, /reached 10, the limit this project sets for a xenos builder's runner, so submitted pages wait for a person/);
+  assert.equal(await autoPickupRefusal(fakeClient({ month: 10 }), tweak, s, 'metic'), null);
+  // higher than the project cap: admits an archon runner past the project's number
+  assert.equal(await autoPickupRefusal(fakeClient({ month: 60 }), tweak, s, 'archon'), null);
+  assert.equal((await autoPickupRefusal(fakeClient({ month: 60 }), tweak, s, 'metic')).code, 'AUTO_PICKUP_CAP_REACHED');
+});
+
+test('claimTask passes the claimer\'s rank, read inside the transaction, to the gate', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'lifecycle', 'db-claims.js'), 'utf8');
+  const body = src.slice(src.indexOf('async function claimTask('), src.indexOf('async function claimTasksBatch'));
+  const rankRead = body.indexOf('const builderRank = builderRows[0] ? builderRows[0].rank : null;');
+  const gate = body.indexOf('autoPickupRefusal(client, task, autoPickupSettings, builderRank)');
+  assert.ok(rankRead > 0 && gate > rankRead);
+});
+
+test('the read reports the caller\'s own cap and what is left of it', async () => {
+  const { route, restore } = buildRouter({ used: 4, rankCaps: { xenos: 6 } });
+  try {
+    const get = handler(route('get', '/project-settings/tweak-autopickup'));
+    const x = fakeRes();
+    await get({ builder: { id: 1, rank: 'xenos' } }, x);
+    assert.deepEqual([x.payload.my_cap, x.payload.my_cap_from, x.payload.remaining_this_month], [6, 'rank', 2]);
+    assert.deepEqual(x.payload.rank_caps, { xenos: 6 });
+    const m = fakeRes();
+    await get({ builder: { id: 2, rank: 'metic' } }, m);
+    assert.deepEqual([m.payload.my_cap, m.payload.my_cap_from, m.payload.remaining_this_month], [20, 'project', 16]);
+  } finally { restore(); }
+});
+
+test('rank_caps is a partial update: a number sets, null clears, an unnamed rank is kept', async () => {
+  const { route, writes, restore } = buildRouter({ rankCaps: { xenos: 5, thetes: 9 } });
+  try {
+    const patch = handler(route('patch', '/project-settings/tweak-autopickup'));
+    const res = fakeRes();
+    await patch({ body: { rank_caps: { metic: 30, xenos: null } }, builder: { id: 7, rank: 'metic' } }, res);
+    assert.equal(res.code, null);
+    // One single-row upsert per named rank — never a read-modify-write of a shared
+    // object, so it cannot overwrite a rank someone else is editing at the same time.
+    assert.deepEqual(writes, [
+      { key: 'tweak.autopickup_rank_cap.metic', value: 30, by: 7 },
+      { key: 'tweak.autopickup_rank_cap.xenos', value: '', by: 7 },
+    ]);
+    assert.deepEqual(res.payload.rank_caps, { thetes: 9, metic: 30 });
+    assert.equal(res.payload.my_cap, 30);
+  } finally { restore(); }
+});
+
+test('two people saving two different ranks at once both keep their edit', async () => {
+  const { route, restore } = buildRouter();
+  try {
+    const patch = handler(route('patch', '/project-settings/tweak-autopickup'));
+    const a = fakeRes();
+    const b = fakeRes();
+    await Promise.all([
+      patch({ body: { rank_caps: { xenos: 5 } }, builder: { id: 7 } }, a),
+      patch({ body: { rank_caps: { archon: 80 } }, builder: { id: 8 } }, b),
+    ]);
+    const after = fakeRes();
+    await handler(route('get', '/project-settings/tweak-autopickup'))({ builder: { id: 9, rank: 'metic' } }, after);
+    assert.deepEqual(after.payload.rank_caps, { xenos: 5, archon: 80 });
+  } finally { restore(); }
+});
+
+test('an unknown rank or a bad rank number writes nothing, the project cap included', async () => {
+  const { route, writes, restore } = buildRouter();
+  try {
+    const patch = handler(route('patch', '/project-settings/tweak-autopickup'));
+    const unknown = fakeRes();
+    await patch({ body: { cap: 100, rank_caps: { olympian: 5 } }, builder: { id: 7 } }, unknown);
+    assert.equal(unknown.code, 'bad_tweak_autopickup');
+    assert.match(unknown.payload.message, /unknown rank 'olympian'/);
+    const zero = fakeRes();
+    await patch({ body: { cap: 100, rank_caps: { xenos: 0 } }, builder: { id: 7 } }, zero);
+    assert.match(zero.payload.message, /rank_caps\.xenos: must be positive/);
+    assert.equal(writes.length, 0);
+  } finally { restore(); }
+});
+
+// The server's permission check on the write, run for real: the route's own
+// requirePermission layer, against a stub government port (the
+// tests/government_require_permission.mjs double). Whoever holds
+// project.settings.manage — the project owner, or anyone granted it — passes; a
+// builder without it is refused with 403 before the handler runs.
+async function runWriteGate(heldKeys) {
+  const { route, restore } = buildRouter();
+  try {
+    const stack = route('patch', '/project-settings/tweak-autopickup').stack;
+    const gate = stack[1].handle;
+    assert.equal(gate.name, 'permissionGate', 'the second layer is the kernel permission gate');
+    seams._reset();
+    seams.registerProvider('government', { resolveBuilderPermissions: async () => heldKeys });
+    const res = { _status: null, _json: null, status(c) { this._status = c; return this; }, json(b) { this._json = b; return this; } };
+    attachFail({}, res, () => {});
+    let passed = false;
+    await gate({ builder: { id: 7, rank: 'metic' }, body: { rank_caps: { xenos: 5 } } }, res, () => { passed = true; });
+    return { passed, res };
+  } finally { seams._reset(); restore(); }
+}
+
+test('a builder holding project.settings.manage may set the caps', async () => {
+  const { passed, res } = await runWriteGate(['project.settings.manage']);
+  assert.equal(passed, true);
+  assert.equal(res._status, null);
+});
+
+test('a builder without project.settings.manage is refused', async () => {
+  const { passed, res } = await runWriteGate(['idea.triage']);
+  assert.equal(passed, false);
+  assert.equal(res._status, 403);
+  assert.equal(res._json.error.code, 'permission_forbidden');
+  assert.deepEqual(res._json.error.details.required, ['project.settings.manage']);
+});
+
+test('the settings page row offers the project cap and one box per live rank', () => {
+  const { tweakCapRow } = require('../modules/lifecycle/routes/project-settings.js');
+  const row = tweakCapRow({ mode: 'off', cap: 200, rank_caps: { xenos: 5 }, source: { cap: 'default' }, invalid: [] });
+  assert.equal(row.key, 'tweak_round_cap');
+  assert.equal(row.editable, true);
+  assert.equal(row.value.cap, 200);
+  assert.deepEqual(row.value.ranks, api.LIVE_RANK_LADDER.map((rank) => ({ rank, cap: rank === 'xenos' ? 5 : null })));
+  const page = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'project-settings.js'), 'utf8');
+  assert.match(page, /row\.key === 'tweak_round_cap'/);
+  assert.match(page, /sendJson\('PATCH', '\/project-settings\/tweak-autopickup', \{ cap: Number\(\$\('ps-tweak-cap'\)\.value\), rank_caps: rankCaps \}\)/);
+});

package/tests/government_act_alone_buildings.mjs

@@ -222,6 +222,7 @@ for (const rel of [
   'modules/security/routes/reports.js',
   'modules/onboarding/routes/access-requests.js',
   'modules/government/routes/government.js',
+  'modules/market-watch/routes/rules.js',
 ]) app.use(require(path.join(ROOT, rel))());
 const server = http.createServer(app);
 await new Promise((r) => server.listen(0, '127.0.0.1', r));
@@ -243,6 +244,8 @@ const REQUESTS = {
   'PATCH /project-settings/ship-mode': ['PATCH', '/project-settings/ship-mode', { mode: 'sometimes' }],
   'PATCH /project-settings/tweak-autopickup': ['PATCH', '/project-settings/tweak-autopickup', { mode: 'sometimes' }],
   'PATCH /work-categories/:id': ['PATCH', `/work-categories/${BAD}`, {}],
+  // task 1004941: the owner deciding a Market Watch proposal
+  'POST /market-watch/proposals/:id/decide': ['POST', `/market-watch/proposals/${BAD}/decide`, { decision: 'approve' }],
   'POST /security/reports/:id/confirm': ['POST', `/security/reports/${BAD}/confirm`, {}],
   'POST /security/reports/:id/dispute': ['POST', `/security/reports/${BAD}/dispute`, {}],
   'POST /security/reports/:id/fix': ['POST', `/security/reports/${BAD}/fix`, {}],

package/tests/government_decision_rules.mjs

@@ -475,7 +475,10 @@ test('a matter\'s act is checked when it is opened: People only, a custom rank o
     openBoardItem: async () => { throw new Error('must not be reached'); },
   }, async () => {
     const act = (a) => ({ type: 'assign_rank', builder_id: 7, rank_key: 'tester', ...a });
-    assert.equal((await board.openMatter({ area: 'rules', title: 't', action: act(), proposedBy: '42' })).reason, 'action_not_supported_here');
+    // task 1004941: Rules now carries one act of its own (a Market Watch proposal), so a
+    // People act there is the wrong act; a building with no acts still refuses any act
+    assert.equal((await board.openMatter({ area: 'rules', title: 't', action: act(), proposedBy: '42' })).reason, 'bad_action');
+    assert.equal((await board.openMatter({ area: 'planning', title: 't', action: act(), proposedBy: '42' })).reason, 'action_not_supported_here');
     assert.equal((await board.openMatter({ area: 'people', title: 't', action: act({ rank_key: 'metic' }), proposedBy: '42' })).reason, 'seeded_rank');
     assert.equal((await board.openMatter({ area: 'people', title: 't', action: act({ rank_key: 'ghost' }), proposedBy: '42' })).reason, 'unknown_rank');
     assert.equal((await board.openMatter({ area: 'people', title: 't', action: act({ type: 'promote' }), proposedBy: '42' })).reason, 'bad_action');

package/tests/governor_matter_acts.mjs

@@ -39,6 +39,7 @@ const sittingRow = (area, decided_by, rule) => ({ area, decided_by, rule, who: n
 autoActs.contributeAutomationMatterActs();
 lifeActs.contributeLifecycleMatterActs();
 buildersRoute();
+require(path.join(ROOT, 'modules', 'market-watch', 'matter-acts.js')).contributeMarketWatchMatterActs();
 
 // ── the shape of each act ───────────────────────────────────────────────────
 
@@ -50,8 +51,11 @@ test('each building\'s act is checked strictly when the matter is opened: shape,
   assert.deepEqual(v('review', { type: 'satisfy_criterion', criterion_id: 9 }).action, { type: 'satisfy_criterion', criterion_id: 9 });
   assert.deepEqual(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: 50 }).action, { type: 'set_budget', builder_id: 7, monthly_usd: 50 });
   assert.equal(v('treasury', { type: 'set_budget', builder_id: 7, monthly_usd: null }).action.monthly_usd, null, 'null clears the limit');
+  // task 1004941: Rules carries one act, a Market Watch proposal approved by vote
+  assert.deepEqual(v('rules', { type: 'market_watch_proposal', proposal_id: '5' }).action, { type: 'market_watch_proposal', proposal_id: 5 });
+  assert.equal(v('rules', { type: 'market_watch_proposal', proposal_id: 0 }).reason, 'bad_action');
   // refusals, each named
-  assert.equal(v('rules', { type: 'switch_on' }).reason, 'action_not_supported_here');
+  assert.equal(v('rules', { type: 'switch_on' }).reason, 'bad_action', 'an act from another building');
   assert.equal(v('planning', { type: 'switch_on' }).reason, 'action_not_supported_here');
   assert.equal(v('automation', { type: 'satisfy_criterion', criterion_id: 9 }).reason, 'bad_action', 'an act from another building');
   assert.equal(v('automation', { type: 'switch_on', goal_id: 3 }).reason, 'unknown_field');

package/tests/hall_page_gate_map.mjs

@@ -49,6 +49,9 @@ const ORACLE = {
   // task 1004473: the Commands page — its two reads (installed skills, CLI verbs)
   // are requireBuilder, so sign-in is the whole gate.
   '/builders/commands': 'requireBuilderPage',
+  // task 1004941: the Market Watch rules page — every member reads it (its read is
+  // requireBuilder); its writes check the owner or the government server-side.
+  '/builders/market-watch-rules': 'requireBuilderPage',
   // task 1004685 (the living-city prototype): My agents — the viewer's own agent
   // settings. Every read behind it is the viewer's own (GET /me, /me/* prefs,
   // /specialities) and requireBuilder, so sign-in is the whole gate.

package/tests/market_watch_module.mjs

@@ -41,6 +41,7 @@ test('the manifest validates, ships disabled, declares a payer, and contributes
   for (const p of ['hub-seed', 'weekly-run', 'weekly-ask']) assert.ok(c.pollers.includes(p), `poller ${p}`);
   assert.ok(c.routes.includes('ask'), 'the weekly ask routes');
   assert.ok(c.uiSections.includes('weekly-ask'), 'the weekly ask hall slice (hallWidgetScripts needs a uiSection)');
+  assert.ok(c.routes.includes('rules'), 'the rules page routes (task 1004941)');
 });
 
 test('the loader discovers it from the live tree — loaded, not an error, not skipped', () => {