@bongos/core 1.24.8 → 1.24.10

package/src/bongos/module-listing.js

@@ -135,39 +135,57 @@ function sortByPart(entries, part) {
 // can both check in one sentence:
 //
 //   highest overall score first; between equal scores the cheaper module first
-//   (free first, then the lowest cash price, then the lowest credit price); then
-//   the key.
+//   (free first, then the lowest cash price, a module whose cash price is still
+//   coming last); then the key.
 //
 // Price never buys a better place: it only orders modules the score could not tell
 // apart (price is never an input to the score, ADR 0343 D6). A buyer may also set a
 // maximum price, which leaves out what costs more — a filter, not a ranking.
 const RANKING = 'Highest overall score first; between equal scores, free modules and then the cheapest come first.';
 
-// A module's current price row ({ price_cents, price_credits } or none) as the
-// catalog shows it. No row is free (isFreePrice, module-store.js); 0 in either
-// currency is free; null means not offered in that currency (core_257). Pure.
+// CREDITS NEVER PRICE A MODULE (task 1004989, ADR 0385 decision 2). Credits are a
+// contribution meter: a credit price would make them stored value. New price rows
+// carry cents only (core_287 refuses price_credits). An OLD row may still carry a
+// credit price; the owner's ruling (2026-10-29) is that such a module stays
+// VISIBLE with a "price coming" note and can NOT be bought with credits, while
+// its author is asked to set a cash price.
+//
+// A module's current price row as the catalog shows it: { cents, free, coming }.
+// Never a credit amount. No row is free (isFreePrice, module-store.js); a cash
+// price of 0 is free. An old row that offered it at 0 credits stays free, as it
+// was: its author offered it at nothing, and no credit moves to have it. An old row whose
+// only price was a positive number of credits is `coming` — no cash price yet,
+// so not free and not buyable. Pure.
 function priceOf(row) {
   const cents = row && row.price_cents != null ? Number(row.price_cents) : null;
-  const credits = row && row.price_credits != null ? Number(row.price_credits) : null;
-  return { cents, credits, free: !row || cents === 0 || credits === 0 };
+  const legacyCredits = row && row.price_credits != null ? Number(row.price_credits) : null;
+  const free = !row || cents === 0 || legacyCredits === 0;
+  return { cents, free, coming: !free && cents == null };
 }
 
-// Whether a module can be bought today. Buying arrives with task 1003788 (area 8's
-// wallet); until then only a free module can be had, and a paid one is listed with
-// its price and marked not yet buyable (owner, 2026-10-26). Flip BUYING_OPEN when
-// the buy action ships, and nothing else needs to change. Pure.
+// What the author of a "price coming" module is asked (task 1004989). One string,
+// so the listing read, the CLI and the hall say the same thing.
+const PRICE_COMING_PROMPT = 'This module still has a price in credits, and credits can no longer price or buy a module. '
+  + 'It stays listed with "price coming" until you set a cash price: bongos module price <key> --cents N (0 makes it free).';
+
+// Whether a module can be bought today. Buying arrives with task 1003788; until
+// then only a free module can be had, and a paid one is listed with its price and
+// marked not yet buyable (owner, 2026-10-26). Flip BUYING_OPEN when the buy action
+// ships. A module whose cash price is still coming stays unbuyable even then:
+// there is nothing to pay in but credits, and credits do not buy. Pure.
 const BUYING_OPEN = false;
 function buyableNow(price) {
-  return !!(price && (price.free || BUYING_OPEN));
+  return !!(price && (price.free || (BUYING_OPEN && price.cents != null)));
 }
 
-// Within a buyer's maximum ({ cents, credits }, either may be null): a free module
-// always is; a priced one is when it is offered at or under a cap the buyer set. Pure.
+// Within a buyer's maximum cash price ({ cents }, or null for no cap): a free
+// module always is; a priced one is when its cash price is at or under the cap.
+// A module whose price is still coming has no cash price to compare, so a cap
+// leaves it out. Pure.
 function withinMaxPrice(price, max) {
-  if (!max || (max.cents == null && max.credits == null)) return true;
+  if (!max || max.cents == null) return true;
   if (price.free) return true;
-  return (max.cents != null && price.cents != null && price.cents <= max.cents)
-    || (max.credits != null && price.credits != null && price.credits <= max.credits);
+  return price.cents != null && price.cents <= max.cents;
 }
 
 // The default order of `listed`, per RANKING. Returns a new array. Pure.
@@ -179,7 +197,6 @@ function rankListed(entries) {
     return ((b.overall ?? -1) - (a.overall ?? -1))
       || (Number(pb.free) - Number(pa.free))
       || (cheap(pa.cents) - cheap(pb.cents))
-      || (cheap(pa.credits) - cheap(pb.credits))
       || a.key.localeCompare(b.key);
   });
 }
@@ -292,8 +309,8 @@ async function buildCatalog({ db, floor = QUALITY_FLOOR, sort = null, maxPrice =
       signals.get(k).push(s);
     }
   }
-  const max = maxPrice && (maxPrice.cents != null || maxPrice.credits != null)
-    ? { cents: maxPrice.cents ?? null, credits: maxPrice.credits ?? null } : null;
+  // A cash cap only (task 1004989): credits are never a price, so never a cap.
+  const max = maxPrice && maxPrice.cents != null ? { cents: maxPrice.cents } : null;
   const cats = await readModuleCategories(newest.map((r) => r.module_key), { db: pool });
   const out = { floor, cap: CAP_PER_SUBCATEGORY, ranking: RANKING, sort: sort || null, sort_parts: SORT_PARTS, max_price: max, listed: [], new: [] };
   for (const r of newest.sort((a, b) => a.module_key.localeCompare(b.module_key))) {
@@ -421,14 +438,24 @@ async function readListing(key, { db, floor = QUALITY_FLOOR, viewerId = null } =
     if (held) placed = { placement: 'excluded', reason: 'over_cap' };
   }
   const overall = score && placed.placement !== 'new' ? score.overall : null;
+  // The price as the catalog shows it, and — to the author only — the ask to set a
+  // cash price when the module still carries only an old credit price (task
+  // 1004989; the owner's ruling, 2026-10-29). Read by idx_store_module_prices_current.
+  const { rows: [priceRow] } = await pool.query(
+    `SELECT price_cents, price_credits FROM store_module_prices
+      WHERE module_key = $1 ORDER BY set_at DESC, id DESC LIMIT 1`, [key]);
+  const price = priceOf(priceRow || null);
   return {
     ...head, version: newest.version, version_id: newest.version_id, overall,
     ...explainPlacement(placed, { overall, floor, security, weaknesses: reading.weaknesses, held }),
     security, ...reading,
+    price, buyable: buyableNow(price),
+    price_prompt: isAuthor && price.coming ? PRICE_COMING_PROMPT : null,
   };
 }
 
 module.exports = {
   QUALITY_FLOOR, STRONG_AT, SORT_PARTS, RANKING, CAP_PER_SUBCATEGORY, placeVersion, readParts,
   sortByPart, priceOf, withinMaxPrice, rankListed, applyCap, listCatalog, explainPlacement, readListing,
+  PRICE_COMING_PROMPT,
 };

package/src/bongos/module-scope-map.js

@@ -201,6 +201,7 @@ const MODULE_GLOBS = {
     // task 1004941: the rules page (proposals, decisions, the run's prompt fence)
     'tests/market_watch_rules.mjs', 'tests/market_watch_rules_db.mjs',
     'tests/market_watch_ask.mjs', 'tests/market_watch_ask_db.mjs',
+    'tests/market_watch_settings.mjs',
   ],
   // --- builder prefs (wandering/skill/sound/render) + builder-needs ---
   // Carved into modules/builder-settings/ (BV1.R80 / ADR 0093 §1): the five pref

package/src/bongos/module-store.js

@@ -254,8 +254,11 @@ async function publishVersion(input, { db, beforeCommit } = {}) {
 // A module with NO price row is free. The owner decided this (2026-09-29): nothing
 // sets a price yet and who may sell is still open, so an unpriced module is
 // acquirable at no cost, and an entitlement taken then is kept if a price is added
-// later (ADR 0338 D2). A priced module is free when either currency it is offered in
-// is zero (0 = free, NULL = not offered in that currency; core_257).
+// later (ADR 0338 D2). A priced module is free when its cash price is zero. An old
+// row that offered it at 0 credits also stays free, as it was — its author offered
+// it at nothing and no credit moves to have it (task 1004989; module-listing.js priceOf
+// reads the same rule). An old row priced only in credits above 0 is NOT free:
+// its cash price is still coming, and credits never buy a module.
 function isFreePrice(priceRow) {
   if (!priceRow) return true;
   return priceRow.price_cents === 0 || priceRow.price_credits === 0;
@@ -387,20 +390,25 @@ async function latestVersions(keys, { db, channelsFor = null } = {}) {
 // author may, and a delisted module takes no new price (it can no longer be
 // acquired). The price is a HISTORY: each change appends a row and the newest is
 // current, which is what the catalog (module-listing.js priceOf) and acquire
-// (isFreePrice above) already read. `cents` / `credits`: a whole number of 0 or
-// more, or null for "not offered in that currency"; at least one must be given
-// (core_257's CHECK), and 0 in either is free. A paid price may be set before
+// (isFreePrice above) already read. `cents`: a whole number of 0 or more; 0 is
+// free. A paid price may be set before
 // buying exists (owner, 2026-10-26): the module is listed with it and marked not yet
 // buyable, and acquire keeps refusing it without an entitlement. Price is never an
 // input to the score (ADR 0343 D6). The history IS the audit of price changes:
 // every row names who set it and when, and the row before it is what it changed
 // from (the audit middleware also logs the request). One transaction, the module row
 // locked FOR UPDATE as publishVersion does, so two changes at once each report the
-// price they really replaced. Returns { ok: true, previous, price } (each
-// { cents, credits } or null) or { ok: false, status, code, message }.
-async function setPrice({ key, cents = null, credits = null, builderId }, { db } = {}) {
+// price they really replaced. Returns { ok: true, previous, price } or
+// { ok: false, status, code, message }.
+//
+// CASH ONLY (task 1004989, ADR 0385 decision 2): credits never price a module, so
+// a new row carries cents and nothing else (core_287 refuses price_credits in the
+// database too). `previous` reports the replaced row's cash price, and `coming:
+// true` when that row priced the module in credits only.
+async function setPrice({ key, cents, builderId }, { db } = {}) {
   const pool = db || require('./pool').pool;
   const refuse = (status, code, message) => ({ ok: false, status, code, message });
+  if (!Number.isInteger(cents) || cents < 0) return refuse(400, 'bad_price', 'A price is a whole number of cents, 0 or more. 0 makes the module free.');
   const client = await pool.connect();
   try {
     await client.query('BEGIN');
@@ -415,13 +423,13 @@ async function setPrice({ key, cents = null, credits = null, builderId }, { db }
       `SELECT price_cents, price_credits FROM store_module_prices
         WHERE module_key = $1 ORDER BY set_at DESC, id DESC LIMIT 1`, [key]);
     await client.query(
-      'INSERT INTO store_module_prices (module_key, price_cents, price_credits, set_by) VALUES ($1, $2, $3, $4)',
-      [key, cents, credits, builderId]);
+      'INSERT INTO store_module_prices (module_key, price_cents, set_by) VALUES ($1, $2, $3)',
+      [key, cents, builderId]);
     await client.query('COMMIT');
     return {
       ok: true,
-      previous: prev ? { cents: prev.price_cents, credits: prev.price_credits } : null,
-      price: { cents, credits },
+      previous: prev ? { cents: prev.price_cents, coming: prev.price_cents == null && Number(prev.price_credits) > 0 } : null,
+      price: { cents },
     };
   } catch (e) {
     try { await client.query('ROLLBACK'); } catch { /* the connection may be gone */ }

package/src/bongos/routes/modules.js

@@ -576,9 +576,9 @@ module.exports = function buildModulesRouter() {
     }));
 
   // POST /api/bongos/store/modules/:key/price — the module's author sets its price
-  // (task 1004894, criterion wa5-module-economy). Body: { cents?, credits? }, each a
-  // whole number of 0 or more, or null for "not offered in that currency"; at least
-  // one is given, and 0 in either is free. Appends a row to the price history; the
+  // (task 1004894, criterion wa5-module-economy). Body: { cents }, a whole number of
+  // 0 or more; 0 is free. A credit price is refused (task 1004989, ADR 0385
+  // decision 2: credits never price or buy a module). Appends a row to the price history; the
   // newest is what the catalog shows and what acquire charges. A paid price may be
   // set before buying exists (owner, 2026-10-26): the catalog marks it not yet
   // buyable. Price never moves the score (ADR 0343 D6). The audit middleware records
@@ -588,21 +588,24 @@ module.exports = function buildModulesRouter() {
   // author check inside setPrice: only the person who published the module prices it.
   router.post('/store/modules/:key/price', auth.requireBuilder, auth.requirePermission('module.submit'),
     asyncHandler('POST /store/modules/:key/price', async (req, res) => {
-      const AMOUNT = { type: 'integer', min: 0, max: 100000000 };
-      if (validateOrRespond(req, res, { cents: AMOUNT, credits: AMOUNT })) return;
+      const body = req.body || {};
+      // Refused before anything else, by name, so an older CLI that still sends
+      // credits is told why rather than seeing a generic validation error.
+      if (body.credits != null) {
+        return res.fail('credit_price_refused', { status: 400, message: 'Credits cannot price a module: they measure contribution and are never spent. Set a cash price in cents (0 makes it free).' });
+      }
+      if (validateOrRespond(req, res, { cents: { type: 'integer', min: 0, max: 100000000 } })) return;
       const { key } = req.params;
       if (!KEY_RE.test(key)) {
         return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
       }
-      const body = req.body || {};
       const cents = body.cents ?? null;
-      const credits = body.credits ?? null;
-      if (cents === null && credits === null) {
-        return res.fail('bad_price', { status: 400, message: 'Give a price in cents, credits or both. 0 in either makes the module free.' });
+      if (cents === null) {
+        return res.fail('bad_price', { status: 400, message: 'Give a price in cents. 0 makes the module free.' });
       }
-      const out = await setPrice({ key, cents, credits, builderId: req.builder.id });
+      const out = await setPrice({ key, cents, builderId: req.builder.id });
       if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
-      log.info({ key, builderId: req.builder.id, cents, credits }, `${key} price set`);
+      log.info({ key, builderId: req.builder.id, cents }, `${key} price set`);
       res.json({ ok: true, module_key: key, previous: out.previous, price: out.price });
     }));
 
@@ -772,9 +775,14 @@ module.exports = function buildModulesRouter() {
       let held = await checkEntitlement(holder);
       if (!held.entitled) {
         if (!r.free) {
+          // Never "pay with credits" (task 1004989): credits are never spent. A
+          // module still carrying only an old credit price has no cash price yet.
+          const coming = r.price && r.price.price_cents == null;
           return res.fail('payment_required', {
             status: 402,
-            message: `"${key}" is priced, and buying a module is not available yet (it arrives with the credit economy, area 8).`,
+            message: coming
+              ? `"${key}" has no cash price yet: its author has been asked to set one. Credits cannot buy a module.`
+              : `"${key}" is priced, and buying a module is not available yet.`,
           });
         }
         const g = await grantEntitlement({ ...holder, source: 'free', grantedBy: req.builder.id });
@@ -917,8 +925,7 @@ module.exports = function buildModulesRouter() {
   // `?sort=<part>` orders the listed modules by the part a buyer cares about
   // (task 1003800, sortByPart); the parts it accepts come back as sort_parts.
   // Without it the listed modules are ranked quality first, price breaking ties
-  // (task 1003808, rankListed); `?max_cents=` / `?max_credits=` leave out modules
-  // that cost more.
+  // (task 1003808, rankListed); `?max_cents=` leaves out modules that cost more.
   //
   // rank: any-builder — a read of public store metadata, like /store/modules/latest:
   // no entitlement taken, nothing changed.
@@ -930,16 +937,19 @@ module.exports = function buildModulesRouter() {
         const names = SORT_PARTS.map((p) => `${p.title} (${p.part})`).join(', ');
         return res.fail('bad_request', { status: 400, message: `The store can be sorted by one part of the score: ${names}.` });
       }
-      // An optional maximum price (task 1003808): ?max_cents= and/or ?max_credits=,
-      // each a whole number of at least 0. Free modules always pass.
+      // An optional maximum price (task 1003808): ?max_cents=, a whole number of at
+      // least 0. Free modules always pass. There is no credit cap (task 1004989):
+      // credits never price a module, so ?max_credits= is refused by name.
+      if (req.query && req.query.max_credits != null) {
+        return res.fail('bad_request', { status: 400, message: 'Credits do not price modules, so there is no maximum in credits. Use max_cents.' });
+      }
       const maxPrice = {};
-      for (const [param, field] of [['max_cents', 'cents'], ['max_credits', 'credits']]) {
-        const v = req.query && req.query[param];
-        if (v == null || v === '') continue;
+      const v = req.query && req.query.max_cents;
+      if (v != null && v !== '') {
         if (typeof v !== 'string' || !/^\d{1,9}$/.test(v)) {
-          return res.fail('bad_request', { status: 400, message: `${param} is a maximum price: a whole number, 0 or more.` });
+          return res.fail('bad_request', { status: 400, message: 'max_cents is a maximum price: a whole number, 0 or more.' });
         }
-        maxPrice[field] = Number(v);
+        maxPrice.cents = Number(v);
       }
       const listing = await listCatalog({ sort, maxPrice });
       res.set('Cache-Control', 'no-store');

package/src/bongos/serve-internal.js

@@ -1323,9 +1323,9 @@ function mountInternalSurfaces(app) {
   // Claude works for them. Every read behind it is the viewer's own and
   // requireBuilder (GET /me and its /me/* prefs, /specialities), so sign-in is the
   // whole gate; the governing reads it adds are gated by their own routes.
-  // task 1004921: `ai-studio`, the studio's AI pages; every route behind it is the viewer's own.
+  // tasks 1004921 `ai-studio` (the viewer's own routes), 1004938 `market-watch-settings` (no data; owner-only routes).
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|settings|atlas|modules|goals|goal-map|roadmap|copy-desk|studio|ai-studio|tweak-editor|ideas|thinking|collab|task|idea|primer(?:\.md)?|diagrams|my-agents|commands)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|settings|atlas|modules|goals|goal-map|roadmap|copy-desk|studio|ai-studio|tweak-editor|ideas|thinking|collab|task|idea|primer(?:\.md)?|diagrams|my-agents|market-watch-settings|commands)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.8'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.10'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hall_nav.mjs

@@ -318,7 +318,9 @@ test('sidebar groups read by audience, in order', () => {
   // the steering surfaces because that is what it is — the owner's third release gate.
   // 'fleet' (task 1001949) follows it at the metic floor of `provisioning.fleet.manage`:
   // what each hosted project costs is an operator surface, like the rest of this group.
-  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'gate', 'sessions', 'project-settings', 'deploy', 'fleet', 'government']);
+  // 'market-watch-settings' (task 1004938) is the owner's Market Watch switch and AI cap,
+  // archon like its four routes, and dropped where the market-watch module is off.
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'gate', 'sessions', 'project-settings', 'deploy', 'fleet', 'market-watch-settings', 'government']);
 });
 
 test('Economy lives in Docs and points at the reward-schedule page', () => {
@@ -750,7 +752,7 @@ test('no glyph path data reads as an IP address to the release leak scan', () =>
 // block (task 1004713). These drive the real shell and the real gov-positions.js.
 
 const tick = () => new Promise((resolve) => setImmediate(resolve));
-const GOVERNING = ['board-room', 'city', 'watch', 'gate', 'sessions', 'project-settings', 'deploy', 'fleet', 'government'];
+const GOVERNING = ['board-room', 'city', 'watch', 'gate', 'sessions', 'project-settings', 'deploy', 'fleet', 'market-watch-settings', 'government'];
 const lead = (building, title) => ({ kind: 'lead', seat: 'lead:' + building, building, title });
 const block = (held) => ({ held, title: held.length ? held[0].title : null, has_position: held.length > 0 });
 

package/tests/hall_page_gate_map.mjs

@@ -56,6 +56,10 @@ const ORACLE = {
   // settings. Every read behind it is the viewer's own (GET /me, /me/* prefs,
   // /specialities) and requireBuilder, so sign-in is the whole gate.
   '/builders/my-agents': 'requireBuilderPage',
+  // task 1004938: the owner's Market Watch settings. Its read and writes are
+  // owner-only (atom + owner seat) (tests/market_watch_settings.mjs proves the 403s), and the
+  // shell carries no data, so sign-in is the page tier and the routes are the wall.
+  '/builders/market-watch-settings': 'requireBuilderPage',
   '/builders/goals': 'requireBuilderPage',
   // task 1003479: the goal map, on the goal board's tier. task 1004232 (sky part 4):
   // the URL now serves THE PROJECT SKY (the same page as /thinking, in its whole-project

package/tests/market_watch_data_db.mjs

@@ -31,6 +31,8 @@ const MIGRATION_002 = readFileSync(new URL('../modules/market-watch/migrations/m
 const MIGRATION_003 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_003_ask_pool.sql', import.meta.url), 'utf8');
 const run = require('../modules/market-watch/run.js');
 const store = require('../modules/market-watch/store.js');
+const settings = require('../modules/market-watch/settings.js');
+const key = require('../modules/market-watch/key.js');
 
 const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
 try {
@@ -295,6 +297,31 @@ try {
     assert.equal(await store.openRun(pool, P), null);
   });
 
+  // task 1004938: the owner's settings writes, on the real table, read back by the run's
+  // own readers (store.readSettings, key.readProjectKey).
+  await check('the settings page writes what the run reads: switch, cap, cadence and the sealed key', async () => {
+    const box = { encrypt: (s) => `v1.iv.tag.${Buffer.from(s).toString('base64url')}`, decrypt: (b) => Buffer.from(b.split('.')[3], 'base64url').toString() };
+    await q(`DELETE FROM market_watch_settings WHERE project = $1`, [OTHER]);
+    // A first write of one field creates the row with the defaults for the rest.
+    assert.deepEqual(await settings.writeSettings(pool, OTHER, { cadence: 'monthly' }, ALICE), { enabled: false, monthly_cap_usd: 20, cadence: 'monthly' });
+    assert.deepEqual(await settings.writeSettings(pool, OTHER, { enabled: true, monthly_cap_usd: 35.5 }, ALICE), { enabled: true, monthly_cap_usd: 35.5, cadence: 'monthly' });
+    const st = store.createStore(pool);
+    assert.equal((await st.readSettings(OTHER)).enabled, true);
+    await settings.writeSettings(pool, OTHER, { enabled: false }, BOB);
+    assert.deepEqual(await st.readSettings(OTHER), { enabled: false, monthly_cap_usd: 35.5, cadence: 'monthly', configured: true });
+    assert.deepEqual(await settings.setKey(pool, OTHER, 'sk-ant-api03-db-test-key-LMNO', ALICE, { encrypt: box.encrypt }), { key_set: true });
+    assert.equal(await key.readProjectKey(pool, OTHER, { decrypt: box.decrypt }), 'sk-ant-api03-db-test-key-LMNO');
+    const view = await settings.readView(pool, OTHER, { ceilingUsd: 0.27, storageConfigured: true });
+    assert.equal(view.key_set, true);
+    assert.ok(!JSON.stringify(view).includes('LMNO'), 'the view never carries the key or its last four');
+    assert.deepEqual(await settings.clearKey(pool, OTHER, ALICE), { key_set: false, removed: true });
+    assert.deepEqual(await settings.clearKey(pool, OTHER, ALICE), { key_set: false, removed: false });
+    assert.equal(await key.readProjectKey(pool, OTHER, { decrypt: box.decrypt }), null);
+    // P's row was never touched by OTHER's writes.
+    assert.notEqual((await st.readSettings(P)).monthly_cap_usd, 35.5);
+    await q(`DELETE FROM market_watch_settings WHERE project = $1`, [OTHER]);
+  });
+
   await check('one open run per project, and the key must be a secret-box blob', async () => {
     await q(`INSERT INTO market_watch_runs (project, status, trigger) VALUES ($1, 'queued', 'manual')`, [OTHER]);
     await refused(`INSERT INTO market_watch_runs (project, status, trigger) VALUES ($1, 'running', 'poller')`, [OTHER], 'a second open run');

package/tests/market_watch_module.mjs

@@ -2,7 +2,7 @@
 // the loader, and an instance boots with it present and DISABLED (task 1004935, goal
 // 1000137). DB-free, so it runs in the unit lane.
 //
-// Task 1004940 mounted its first routes (the weekly ask); task 1004936 gave it its tables and a one-shot hub seed
+// Task 1004940 mounted its first routes (the weekly ask), task 1004938 the owner settings routes; task 1004936 gave it its tables and a one-shot hub seed
 // poller (tests/market_watch_data.mjs covers those). What this file
 // pins is everything the later Market Watch tasks will stand on:
 //   1. the manifest validates, ships default:false, and declares spend.requiresPayer;
@@ -40,6 +40,7 @@ test('the manifest validates, ships disabled, declares a payer, and contributes
   assert.equal(c.migrations, true);
   for (const p of ['hub-seed', 'weekly-run', 'weekly-ask']) assert.ok(c.pollers.includes(p), `poller ${p}`);
   assert.ok(c.routes.includes('ask'), 'the weekly ask routes');
+  assert.ok(c.routes.includes('settings'), 'the owner settings routes (task 1004938, tests/market_watch_settings.mjs)');
   assert.ok(c.uiSections.includes('weekly-ask'), 'the weekly ask hall slice (hallWidgetScripts needs a uiSection)');
   assert.ok(c.routes.includes('rules'), 'the rules page routes (task 1004941)');
 });
@@ -72,14 +73,17 @@ test('the spend guard bites it: an open door with no payer cannot enable it; a c
   assert.equal(mods.resolveModules({ instance: on, registry, spendGuard: { joinDoorOpen: false, payer: null }, warn: silent })[KEY], true);
 });
 
-test('it has a scope-roster key, and the creation picker does not offer it while it is empty', () => {
+test('it has a scope-roster key, and the creation picker offers it, off, now its switch exists', () => {
   assert.ok(Array.isArray(scopeMap.MODULE_GLOBS[KEY]) && scopeMap.MODULE_GLOBS[KEY].includes('modules/market-watch/'));
   // Every entry is an exact path or a dir prefix (the touches[] convention has no
   // wildcards), and this test's own path resolves to the module's scope.
   for (const g of scopeMap.MODULE_GLOBS[KEY]) assert.ok(!g.includes('*'), `wildcard glob never matches: ${g}`);
   assert.ok(scopeMap.MODULE_GLOBS[KEY].includes('tests/market_watch_module.mjs'));
-  assert.ok(bundles.HUB_ONLY_MODULES.includes(KEY));
-  assert.ok(!bundles.OPTIONAL_MODULES.some((m) => m.key === KEY));
+  // Task 1004938 shipped the owner's switch (routes/settings.js), so it left the hub-only
+  // list for the opt-in catalog, with owner-facing copy. Opt-in, never always-on.
+  assert.ok(!bundles.HUB_ONLY_MODULES.includes(KEY));
+  const offered = bundles.OPTIONAL_MODULES.find((m) => m.key === KEY);
+  assert.ok(offered && offered.label && offered.summary, 'offered with copy an owner can read');
   assert.ok(!bundles.ALWAYS_ON_CORE.includes(KEY));
 });