Build the Elekloader catalogue from per-module records - #614

Second of two PRs, stacked on #611. After both, two Digitakt/Digitone module PRs no longer edit any of the same files, so merging one leaves the other green and mergeable.

The problem

Every Digi module PR also edited:

• vendor/elekloader/catalog/catalog.json: it appended the module's pins and changed the whole-catalogue revision;
• vendor/elekloader/elekloader.lock.json: the catalogue hash and the mod count.

The second of any two PRs therefore always conflicted.

What changes

• vendor/elekloader/upstream-catalog.json (new, committed) holds elekloader's upstream cores and mods (5 cores, 21 mods). The lock now pins this file alone. It was written and verified by the kit's own lock and verify --lock, and its kit section is unchanged.
• Module records: Modwerk-built pins already live in each module's import record, sdk/imports/elekloader-*.json. All 17 such pins in the old catalog.json matched their record exactly.
• catalog/catalog.json is now the upstream catalogue plus every record. prepare generates it (npm ci, npm run check, npm run dev), it is never committed, and the builder, scripts and tests keep reading the same path.
  • It holds the same 43 pins as before. Only their order changes (records are added in file-name order), so the catalogue revision changes once, 1041766 → fead123. As before, older configuration backups still import, with their modules checked again.
• elekloader:check verifies the kit and upstream catalogue against the lock, that catalog.json equals upstream plus records, and every pinned file.
• npm run elekloader:update:
  • writes the upstream part, keeps record pins in their records, and locks the upstream part alone;
  • verifies the full served folder;
  • --overlay now names a record in sdk/imports/;
  • --library keeps the record packages and anything they require.
• Author-release check (please review):
  • The privileged job assembles the served catalogue at the base and the head from Git objects, still without running PR code, and the same authorizeVendor rules apply: other modules, cores, OS targets and licences frozen; exact source-commit pins; every approved OS package updated; stock target, author and licence kept.
  • New: an author may change only a record that holds nothing but their own pins, before and after. A lock change always needs owner review.
• Licence notices: the digi-mods notices now say the upstream pins are in upstream-catalog.json, and the distribution notices were regenerated. No licence or credit changed.
• Docs: vendor/elekloader/README.md, ADD_A_MODULE, MODULE_AUTHOR_UPDATES and DECISIONS. VERIFICATION.md is left as its historical log.

Tested

• npm run check -- --base origin/main passed: 284 test files, 2,329 tests, plus lint, typecheck, bundle and sdk checks.
• Two parallel module PRs, real data. Starting from this commit:
  1. I removed CC Names and Note Accumulator, every file of each module. That base passes the checks.
  2. I added each back on its own branch, as two author PRs would.
  3. I merged both. Git reported no conflicts, the result is identical to this commit, and elekloader:check, the changelog check and the module-list check pass.
• New tests:
  • At the Git level: an author's package update with their own record passes. Changing another module's record, or a malformed record, goes to owner review.
  • At the unit level: another module's record, a record with a core, the lock and the upstream catalogue all go to owner review.
• Update-tool CLI tests: all 11 pass, including rollback of the new upstream file.

Not tested

• A live elekloader:update against a real elekloader release or a GitHub download. The CLI tests use a local kit zip and already-present packages.
• A firmware build in the browser with the reordered catalogue. The builder plans by pin, not by order, and the planning tests pass.

Merge order

Merge #611 first, then retarget this PR to main. Open module PRs written for the old layout (#577 and the Octatrack ones in #611's list) need a one-time move. Their Elekloader pins already sit in their records, so the move is:

1. drop their catalog.json and lock edits;
2. take main's lock;
3. run npm run prepare.

🤖 Generated with Claude Code