@bongos/core 1.19.1028 → 1.19.1029

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1028",
-  "core_contract": "1.19.1028",
-  "source_commit": "56463d9a30a9ee0f32df461962daa7af33212ae5",
+  "core_version": "1.19.1029",
+  "core_contract": "1.19.1029",
+  "source_commit": "9061b1b634a11e0d3737336b0d59fe110d2a7a17",
   "source_ref": "HEAD",
-  "built_at": "2026-09-25T20:58:56.481Z",
+  "built_at": "2026-09-25T21:07:08.900Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 529,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3014,
-  "tree_sha256": "3ca110c17a46fb54f2debd7630fb29f210243604a8c10d3e7cef945f794019eb",
+  "tree_sha256": "1305b1deb2512746e9b12451812ed65ff0e0364e416b1cbdc3ffacb9d12b8851",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2757,7 +2757,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0857762db09c3257ba652f6ddc7210e09cda9663c470b79f81441090e2d64f7f"
+      "sha256": "bc6a32426c475f26a5257ae634f5cf8c9c0863c53edd9b8981c411323b2f21e4"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5882,7 +5882,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "a36a23b4f67dc43848bc0798e7b9724aee1290799dc8fa1b22e5260268bf5c70"
+      "sha256": "e15bf5a3f2ec8ede9b5a8c90c3e00c472c229f351b809333beebfeb90dad2bcc"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -6192,7 +6192,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "654addc8813a815d862da35677bb823a5d98a3685d03653fdbcb58a64aca38f4"
+      "sha256": "520b63212462c762fdf23e40ffdb084c22f786616d3a5694b4dc182e334eeaa7"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -8362,12 +8362,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8a41416b983d8c2f82e4cdb0c64856dd5a304ca8414a723f648ea9b072a8f076"
+      "sha256": "8608f78a458012a57ffc19e813402909f783c77bcc50f3d45780e4f8b2e3f759"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c5a4583b1eb2bd9fafb13ecb68661a6e1f81fbbbcf4444155864af2782a0232d"
+      "sha256": "32e6fc0b4953d6f15b41649ea9df77918f37ac8a8ed7168ce17d9040d04bf5c6"
     },
     {
       "path": "public-docs/index.html",
@@ -10412,7 +10412,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "af6c6577a4ca4d909583bebf81192b552bc96b47dc43f387e0468fb7bdf306bd"
+      "sha256": "9763f23d6375a13a9ce55193be5689f74c04cd9170079735bca1956524f007c7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11982,7 +11982,7 @@
     {
       "path": "tests/goal_member_kinds.mjs",
       "mode": "0000644",
-      "sha256": "3bb40fceeeeaa835db715b724ac73475be2a9ae166c740e9daa78eafc6957b03"
+      "sha256": "5ae48afae42839d5b8ea6002b5d9c892d027be87eda2e60bded481437a3306a6"
     },
     {
       "path": "tests/goal_membership_requests.mjs",

package/docs/module-api-changelog.md

@@ -2535,5 +2535,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1026 with no explicit bump. run 36187742785. (task 1002620)
   1.19.1028 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1027 with no explicit bump. run 36188894725. (task 1002620)
+  1.19.1029 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1028 with no explicit bump. run 36189693139. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-goals.js

@@ -942,8 +942,14 @@ async function setGoalMembershipKind({ goalId, builderId, membershipKind }, deps
 // "drops to manager" — exactly the handoff semantics the route promises. The
 // route gates WHO may call this (owner | Archon, target Metic+); this helper
 // just performs the move. Returns the updated goal row, or null for unknown id.
+//
+// The new owner arriving as 'lead' is a membership arrival like any other, so it
+// also closes that builder's still-pending ask/invite on this goal (task
+// 1003661, the third path after addGoalMember — see its comment for why
+// 'cancelled'). Same statement, so the cancel commits with the transfer or not
+// at all; resolvedBy is the ACTOR handing the goal over.
 
-async function transferGoalOwnership({ goalId, newOwnerId }, deps = {}) {
+async function transferGoalOwnership({ goalId, newOwnerId, resolvedBy = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
     `WITH g AS (
@@ -955,9 +961,15 @@ async function transferGoalOwnership({ goalId, newOwnerId }, deps = {}) {
        INSERT INTO goal_members (goal_id, builder_id, membership_kind)
        SELECT g.id, $2, 'lead' FROM g
        ON CONFLICT (goal_id, builder_id) DO UPDATE SET membership_kind = 'lead'
+     ), cancelled AS (
+       UPDATE goal_membership_requests
+          SET status = 'cancelled', resolved_by = $3, resolved_at = now(), updated_at = now()
+        WHERE goal_id = $1 AND builder_id = $2 AND status = 'pending'
+          AND EXISTS (SELECT 1 FROM g)
+       RETURNING id
      )
      SELECT * FROM g`,
-    [goalId, newOwnerId]
+    [goalId, newOwnerId, resolvedBy]
   );
   return rows[0] ?? null;
 }

package/modules/lifecycle/routes/goals.js

@@ -899,7 +899,7 @@ module.exports = function buildGoalsRouter() {
       if (decision.noop) {
         return res.json({ ok: true, goal, changed: false });
       }
-      const updated = await db.transferGoalOwnership({ goalId: id, newOwnerId });
+      const updated = await db.transferGoalOwnership({ goalId: id, newOwnerId, resolvedBy: req.builder.id });
       if (!updated) {
         return res.fail('transfer_conflict', { status: 409, message: 'The goal changed underneath this request — re-read it and retry.' });
       }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1028",
+  "version": "1.19.1029",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1028",
+      "version": "1.19.1029",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1028",
+  "version": "1.19.1029",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1028'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1029'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_member_kinds.mjs

@@ -400,7 +400,7 @@ await test('transferGoalOwnership: created_by moves and the new owner upserts to
   const out = await transferGoalOwnership({ goalId: 7, newOwnerId: 5 }, { pool });
   assert.deepEqual(out, GOAL_ROW);
   const upd = find(pool.queries, /UPDATE goals SET created_by = \$2/);
-  assert.deepEqual(upd.params, [7, 5]);
+  assert.deepEqual(upd.params, [7, 5, null], 'resolvedBy defaults to null for a non-route caller');
   const sql = String(upd.sql).replace(/\s+/g, ' ');
   assert.match(sql, /INSERT INTO goal_members \(goal_id, builder_id, membership_kind\)/,
     'the new owner\'s membership rides in the same statement');
@@ -409,6 +409,29 @@ await test('transferGoalOwnership: created_by moves and the new owner upserts to
   assert.match(sql, /updated_at = now\(\)/);
 });
 
+// task 1003661 — the third arrival path (after join / direct-add, task 1002888):
+// handing a goal to a builder who still has a pending ask outstanding on it must
+// close that ask in the SAME statement, or the stale row lingers in the inbox.
+await test('transferGoalOwnership: cancels the new owner\'s pending ask in the same statement, attributed to the actor', async () => {
+  const pool = fakePool((s) => (/UPDATE goals SET created_by = \$2/.test(s) ? { rows: [GOAL_ROW] } : null));
+  await transferGoalOwnership({ goalId: 7, newOwnerId: 5, resolvedBy: 99 }, { pool });
+  assert.equal(pool.queries.length, 1, 'ONE statement — the cancel commits with the transfer or not at all');
+  const upd = find(pool.queries, /UPDATE goals SET created_by = \$2/);
+  assert.deepEqual(upd.params, [7, 5, 99], 'goal, new owner, actor');
+  const sql = String(upd.sql).replace(/\s+/g, ' ');
+  assert.match(sql, /UPDATE goal_membership_requests SET status = 'cancelled', resolved_by = \$3/);
+  assert.match(sql, /WHERE goal_id = \$1 AND builder_id = \$2 AND status = 'pending'/,
+    'scoped to this goal + new owner, pending rows only');
+  assert.doesNotMatch(sql, /status = 'accepted'/);
+  assert.match(sql, /AND EXISTS \(SELECT 1 FROM g\)/, 'an unknown goal (no g row) must cancel nothing');
+});
+
+await test('routes: POST /goals/:id/transfer passes resolvedBy to transferGoalOwnership', async () => {
+  const { readFileSync } = await import('node:fs');
+  const src = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
+  assert.match(src, /db\.transferGoalOwnership\(\{[^}]*resolvedBy:\s*req\.builder\.id/);
+});
+
 await test('transferGoalOwnership: unknown goal → null', async () => {
   const pool = fakePool(() => ({ rows: [] }));
   assert.equal(await transferGoalOwnership({ goalId: 999, newOwnerId: 5 }, { pool }), null);