@bongos/core 1.19.1048 → 1.19.1049

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1048",
-  "core_contract": "1.19.1048",
-  "source_commit": "64aa3088cc068647e5de41e2f87ab9fc416debb7",
+  "core_version": "1.19.1049",
+  "core_contract": "1.19.1049",
+  "source_commit": "9d25b951a2f85a4303027917ebf5c95d02cac06e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-27T01:33:19.203Z",
+  "built_at": "2026-09-27T13:43:34.143Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 543,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3083,
-  "tree_sha256": "6f357e234dc4c052c43532cc7d280e9a51fa2731009c99e74eda18ec0ef06164",
+  "tree_sha256": "a84ed2035d842841f5e0b994df4754f714dc15c3ff0f080cef771d939cd37e7b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "425c39cac8e66f234ff1558841f45fa8d33eaad6311b5ee3c0f6ebaa7e9dc7fe"
+      "sha256": "113ce655a21853395a81cfdcf467e9de8e1e8b46e5dfe15b1dd5f4d9401e0193"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3027,7 +3027,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "f8800c2b308a057b851b868eae07e6d2268b68e342de146dd341b677e64b46c8"
+      "sha256": "169e4aedf245478230027ad6a202aa7dd2ce35f019d489d2ea4c0735647d0fe6"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -8497,12 +8497,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f8821b1b474225bcb1658d4ccee4aca9c9439f6757ee8624f36643af567d39e0"
+      "sha256": "acb5560af98adc58a474b3aa9fd2280a803c10e58538fb31f4c7cbd6be8518e2"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5fa9fe3e161288c87dacff6bc04ef6a4f9c1e7c0f0f5b8684ec2c887dd289484"
+      "sha256": "dd99e950d328fee80b5a502201e1a2193d15590a5fe489645beca54695f9a774"
     },
     {
       "path": "public-docs/index.html",
@@ -8522,7 +8522,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "4b8836320c211dcd59f9f978755c247998fbc3bbbfc78d4aaa073a3051f367f0"
+      "sha256": "e0a7dbc41f8706f31363a5ef24aed64d4176f23edb66c72e99911a58beee7835"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10592,7 +10592,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "097ef7d2d748ad98273257de5771d10d2ffa523e558ff8b3de6b039aeecfab1f"
+      "sha256": "2be8a6906c0dd4d9d3e4af313c25e885abdeafe0f917399d1775c3692ce64c8f"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -2583,5 +2583,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1046 with no explicit bump. run 36280220559. (task 1002620)
   1.19.1048 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1047 with no explicit bump. run 36285856717. (task 1002620)
+  1.19.1049 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1048 with no explicit bump. run 36323359891. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/upgrading-the-core.md

@@ -142,6 +142,26 @@ sudo systemctl daemon-reload && sudo systemctl restart <instance>-core-update-su
 systemctl list-timers '*core-update-subscription*' --no-pager   # confirm the next elapse is minutes away
 ```
 
+Three things to know before you run that restart (task 1003969, learned on
+cloudbongos.com 2026-09-26):
+
+- **The instance's installed core must be 1.19.1047 or later.** The sweep runs
+  `go-live.js` from the instance's OWN installed core, not from the checkout the
+  unit starts in. Before 1.19.1047 go-live wrote a full `pg_dump` *before*
+  `bongos upgrade` could refuse, and never pruned, so a deploy held by the artist
+  gate cost one dump per attempt: 65 MB every 15 minutes, a full disk in about
+  three days. From 1.19.1047 a refused move costs one `--dry-run` and nothing else,
+  and pre-upgrade dumps are capped at the newest ten (task 1004306).
+- **Restarting a `Persistent=true` timer fires a catch-up run at once.** If a newer
+  version is published, the `restart` above starts a real upgrade within seconds,
+  restart of the site included. Run it when an upgrade is welcome.
+- **A failing upgrade is retried every run.** Each attempt restarts the service
+  twice (the bump, then the auto-rollback), so at 15 minutes a version that keeps
+  failing means a brief blip four times an hour until it is fixed or the channel is
+  pinned. The one-day hold on a failed version (task 1004297) is the fix; until
+  every sweep carries it, look at the core_upgrades rows for `rolled_back:` notes
+  during the first day.
+
 **Do not go below ~5 minutes.** An upgrading run takes ~2 minutes; at a tighter
 spacing runs overlap. A run with nothing to take costs one `npm view` and exits,
 so 15 minutes is cheap — the cost scales with releases, not with checks.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1048",
+  "version": "1.19.1049",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1048",
+      "version": "1.19.1049",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1048",
+  "version": "1.19.1049",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7589,5 +7589,11 @@
       "id": "1003883",
       "text": "Public read endpoints are now rate-limited by default, so a newly added endpoint can no longer go live unprotected; existing protected endpoints keep their own limits."
     }
+  ],
+  "1.19.1049": [
+    {
+      "id": "1003969",
+      "text": "cloudbongos.com now checks for a new version every 15 minutes instead of once a day, so merged work goes live within about a quarter of an hour."
+    }
   ]
 }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1048'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1049'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');