@bongos/core 1.19.149 → 1.19.151

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.149",
-  "core_contract": "1.19.149",
-  "source_commit": "38bb790f0c03376979720a73d20e7a966749e06c",
+  "core_version": "1.19.151",
+  "core_contract": "1.19.151",
+  "source_commit": "6ffcec970cdf3d4340b66e42edb33a49257fd4c5",
   "source_ref": "HEAD",
-  "built_at": "2026-08-16T14:37:21.742Z",
+  "built_at": "2026-08-16T14:50:02.406Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 304,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1579,
-  "tree_sha256": "4d4238a80aa501af9cdf8257ebb99f5f51c806b2f9a87c9b02adcb878cda1af0",
+  "tree_sha256": "0b11b762ff3c5e42925fc4aa0d743f3bd3f3b77e4340e4d00013c3cefe401540",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1177,7 +1177,7 @@
     {
       "path": "docs/adr/0144-devbox-rehome-onto-cloudbongos-plane.md",
       "mode": "0000644",
-      "sha256": "e4ddc6e640919691a6f6143493158ee080bb6e9edb9e6bf0b8cc24832fb9c3b2"
+      "sha256": "6f3312ff0cdfdb824626375ca4e3e517e21f5f0f7087f579feee40e836bb3cc1"
     },
     {
       "path": "docs/adr/0144-federated-single-logout-backchannel.md",
@@ -1352,7 +1352,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "3967a6a48afbbd5e71d486f4f518f768fc3e3000ccd75ee310406a93977a3489"
+      "sha256": "49747f42b1229ee8a2ecc54c317fc7173a91a4340ddfe2033e1a78b0f6ed1482"
     },
     {
       "path": "docs/branding-contract.md",
@@ -3162,7 +3162,7 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "fcfe94b3e0cd00ddc881283d9897121518a7acc00b3d05b0715552911e2a0705"
+      "sha256": "f24cfdca48676d882cfa51754fcf1519ade4646a760cb2be1db71fbc27571bca"
     },
     {
       "path": "modules/hall-ui/public/goals.css",
@@ -3197,7 +3197,7 @@
     {
       "path": "modules/hall-ui/public/hall-kit.js",
       "mode": "0000644",
-      "sha256": "672ef980513a150a81773ad674750e7d1560535dd08cbf2e1463155fbe00d7f6"
+      "sha256": "4d5ec8f334fc00f23e81fe21283b7ea2fb173b253c638a08ef48b97111cc654f"
     },
     {
       "path": "modules/hall-ui/public/hall-widgets.js",
@@ -3407,7 +3407,7 @@
     {
       "path": "modules/hall-ui/public/task.js",
       "mode": "0000644",
-      "sha256": "2430a3b351d80ae55724c1bfd1c514855e9a5c04ceaa1012e4475d2dc09b9d84"
+      "sha256": "ac6bfa459924a43005625e9c2655a5a1397c941dfa0727594bb25f930180d36a"
     },
     {
       "path": "modules/hall-ui/public/watch.css",
@@ -3427,7 +3427,7 @@
     {
       "path": "modules/hall-ui/public/work.css",
       "mode": "0000644",
-      "sha256": "8ad8c570a2196aabb46c86e8efcfab2b0d22451b4f23aa10a02b4f52d1415690"
+      "sha256": "e5dd2fd84b31174d10bb6558920cbbc9e34b1776d775db3c69518810a1c7b96c"
     },
     {
       "path": "modules/hall-ui/public/work.html",
@@ -3437,7 +3437,7 @@
     {
       "path": "modules/hall-ui/public/work.js",
       "mode": "0000644",
-      "sha256": "eb7e5919af8d60c5ae6f68e05a5d97e4b7ca97fa17941b79086eec39c9af7faf"
+      "sha256": "8ee189def6ded1c8669212d7233f57948ac58bf23ad8277422996ffd8914e537"
     },
     {
       "path": "modules/ideas/CLAUDE.md",
@@ -4187,12 +4187,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4683e76f97deb0d808cc94b82abc8bba5b4332646d073cbb95155a305dce7bac"
+      "sha256": "739468093ef4eab580a28b005fd816fadee7f7cf1facf9db6f9f5cf9cc352b36"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0ba329b9178e83c2d379bc65d0defde57428ae8b317a4c9ad0d900c872eb1d64"
+      "sha256": "6f3fd6f5b9780d2e612b95a4d1ba8cba840b1d5c79be73aaa034d435a8da344b"
     },
     {
       "path": "public-docs/index.html",
@@ -4622,7 +4622,7 @@
     {
       "path": "scripts/gds/box.js",
       "mode": "0000644",
-      "sha256": "117b0ed6730e35559356403b50240d0ef5b6ab46752a8cf76de4e0a8ad244d42"
+      "sha256": "c8a79e6541a2e26e590bd8ee1bbf31cb0f7300c53dbd30c241f4c1f04a2af7bf"
     },
     {
       "path": "scripts/gds/build-bongos.js",
@@ -5782,7 +5782,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f551b1a40bb56bfbdef3ad3f40cbbae092c6ac42ac0683c43db63d033aa0a1bb"
+      "sha256": "ac7dd33de47d132bc68dca844d0d7f0992a5fa14249516e84c32c21960b14ba6"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/adr/0144-devbox-rehome-onto-cloudbongos-plane.md

@@ -39,3 +39,6 @@ Stand up a **cloudbongos-native box plane** alongside (not replacing) the legacy
 2. **Cloudflare token scope.** Provision warned the ADR 0053 cookie-strip Transform Rule was **not** applied — `CLOUDFLARE_API_TOKEN` lacks "Transform Rules" edit scope on the cloudbongos.com zone. Add the scope (or apply the rule once in the dashboard) **before** other builders get boxes on `*.cloudbongos.com`, so platform cookies (`cookieDomain=<redacted> aren't sent to box subdomains.
 3. **Cosmetic `otb-` prefix.** Tunnel names (`otb-term-<login>`) and the droplet name (`otb-box-<login>`) are still hardcoded in `box-onboard.js`/`box.js`. Harmless (fleet separation is by tag, and DNS is per-zone), but a branding leak worth parameterizing.
 4. **Phase 4 — retire the legacy example plane** (owner decision) — **part (a) DONE in task 1002248 (2026-07-15).** Pre-checked read-only that the legacy fleet was empty (0 `otb-builder-box` droplets on DigitalOcean; cohost intent queue `ran=0`), then `systemctl disable --now` on the four `cohost-box-*` timers (intent-runner / idle-suspend / drift-reconcile / dormant-reclaim) on the control-plane host — now `disabled`/`inactive`; the native `cloudbongos-box-*` timers were left `enabled`/`active`. **Part (b) — disabling the dev-box module on example.com itself — NOT reachable from the control plane, flagged to owner:** example's web app + instance checkout are not co-located on the cloudbongos droplet (no local checkout, no ssh alias) and the local example GDS token is expired, so a durable module-disable needs owner access to example's own config/host. Harmless meanwhile: with the runners stopped there is no cost/security impact — worst case is a box request on the legacy instance that now hangs unfulfilled.
+5. **The control plane silently froze on core 1.19.2 — FIXED (task 1002738, 2026-08-16).** The four `cloudbongos-box-*` units were installed with `WorkingDirectory=/home/lars/cloudbongos` (§2 above), and `infra/core-node.sh` resolves the core from *that* root's `node_modules/@bongos/core` — pinned to the vendored `bongos-core-1.19.2.tgz`. The web app meanwhile moved to the npm registry pin and rode the nightly patch sweep to **1.19.146**. The two never converged, because `config/update-subscriptions.json` lists exactly ONE instance (`/home/lars/cloudbongos-instance`) and the box root was never added. Net effect: **every park/destroy/provision decision on this fleet was made by a core ~145 patches old**, so the whole point of tasks 1002726/1002727 — an idle box *parks* instead of being destroyed — was landed in `main`, released, deployed to the web app, and still **never executed**: `cmdSweepIdle` in 1.19.2 calls `deprovisionOne`. Nothing surfaced it; a shipped, released, deployed fix was simply inert.
+   **Fix.** A systemd drop-in on each of the four units re-points `WorkingDirectory` at `/home/lars/cloudbongos-instance` — the subscribed root the nightly sweep keeps current — and runs `node node_modules/@bongos/core/scripts/gds/box.js <cmd> --apply` directly. Same shape as the drop-ins already applied to `{selfhost,cohost}-provision-intent-runner`. The box lifecycle now inherits every core release with no second upgrade path to remember. The stale root is NOT retired: it still vendors `infra/` (the cloud-init + bring-up scripts the core package does not ship — follow-up 1 / ADR 0150), supplied to the units via `CLOUDBONGOS_BOX_INFRA_DIR=/home/lars/cloudbongos/infra`, the documented escape hatch that is candidate [#1](http://localhost:3000/builders#/task/1) in `boxInfraCandidates()`. Verified: all four commands dry-ran **identically** on old and new core before cutover (0 idle, 0 intents, DO⇄DB consistent, 0 dormant), then ran live under the drop-ins; the dormant sweep's new `warn >11d` window in the journal is the 1002727 code proving itself present.
+   **Why it stayed invisible, and the guard.** The sweep banner printed the *threshold* but never the *code*, so a stale plane looked identical to a current one in `journalctl`; diagnosing it needed a filesystem dig across two instance roots. `box.js` now prints one provenance line on every invocation — `box.js · running from @bongos/core@<version> · instance <root>` — naming the package it actually resolved. A frozen plane now announces itself in its own logs.

package/docs/architecture.md

@@ -11,7 +11,7 @@
 
 - **Domain:** `example.com` — registered at Cloudflare Registrar. DNS A records (apex + `www`) point to the droplet at `REDACTED_IP`. Cloudflare proxy is **ON (orange cloud)**. CF terminates TLS at the edge; the **Cloudflare Origin Certificate** handles the CF↔origin leg (valid through 2041-05-04). A `status` subdomain is added at PMS-V1 deploy time (see [`docs/pms-v1-deploy.md`](pms-v1-deploy.md)) with the same proxy/cert posture; Origin Cert needs `*.example.com` SAN. Real client IPs come in via `CF-Connecting-IP` / `X-Forwarded-For`, wired into Caddy's `trusted_proxies static` (the Cloudflare IP ranges) in the `infra/Caddyfile` global options block.
 - **Production droplet (co-hosting box):** DigitalOcean, hostname `example`, IPv4 `REDACTED_IP`, IPv6 `REDACTED_IP`. NYC3, Premium Intel 2 GB / 1 vCPU / 60 GB NVMe. Ubuntu 24.04 LTS. ~$14/mo. Hosts the OTB game + co-hosted project instances (`emersonian-circles.`, `staging.`).
-- **Cloud Bongos control-plane droplet (NEW 2026-07-05, [ADR 0126](adr/<redacted>.md), task [#2063](https://example.com/builders#/task/2063)):** DigitalOcean, hostname `cloudbongos`, IPv4 `REDACTED_IP`, NYC3, `s-1vcpu-2gb` (2 GB / 1 vCPU), Ubuntu 24.04, ~$12/mo, tag `cloudbongos-control`. Runs **cloudbongos.com + `builders.` + `status.`** (`src/platform-server.js`, Cloud Bongos brand, port 3002, own `cloudbongos` DB, checkout `/home/lars/cloudbongos`) and is the **sole token-holding control plane** — `/etc/cloudbongos/box.env` holds the account-wide Cloudflare token (IP-locked to this box) + the DigitalOcean token; this is where `provision.js` provisions instance subdomains. **Structurally separate SSH** (own `cloudbongos_ed25519` key). IPv6 egress disabled so the IPv4-locked CF token can't be spuriously rejected. cloudbongos.com was previously a co-tenant on the co-hosting box; that unit was decommissioned at cutover. **Follow-ups:** deploy automation (task [#2064](https://example.com/builders#/task/2064)) + fully stripping cloud tokens off the co-hosting box (task [#2065](https://example.com/builders#/task/2065)).
+- **Cloud Bongos control-plane droplet (NEW 2026-07-05, [ADR 0126](adr/<redacted>.md), task [#2063](https://example.com/builders#/task/2063)):** DigitalOcean, hostname `cloudbongos`, IPv4 `REDACTED_IP`, NYC3, `s-1vcpu-2gb` (2 GB / 1 vCPU), Ubuntu 24.04, ~$12/mo, tag `cloudbongos-control`. Runs **cloudbongos.com + `builders.` + `status.`** (`src/platform-server.js`, Cloud Bongos brand, port 3002, own `cloudbongos` DB, checkout `/home/lars/cloudbongos-instance`, the root subscribed to the nightly core-patch sweep) and is the **sole token-holding control plane** — a SECOND root, `/home/lars/cloudbongos`, survives only to vendor `infra/` (the box cloud-init the core package does not ship, ADR 0150); it is not subscribed, so nothing may resolve core code from it (task 1002738, [ADR 0144](adr/<redacted>.md) follow-up 5) — `/etc/cloudbongos/box.env` holds the account-wide Cloudflare token (IP-locked to this box) + the DigitalOcean token; this is where `provision.js` provisions instance subdomains. **Structurally separate SSH** (own `cloudbongos_ed25519` key). IPv6 egress disabled so the IPv4-locked CF token can't be spuriously rejected. cloudbongos.com was previously a co-tenant on the co-hosting box; that unit was decommissioned at cutover. **Follow-ups:** deploy automation (task [#2064](https://example.com/builders#/task/2064)) + fully stripping cloud tokens off the co-hosting box (task [#2065](https://example.com/builders#/task/2065)).
 - **Server stack:** Node.js 22 LTS · PostgreSQL 16 · Caddy 2.11.2. `example.service` (systemd) runs `node server.js` as user `lars` on `127.0.0.1:3000`; restart-on-failure.
 - **Hardening:** `lars` user with passwordless sudo; SSH key-only (root login disabled, password auth disabled); ufw allows 22/80/443; fail2ban active; unattended-upgrades enabled; timezone `America/New_York`.
 - **TLS:** Origin cert at `/etc/caddy/origin.crt` + `/etc/caddy/origin.key` for the example apexes on the co-hosting box. **cloudbongos.com's apexes moved to the dedicated control-plane droplet** ([ADR 0126](adr/<redacted>.md)) with their own copy of the Cloudflare Origin Cert (SAN `*.cloudbongos.com, cloudbongos.com`) at `/etc/caddy/cloudbongos-origin.{crt,key}` on `REDACTED_IP`. Cloudflare SSL/TLS mode = Full (strict). Renewal is a non-issue for ~15 years. **Provisioned instance hosts use a different, coexisting posture** ([ADR 0111](adr/<redacted>.md) §4 / task P4): Caddy **on-demand ACME** (Let's Encrypt) via the global `on_demand_tls { ask … }` block, gated to hostnames the `provisioning` module actually stood up (`/api/bongos/provisioning/tls-check`). Their DNS records are **proxied=false (grey cloud)** so the ACME challenge reaches Caddy — the opposite of the origin-cert apexes; do not enable the proxy on them or renewal breaks silently ([ADR 0003](adr/<redacted>.md)). Per-instance site snippets live in `/etc/caddy/sites/*.caddy` (`import`ed by `infra/Caddyfile`). **Tradeoff (accepted, SEC review of task 1945):** `proxied=false` publishes the box's real origin IP in public DNS for every co-tenant provisioned hostname — defeating, for those names, the Cloudflare-proxy IP-hiding the apexes enjoy (a co-tenant host resolves to the same `REDACTED_IP` that serves the main game). This is inherent to on-demand ACME (the challenge must hit the origin) and acceptable under the budget/trust model; prefer a **dedicated droplet** (its own IP) for any instance expected to draw hostile attention.

package/modules/hall-ui/public/goals-page.js

@@ -529,6 +529,9 @@
     const touchesChip = touches.length
       ? `<span class="task__touches" title="${escapeHtml(touches.join('\n'))}">✎ ${touches.length} file${touches.length === 1 ? '' : 's'}</span>`
       : '';
+    // task 1002955: same age chip the board renders — reviewing a goal for stale
+    // work is the case that needed it most.
+    const ageChip = window.OTBKit.ageChipHtml(t.created_at);
     const claim = state.claimsByTask.get(id);
     const isReady = t.status === 'ready' && !!state.me;
     const mineActive = t.status === 'active' && claim && sameId(claim.builder_id, selfId());
@@ -569,6 +572,7 @@
             <span>${minutesText}</span>
             <span>${cpmText}</span>
             ${touchesChip}
+            ${ageChip}
           </div>
         </div>
         <div class="task__credits">

package/modules/hall-ui/public/hall-kit.js

@@ -417,6 +417,66 @@
     };
   }
 
+  // ---- age (task 1002955) ------------------------------------------------------
+  // How old is this row? The board, the goal Work card and the task panel all
+  // render a task's kind/estimate/credits but never said when it was written, so
+  // a queue of 40 ready tasks read as equally fresh whether it was filed
+  // yesterday or three months ago. Kit-level because the card markup is
+  // duplicated across work.js + goals-page.js (task 1002463) and a third
+  // hand-rolled date helper is exactly what this file exists to prevent.
+
+  // Coarse buckets on purpose: past a week nobody cares about the hour, and the
+  // exact day is one hover away (ageChipHtml puts it on title=). Anything in the
+  // future — a clock skew, a seeded row — clamps to "new" rather than "-3d".
+  const AGE_STALE_DAYS = 30;
+  function fmtAge(iso) {
+    if (!iso) return '';
+    const ms = Date.now() - new Date(iso).getTime();
+    if (!Number.isFinite(ms)) return '';
+    const days = Math.floor(ms / 86400000);
+    if (days < 0) return 'new';
+    if (days === 0) return 'today';
+    if (days === 1) return '1d';
+    if (days < 14) return `${days}d`;
+    if (days < 60) return `${Math.floor(days / 7)}w`;
+    // Clamped at 11: 30-day months overshoot, so days 330-364 would otherwise
+    // print "12mo" immediately before the year bucket takes over at 365.
+    if (days < 365) return `${Math.min(11, Math.floor(days / 30))}mo`;
+    const years = Math.floor(days / 365);
+    const rem = Math.floor((days % 365) / 30);
+    return rem ? `${years}y ${rem}mo` : `${years}y`;
+  }
+
+  // Absolute date for the tooltip — locale-formatted, no time (the age chip is
+  // about which week something was filed, not which minute).
+  function fmtAbsDate(iso) {
+    if (!iso) return '';
+    const d = new Date(iso);
+    if (Number.isNaN(d.getTime())) return '';
+    try {
+      return d.toLocaleDateString(undefined, { year: 'numeric', month: 'short', day: 'numeric' });
+    } catch (_) { return d.toISOString().slice(0, 10); }
+  }
+
+  function ageDays(iso) {
+    if (!iso) return null;
+    const ms = Date.now() - new Date(iso).getTime();
+    return Number.isFinite(ms) ? Math.floor(ms / 86400000) : null;
+  }
+
+  // ageChipHtml(iso, opts?) → the meta-row chip. Past AGE_STALE_DAYS it gains
+  // .task__age--stale, so scanning a goal's queue for work that has been sitting
+  // is a glance rather than an API call. `label` names the date in the tooltip
+  // ("Created" by default) so the same chip can carry other timestamps.
+  function ageChipHtml(iso, { label = 'Created' } = {}) {
+    const text = fmtAge(iso);
+    if (!text) return '';
+    const days = ageDays(iso);
+    const stale = days != null && days >= AGE_STALE_DAYS;
+    const abs = fmtAbsDate(iso);
+    return `<span class="task__age${stale ? ' task__age--stale' : ''}" title="${esc(label)} ${esc(abs)}">${esc(text)}</span>`;
+  }
+
   // ---- empty state / skeleton / collapsible ------------------------------------
 
   // One standard empty pattern: a short line + at most one action link. An
@@ -465,6 +525,8 @@
     makeLedger, makeFilterBar, makeTabs, makeSectionRail,
     // states
     emptyStateHtml, skeletonRows, collapsibleCard,
+    // age (task 1002955)
+    fmtAge, fmtAbsDate, ageChipHtml, AGE_STALE_DAYS,
   };
 
   // Node-require-safe (the dom-utils.js pattern): assignment is the only

package/modules/hall-ui/public/task.js

@@ -184,6 +184,14 @@
     if (t.est_minutes) meta.push(`${t.est_minutes}m`);
     parts.push(`<p class="deeplink-card__meta">${meta.join(' · ')}</p>`);
 
+    // task 1002955: when was this written? The panel showed a shipped date but
+    // never a created one, so an untouched task carried no age at all. Absolute
+    // date first (the panel has the room the card chip doesn't), age after it.
+    if (t.created_at) {
+      const age = fmtRel(t.created_at);
+      parts.push(`<p class="deeplink-card__note">Created ${escapeHtml(fmtDate(t.created_at))}${age ? ` — ${escapeHtml(age)}` : ''}.</p>`);
+    }
+
     if (t.goal_id) {
       parts.push(`<p class="td-goal">Goal: <a href="/goals#/goal/${encodeURIComponent(t.goal_id)}">Goal #${escapeHtml(String(t.goal_id))}</a></p>`);
     }

package/modules/hall-ui/public/work.css

@@ -66,6 +66,21 @@
   cursor: help;
 }
 
+/* How old the task is (task 1002955, OTBKit.ageChipHtml). Quiet by default —
+   it's orientation, not a call to act — but a task past the stale threshold
+   steps up from faint to soft+bold so a queue that has been sitting reads at a
+   glance instead of needing the API. The exact date is on the tooltip, hence
+   `cursor: help`. Deliberately NOT --warn: that token is a dark amber paired
+   with --warn-weak behind it, and as bare text it loses contrast on the dark
+   theme's card. --ink-soft steps up legibly in both. */
+.task__age {
+  color: var(--ink-faint);
+  font-size: 12px;
+  white-space: nowrap;
+  cursor: help;
+}
+.task__age--stale { color: var(--ink-soft); font-weight: 600; }
+
 .task__tag--newcomer {
   background: var(--ok-weak);
   color: var(--ok);

package/modules/hall-ui/public/work.js

@@ -360,6 +360,9 @@
       const touchesChip = touches.length
         ? `<span class="task__touches" title="${escapeHtml(touches.join('\n'))}">✎ ${touches.length} file${touches.length === 1 ? '' : 's'}</span>`
         : '';
+      // task 1002955: how old is this task? A ready queue reads as equally fresh
+      // without it; the exact date rides the tooltip.
+      const ageChip = window.OTBKit.ageChipHtml(t.created_at);
       const selected = selection.claim.has(String(t.id));
       return `
         <div class="task${selected ? ' task--selected' : ''}" data-task-id="${t.id}">
@@ -380,6 +383,7 @@
               <span>${minutesText}</span>
               <span>${cpmText}</span>
               ${touchesChip}
+              ${ageChip}
             </div>
           </div>
           <div class="task__credits">

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.149",
+  "version": "1.19.151",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.149",
+      "version": "1.19.151",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.149",
+  "version": "1.19.151",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box.js

@@ -1447,11 +1447,38 @@ Named browser-terminal tunnel (#771, ADR 0038 — OPT-IN, default OFF):
 // never imports it, it is always spawned) it exposes the orchestration fns so the
 // dry-run/live contract can be exercised with injected fakes (#1034). The guard
 // keeps a require() from running the CLI + calling process.exit.
+// provenance() — WHICH core is making this fleet decision, and from which root.
+//
+// Task 1002738: the four cloudbongos-box-* units ran with WorkingDirectory pointed at
+// a root whose vendored @bongos/core was 1.19.2 while the web app had long since moved
+// to 1.19.146 — so every park/destroy/provision decision was made by a core ~145
+// patches behind, including a cmdSweepIdle that still DESTROYED an idle box. Nothing
+// in the journal said so: the sweep banner reports the THRESHOLD but never the code.
+// Diagnosing it took a filesystem dig across two instance roots.
+//
+// One line, printed by every invocation, makes that failure self-announcing: a stale
+// plane now says its own version in `journalctl -u cloudbongos-box-idle-suspend`, next
+// to the instance root that supplied it. Cheap, unconditional, and it can only be
+// wrong if the package it reads is the package it ran.
+// Names the package REPO_ROOT resolved to, not just its version: installed, that is
+// `@bongos/core@1.19.148`; in a monolith checkout it is the instance's own package, and
+// saying so is the point — the line must never let a monolith masquerade as a core pin.
+function provenance() {
+  let pkg = 'unknown';
+  try {
+    const p = require(path.join(REPO_ROOT, 'package.json'));
+    pkg = `${p.name || 'unknown'}@${p.version || 'unknown'}`;
+  } catch { /* a core with no readable package.json still runs — just say unknown */ }
+  const inst = instanceConfig.resolveInstanceRootExplicit() || process.cwd();
+  return `box.js · running from ${pkg} · instance ${inst}`;
+}
+
 async function main() {
   const args = process.argv.slice(2);
   const cmd = args[0];
   APPLY = hasFlag(args, '--apply');
   if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') { usage(); process.exit(0); }
+  console.log(provenance());
 
   const known = ['provision', 'onboard', 'park', 'wake', 'deprovision', 'run-intents', 'sweep-idle', 'sweep-dormant', 'reconcile', 'reconcile-drift', 'status'];
   if (!known.includes(cmd)) { console.error(`unknown command: ${cmd}\n`); usage(); process.exit(2); }

package/src/module-api.js

@@ -725,8 +725,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.147 with no explicit bump. run 31952592623. (task 1002620)
 //   1.19.149 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.148 with no explicit bump. run 31953207683. (task 1002620)
+//   1.19.150 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.149 with no explicit bump. run 31953504697. (task 1002620)
+//   1.19.151 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.150 with no explicit bump. run 31953827282. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.149'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.151'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');