@bongos/core 1.19.271 → 1.19.273

package/docs/copy-registry.json

@@ -101,8 +101,8 @@
       "at": [
         "modules/hall-ui/public/goals-page.js:674",
         "modules/hall-ui/public/goals-page.js:926",
-        "modules/hall-ui/public/work.js:747",
-        "modules/hall-ui/public/work.js:812"
+        "modules/hall-ui/public/work.js:751",
+        "modules/hall-ui/public/work.js:821"
       ]
     },
     {
@@ -134,8 +134,8 @@
       "text": "Copy prompt",
       "occurrences": 3,
       "at": [
-        "modules/hall-ui/public/task.js:252",
-        "modules/hall-ui/public/task.js:269",
+        "modules/hall-ui/public/task.js:258",
+        "modules/hall-ui/public/task.js:275",
         "modules/hall-ui/public/work.js:446"
       ]
     },
@@ -179,8 +179,8 @@
       "occurrences": 3,
       "at": [
         "modules/hall-ui/public/goals-page.js:949",
-        "modules/hall-ui/public/work.js:783",
-        "modules/hall-ui/public/work.js:836"
+        "modules/hall-ui/public/work.js:792",
+        "modules/hall-ui/public/work.js:845"
       ]
     },
     {
@@ -385,7 +385,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/goals-page.js:677",
-        "modules/hall-ui/public/work.js:750"
+        "modules/hall-ui/public/work.js:754"
       ]
     },
     {
@@ -775,7 +775,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/profile.js:144",
-        "modules/hall-ui/public/work.js:905"
+        "modules/hall-ui/public/work.js:914"
       ]
     },
     {
@@ -795,7 +795,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/goals-page.js:702",
-        "modules/hall-ui/public/work.js:954"
+        "modules/hall-ui/public/work.js:963"
       ]
     },
     {
@@ -915,7 +915,7 @@
       "occurrences": 2,
       "at": [
         "modules/hall-ui/public/goals-page.js:944",
-        "modules/hall-ui/public/work.js:828"
+        "modules/hall-ui/public/work.js:837"
       ]
     },
     {
@@ -1519,7 +1519,7 @@
       "surface": "builders-hall",
       "text": ", follow its acceptance criteria, stay within touches[], /builder-ship",
       "file": "modules/hall-ui/public/work.js",
-      "line": 735,
+      "line": 739,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2032,7 +2032,7 @@
       "surface": "builders-hall",
       "text": "Awaiting the grader / a confirmation before it can ship.",
       "file": "modules/hall-ui/public/task.js",
-      "line": 247,
+      "line": 253,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2311,7 +2311,7 @@
       "surface": "builders-hall",
       "text": "Checking dependency order…",
       "file": "modules/hall-ui/public/work.js",
-      "line": 696,
+      "line": 700,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -2320,7 +2320,7 @@
       "surface": "builders-hall",
       "text": "Checking for conflicts…",
       "file": "modules/hall-ui/public/work.js",
-      "line": 675,
+      "line": 679,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -2401,7 +2401,7 @@
       "surface": "builders-hall",
       "text": "Claimed {…} tasks. Open a terminal to start work.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 750,
+      "line": 754,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -2608,7 +2608,7 @@
       "surface": "builders-hall",
       "text": "Confirm that verification for #{…} actually passed?",
       "file": "modules/hall-ui/public/task.js",
-      "line": 284,
+      "line": 290,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -2743,7 +2743,7 @@
       "surface": "builders-hall",
       "text": "Copy prompt",
       "file": "modules/hall-ui/public/task.js",
-      "line": 252,
+      "line": 258,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2752,7 +2752,7 @@
       "surface": "builders-hall",
       "text": "Copy prompt",
       "file": "modules/hall-ui/public/task.js",
-      "line": 269,
+      "line": 275,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -2950,7 +2950,7 @@
       "surface": "builders-hall",
       "text": "Could not load #{…}",
       "file": "modules/hall-ui/public/task.js",
-      "line": 303,
+      "line": 309,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4147,7 +4147,7 @@
       "surface": "builders-hall",
       "text": "Goal #{…}",
       "file": "modules/hall-ui/public/task.js",
-      "line": 196,
+      "line": 202,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4723,7 +4723,7 @@
       "surface": "builders-hall",
       "text": "Last claimed by",
       "file": "modules/hall-ui/public/task.js",
-      "line": 207,
+      "line": 213,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5560,7 +5560,7 @@
       "surface": "builders-hall",
       "text": "Not found",
       "file": "modules/hall-ui/public/task.js",
-      "line": 298,
+      "line": 304,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -5632,7 +5632,7 @@
       "surface": "builders-hall",
       "text": "Nothing in the backlog right now.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 944,
+      "line": 953,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5659,7 +5659,7 @@
       "surface": "builders-hall",
       "text": "Nothing shipped yet.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 905,
+      "line": 914,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5794,7 +5794,7 @@
       "surface": "builders-hall",
       "text": "Open task #{…}",
       "file": "modules/hall-ui/public/work.js",
-      "line": 954,
+      "line": 963,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5839,7 +5839,7 @@
       "surface": "builders-hall",
       "text": "Open the Work Board",
       "file": "modules/hall-ui/public/task.js",
-      "line": 252,
+      "line": 258,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6352,7 +6352,7 @@
       "surface": "builders-hall",
       "text": "Recent history could not be loaded right now.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 1043,
+      "line": 1052,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6433,7 +6433,7 @@
       "surface": "builders-hall",
       "text": "Release your claim on #{…}? It returns to the queue and no {…} are earned.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 828,
+      "line": 837,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6442,7 +6442,7 @@
       "surface": "builders-hall",
       "text": "Release {…}? {…} to the queue and no {…} are earned.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 777,
+      "line": 786,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6460,7 +6460,7 @@
       "surface": "builders-hall",
       "text": "Released #{…}. It returns to the queue.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 783,
+      "line": 792,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6469,7 +6469,7 @@
       "surface": "builders-hall",
       "text": "Released #{…}. It returns to the queue.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 836,
+      "line": 845,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -6937,7 +6937,7 @@
       "surface": "builders-hall",
       "text": "Select at least 2 waiting tasks to copy a parallel-session prompt.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 660,
+      "line": 664,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6946,7 +6946,7 @@
       "surface": "builders-hall",
       "text": "Select at least 2 waiting tasks to copy a sequential prompt.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 685,
+      "line": 689,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7090,7 +7090,7 @@
       "surface": "builders-hall",
       "text": "Ship it",
       "file": "modules/hall-ui/public/task.js",
-      "line": 243,
+      "line": 249,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7099,7 +7099,7 @@
       "surface": "builders-hall",
       "text": "Shipped {…}{…}.",
       "file": "modules/hall-ui/public/task.js",
-      "line": 228,
+      "line": 234,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7378,7 +7378,7 @@
       "surface": "builders-hall",
       "text": "Task #{…}",
       "file": "modules/hall-ui/public/task.js",
-      "line": 170,
+      "line": 176,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7441,7 +7441,7 @@
       "surface": "builders-hall",
       "text": "Tasks are numbered separately from GitHub pull requests, so this may be a PR rather than a GDS task.",
       "file": "modules/hall-ui/public/task.js",
-      "line": 293,
+      "line": 299,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7810,7 +7810,7 @@
       "surface": "builders-hall",
       "text": "The task list could not be loaded right now.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 1097,
+      "line": 1106,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7828,7 +7828,7 @@
       "surface": "builders-hall",
       "text": "The work board failed to load. Reload to try again.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 1266,
+      "line": 1275,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8089,7 +8089,7 @@
       "surface": "builders-hall",
       "text": "Try reloading in a moment.",
       "file": "modules/hall-ui/public/task.js",
-      "line": 303,
+      "line": 309,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8269,7 +8269,7 @@
       "surface": "builders-hall",
       "text": "Welcome, {…}. Claim and release tasks and follow work in progress — no terminal needed.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 1034,
+      "line": 1043,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8566,7 +8566,7 @@
       "surface": "builders-hall",
       "text": "You claimed #{…}. Open a terminal to start work.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 747,
+      "line": 751,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8575,7 +8575,7 @@
       "surface": "builders-hall",
       "text": "You claimed #{…}. Open a terminal to start work.",
       "file": "modules/hall-ui/public/work.js",
-      "line": 812,
+      "line": 821,
       "origin": "js-notice",
       "confidence": "certain"
     },

package/modules/hall-ui/public/dom-utils.js

@@ -230,8 +230,48 @@
     return { label: label || stripMd(raw).slice(0, 80), detail };
   }
 
+
+  // ---- ADR 0116 error envelope (task 1002462) -------------------------------
+  //
+  // The server returns `{ error: { code, message, details } }` via res.fail().
+  // The code is NESTED, so a bare `data.error === 'CODE'` test compares a string
+  // to an OBJECT and silently never matches: every switch falls through to its
+  // generic default. That degrades into a wrong-but-plausible toast rather than a
+  // visible break, so no smoke test catches it — which is how the same defect
+  // survived independently across four hall surfaces (work.js, task.js, and
+  // hand-rolled copies in goals-page.js and task-detail.js).
+  //
+  // These live here, in the shared toolkit every hall page already loads first,
+  // so a fifth copy is never the easiest option. They take the RESPONSE BODY —
+  // callers pass `err.data` — and each accepts BOTH the envelope and the
+  // pre-envelope flat shape `{ error: 'CODE', ...fields }`, so an older server
+  // still maps. Pure: no DOM, no network, no page-specific behaviour (unlike the
+  // network helpers, which are deliberately NOT in this file).
+  function errCode(data) {
+    const e = data && data.error;
+    if (e && typeof e === 'object') return e.code || '';
+    if (typeof e === 'string') return e;
+    return (data && data.code) || '';
+  }
+  function errMessage(data) {
+    const e = data && data.error;
+    if (e && typeof e === 'object' && e.message) return e.message;
+    return (data && data.message) || '';
+  }
+  // Structured payload. Falls back to the BODY itself on the flat shape, where
+  // the extra fields (conflicts, failures, what_to_do) sat at the top level.
+  function errDetails(data) {
+    const e = data && data.error;
+    if (e && typeof e === 'object' && e.details && typeof e.details === 'object') return e.details;
+    // ALWAYS an object, so every caller can read `det.conflicts` with no type
+    // guard. A non-object body (a string, a number) would otherwise leak through
+    // and turn a detail read into undefined-or-worse at the call site.
+    return (data && typeof data === 'object') ? data : {};
+  }
+
   window.OTB = {
     escapeHtml, $, fmtNum, num, fmtInt, fmtCompact, fmtDate, rankLabel, toast, moduleOn,
+    errCode, errMessage, errDetails, // task 1002462 — ADR 0116 envelope readers
     contributeSettingsPanel, settingsPanels,
     contributeHallWidget, hallWidgets, hallWidgetIds,
     splitCriterion,

package/modules/hall-ui/public/task.js

@@ -21,7 +21,7 @@
   // builds through unchanged; result-mode ({ status, ok, data }) preserves control flow 1:1.
   const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
   const AUTH_NEEDED = 'auth-needed';
-  const { escapeHtml, $, fmtDate } = window.OTB;
+  const { escapeHtml, $, fmtDate, errCode, errMessage } = window.OTB; // task 1002462: envelope readers
   const toast = (msg) => window.OTB.toast(msg, { duration: 2600 });
   const curLabel = () => (window.__BRANDING__ && window.__BRANDING__.currency && window.__BRANDING__.currency.label) || 'credits';
 
@@ -70,13 +70,19 @@
   // exactly those POST /tasks/:id/ship + /confirm can return. The server is the
   // authority (ADR 0016); the UI only surfaces the refusal.
   function friendlyActionError(status, data) {
-    switch (data && data.error) {
+    // task 1002462: read the ADR 0116 envelope. `data.error` is an OBJECT here,
+    // so every case fell through to the generic default and a precise lifecycle
+    // refusal ("not confirmed yet", "attestation required") rendered as
+    // "Could not complete that (409)".
+    switch (errCode(data)) {
       case 'task_not_confirmed':
         return 'That task can only be shipped once it is confirmed (its grade has landed).';
       case 'task_not_completed':
         return 'That task is not marked complete yet.';
       case 'verify_attestation_required':
-        return (data && data.message) || 'Confirm a verification task only after the verify actually passed.';
+        // The server's own sentence is the useful one — it names the task and the
+        // flag. It sits at error.message under the envelope, not data.message.
+        return errMessage(data) || 'Confirm a verification task only after the verify actually passed.';
       case 'rank_too_low_for_task':
       case 'INSUFFICIENT_RANK':
         return 'Your rank is not high enough for that action.';

package/modules/hall-ui/public/work.js

@@ -35,7 +35,7 @@
   // window.OTB toolkit (dom-utils.js, loaded first). Thin wrappers keep this
   // file's exact variants (date-only fmtDate; a 2200ms clearing toast).
   // fmtAgo / toAuth / getJSON / postJSON stay local below.
-  const { escapeHtml, $, fmtNum } = window.OTB;
+  const { escapeHtml, $, fmtNum, errCode, errDetails } = window.OTB; // task 1002462: envelope readers
   // Shared task-domain helpers (task 1002463). These lived in two copies here and
   // in the other board and had already drifted — goals-page.js had silently lost
   // friendlyBatchReason's MODULE_CONFLICT case. Destructured so every call site
@@ -468,14 +468,18 @@
   // Map the server's typed error code to a builder-readable line. The codes are
   // exactly those POST /claims and POST /claims/:id/resolve can return.
   function friendlyActionError(status, data) {
-    const code = data && data.error;
-    switch (code) {
+    // task 1002462: read the ADR 0116 envelope. `data.error` is an OBJECT, so the
+    // old `const code = data && data.error` compared a string to an object and
+    // EVERY case below fell through to the generic default — a wrong-but-plausible
+    // toast on every claim/release refusal.
+    const det = errDetails(data);
+    switch (errCode(data)) {
       case 'ALREADY_CLAIMED':
         return 'Someone else claimed that task first. The board will refresh.';
       case 'TASK_NOT_READY':
         return 'That task is no longer ready to be claimed.';
       case 'TOUCHES_CONFLICT': {
-        const titles = Array.isArray(data.conflicts) ? data.conflicts.map((c) => c.title).filter(Boolean) : [];
+        const titles = Array.isArray(det.conflicts) ? det.conflicts.map((c) => c.title).filter(Boolean) : [];
         return titles.length
           ? `That task overlaps an active claim: ${titles.join('; ')}. Wait for it to ship.`
           : 'That task overlaps another active claim. Wait for it to ship.';
@@ -487,7 +491,7 @@
       case 'INSUFFICIENT_RANK':
         return 'Your rank is not yet high enough for that task.';
       case 'newcomer_must_ship_first':
-        return data.what_to_do || 'Ship your current claim before opening another.';
+        return det.what_to_do || 'Ship your current claim before opening another.';
       case 'NOT_YOUR_CLAIM':
         return 'That claim is not yours to release.';
       case 'ALREADY_RESOLVED':
@@ -753,8 +757,13 @@
       await refreshLive();
     } catch (err) {
       if (err && err.message === 'redirecting to auth') return;
-      if (err.status === 409 && err.data && err.data.error === 'batch_failed') {
-        const failures = Array.isArray(err.data.failures) ? err.data.failures : [];
+      // task 1002462: same envelope defect — this tested `err.data.error === 'batch_failed'`
+      // against an object, so an all-or-nothing batch refusal rendered as the generic toast
+      // and the per-task reasons were dropped on the floor.
+      if (err.status === 409 && errCode(err.data) === 'batch_failed') {
+        const bdet = errDetails(err.data);
+        const failures = Array.isArray(bdet.failures) ? bdet.failures
+          : (Array.isArray(err.data && err.data.failures) ? err.data.failures : []);
         const lines = failures.map((f) => `#${f.task_id} (${friendlyBatchReason(f)})`);
         toast(lines.length
           ? `The batch could not be claimed — ${lines.join('; ')}.`

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.271",
+  "version": "1.19.273",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.271",
+      "version": "1.19.273",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.271",
+  "version": "1.19.273",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/context-pack.js

@@ -25,6 +25,7 @@
 //     and must NEVER throw or block a claim.
 
 const { execFileSync } = require('node:child_process');
+const path = require('node:path');
 
 // The live validators. task-classifier is a pure module (no DB, no network),
 // so importing it from a CLI is safe — same precedent as next-number.js reading
@@ -61,14 +62,70 @@ function apiContract() {
 
 // Resolve the absolute worktree root. runGit throws → fall back to cwd (which is
 // still better than nothing; the builder at least sees the directory they're in).
+//
+// task 1002573: also resolve WHICH KIND of tree this is. The pack used to print
+// the root and then assert "this is the session's tree, not the main checkout"
+// unconditionally — so claiming from the main checkout produced a sentence that
+// was flatly false, and the tooling told the builder to do the one thing that
+// makes the ship unmergeable (ship.js's local auto-merge has nowhere to merge
+// INTO when the receiving tree is the one holding the branch — task 1002572).
+//
+// The signal is the same one claim.js detectWorktreeName() already uses: in the
+// main checkout `--git-dir` and `--git-common-dir` resolve to the same path; in a
+// linked worktree they diverge. isMainCheckout is TRI-STATE — null means "could
+// not tell", and the guidance hedges rather than guessing, because this is a UX
+// surface that must never block a claim.
 function resolveWorktreeRoot({ runGit, cwd }) {
+  let root = null;
+  let degraded = false;
   try {
-    const root = runGit(['rev-parse', '--show-toplevel']).trim();
-    if (root) return { root, degraded: false };
+    root = runGit(['rev-parse', '--show-toplevel']).trim() || null;
   } catch {
     /* fall through */
   }
-  return { root: cwd, degraded: true };
+  if (!root) {
+    root = cwd;
+    degraded = true;
+  }
+  let isMainCheckout = null;
+  try {
+    const gitDir = runGit(['rev-parse', '--git-dir']).trim();
+    const commonDir = runGit(['rev-parse', '--git-common-dir']).trim();
+    if (gitDir && commonDir) {
+      // Both can come back RELATIVE ('.git' in the main checkout), so resolve
+      // against the tree we are describing rather than the process cwd.
+      const base = degraded ? cwd : root;
+      isMainCheckout = path.resolve(base, gitDir) === path.resolve(base, commonDir);
+    }
+  } catch {
+    /* unknown — the guidance hedges */
+  }
+  return { root, degraded, isMainCheckout };
+}
+
+// task 1002573: the guidance line(s) for the resolved tree. Pure, and exported so
+// the "these two must not read the same" property is unit-tested rather than
+// eyeballed. Returns an array of lines (the warning needs more than one).
+function worktreeGuidance(worktree) {
+  const isMain = worktree ? worktree.isMainCheckout : null;
+  if (isMain === true) {
+    return [
+      '    ⚠ THIS IS THE MAIN CHECKOUT — not a per-claim worktree.',
+      '      Working the claim here parks the main checkout off `main`, and the local',
+      '      auto-merge then has nowhere to merge INTO: the ship strands at `confirmed`',
+      '      until the server reconciler (or /merge-mode) catches it. Automation that',
+      '      resets this tree mid-session can also take your uncommitted work with it.',
+      '      Prefer a worktree:  git worktree add .claude/worktrees/<name> -b <branch>',
+    ];
+  }
+  if (isMain === false) {
+    return ['    → edit files + run git HERE. This is the session\'s tree, not the main checkout (the #1 wrong-path footgun).'];
+  }
+  return [
+    '    → edit files + run git HERE.',
+    '    ⚠ Could not tell whether this is the main checkout or a linked worktree. If it is',
+    '      the main checkout, prefer a per-claim worktree — see the warning in /builder-claim.',
+  ];
 }
 
 // OS toolchain facts the corpus showed sessions tripping over. `which` returns a
@@ -148,7 +205,7 @@ function formatContextPack(pack) {
   const lines = [];
   lines.push('🧭 Context pack (so this session starts knowing, not hunting):');
   lines.push(`  Worktree root:  ${worktree.root}`);
-  lines.push('    → edit files + run git HERE. This is the session\'s tree, not the main checkout (the #1 wrong-path footgun).');
+  lines.push(...worktreeGuidance(worktree)); // task 1002573 — tells the TRUTH about which tree this is
   if (worktree.degraded) {
     lines.push('    ⚠ git toplevel unreadable — showing cwd; double-check before writing.');
   }
@@ -217,6 +274,7 @@ module.exports = {
   API_PREFIX,
   apiContract,
   resolveWorktreeRoot,
+  worktreeGuidance, // task 1002573
   osFacts,
   normalizeClaims,
   buildContextPack,

package/src/module-api.js

@@ -969,8 +969,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.269 with no explicit bump. run 32428659648. (task 1002620)
 //   1.19.271 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.270 with no explicit bump. run 32437463473. (task 1002620)
+//   1.19.272 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.271 with no explicit bump. run 32438140524. (task 1002620)
+//   1.19.273 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.272 with no explicit bump. run 32441024959. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.271'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.273'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');