@bongos/core 1.19.290 → 1.19.292

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.290",
-  "core_contract": "1.19.290",
-  "source_commit": "a983fae1fa7615fda22b12d59ff393255fd81a19",
+  "core_version": "1.19.292",
+  "core_contract": "1.19.292",
+  "source_commit": "57bc876c876c64bf07069a3646e253006a917fc6",
   "source_ref": "HEAD",
-  "built_at": "2026-08-22T04:46:05.299Z",
+  "built_at": "2026-08-22T15:49:03.336Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 320,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1389,
+    "functional_verbatim": 1391,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1731,
-  "tree_sha256": "f3100f6df33ff1d5f9e4da0d536a0cc792b0c7ad9e3c945c87324554b34105db",
+  "file_count": 1733,
+  "tree_sha256": "ca47008669375b8c24cbecd5f6142a05b189fce9c02e8c3d2bdc29a2da237f87",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2434,6 +2434,11 @@
       "mode": "0000644",
       "sha256": "9939ee2c641caa8ae4f5055c60e3208a6ed4e379b1bfd1aaa67247a8ed4a4fd8"
     },
+    {
+      "path": "migrations/core_223_blocker_resolve_respects_other_open_blockers.sql",
+      "mode": "0000644",
+      "sha256": "8fc38c0353811699e19d861321d4fca8fe8fd5cca1f66ff96312d7f44fb0290e"
+    },
     {
       "path": "modules/autonomy/CLAUDE.md",
       "mode": "0000644",
@@ -2797,7 +2802,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "3b7b24b5ced8eead07e1d758e4c1b59321b0fb0f2108aefefd0e4b73bb7cc78b"
+      "sha256": "7faac7fc48e714c76c2b19feaaf9c730b2c9b10ab71ddc5697c21497d02f10ef"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4522,12 +4527,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e96dcf6ef882c61be154cfcb5d902942a1cad182173d11b63c824fdfb87f9879"
+      "sha256": "417cc856bf6eca0ed8c214b12624c6bc7567bb96b07a5999ebf5b72ab6b4ca05"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b1b86eeccda0d20d4c9b739016bd727f4867fa59de6a9dc5526b24ba5a6c92dd"
+      "sha256": "06e136123405fad423973fd79250b7baae689b122c0975e41f369ae87cdfe9e9"
     },
     {
       "path": "public-docs/index.html",
@@ -5437,7 +5442,7 @@
     {
       "path": "scripts/gds/package-core.js",
       "mode": "0000644",
-      "sha256": "e33e72278f4bb7b96c2e3f9d911ec55838ea96154327b8f98af3b45439d01590"
+      "sha256": "2fe4490f873e02e2ade253ff8e63ec70c555ea08b01ab27856deee8af2eb93dc"
     },
     {
       "path": "scripts/gds/paste-token.js",
@@ -6172,7 +6177,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6d275b0dea8e96343483360f9429816f5b6b3a754d71e9ae0a3700481a22e0aa"
+      "sha256": "a00525dccc2576669f8793418e40f7232dd2f8662163900142b561ce3c93a2db"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6449,6 +6454,11 @@
       "mode": "0000644",
       "sha256": "0ade9bbcb1782ffa2dd01799002dee7d88f6b17dab8ee418fe58e1a06ffb925e"
     },
+    {
+      "path": "tests/blocker_resolve_guard.mjs",
+      "mode": "0000644",
+      "sha256": "3a85b9e9bee4258aa64d26ca025d52c605f5f33938d3fdd5a31c393f1ec3f249"
+    },
     {
       "path": "tests/bongos_box_connect.mjs",
       "mode": "0000644",
@@ -6792,7 +6802,7 @@
     {
       "path": "tests/cutover_codemod.mjs",
       "mode": "0000644",
-      "sha256": "4555a337ce7d795fbda7e463f4a33774583dd17c8c81af83b928cf0057823427"
+      "sha256": "827dbb19b8be01a5658b3079620ab977af211a7aaf5b7f82a488bb9715d720fb"
     },
     {
       "path": "tests/dead_deps.mjs",
@@ -7872,7 +7882,7 @@
     {
       "path": "tests/package_core.mjs",
       "mode": "0000644",
-      "sha256": "269ebccbc3697af01219f282b91bff138f880054e82eb31fa29ad07800043db0"
+      "sha256": "9bdebe777e63bb2269e528a7ee19194a73610ab9226f59a18fec6fbe18c7a98e"
     },
     {
       "path": "tests/parallel-load.mjs",
@@ -8027,7 +8037,7 @@
     {
       "path": "tests/pruned_lockfile_integrity.mjs",
       "mode": "0000644",
-      "sha256": "a2e29941b5275751d37004bbe01a7123f0d11edcd1d34f5a2ee4079f91cd711a"
+      "sha256": "7c24744feee780786c82ac2ed76779e22ccde35e0c4c7ab5894ca4c4bce4bd90"
     },
     {
       "path": "tests/public_landing_projects.mjs",

package/migrations/core_223_blocker_resolve_respects_other_open_blockers.sql

@@ -0,0 +1,74 @@
+-- core_223_blocker_resolve_respects_other_open_blockers.sql — resolving ONE of a
+-- task's blockers must not release it while others are still open (task 1003149).
+--
+-- Bug: 009's resolve trigger promotes on ANY resolve, with no check for the
+-- task's OTHER blockers:
+--
+--     UPDATE tasks SET status = 'ready'
+--      WHERE id IN (SELECT task_id FROM task_blockers WHERE blocker_id = NEW.id)
+--        AND status = 'blocked';
+--
+-- So a task blocked by N blockers becomes claimable the moment the FIRST one
+-- resolves, with N-1 owner decisions still outstanding.
+--
+-- It is the ASYMMETRY that makes this a bug rather than a policy. Migration 176
+-- (V4.R15 / task 953) fixed exactly this hazard on the DEPENDENCY promotion path
+-- by folding a "no open blocker" check into task_is_fully_unblocked, and its own
+-- header defers to this trigger — "009's blocker-resolve trigger is what should
+-- release it, not a dep ship". But 009 releases on the first resolve, not the
+-- last. One path fail-closes; the other did not. This aligns them.
+--
+-- Live at the time of writing: task 1000594 was blocked by BOTH blocker 1000065
+-- and blocker 1000093 — duplicates covering the same two owner decisions — so
+-- closing either as a duplicate would have released the task with the decision
+-- still open. That is what made a routine duplicate-close unsafe, and there is
+-- no unlink route to detach one first.
+--
+-- `b.id <> NEW.id` IS LOAD-BEARING, NOT COSMETIC. This is a BEFORE UPDATE
+-- trigger, so the blockers row for NEW.id still reads status = 'open' in the
+-- table while the function body runs. Without the exclusion the guard would see
+-- the blocker being resolved as still open and NOTHING would ever promote —
+-- turning an over-eager release into a permanent stall. For the same reason this
+-- cannot simply call task_is_fully_unblocked(): that predicate reads the live
+-- table and would always be false here.
+--
+-- Deliberately NOT also checking dependencies. A task left in 'blocked' because
+-- its deps are unshipped would be STRANDED: the dep-promotion triggers (163)
+-- only ever flip 'backlog' -> 'ready', never 'blocked' -> 'ready', so no path
+-- would release it. Blocker-clearing and dep-clearing stay separate concerns.
+--
+-- Legacy markdown-anchor links (task_blockers.blocker_ref with no blocker_id
+-- row) are not tracked here and behave exactly as before — same scope as 176.
+--
+-- Idempotent: pure CREATE OR REPLACE of the function. The trigger created in 009
+-- resolves the function by name, so it needs no redefinition.
+
+BEGIN;
+
+CREATE OR REPLACE FUNCTION trg_promote_tasks_on_blocker_resolve()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.status = 'resolved' AND (OLD.status IS NULL OR OLD.status <> 'resolved') THEN
+    IF NEW.resolved_at IS NULL THEN
+      NEW.resolved_at := now();
+    END IF;
+
+    UPDATE tasks
+       SET status = 'ready', updated_at = now()
+     WHERE id IN (SELECT task_id FROM task_blockers WHERE blocker_id = NEW.id)
+       AND status = 'blocked'
+       -- … and no OTHER blocker on this task is still open (task 1003149).
+       AND NOT EXISTS (
+         SELECT 1
+           FROM task_blockers tb
+           JOIN blockers b ON b.id = tb.blocker_id
+          WHERE tb.task_id = tasks.id
+            AND b.id <> NEW.id
+            AND b.status = 'open'
+       );
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+COMMIT;

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -278,6 +278,8 @@ function createClient(opts = {}) {
       postDiscordChannelsReconcile: (args) => request("POST", "/discord/channels/reconcile", { hasBody: true }, args),
     },
     "doneWhen": {
+      // PATCH /done-when/{criterionId} — rank: metic+archon — PATCH /done-when/:criterionId
+      patchDoneWhenCriterionId: (args) => request("PATCH", "/done-when/{criterionId}", { hasBody: true }, args),
       // POST /done-when/{criterionId}/satisfy — rank: metic+archon — POST /done-when/:criterionId/satisfy
       postDoneWhenCriterionIdSatisfy: (args) => request("POST", "/done-when/{criterionId}/satisfy", { hasBody: true }, args),
       // POST /done-when/{criterionId}/unsatisfy — rank: metic+archon — POST /done-when/:criterionId/unsatisfy
@@ -308,6 +310,8 @@ function createClient(opts = {}) {
       postGoals: (args) => request("POST", "/goals", { hasBody: true }, args),
       // GET /goals/{id} — rank: any-builder — GET /goals/:id
       getGoalsId: (args) => request("GET", "/goals/{id}", { hasBody: false }, args),
+      // PATCH /goals/{id} — rank: any-builder — PATCH /goals/:id
+      patchGoalsId: (args) => request("PATCH", "/goals/{id}", { hasBody: true }, args),
       // POST /goals/{id}/archive — rank: metic+archon — POST /goals/:id/archive
       postGoalsIdArchive: (args) => request("POST", "/goals/{id}/archive", { hasBody: true }, args),
       // GET /goals/{id}/conflicts — rank: any-builder — GET /goals/:id/conflicts
@@ -350,6 +354,8 @@ function createClient(opts = {}) {
       getGoalsInbox: (args) => request("GET", "/goals/inbox", { hasBody: false }, args),
       // POST /goals/reorder — rank: metic+archon — POST /goals/reorder
       postGoalsReorder: (args) => request("POST", "/goals/reorder", { hasBody: true }, args),
+      // GET /goals/suggestions — rank: any-builder — GET /goals/suggestions
+      getGoalsSuggestions: (args) => request("GET", "/goals/suggestions", { hasBody: false }, args),
     },
     "government": {
       // GET /government/assignments — rank: archon — GET /government/assignments
@@ -396,6 +402,8 @@ function createClient(opts = {}) {
       getInboxId: (args) => request("GET", "/inbox/{id}", { hasBody: false }, args),
       // PATCH /inbox/{id} — rank: metic+archon — PATCH /inbox/:id
       patchInboxId: (args) => request("PATCH", "/inbox/{id}", { hasBody: true }, args),
+      // PATCH /inbox/{id}/body — rank: any-builder — PATCH /inbox/:id/body
+      patchInboxIdBody: (args) => request("PATCH", "/inbox/{id}/body", { hasBody: true }, args),
       // POST /inbox/{id}/ratify — rank: metic+archon — POST /inbox/:id/ratify
       postInboxIdRatify: (args) => request("POST", "/inbox/{id}/ratify", { hasBody: true }, args),
       // POST /inbox/{id}/resubmit — rank: any-builder — POST /inbox/:id/resubmit

package/package-lock.json

@@ -1,18 +1,24 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.290",
+  "version": "1.19.292",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.290",
+      "version": "1.19.292",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
         "pg": "^8.20.0"
       }
     },
+    "node_modules/@pinojs/redact": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
+      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
+      "license": "MIT"
+    },
     "node_modules/accepts": {
       "version": "1.3.8",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
@@ -32,6 +38,15 @@
       "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
       "license": "MIT"
     },
+    "node_modules/atomic-sleep": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
+      "integrity": "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
     "node_modules/body-parser": {
       "version": "1.20.5",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
@@ -539,6 +554,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/on-exit-leak-free": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
+      "integrity": "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/on-finished": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -655,6 +679,43 @@
         "split2": "^4.1.0"
       }
     },
+    "node_modules/pino": {
+      "version": "9.14.0",
+      "resolved": "https://registry.npmjs.org/pino/-/pino-9.14.0.tgz",
+      "integrity": "sha512-8OEwKp5juEvb/MjpIc4hjqfgCNysrS94RIOMXYvpYCdm/jglrKEiAYmiumbmGhCvs+IcInsphYDFwqrjr7398w==",
+      "license": "MIT",
+      "dependencies": {
+        "@pinojs/redact": "^0.4.0",
+        "atomic-sleep": "^1.0.0",
+        "on-exit-leak-free": "^2.1.0",
+        "pino-abstract-transport": "^2.0.0",
+        "pino-std-serializers": "^7.0.0",
+        "process-warning": "^5.0.0",
+        "quick-format-unescaped": "^4.0.3",
+        "real-require": "^0.2.0",
+        "safe-stable-stringify": "^2.3.1",
+        "sonic-boom": "^4.0.1",
+        "thread-stream": "^3.0.0"
+      },
+      "bin": {
+        "pino": "bin.js"
+      }
+    },
+    "node_modules/pino-abstract-transport": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-2.0.0.tgz",
+      "integrity": "sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.0.0"
+      }
+    },
+    "node_modules/pino-std-serializers": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
+      "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
+      "license": "MIT"
+    },
     "node_modules/postgres-array": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
@@ -694,6 +755,22 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/process-warning": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.1.0.tgz",
+      "integrity": "sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/proxy-addr": {
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
@@ -722,6 +799,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/quick-format-unescaped": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
+      "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
+      "license": "MIT"
+    },
     "node_modules/range-parser": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
@@ -746,6 +829,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/real-require": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
+      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12.13.0"
+      }
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -766,6 +858,15 @@
       ],
       "license": "MIT"
     },
+    "node_modules/safe-stable-stringify": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
+      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -895,6 +996,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/sonic-boom": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
+      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
+      "license": "MIT",
+      "dependencies": {
+        "atomic-sleep": "^1.0.0"
+      }
+    },
     "node_modules/split2": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
@@ -913,6 +1023,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/thread-stream": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-3.2.0.tgz",
+      "integrity": "sha512-zLBvqpwr4Esa0kRjcrzGU6zL25lePWaCLMx0RQFrmteozIfeNdaMLpG5U7PeHzvlFkAWaRKA9/KVW4F60iB+qw==",
+      "license": "MIT",
+      "dependencies": {
+        "real-require": "^0.2.0"
+      }
+    },
     "node_modules/toidentifier": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.290",
+  "version": "1.19.292",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -25,7 +25,8 @@
   },
   "dependencies": {
     "express": "^4.21.2",
-    "pg": "^8.20.0"
+    "pg": "^8.20.0",
+    "pino": "^9.14.0"
   },
   "overrides": {
     "undici": "^6.27.0"

package/scripts/gds/package-core.js

@@ -252,10 +252,13 @@ function isNpmStripped(pathRel) {
 // git) and staged in their place. Everything else still ships through the
 // normal isPublishable()/processCoreFile path.
 //
-// Core deps are express + pg (+ an undici pin) — ADR 0108 §Context. discord.js
-// (+ its undici requirement) is an OPTIONAL MODULE dependency, not core; a
-// consumer that enables the discord module installs it itself.
-const CORE_DEP_NAMES = ['express', 'pg'];
+// Core deps are express + pg + pino (+ an undici pin) — ADR 0108 §Context.
+// pino joined the core boot path with the structured logger (task 1003130:
+// platform-server → serve-internal → routes → middleware/audit → logger); a
+// published core without it crashes MODULE_NOT_FOUND at startup (task 1003160).
+// discord.js (+ its undici requirement) is an OPTIONAL MODULE dependency, not
+// core; a consumer that enables the discord module installs it itself.
+const CORE_DEP_NAMES = ['express', 'pg', 'pino'];
 
 // Pure — takes the source package.json's `dependencies`/`overrides` as plain
 // objects so this is unit-testable with no disk I/O. Throws if a required core

package/src/module-api.js

@@ -1007,8 +1007,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.288 with no explicit bump. run 32549912116. (task 1002620)
 //   1.19.290 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.289 with no explicit bump. run 32552538814. (task 1002620)
+//   1.19.291 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.290 with no explicit bump. run 32580353000. (task 1002620)
+//   1.19.292 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.291 with no explicit bump. run 32582800234. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.290'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.292'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/blocker_resolve_guard.mjs

@@ -0,0 +1,96 @@
+// tests/blocker_resolve_guard.mjs
+//
+// Task 1003149 — resolving ONE of a task's blockers must not release it while
+// others are still open. Static shape guard for core_223, in the style of
+// dependencies_migration.mjs: no live DB, assert the SQL TEXT so a future edit
+// cannot silently drop the guard or "simplify" it back into the bug. The runtime
+// behaviour is proven against real Postgres at deploy; this pins the contract.
+//
+// Run:  node tests/blocker_resolve_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+const require = createRequire(import.meta.url);
+
+const MIG = 'core_223_blocker_resolve_respects_other_open_blockers.sql';
+const mig = read('migrations', MIG);
+const migN = mig.replace(/\s+/g, ' ');
+// Comments carry the load-bearing rationale; strip them when asserting on the
+// executable body so a claim in prose can never stand in for the real SQL.
+const body = mig.replace(/^\s*--.*$/gm, '').replace(/\s+/g, ' ');
+
+const { test, summary } = makeRunner();
+
+await test('223 replaces the resolve trigger function (and only replaces it)', () => {
+  assert.match(mig, /CREATE OR REPLACE FUNCTION trg_promote_tasks_on_blocker_resolve\(\)/);
+  // The trigger from 009 binds by name, so redefining it here would be noise —
+  // and a DROP TRIGGER would leave a window where resolves promote nothing.
+  assert.doesNotMatch(body, /DROP TRIGGER/i);
+  assert.doesNotMatch(body, /CREATE TRIGGER/i);
+});
+
+await test('the promote UPDATE is guarded by a NOT EXISTS over the task\'s OTHER open blockers', () => {
+  assert.match(body, /UPDATE tasks SET status = 'ready'/);
+  assert.match(body, /AND status = 'blocked'/);
+  assert.match(body, /AND NOT EXISTS \( SELECT 1 FROM task_blockers tb JOIN blockers b ON b\.id = tb\.blocker_id/);
+  assert.match(body, /WHERE tb\.task_id = tasks\.id/);
+  assert.match(body, /AND b\.status = 'open'/);
+});
+
+await test("`b.id <> NEW.id` is present — without it a BEFORE trigger stalls forever", () => {
+  // The blockers row for NEW.id still reads 'open' while a BEFORE UPDATE trigger
+  // body runs, so dropping this exclusion would mean NOTHING ever promotes —
+  // trading an over-eager release for a permanent stall. This is the single
+  // most important character sequence in the migration.
+  assert.match(body, /AND b\.id <> NEW\.id/);
+});
+
+await test('223 does NOT also gate on dependencies — that would strand blocked tasks', () => {
+  // The dep-promotion triggers (163) only flip backlog -> ready, never
+  // blocked -> ready, so a task held in 'blocked' for unshipped deps would have
+  // no release path at all.
+  assert.doesNotMatch(body, /task_is_fully_unblocked/);
+  assert.doesNotMatch(body, /FROM dependencies/);
+});
+
+await test('the resolved_at capture from 009 is preserved', () => {
+  assert.match(body, /IF NEW\.resolved_at IS NULL THEN NEW\.resolved_at := now\(\);/);
+  assert.match(body, /IF NEW\.status = 'resolved' AND \(OLD\.status IS NULL OR OLD\.status <> 'resolved'\) THEN/);
+});
+
+await test('223 is transactional and idempotent (pure CREATE OR REPLACE)', () => {
+  assert.match(migN, /BEGIN;.*COMMIT;/);
+  assert.doesNotMatch(body, /ALTER TABLE/i);
+  assert.doesNotMatch(body, /DROP FUNCTION/i);
+});
+
+await test('009 remains the only OTHER definition — 223 is the last word', () => {
+  const defs = readdirSync(join(repoRoot, 'migrations'))
+    .filter((f) => f.endsWith('.sql'))
+    .filter((f) => /FUNCTION trg_promote_tasks_on_blocker_resolve/.test(read('migrations', f)))
+    .sort();
+  assert.deepEqual(defs, ['009_pms_v2_blockers_table.sql', MIG]);
+  // Ordering matters: migrate.sh applies in filename order, so a lower-numbered
+  // redefinition landing later would silently reinstate the bug.
+  assert.ok(MIG > '009_pms_v2_blockers_table.sql', 'core_223 must sort after 009');
+});
+
+await test('the JS resolve path still only OBSERVES — promotion stays in the trigger', () => {
+  const src = read('modules', 'ideas', 'blockers.js');
+  // resolveBlocker flips the blocker and then reads back which tasks are ready;
+  // if it ever started UPDATE-ing tasks.status itself, this guard would be
+  // bypassable and the fix would need to live in two places.
+  assert.doesNotMatch(src, /UPDATE\s+tasks[\s\S]{0,200}?status\s*=\s*'ready'/);
+  const blockers = require('../modules/ideas/blockers.js');
+  assert.equal(typeof blockers.resolveBlocker, 'function');
+});
+
+summary('blocker_resolve_guard');

package/tests/cutover_codemod.mjs

@@ -174,7 +174,7 @@ t('planCodemod rewrites host files, skips core files, reports unmapped', () => {
 
 t('every CORE_INTERNAL_MAP target is exported by the core package (a rewrite never outruns an export)', () => {
   const { buildPackageJson } = require('../scripts/gds/package-core.js');
-  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0' } });
+  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
   for (const mapped of Object.values(CORE_INTERNAL_MAP)) {
     assert.ok(pkg.exports[`./${mapped}`], `@bongos/core must export ./${mapped} (targeted by the codemod)`);
   }

package/tests/package_core.mjs

@@ -360,15 +360,15 @@ t('TAR_ROOT is the npm-required "package/" (not the ARTIFACT_NAME dir)', () => {
   assert.equal(TAR_ROOT, 'package/');
 });
 
-t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici override', () => {
+t('buildPackageJson: prunes to express+pg+pino, keeps the source ranges + the undici override', () => {
   const pkg = buildPackageJson({
     version: '1.14.0',
-    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
+    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
     sourceOverrides: { undici: '^6.27.0' },
   });
   assert.equal(pkg.name, '@bongos/core');
   assert.equal(pkg.version, '1.14.0');
-  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0' });
+  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0' });
   assert.equal(pkg.dependencies.phaser, undefined);
   assert.equal(pkg.dependencies['discord.js'], undefined);
   assert.deepEqual(pkg.overrides, { undici: '^6.27.0' });
@@ -400,7 +400,7 @@ t('publishArgs: private (restricted) publish, dry-run unless live (task 2089 / A
 });
 
 t('buildPackageJson: omits `overrides` when the source has none', () => {
-  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0' } });
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
   assert.equal(pkg.overrides, undefined);
 });
 
@@ -408,8 +408,8 @@ t('buildPackageJson: throws when a required core dep is missing from the source'
   assert.throws(() => buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0' } }), /missing required core dependency "pg"/);
 });
 
-t('CORE_DEP_NAMES is exactly [express, pg]', () => {
-  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg']);
+t('CORE_DEP_NAMES is exactly [express, pg, pino]', () => {
+  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg', 'pino']);
 });
 
 // A tiny synthetic lockfile fixture with a THREE-level chain (root -> a -> b) and

package/tests/pruned_lockfile_integrity.mjs

@@ -71,8 +71,8 @@ t('pruned lockfile: integrity hashes match the SOURCE lockfile verbatim (not rew
   assert.equal(mismatched.length, 0, `integrity rewritten for: ${mismatched.slice(0, 10).join(', ')}`);
 });
 
-t('CORE_DEP_NAMES: the pin domain is exactly the runtime core deps (express + pg)', () => {
-  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg'));
+t('CORE_DEP_NAMES: the pin domain is exactly the runtime core deps (express + pg + pino)', () => {
+  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg') && CORE_DEP_NAMES.includes('pino'));
 });
 
 console.log(`\npruned_lockfile_integrity: ${passed} passed, ${failed} failed`);