@bongos/core 1.19.344 → 1.19.345

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.344",
-  "core_contract": "1.19.344",
-  "source_commit": "8c08be71d310a5efcda6758c75e8483382426e06",
+  "core_version": "1.19.345",
+  "core_contract": "1.19.345",
+  "source_commit": "ef6d8227178f4b2a0b050772442f2440b6ad34ab",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T01:57:13.504Z",
+  "built_at": "2026-08-25T02:17:29.630Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 328,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1839,
-  "tree_sha256": "6cf7037df1f7ae7c712b6255408972f1e179b6487b592b76e87520344ed0756f",
+  "tree_sha256": "2405d3d77e5a22dee9b903e443cef2f24c9b91b96c890cd2ad93b26ed7e208d4",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4742,12 +4742,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ce99df6084ae3c2b151cc254d147ece750898e9d87d33fb204b32ace1a7d8029"
+      "sha256": "1f08aad9924b7023db8de3c1bb3b7212da7a826227695318d23634865f729975"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cf51aa1815eea987d945024edc01d09faf17c7adf77ef381844d56ac096db7d9"
+      "sha256": "1790b798df1626b11f335c995d9c6e6e6c297fead47852cab15f8fcfae4f89f0"
     },
     {
       "path": "public-docs/index.html",
@@ -6587,7 +6587,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "26318bb3c73b91064f7f85d04c66203a16da0de847993823dadf3a340db7b175"
+      "sha256": "3aa07baacc3e1cdc43bc310db5e0c104c931117a788879501694c9d525083634"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6847,7 +6847,7 @@
     {
       "path": "tests/baseline_staleness.mjs",
       "mode": "0000644",
-      "sha256": "44a2469b0f18c62fab6d9b3fe5a5125b8a9a351b5b1b48cb88cd812994d86b10"
+      "sha256": "2543492e930ace22ed9de1bf69c6efb5fdba265e88d322a45a35da18248a8731"
     },
     {
       "path": "tests/bfg.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.344",
+  "version": "1.19.345",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.344",
+      "version": "1.19.345",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.344",
+  "version": "1.19.345",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1118,8 +1118,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.342 with no explicit bump. run 32799245758. (task 1002620)
 //   1.19.344 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.343 with no explicit bump. run 32799492873. (task 1002620)
+//   1.19.345 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.344 with no explicit bump. run 32800819617. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.344'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.345'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/baseline_staleness.mjs

@@ -165,18 +165,27 @@ test('LIVE: every floor in the shipped baseline file carries a reason', () => {
   assert.equal(r.historyAvailable, true, 'this checkout should have git history for the baseline file');
 });
 
-test('LIVE: shrink the window to 1 day and the real baselines DO get flagged', () => {
-  // Proof the check is not passing because it cannot see. Every current baseline
-  // was written days ago, so at a one-day window the reducible ones must surface —
-  // if this returns nothing, the detector is inert.
-  const r = bs.run({ maxAgeDays: 1 });
-  assert.ok(r.stale.length > 0, 'a 1-day window must flag the real baselines');
+test('LIVE: shrink the window past zero and the real baselines DO get flagged', () => {
+  // Proof the detector is not passing merely because it cannot see. A negative
+  // window makes EVERY metric with a measurable age older than the threshold, so
+  // the flagged set is decided purely by the exemption rules.
+  //
+  // This deliberately names no individual metric. The first version asserted
+  // `doc_stale_links` would be flagged; task 1003211 then reduced that metric,
+  // resetting its age to zero, and the test went red on a tree that was perfectly
+  // healthy — it had been pinned to transient state rather than to a property.
+  // Paying debt down must never break the check that watches the debt.
+  const r = bs.run({ maxAgeDays: -1 });
   const names = r.stale.map((s) => s.name);
-  assert.ok(names.includes('doc_stale_links'), `expected doc_stale_links among ${names.join(', ')}`);
-  // …and the exempt ones must STILL be exempt at a 1-day window: the exemption is
-  // the floor, not the clock.
+  assert.ok(names.length > 0, 'a negative window must flag every metric that is above its floor');
+  // The exemptions are the floor and zero, never the clock — so they hold even
+  // when the window guarantees everything else is flagged.
   assert.ok(!names.includes('require_cycle_count'), 'a metric at its declared floor must never be flagged');
   assert.ok(!names.includes('oversized_file_count'), 'a metric at zero must never be flagged');
+  assert.ok(!names.includes('excess_lines_total'), 'a metric at zero must never be flagged');
+  // Every flagged metric must genuinely be above its floor — the flag means
+  // "reducible and unmoved", not merely "old".
+  for (const s of r.stale) assert.ok(s.value > s.floor, `${s.name} flagged at or below its floor`);
 });
 
 test('LIVE: --update-baselines preserves the floors instead of overwriting them', () => {