@bongos/core 1.19.50 → 1.19.52

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.50",
-  "core_contract": "1.19.50",
-  "source_commit": "1a7b11b4377e9fefb36560c0cda9d4b1030a05c9",
+  "core_version": "1.19.52",
+  "core_contract": "1.19.52",
+  "source_commit": "ce8e0d15694aed30b1640891c4256c96322a2a6f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T18:44:57.114Z",
+  "built_at": "2026-08-11T19:06:37.776Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1217,
+    "functional_verbatim": 1218,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1529,
-  "tree_sha256": "e96a0d29e2d6adc516aaa0d095dbb1c4d543dbec0508228b2cbcf16a1b400dbd",
+  "file_count": 1530,
+  "tree_sha256": "72953759b072de03029b81979095699aeb2d45b2363ba7047d8503457761956f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "649065862779b6a9b871607debfee5ca18bde8cccbde4d00ea42b0d175938c9d"
+      "sha256": "a5b9642b383c8c415158e091785ff40f28490d8341b4010f4c051b1a68942daf"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1307,12 +1307,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "8f83ea78edb348688196414bf2fb7352df3de0ded6abbbe44f2371c099431016"
+      "sha256": "27e9c0ab46db5386833b9e03bcff0dae31f4606882e845e7e830f9ef6f2550b5"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "27cf9c2b8548168f13dd2add1633bc9b3ca57f2fd5aa3b42ac8dbfb5cf60c41f"
+      "sha256": "612c7a81756f61f2c18d4b35540379cf63f32a4caa9e8d84a64b247d497ad7a3"
     },
     {
       "path": "docs/architecture.md",
@@ -2502,7 +2502,7 @@
     {
       "path": "modules/dev-box/app/src/gds-client.js",
       "mode": "0000644",
-      "sha256": "845f51622803363dbc1229c325c4d6148087c756812e7e8e049ced7aa479f168"
+      "sha256": "323f5e71b7836dd1fb6c7710e1b2159dec6382df89a7c5d001b7e7cccd5aa46d"
     },
     {
       "path": "modules/dev-box/app/src/main.js",
@@ -3387,7 +3387,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "57c88852ff0aa9f0b3673fa62b35f352d92cc9070e7872137003e395c42eb026"
+      "sha256": "8e67cd1325da44cf95d5d8c34427222e555e0458bb17f23f33c1055b1ae7e211"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3492,7 +3492,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "8a6ecd6c7ecadcbec79483a589fef11957d13e2c94b569a9ff9da97f2908b713"
+      "sha256": "68b4f47e3a5016645893c60eca2fe11a242012abf6625c99d6a774356d82d1ce"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4037,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ffd1f91d40f2098324c3054cd3accdfdf210a668972dcb8702104cd11ed6c4dc"
+      "sha256": "37bb9183f916ffafd19c5c88408f5f776bdb091afc46b1bfbad64669d642102f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cd444deb3940b96b8afedb89f5ece513d842d4a9148b3a50304d8d77866dd904"
+      "sha256": "80465cb4506affe5fc47c835df7a0f4f1634a0743c2de6d14f843f342d487c45"
     },
     {
       "path": "public-docs/index.html",
@@ -5632,7 +5632,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "25c52c06c03af400c94f04f2cda1aaab0c5e5486a084005b9a4e224f345a4871"
+      "sha256": "2f88796346b1c3a6dc49e25766b223fbf2d99e34b38b9a0f1e64a6fb9a59856d"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -5662,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2d8b78d34893b1e4c25d081c343ad1b0d1deb2a675cae9a3c4e96500c6cea821"
+      "sha256": "fc779475caf64dd09a7a3f952b4dadfcf2f123ca1a3d0ea9af20762b3de5e6c8"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6247,7 +6247,7 @@
     {
       "path": "tests/devbox_downloads.mjs",
       "mode": "0000644",
-      "sha256": "91950e7477f9fff30e361bc32def211e1cb3792fa098e9c839d5db1e1ba21d6a"
+      "sha256": "897fe6b114c612e132e6fa0b3c68f43b865c684c7653e73cf42db894a7e4dc94"
     },
     {
       "path": "tests/devbox_icons.mjs",
@@ -6264,6 +6264,11 @@
       "mode": "0000644",
       "sha256": "ac0a024d96ef40af52af8b94570447ad5f1556467b68380c1b45fd3419139ad6"
     },
+    {
+      "path": "tests/devbox_update_path.mjs",
+      "mode": "0000644",
+      "sha256": "b58e87eeca17053709a8e2bdcefd032060358cc85314d28bf816a92d465fdae8"
+    },
     {
       "path": "tests/device_flow_start.mjs",
       "mode": "0000644",
@@ -6882,7 +6887,7 @@
     {
       "path": "tests/migration_allocation.mjs",
       "mode": "0000644",
-      "sha256": "08db201ebec44ea5a711e3c86e36dda63ec22881a400e910dd7c64961c80f6e9"
+      "sha256": "6755c9568cd6cdb7b8600ae2c6651856d63c053684dcb8b765f7329590a9fc08"
     },
     {
       "path": "tests/migration_namespace.mjs",

package/clients/bongos-client/index.d.ts

@@ -131,7 +131,7 @@ export interface PatchMeSkillPrefsResponse { prefs: unknown; effective: unknown;
 export interface PatchMeSoundPrefsResponse { prefs: unknown; effective: unknown; effective_map: unknown; volume: unknown; defaults: unknown; known_sounds: unknown }
 export interface PatchProjectsIdFeaturedRequest { featured: boolean }
 export interface PatchProjectsIdFeaturedResponse { project: unknown }
-export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; status?: unknown }
+export interface PatchTasksIdRequest { kind?: string; discipline?: string; requires_rank?: string; module_key?: string; goal_id?: number; parent_task_id?: StringifiableId; parallel_safe?: unknown; newcomer_friendly?: boolean; xenos_claimable?: boolean; security_sensitive?: boolean; automation_tag?: string; needs_migration?: boolean; description?: string; status?: unknown }
 export interface PostAccessRequestsRequest { github_login: string; display_name?: string; note?: string }
 export interface PostAccessRequestsResponse { ok: boolean; request?: unknown; already_pending?: boolean }
 export interface PostAuthAppPairApproveRequest { pair_code: string }

package/docs/api/openapi.json

@@ -13792,6 +13792,11 @@
           "needs_migration": {
             "type": "boolean"
           },
+          "description": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 50000
+          },
           "status": {}
         },
         "additionalProperties": false

package/docs/api-reference.md

@@ -463,7 +463,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/tasks` | `any-builder` | — | reads (filtered task list); preserved per CRITICAL §4. |
 | POST | `/api/bongos/tasks` | `metic+archon` | `version_id`, `title`, `description`, `status`, `touches`, `est_minutes`, `est_cost_usd`, `manual_degree`, `priority`, `automation_tag`, `credits_reward`, `source`, `source_ref`, `value_summary`, `kind`, `discipline`, `parallel_safe`, `newcomer_friendly`, `security_sensitive`, `requires_rank`, `auto_detect_touches`, `criterion_ids`, `module_key`, `goal_id` | Task create/promote/edit (plan/scope mutation) is Metic+ as of ADR 0090 (owner decision 2026-06-26): a Metic who can run idea-triage may … |
 | GET | `/api/bongos/tasks/:id` | `any-builder` | — | single-task read; preserved per CRITICAL §4 (supervisor hot path). |
-| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
+| PATCH | `/api/bongos/tasks/:id` | `metic+archon` | `kind`, `discipline`, `requires_rank`, `module_key`, `goal_id`, `parent_task_id`, `parallel_safe`, `newcomer_friendly`, `xenos_claimable`, `security_sensitive`, `automation_tag`, `needs_migration`, `description`, `status` | PATCH /tasks/:id — supports body.parent_task_id (V2 C2), body.kind (V2 B1), body.discipline (mig 014), body.parallel_safe (mig 028), and … |
 | POST | `/api/bongos/tasks/:id/abandon` | `metic+archon` | `reason` | POST /tasks/:id/abandon — terminal "retire this task" transition (task 987). |
 | POST | `/api/bongos/tasks/:id/attest-gate` | `any-builder` | `head_sha` | POST /tasks/:id/attest-gate — body: { head_sha }. |
 | POST | `/api/bongos/tasks/:id/confirm` | `any-builder` | `verified` |  |

package/modules/dev-box/app/src/gds-client.js

@@ -82,8 +82,12 @@ function createClient({ getToken, getApiBase, fetchImpl } = {}) {
     claimableTasks: () => unwrap(gen('').request('GET', '/api/gds/tasks/claimable')),
     claimTask: (taskId) => unwrap(gen('').request('POST', '/api/gds/claims', { body: { task_id: taskId } })),
     boxScope: () => unwrap(gen('').request('GET', '/api/gds/box/scope')),
-    // update check (public static asset at the origin root, not under /api/gds)
-    latestRelease: () => unwrap(gen('').request('GET', '/downloads/devbox/latest.json')),
+    // update check (public route at the origin root, not under /api/gds).
+    // task 1002649: polls the EXTENSIONLESS /version twin, NOT latest.json — a
+    // front proxy with a file-matcher can eat *.json paths before Node (the
+    // live instance's pre-ADR-0152 vhost 404'd latest.json empty while this
+    // endpoint worked), and the updater only needs { version, assets } anyway.
+    latestRelease: () => unwrap(gen('').request('GET', '/downloads/devbox/version')),
   };
 }
 

package/modules/lifecycle/db.js

@@ -1477,7 +1477,7 @@ async function findTaskBySourceRef({ source, sourceRef } = {}, deps = {}) {
 
 const TASK_SETTER_COLUMNS = new Set([
   'kind', 'discipline', 'newcomer_friendly', 'security_sensitive', 'parallel_safe', 'automation_tag',
-  'needs_migration', 'module_key',
+  'needs_migration', 'module_key', 'description',
 ]);
 
 async function updateTaskColumn(id, column, value) {
@@ -1532,6 +1532,12 @@ async function updateTaskGoal(id, goalId) {
 
 async function updateTaskKind(id, kind) { return updateTaskColumn(id, 'kind', kind); }
 
+// task 1002647 (choke-point map s4.3): the task body is a load-bearing prompt —
+// it was settable only at create, un-editable at every rank. Editable now under
+// the same task.edit permission as the other planning fields; the global
+// write-audit middleware captures each edit's new body in audit_log.
+async function updateTaskDescription(id, description) { return updateTaskColumn(id, 'description', description); }
+
 
 async function updateTaskDiscipline(id, discipline) { return updateTaskColumn(id, 'discipline', discipline); }
 
@@ -5457,6 +5463,7 @@ module.exports = {
   updateTaskGoal,
   createCriterion,
   updateTaskKind,
+  updateTaskDescription,
   updateTaskDiscipline,
   updateTaskNewcomerFriendly,
   updateTaskRequiresRank,

package/modules/lifecycle/routes/tasks.js

@@ -793,6 +793,12 @@ module.exports = function buildTasksRouter() {
       security_sensitive: { type: 'boolean' },           // task 990 — Archon-only ship broadcast
       automation_tag: { type: 'string', maxLength: 64 },
       needs_migration: { type: 'boolean' },              // task 1002648 — correct the create-time heuristic's flag (the claim-time allocator keys off it)
+      // task 1002647 (map s4.3): the task body is a load-bearing builder prompt
+      // and was settable only at create — no route edited it at any rank. Now
+      // editable under this route's task.edit permission. minLength 1: a body
+      // can be rewritten, never blanked (and null is refused by the type check).
+      // Each edit's new body lands in audit_log via the write-audit middleware.
+      description: { type: 'string', minLength: 1, maxLength: LIMITS.DESCRIPTION },
       // task 1002614 (map D-18): DECLARED so strict-mode admits the request far
       // enough to reach the deliberate status_not_patchable hint below (#514) —
       // the hint had been unreachable dead code behind unknown_field since the
@@ -818,6 +824,7 @@ module.exports = function buildTasksRouter() {
     const hasRequiresRank = Object.prototype.hasOwnProperty.call(body, 'requires_rank');
     const hasModuleKey = Object.prototype.hasOwnProperty.call(body, 'module_key');
     const hasGoalId = Object.prototype.hasOwnProperty.call(body, 'goal_id');
+    const hasDescription = Object.prototype.hasOwnProperty.call(body, 'description');
     // #514: status is a lifecycle field, not a PATCH-able column — it moves only
     // through the dedicated transition routes. The #506 session tried
     // `PATCH status=ready`, got the generic no_supported_fields error, and had
@@ -829,8 +836,8 @@ module.exports = function buildTasksRouter() {
     if (Object.prototype.hasOwnProperty.call(body, 'status')) {
       return res.fail('status_not_patchable', { status: 400, message: STATUS_HINT });
     }
-    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId) {
-      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
+    if (!hasParent && !hasKind && !hasDiscipline && !hasNewcomerOrXenos && !hasParallelSafe && !hasSecuritySensitive && !hasAutomationTag && !hasNeedsMigration && !hasRequiresRank && !hasModuleKey && !hasGoalId && !hasDescription) {
+      return res.fail('no_supported_fields', { status: 400, message: 'PATCH /tasks/:id supports parent_task_id, kind, discipline, description, parallel_safe, security_sensitive, automation_tag, needs_migration, requires_rank, module_key, goal_id, and newcomer_friendly (alias: xenos_claimable). ' + STATUS_HINT });
     }
     // ---- task 1002609 (G-22): settle EVERY gate and validation before the ----
     // ---- FIRST write. The previous shape validated-and-wrote per field in ----
@@ -976,6 +983,15 @@ module.exports = function buildTasksRouter() {
         return res.fail('patch_failed', { status: 500, message: 'internal error' });
       }
     }
+    if (hasDescription) {
+      try {
+        updated = await db.updateTaskDescription(id, body.description);
+        if (!updated) return res.fail('task_not_found', 404);
+      } catch (err) {
+        console.error('[gds] PATCH /tasks/:id description', err);
+        return res.fail('patch_failed', { status: 500, message: 'internal error' });
+      }
+    }
     if (hasGoalId) {
       try {
         updated = await db.updateTaskGoal(id, body.goal_id);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.50",
+  "version": "1.19.52",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.50",
+      "version": "1.19.52",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.50",
+  "version": "1.19.52",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -359,6 +359,38 @@ function isBuildersHost(req) {
 // Call this ONCE, right after app setup (trust proxy etc.) and BEFORE any
 // entrypoint-specific tail (the game static + themed 404 in server.js; the plain
 // 404 in platform-server.js).
+// The Dev Box download/manifest mini-router (#904, ADR 0045), extracted so the
+// ACTUAL route handlers are hermetically testable (tests/devbox_update_path.mjs
+// mounts them on a throwaway app — the docs_openapi_route pattern) instead of
+// only their pure builder. task 1002649: the manifest is served under BOTH
+// /latest.json and an extensionless /latest twin — a front proxy with a
+// file-matcher can eat *.json paths before Node (the live pre-ADR-0152 vhost
+// 404'd latest.json empty while extensionless siblings worked), so every
+// manifest consumer has a path that survives that class. Registration order
+// matters: the literal routes must precede the `:target` catch-all.
+function mountDevboxDownloads(app, devboxDownloads) {
+  const manifest = (_req, res) => {
+    // Short TTL: a release bump (config change + deploy) is visible within a
+    // minute, same posture as the hall's HTML.
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json(devboxDownloads.latestJson());
+  };
+  app.get('/downloads/devbox/latest.json', manifest);
+  app.get('/downloads/devbox/latest', manifest);
+  // #924: the lightweight update-check endpoint the Dev Box app polls + the hall
+  // /settings courtesy line reads.
+  app.get('/downloads/devbox/version', (_req, res) => {
+    res.set('Cache-Control', 'public, max-age=60');
+    res.json(devboxDownloads.versionJson());
+  });
+  app.get('/downloads/devbox/:target', (req, res) => {
+    const url = devboxDownloads.redirectFor(req.params.target);
+    if (!url) return res.fail('unknown_target', 404, { targets: Object.keys(devboxDownloads.latestJson().assets) });
+    res.set('Cache-Control', 'public, max-age=60');
+    res.redirect(302, url);
+  });
+}
+
 function mountInternalSurfaces(app) {
   // Prometheus instrumentation (task #1680, V4.R28a). The counting middleware
   // mounts FIRST so it wraps every surface registered below (and, since
@@ -477,26 +509,7 @@ function mountInternalSurfaces(app) {
   // /builders/downloads/* and 404).
   const devboxCfg = tryLoadInstanceConfig('devbox-app.json');
   if (devboxCfg) {
-    const devboxDownloads = buildDevboxDownloads(devboxCfg);
-    app.get('/downloads/devbox/latest.json', (_req, res) => {
-      // Short TTL: a release bump (config change + deploy) is visible within a
-      // minute, same posture as the hall's HTML.
-      res.set('Cache-Control', 'public, max-age=60');
-      res.json(devboxDownloads.latestJson());
-    });
-    // #924: the lightweight update-check endpoint the Dev Box app polls + the hall
-    // /settings courtesy line reads. MUST be registered before the `:target` route
-    // below, or Express would treat "version" as a download target and 404 it.
-    app.get('/downloads/devbox/version', (_req, res) => {
-      res.set('Cache-Control', 'public, max-age=60');
-      res.json(devboxDownloads.versionJson());
-    });
-    app.get('/downloads/devbox/:target', (req, res) => {
-      const url = devboxDownloads.redirectFor(req.params.target);
-      if (!url) return res.fail('unknown_target', 404, { targets: Object.keys(devboxDownloads.latestJson().assets) });
-      res.set('Cache-Control', 'public, max-age=60');
-      res.redirect(302, url);
-    });
+    mountDevboxDownloads(app, buildDevboxDownloads(devboxCfg));
   }
 
   // Standalone `bongos` CLI downloads + the one-line installer (task 1248,
@@ -979,4 +992,4 @@ function mountInternalSurfaces(app) {
   return app;
 }
 
-module.exports = { mountInternalSurfaces, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };
+module.exports = { mountInternalSurfaces, mountDevboxDownloads, isStatusHost, isBuildersHost, injectBrandingGlobal, injectBrandingInto, injectModuleHallWidgets, themeMarkup, applyBrandTokens, resolveOpenapiJson, openapiJson, tryLoadInstanceConfig };

package/src/module-api.js

@@ -527,8 +527,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.48 with no explicit bump. run 31523559509. (task 1002620)
 //   1.19.50 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.49 with no explicit bump. run 31524280584. (task 1002620)
+//   1.19.51 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.50 with no explicit bump. run 31525032273. (task 1002620)
+//   1.19.52 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.51 with no explicit bump. run 31526131183. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.50'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.52'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/devbox_downloads.mjs

@@ -119,5 +119,22 @@ t('config/devbox-app.json parses, resolves every target, and aliases point at re
   }
 });
 
+console.log('update manifest (task 1002649 — the payload the devbox-app updater reads):');
+
+t('committed config yields a NON-EMPTY manifest — version + at least one asset in both shapes', () => {
+  // The live symptom behind task 1002649 was latest.json arriving as an empty
+  // body. The route is a pure function of this committed config, so pin here
+  // that the manifest can never be empty at the source.
+  const d = buildDevboxDownloads(committedConfig);
+  for (const shape of [d.latestJson(), d.versionJson()]) {
+    assert.match(shape.version, /^\d+\.\d+\.\d+$/, 'manifest carries a semver version');
+    assert.ok(Object.keys(shape.assets).length >= 1, 'manifest carries at least one asset');
+  }
+});
+
+// The client-path pin (extensionless /version, never .json) lives in
+// tests/devbox_update_path.mjs — NOT here — so it still runs on the neutral
+// core checkout where this file topology-skips (task 1002649).
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/devbox_update_path.mjs

@@ -0,0 +1,84 @@
+// tests/devbox_update_path.mjs — the devbox-app update-check path pin (task 1002649).
+//
+// Deliberately SEPARATE from tests/devbox_downloads.mjs: that file topology-
+// skips wherever config/devbox-app.json is absent (this neutral core checkout),
+// but this pin reads only the app client's SOURCE, so it must run everywhere —
+// including this repo's `unit` lane.
+//
+// Why the pin exists: a front proxy with a file-matcher can eat *.json paths
+// before they reach Node — the live pre-ADR-0152 vhost 404'd
+// /downloads/devbox/latest.json with an empty body while the extensionless
+// /downloads/devbox/version twin worked, silently breaking the app's update
+// check. The updater only needs { version, assets }, which /version carries.
+//
+// Run:  node --test tests/devbox_update_path.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const src = readFileSync(new URL('../modules/dev-box/app/src/gds-client.js', import.meta.url), 'utf8');
+
+test('latestRelease polls the extensionless /downloads/devbox/version, never a .json path', () => {
+  const line = src.split('\n').find((l) => l.includes('latestRelease:'));
+  assert.ok(line, 'gds-client exposes latestRelease');
+  assert.ok(line.includes("'/downloads/devbox/version'"), 'latestRelease polls /downloads/devbox/version');
+  assert.ok(!line.includes('latest.json'), 'latestRelease must not poll a .json-suffixed path');
+});
+
+// ---- The ACTUAL route handlers, over loopback (the docs_openapi_route ----
+// pattern). This is the layer the repo owns: the Express routes must serve a
+// NON-EMPTY manifest on all three paths and redirect targets. (The infra layer
+// above Node — the host's front proxy — cannot be pinned from a unit test;
+// that is blocker 1000105. These pins guarantee that when a request reaches
+// Node, the manifest is never empty.)
+const CFG = {
+  releases_repo: 'owner/devbox-releases',
+  version: '9.9.9',
+  assets: { 'win-x64': 'Setup-9.9.9-x64.exe', 'mac-arm64': 'App-9.9.9-arm64.dmg' },
+  aliases: { windows: 'win-x64', mac: 'mac-arm64' },
+};
+
+async function withDevboxServer(fn) {
+  const express = require('express');
+  const { mountDevboxDownloads } = require('../src/bongos/serve-internal.js');
+  const { buildDevboxDownloads } = require('../src/devbox-downloads.js');
+  const app = express();
+  mountDevboxDownloads(app, buildDevboxDownloads(CFG));
+  const server = await new Promise((resolve) => { const s = app.listen(0, () => resolve(s)); });
+  try {
+    await fn(`http://127.0.0.1:${server.address().port}`);
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+}
+
+test('latest.json and the extensionless /latest twin both serve the full non-empty manifest', async () => {
+  await withDevboxServer(async (base) => {
+    for (const p of ['/downloads/devbox/latest.json', '/downloads/devbox/latest']) {
+      const r = await fetch(base + p);
+      assert.equal(r.status, 200, `${p} must 200`);
+      assert.match(r.headers.get('content-type') || '', /application\/json/, `${p} content-type`);
+      const j = await r.json();
+      assert.equal(j.version, '9.9.9');
+      assert.ok(Object.keys(j.assets).length >= 1, `${p} manifest must carry assets — the task-1002649 empty-body class`);
+      assert.equal(j.assets['win-x64'].file, 'Setup-9.9.9-x64.exe');
+      assert.match(j.assets['win-x64'].url, /\/releases\/download\/v9\.9\.9\//);
+    }
+  });
+});
+
+test('/version serves the flat update-check payload; a target redirects 302', async () => {
+  await withDevboxServer(async (base) => {
+    const v = await fetch(base + '/downloads/devbox/version');
+    assert.equal(v.status, 200);
+    const j = await v.json();
+    assert.equal(j.version, '9.9.9');
+    assert.equal(typeof j.assets['win-x64'], 'string', 'flat {target: url} shape');
+    const r = await fetch(base + '/downloads/devbox/windows', { redirect: 'manual' });
+    assert.equal(r.status, 302);
+    assert.match(r.headers.get('location') || '', /Setup-9\.9\.9-x64\.exe$/);
+  });
+});

package/tests/migration_allocation.mjs

@@ -197,6 +197,7 @@ function shouldReserveMigrationNumber(task) {
         [() => db.updateTaskAutomationTag(1, 'live-only'), 'automation_tag'],
         [() => db.updateTaskNeedsMigration(1, false), 'needs_migration'],
         [() => db.updateTaskModuleKey(1, null), 'module_key'],
+        [() => db.updateTaskDescription(1, 'edited body'), 'description'], // task 1002647
       ];
       for (const [call, column] of setters) {
         const before = seen.length;