@bongos/core 1.19.602 → 1.19.604

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.602",
-  "core_contract": "1.19.602",
-  "source_commit": "ca03701e78c9390c176c73f0dec2b563083b1e43",
+  "core_version": "1.19.604",
+  "core_contract": "1.19.604",
+  "source_commit": "a0b8d2452aa627d45214f54b63305c41150dfffd",
   "source_ref": "HEAD",
-  "built_at": "2026-09-08T05:15:57.913Z",
+  "built_at": "2026-09-08T23:04:26.027Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 457,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2558,
-  "tree_sha256": "13e4a26b146d93eb6acf0b25727174b402c29e627a2a522f800f30be739dab2f",
+  "tree_sha256": "e207bd28e7b6dfedc243c12724dc4419850b2fd1b573af52c057014c148408ee",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2727,7 +2727,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "bd7f11eca7a06de98c0f11aad60e8128cda215ac91d9bc108af94b54e9c7df91"
+      "sha256": "e2b518f8b64d95ee83ea4821e25942fc0b37e6ac3c3ebf0c2351ffad064f7020"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2762,7 +2762,7 @@
     {
       "path": "docs/onboarding/diagrams/05-versioning.mmd",
       "mode": "0000644",
-      "sha256": "3ed87568c4635c1835a3c4e375fd302da6eb46e394a8beffb83127a081e6c4ba"
+      "sha256": "9953ad9844456ab15b151e7e0d9c4bdedbde2551e59e6626ca00b18acee413b8"
     },
     {
       "path": "docs/onboarding/diagrams/README.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/onboarding/diagrams/assertions.json",
       "mode": "0000644",
-      "sha256": "56de4892dbe0bd388bdf904d25dd6c8ebc6b2f5553e640c761245dbc1e463a92"
+      "sha256": "01096656b5a5aef3a11322dbde7a3339f9605388186d7e25e2e6b2c2aaee198b"
     },
     {
       "path": "docs/onboarding/diagrams/puppeteer-config.json",
@@ -5567,7 +5567,7 @@
     {
       "path": "modules/lifecycle/db-versions.js",
       "mode": "0000644",
-      "sha256": "2c10a17f86506788ab2f9db25c23024120ec9fddb3c7c4894e65d8354cd46869"
+      "sha256": "51b170cdd34a90c49070ec79723b5250dffbc8c61d5ed114d6a560bcc93cadb7"
     },
     {
       "path": "modules/lifecycle/db.js",
@@ -7627,12 +7627,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4f6f3fe27c26565c9b2b010a7970bfe1322e4d91d53d6bb8c4f5cfd592c8c7d3"
+      "sha256": "5641c682f6618871cdcb765ee962b6b7ce884bad1786e6ee4a24c8bf0a43f8c0"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "43b5dfed26f44044bbb3730cd8dd0ac08f251e95a2c0942d440d1dd8c5ca5633"
+      "sha256": "a725aa33a88eadd39a01540bd819b5856c541d3d10f6386bcd8ee05b70497377"
     },
     {
       "path": "public-docs/index.html",
@@ -9347,7 +9347,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ecb3569e4061f1cb6cb82d9d88eeb00e0cf7eaf56796ee5c1bacba73ca6b2ef1"
+      "sha256": "ec2543ebf2e3bd98d8497238975cec5bccc13cbff7f8835b42bec4757ae078f9"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12727,12 +12727,12 @@
     {
       "path": "tests/version_promotion.mjs",
       "mode": "0000644",
-      "sha256": "43ba25381f3d02d7ecaaa8a2639bb8f1f72587d6966e6498db1c887b289148eb"
+      "sha256": "a2be1bb9ea506cac6f1d7e4c54fe4dbd07fbca5fbd64624c099c0faf8be528de"
     },
     {
       "path": "tests/version_roll_forward.mjs",
       "mode": "0000644",
-      "sha256": "fa0f079b8dff816806788bc34b6beb31e3366d5c7166e531108fe4ea40890373"
+      "sha256": "cb4b723c632f3ec5f3bdbf06057d252bfbe3052841548a8ac386984c52447fc9"
     },
     {
       "path": "tests/versions_route.mjs",

package/docs/module-api-changelog.md

@@ -1653,5 +1653,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.600 with no explicit bump. run 34188958832. (task 1002620)
   1.19.602 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.601 with no explicit bump. run 34189930315. (task 1002620)
+  1.19.603 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.602 with no explicit bump. run 34191126290. (task 1002620)
+  1.19.604 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.603 with no explicit bump. run 34288910914. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/onboarding/diagrams/05-versioning.mmd

@@ -18,6 +18,8 @@ flowchart TB
         v_GDS_V4 --> v_BONGOS_V1
         v_CB_V1["CB-V1 — building"]
         v_BONGOS_V1 --> v_CB_V1
+        v_BONGOS_V2["BONGOS-V2 — planning"]
+        v_CB_V1 --> v_BONGOS_V2
     end
     VERSIONS --> CLOSE["Version close — all done_when_criteria satisfied"]
     CLOSE --> ARCHIVE["Archive scope to limitations/*.md; status=shipped"]

package/docs/onboarding/diagrams/assertions.json

@@ -69,6 +69,10 @@
       {
         "id": "CB-V1",
         "status": "building"
+      },
+      {
+        "id": "BONGOS-V2",
+        "status": "planning"
       }
     ]
   },

package/modules/lifecycle/db-versions.js

@@ -404,11 +404,27 @@ async function closeVersion({ versionId, plan = [], reason, planningVersionId =
         // Smoke fixtures are excluded on the same terms as the abandon branch, so
         // both doors agree about what "unfinished" means.
         const { rows: moved } = await client.query(
-          `UPDATE tasks SET goal_id = $2, updated_at = now()
+          // THE VERSION MOVES WITH THE GOAL (task 1003710). Setting only
+          // `goal_id` leaves the task in a goal on the SUCCESSOR while still
+          // stamped with the version that just closed, and that column is not
+          // decoration: `version_progress` joins `tasks t ON t.version_id = v.id`
+          // and `version-close.js` filters `WHERE version_id = $1` in three
+          // places. A half-moved task therefore counts against a SHIPPED version
+          // forever, never counts toward the successor, and leaves the closed
+          // version still reporting carry-over it no longer holds — surfacing as
+          // "V1 closed but still shows N carried", a long way from here.
+          //
+          // Identical to the fix task 1003709 made to `carryBugsForward`
+          // (db-goals.js). Both halves of the boundary move — the roll-forward
+          // here and the maintenance carry-over there — and I shipped both with
+          // the same defect while only one got fixed. tests/version_roll_forward.mjs
+          // now pins the two against each other so the next edit cannot drift one
+          // without the other.
+          `UPDATE tasks SET goal_id = $2, version_id = $3, updated_at = now()
             WHERE goal_id = $1 AND ${nonTerminalSql('status')}
               AND title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
             RETURNING id`,
-          [step.goalId, successorId]
+          [step.goalId, successorId, planningVersionId]
         );
 
         await client.query(

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.602",
+  "version": "1.19.604",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.602",
+      "version": "1.19.604",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.602",
+  "version": "1.19.604",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.602'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.604'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/version_promotion.mjs

@@ -128,7 +128,11 @@ test('the hook is composed in the ROUTE, not inside closeVersion', () => {
   // the module's require DAG — and the route is the one place already holding the
   // whole facade. Reaching sideways between the units is how that DAG stops being
   // one.
-  assert.equal(/carryBugsForward/.test(DBV), false,
+  // Comments stripped: db-versions.js NAMES carryBugsForward in prose (task
+  // 1003710's fix note points at the identical fix made there), and a check that
+  // read the explanation would fail on the cross-reference rather than on a call.
+  const dbvCode = DBV.replace(/\/\/[^\n]*/g, '');
+  assert.equal(/carryBugsForward/.test(dbvCode), false,
     'db-versions.js must not reach into db-goals.js');
   assert.match(ROUTES, /db\.promotePlanningVersion\(client\)/);
   assert.match(ROUTES, /db\.carryBugsForward\(/);

package/tests/version_roll_forward.mjs

@@ -36,7 +36,16 @@ const ROUTES = src('modules/lifecycle/routes/versions.js');
 
 // The roll_forward branch, sliced so assertions land on the right code.
 const CLOSE = DBV.slice(DBV.indexOf('async function closeVersion'));
-const ROLL = CLOSE.slice(CLOSE.indexOf("verb: 'roll_forward'") - 4000, CLOSE.indexOf('// The invariant'));
+// The roll_forward branch, bounded by its own `else {` and the invariant check
+// that follows the disposition loop. Anchored on real markers rather than a
+// character offset: a `- 4000` window silently stopped reaching the branch's own
+// guard the moment the branch grew (task 1003710 added a comment and broke it).
+const ROLL = (() => {
+  const start = CLOSE.lastIndexOf('} else {', CLOSE.indexOf("verb: 'roll_forward', result: 'succeeded'"));
+  const end = CLOSE.indexOf('// The invariant');
+  if (start === -1 || end === -1) throw new Error('roll_forward branch markers moved — fix this slice, do not widen it');
+  return CLOSE.slice(start, end);
+})();
 
 // ---------------------------------------------------------------------------
 // The lineage
@@ -95,6 +104,33 @@ test('only UNFINISHED tasks are re-pointed; shipped work stays with the version
   assert.match(move, /smoke/, 'smoke fixtures are excluded on the same terms as the abandon branch');
 });
 
+test('the VERSION moves with the goal, not just the goal_id (task 1003710)', () => {
+  // THE BUG THIS PINS, and it shipped. Setting only `goal_id` leaves the task in
+  // a goal on the successor while still stamped with the version that closed.
+  // `version_progress` joins `tasks t ON t.version_id = v.id` and
+  // `version-close.js` filters `WHERE version_id = $1`, so the task counts
+  // against a SHIPPED version forever, never counts toward the successor, and
+  // leaves the closed version reporting carry-over it no longer holds.
+  const move = ROLL.slice(ROLL.indexOf('UPDATE tasks SET goal_id'), ROLL.indexOf('RETURNING id`,', ROLL.indexOf('UPDATE tasks SET goal_id')));
+  assert.match(move, /version_id = \$3/, 'the successor version must be written too');
+  assert.match(ROLL, /\[step\.goalId, successorId, planningVersionId\]/, 'and bound, not interpolated');
+});
+
+test('BOTH boundary moves write both columns — they cannot drift apart', () => {
+  // The roll-forward here and `carryBugsForward` in db-goals.js are the two ways
+  // a task crosses a version boundary. They shipped with the same defect and only
+  // one was fixed (task 1003709 fixed the carry-over, 1003710 this one). Pinning
+  // them against each other is what stops the next edit repeating it.
+  const dbg = src('modules/lifecycle/db-goals.js');
+  const carry = dbg.slice(dbg.indexOf('async function carryBugsForward'));
+  const carryMove = carry.slice(carry.indexOf('UPDATE tasks SET goal_id'));
+  for (const [name, sql] of [['roll_forward (db-versions.js)', ROLL.slice(ROLL.indexOf('UPDATE tasks SET goal_id'))],
+                             ['carryBugsForward (db-goals.js)', carryMove]]) {
+    assert.match(sql.slice(0, 200), /goal_id = \$2/, `${name}: must move goal_id`);
+    assert.match(sql.slice(0, 200), /version_id = \$3/, `${name}: must move version_id`);
+  }
+});
+
 test('the predecessor is archived LAST, after its work has left', () => {
   // The brief's explicit ask: it archives holding zero unfinished tasks, so it
   // passes R10's own closure check on the way out rather than being