@bongos/core 1.19.628 → 1.19.629

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.628",
-  "core_contract": "1.19.628",
-  "source_commit": "4f99983713ad375f7f42c932c781c3c77a47bc66",
+  "core_version": "1.19.629",
+  "core_contract": "1.19.629",
+  "source_commit": "80bf853bd558fa5134bd5bddcb0e4804579fc27e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-09T19:56:16.788Z",
+  "built_at": "2026-09-09T22:26:18.376Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 466,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2588,
-  "tree_sha256": "ab072d3e169daecbd6fbfc4d2e18d2786ea247cb5b84a4d4d5dc06cf17b0c210",
+  "tree_sha256": "c5bd187e5ed644428b20c65f6fee6c2b6b122ae4952a3e36e19b84cfa2e4d722",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -332,7 +332,7 @@
     {
       "path": ".gitattributes",
       "mode": "0000644",
-      "sha256": "7f5faf22678ad182025b2f3f9107c209f92e461200e15665fa2feb4a3cd86858"
+      "sha256": "83c94b055dc619fdbf3bc1142fc5357810d901e4200644f1fb399e6939571c5f"
     },
     {
       "path": "CLAUDE.md",
@@ -2767,7 +2767,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f0bda08beedf16b6f2eed29c598f4a7602c35e84f084ca744861c6242656fe01"
+      "sha256": "aba3d7e763196a3052a53ee81f5327e0caad5274bd4de41b09b031b2277c82d2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3012,7 +3012,7 @@
     {
       "path": "docs/recipes/windows-builders.md",
       "mode": "0000644",
-      "sha256": "229da205775c6b84534633bc15be7355337d0d8cfacd81ff03860bc24bfc783f"
+      "sha256": "b7d849d1786c7eca4156969d38343425839bef3bae19a10a94b5e54916e3ea09"
     },
     {
       "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
@@ -7697,12 +7697,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "aba13c3ae1fa839b97bc3f11aff342251f550f7cbcc8531a9ae3c6856f326d6e"
+      "sha256": "41fdf5ef9ec5b4cb8a9f7a85f0efeba2595895fc5688c3c78702652fe4002d67"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bdea58839926be753b49b016fc961cff55481f292f911d9fa044e77db022db21"
+      "sha256": "c8bb2a1526d2abc3ba1bcb859d83ca86a081fd7c89a178f45f5b39a481ecaebe"
     },
     {
       "path": "public-docs/index.html",
@@ -8012,7 +8012,7 @@
     {
       "path": "scripts/gds/copy-inventory.js",
       "mode": "0000644",
-      "sha256": "8c798359b51abdd749233e65aa5906732bccc5b9088dae32513cde7949404b6c"
+      "sha256": "7269164648fc1d00e1bf3272a82f933a5f8da228e562e00848dbc29c671d3e94"
     },
     {
       "path": "scripts/gds/coreB-carve-proof.sh",
@@ -9442,7 +9442,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f14dc0f62bb0abba340f775a22b7810b56eacc91c29015a9712f7d9afd57f0ac"
+      "sha256": "46df738e31dab69636774474ec6714365bf625a395df0a0e5ab4ecbacf178b16"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10137,7 +10137,7 @@
     {
       "path": "tests/copy_inventory.mjs",
       "mode": "0000644",
-      "sha256": "97ff5dac1f7bef96cf0f80082e8f6ebb2cea30f3c371c3ab080e9189818fb5fd"
+      "sha256": "716aa03c5e93b71aec0c7e6fe646e5abd702b8b6ffda0ef6235a804d2c17a0ca"
     },
     {
       "path": "tests/cosmos_token_contrast.mjs",
@@ -10517,7 +10517,7 @@
     {
       "path": "tests/git_merge_regen.mjs",
       "mode": "0000644",
-      "sha256": "1d5f97589b84b493f7406fba3b162443a70fbf0ad24190049d054dbd2fe17273"
+      "sha256": "c6cb1bda6809d8d384a9c35b376995af038d18c26b1b935cb5c0faebb163b72e"
     },
     {
       "path": "tests/github_push_ancestry.mjs",

package/.gitattributes

@@ -85,8 +85,18 @@ src/bongos/routes/CLAUDE.md   merge=otb-regen
 # files. Same otb-regen shape as docs/session-log-index.md above (whole-file
 # rebuild, all three merge sides ignored); REGENERABLE in git-merge-regen.js
 # carries the matching rule.
+#
+# The `text eol=lf` on the .md (task 1003619) is NOT cosmetic — it is what keeps
+# `copy-inventory.js --check` honest on Windows. The generator writes LF and the
+# check string-compares its output against the worktree file, so under the default
+# `* text=auto` above (index LF, worktree CRLF) the check reported STALE forever on
+# every Windows checkout while the committed content was already correct. The .json
+# never had the bug because `*.json text eol=lf` above already pins it; the .md fell
+# through to text=auto because no `*.md` rule exists (and none should — pinning all
+# 685 tracked .md files would renormalize the whole docs tree for one generated file).
+# `*.md` deliberately stays unpinned; only the GENERATED artifact is pinned here.
 docs/copy-registry.json    merge=otb-regen
-docs/copy-inventory.md     merge=otb-regen
+docs/copy-inventory.md     merge=otb-regen text eol=lf
 
 # Append-only index tables (task 1385 / ADR 0082). docs/adr/README.md is a
 # hand-maintained ADR index whose ONLY recurring conflict is two branches each

package/docs/module-api-changelog.md

@@ -1705,5 +1705,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.626 with no explicit bump. run 34390069410. (task 1002620)
   1.19.628 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.627 with no explicit bump. run 34397967061. (task 1002620)
+  1.19.629 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.628 with no explicit bump. run 34412159317. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/windows-builders.md

@@ -147,3 +147,4 @@ caught a real bug during task 1003548, so read its assertion before blaming the
 
 - Several hall files (`people.css`, `people.html`, `style.css`, the privacy spec) and every `.claude/skills/*/SKILL.md` are CRLF; `scripts/gds/*.js` and the tests are LF. An exact-string patch must detect the file's EOL before joining lines (`text.includes('\r\n') ? '\r\n' : '\n'`), or the find matches nothing and the edit is a silent no-op (session log 2026-08-24).
 - A `git diff --stat` that touches every line of a file you barely edited is an EOL flip — check with `git diff --stat --ignore-cr-at-eol`, and restore the original EOL before committing.
+- **`copy-inventory.js --check` no longer reds on line endings alone** (task 1003619). It used to: the generator emits LF and the check byte-compared that against a CRLF worktree file, so `/ship-check` showed one permanent red line on every Windows checkout while the committed content was already correct — and a builder who "fixed" it committed a whole-file CRLF diff. `docs/copy-inventory.md` is now pinned `text eol=lf` in `.gitattributes` (its `.json` sibling always was, via `*.json`), and the check compares EOL-blind so an already-CRLF worktree passes without a re-clone. If it reports STALE now, the content really is stale — regenerate, don't reach for `--ignore-cr-at-eol`. Note `*.md` is deliberately NOT pinned repo-wide; only that one generated artifact is.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.628",
+  "version": "1.19.629",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.628",
+      "version": "1.19.629",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.628",
+  "version": "1.19.629",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-inventory.js

@@ -485,6 +485,32 @@ function renderReport(reg) {
   return L.join('\n');
 }
 
+// Line-ending-blind view of a file's text, for the --check compare ONLY (task 1003619).
+// Why: the generator emits LF, and --check string-compares that against the file on
+// disk. A Windows checkout hands back CRLF, so the compare reported STALE forever on
+// content that was byte-identical in the index — a permanently red /ship-check gate,
+// which teaches builders to wave past the one check that catches a REAL stale artifact.
+// .gitattributes now pins this pair to eol=lf, but that only governs FUTURE checkouts:
+// a file already sitting CRLF in an existing worktree stays CRLF until renormalized,
+// so the checker must not care either way. Freshness is a question about CONTENT.
+// Not used on the write path — generated files are still written with LF endings.
+function lf(s) {
+  return s.replace(/\r\n/g, '\n');
+}
+
+// Is the artifact on disk still what the generator would write? Freshness is a
+// question about CONTENT, so CRLF-vs-LF is not a difference — see lf() above for
+// why that mattered. A missing file (`have === null`) is stale by definition.
+// Only \r\n is folded, NOT a lone \r: no tool in this repo emits classic-Mac
+// endings, and treating a bare \r as a newline would let a genuinely corrupt file
+// read as fresh. Pure + exported so the decision is unit-testable without writing
+// to the committed artifacts (same shape as shouldRefuseSessionClaim in
+// modules/lifecycle/routes/claims.js).
+function matchesGenerated(have, want) {
+  if (have === null || have === undefined) return false;
+  return lf(have) === lf(want);
+}
+
 function write({ check = false } = {}) {
   const reg = buildRegistry();
   const json = `${JSON.stringify(reg, null, 2)}\n`;
@@ -495,7 +521,7 @@ function write({ check = false } = {}) {
     const stale = [];
     for (const [p, want] of [[jsonPath, json], [mdPath, md]]) {
       const have = fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null;
-      if (have !== want) stale.push(path.relative(REPO_ROOT, p));
+      if (!matchesGenerated(have, want)) stale.push(path.relative(REPO_ROOT, p));
     }
     return { reg, stale };
   }
@@ -525,5 +551,5 @@ if (require.main === module) {
 module.exports = {
   SURFACES, COPY_ATTRS, BLIND_SPOTS, REGISTRY_REL, REPORT_REL,
   cmp, stableId, looksLikeCopy, lineIndex, lineAt, stripEmbedded, fromHtml, fromJs, filesFor,
-  buildRegistry, renderReport, write,
+  buildRegistry, renderReport, write, lf, matchesGenerated,
 };

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.628'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.629'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/git_merge_regen.mjs

@@ -176,9 +176,24 @@ function withBlockBody(src, body) {
 // .gitattributes, one in REGENERABLE) — nothing checked that they still matched, so
 // docs/copy-inventory.md + docs/copy-registry.json could be (and were) added to
 // neither and merge like ordinary text. This pins the two lists as one set.
+// A .gitattributes line may carry SEVERAL attributes for one path — git reads
+// `docs/copy-inventory.md merge=otb-regen text eol=lf` exactly as it reads the
+// bare `merge=otb-regen` form. The original matcher here was end-anchored
+// (/^(\S+)\s+merge=otb-regen\s*$/), so adding any second attribute made this
+// check stop SEEING the entry and report it as missing (task 1003619, where the
+// .md gained an eol pin). Under-inclusive in the dangerous direction too: a
+// regenerable path declared with extra attributes would slip the REGENERABLE
+// cross-check entirely. Tokenize the attribute list instead of pattern-matching
+// the whole line, so the set equality below is about PATHS, not line formatting.
 {
   const attrsText = fs.readFileSync(path.join(repo, '.gitattributes'), 'utf8');
-  const otbRegenPaths = [...attrsText.matchAll(/^(\S+)\s+merge=otb-regen\s*$/gm)].map((m) => m[1]);
+  const otbRegenPaths = attrsText
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line && !line.startsWith('#'))
+    .map((line) => line.split(/\s+/))
+    .filter((tokens) => tokens.slice(1).includes('merge=otb-regen'))
+    .map((tokens) => tokens[0]);
   assert.ok(otbRegenPaths.length > 0, 'expected at least one merge=otb-regen line in .gitattributes');
   for (const p of otbRegenPaths) {
     assert.ok(regen.REGENERABLE.has(p), `.gitattributes declares merge=otb-regen for ${p} but REGENERABLE (git-merge-regen.js) does not know it`);