@bongos/core 1.19.759 → 1.19.761

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.759",
-  "core_contract": "1.19.759",
-  "source_commit": "707e9f0b5bf49699402632ba77c655817675f27c",
+  "core_version": "1.19.761",
+  "core_contract": "1.19.761",
+  "source_commit": "3412fa5f1d7bb5d383191d64806396f61b136ae5",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T03:03:00.033Z",
+  "built_at": "2026-09-16T03:36:29.589Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2623,
-  "tree_sha256": "72ddc6e8bfc5b6eb4aa5ab50108bbe35d4639bb91cad6318c0d6359b3c86ceec",
+  "tree_sha256": "e9ee270455be1db1f07c7c206e5f9ba6a408a2f231634a18330a70ac78a0ed59",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1c38ce9a7932e516d69df1e3deaf499f2a8e10ef545e8d4621919eef11a14b8a"
+      "sha256": "94b5d8c1844e775937a9acec9a78b5c2a789ed6e8e194835c02cd0d2634a4d29"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7567,12 +7567,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d3aebc78f2bcf902f69e9f27bb7375410de5851af241dbaebf7aefe729465f69"
+      "sha256": "172d01adc5b82fa70d7079ec41e84a7a99b89b84c40c58d8d383b45c7a18f584"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "83cc5d9eb22a0201d8a6bca2a74392b23eb9713aa78a651200552a3e2710b273"
+      "sha256": "7f3d59f7939972bb1a32c493f4203e0c22286a3296ae69d9a11a06ed2c5d62a9"
     },
     {
       "path": "public-docs/index.html",
@@ -8242,7 +8242,7 @@
     {
       "path": "scripts/gds/linkify-refs.js",
       "mode": "0000644",
-      "sha256": "ad292a1bcfd4c9f3ef93260af1b1a34883b78185ba03d0677b51765165915ea1"
+      "sha256": "73be262f96571e9d35ed83f0c9d27e7652f1dad74016c302f8b24d1d9a724333"
     },
     {
       "path": "scripts/gds/lint-infra-exec.js",
@@ -9352,7 +9352,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "f4bba033b2052b61d026682b0a06dd3044d77138e1978ad601060fbebbfdc34d"
+      "sha256": "405b8069c27ea596981cd4a2fd6a57b7e3637022cf63962d46a19b452fa675fc"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -9382,7 +9382,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8ec75227e0ef1df2b932e943d085151cbb47133212aae42c86b425fb664a3c4c"
+      "sha256": "3429cc6b1beee6916f92a274dd2e85be55cb7e10236d8d70c4a4a8cf7ac6387c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11067,7 +11067,7 @@
     {
       "path": "tests/hall_page_gate_map.mjs",
       "mode": "0000644",
-      "sha256": "c4da76a78326495bad7393797d47ca076f8ad1f49fc3224fa2be337a3b6f109d"
+      "sha256": "10d8376f94e415d20b112a61e8d1f7f8f0f539eba5f685bdac4509624a69c13e"
     },
     {
       "path": "tests/hall_palette.mjs",
@@ -11457,7 +11457,7 @@
     {
       "path": "tests/linkify_refs.mjs",
       "mode": "0000644",
-      "sha256": "ba5164ec77b5541b22b50ed7611dfbbe61731f62b3dfbb678f7de4f77282e918"
+      "sha256": "f4e905823f8c3b7f540d3dbc6a9873198a26e022810b21194b2ae45ef9437954"
     },
     {
       "path": "tests/live_channel.mjs",

package/docs/module-api-changelog.md

@@ -1992,5 +1992,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.757 with no explicit bump. run 35049006030. (task 1002620)
   1.19.759 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.758 with no explicit bump. run 35050268139. (task 1002620)
+  1.19.760 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.759 with no explicit bump. run 35052040282. (task 1002620)
+  1.19.761 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.760 with no explicit bump. run 35052410219. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.759",
+  "version": "1.19.761",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.759",
+      "version": "1.19.761",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.759",
+  "version": "1.19.761",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/linkify-refs.js

@@ -200,6 +200,72 @@ const LIST_GLUE_RE = /^[\s,–—-]*(?:and|&|\+|or|to|through)?[\s,–—-]*$/i;
 // last. Each site builds its own.
 const REF_DIGITS = '\\d{1,7}';
 
+// ---- the ordinal-prose guard (task 1002975) --------------------------------
+//
+// THE BUG. With no context word, a bare `#N` was linkified on ID EXISTENCE ALONE:
+// the prose "side door #1" became a link to task 1, while its sibling "side door
+// #2" survived only because no id 2 exists. That is luck, not grammar, and task
+// 1002974 had to repair a committed doc because of it.
+//
+// THE RULE, AND WHY IT IS A WIDTH RULE. The originating row proposed "a preceding
+// bare noun without task/idea/blocker context words → leave alone". Measured
+// against the actual corpus, that is far too broad: running linkifyText over every
+// committed .md with a maximally permissive id set rewrites 231 context-less refs,
+// 77 of them preceded by a bare word — and 49 of those are GENUINE ("the #506",
+// "by #435", "under #436"). Skipping on the preceding noun alone would leave ~49
+// real refs bare, which is exactly the GitHub-mis-autolink harm this script exists
+// to prevent. So the noun test alone would have traded one defect for a worse one.
+//
+// What DOES separate them in the corpus is WIDTH. All 28 word-preceded refs of 1–2
+// digits are ordinal prose — "§Decision #4" (an ADR section, 13 of them), "limiter
+// #4", "limiter #5", "idea fixture #1", "fixture #4", "ask #1", "and #7", "with
+// #5" — and every word-preceded ref of 3+ digits is a real task. Ordinals in
+// English prose are small; the ids these docs cite are not. Hence: no context
+// word, AND a bare word immediately before, AND at most two digits.
+//
+// Both conjuncts are load-bearing. Drop the width and 49 real refs go bare; drop
+// the preceding-word test and "(#1)" or a line-leading "#7" — which the corpus
+// shows are ordinarily genuine — stop linking too.
+//
+// Known cost, accepted: "PMS-V2 #37" and "the #54" are legacy two-digit refs that
+// now stay bare. Two ambiguous links lost against ~26 false ones fixed, and a bare
+// "#37" with no entity word is ambiguous to a human reader as well.
+//
+// This lands in linkifyText rather than beside it because `.claude/hooks/
+// stop-refcheck.js` classifies by CALLING linkifyText — so the same prose stops
+// being flagged in chat by the same change, with no second copy of the rule.
+// The one context word the guard must stand down for. There is deliberately NO
+// task entry in classifyKind — "task #170" is handled by the DEFAULT path (no
+// kind, id exists → link), because a task is the thing this resolver is for. That
+// leaves "task #3" looking exactly like "limiter #4" to a width rule, and the
+// first cut of this guard ate it. Caught by its own test, which is why the test
+// exists. Not folded into ENTITY_RE: that set means "shares the integer space
+// with tasks but is NOT one", and adding `task` there would neutralize every
+// "task #N" into a code span.
+const TASK_CTX_RE = /\b(tasks?)[`'")\s(:]*$/i;
+// Words that INTRODUCE a reference rather than being the noun it counts. The row
+// asked for "a preceding bare NOUN", and these are not nouns: "see #2" is a real
+// ref and the Stop hook is right to block it in chat, which is how this omission
+// was caught — tests/stop_refcheck.mjs went red on exactly that string.
+//
+// Kept deliberately short, and checked against the corpus rather than guessed: the
+// 1–2 digit word-preceded refs in committed docs are preceded by pms-v2 · task ·
+// the · ask · and · decision · limiter · fixture · sr · with · fixing. None of
+// these six appears there, so exempting them re-breaks nothing that was measured.
+// Words like "the", "and", "with" and "of" are NOT here on purpose — they precede
+// ordinal phrases at least as often as references ("ask #1 and #7" means the
+// questions, not two tasks).
+const ORDINAL_EXEMPT_RE = /\b(see|from|per|via|in|at)[`'")\s(:]*$/i;
+const ORDINAL_MAX_DIGITS = 2;
+// A bare word (letters, then letters/digits/'/-) immediately before the '#',
+// separated by spaces or tabs or nothing at all. Anchored at the end of the left
+// context. The whitespace is OPTIONAL because the corpus contains "SR#11" — a
+// security-review finding number, unspaced and just as much a false positive as
+// the spaced ones. Widening it is safe precisely because the width conjunct is
+// what protects real refs: every word-adjacent ref of 3+ digits is untouched
+// either way, so this only ever admits more of the same two-digit class.
+const ORDINAL_PROSE_LEFT_RE = /[A-Za-z][A-Za-z0-9'-]*[ \t]*$/;
+
 const RESOLVER_LINK_RE = new RegExp(`\\[#(${REF_DIGITS})\\]\\((?:https?:\\/\\/[^/)\\s]+)?\\/builders#\\/task\\/(${REF_DIGITS})\\)`, 'g');
 
 // Classify a ref by its left context (+ list-glue carry). Returns one of
@@ -313,6 +379,11 @@ function linkifySegment(segment, ids, leftContext, stats) {
     } else if (kind === 'github') {
       // "PR #475" — genuinely GitHub's number space; the bare autolink is CORRECT.
       skipReason = 'github-namespace';
+    } else if (!kind && !TASK_CTX_RE.test(left) && !ORDINAL_EXEMPT_RE.test(left)
+               && ORDINAL_PROSE_LEFT_RE.test(left) && num.length <= ORDINAL_MAX_DIGITS) {
+      // "side door #1", "limiter #4", "§Decision #4" — a noun followed by a small
+      // ordinal, not a ref. See ORDINAL_MAX_DIGITS for the corpus evidence.
+      skipReason = 'ordinal-prose';
     } else if (!kind && !ids.tasks.has(Number(num))) {
       // No context and not a known task id — too ambiguous to touch (a bare PR
       // ref, a future task, a numeric color). Left bare.

package/src/bongos/serve-internal.js

@@ -1164,8 +1164,16 @@ function mountInternalSurfaces(app) {
   // task 1003172 (C02): `collab` joins the same tier — every read behind it is
   // any-builder and scoped to the caller by the SERVER (GET /help-requests/for-me
   // derives crafts from the viewer's own profile), so signed-in is the right floor.
+  // task 1003629 (idea 1000907): the BARE `task` and `idea` slugs join the tier
+  // their own /:id forms already sit on. /builders/task/:id and /builders/idea/:id
+  // are gated by TASK_DETAIL_PAGE_RE / IDEA_DETAIL_PAGE_RE below, but those
+  // regexes require a numeric id, so the id-less slugs fell through to
+  // BUILDERS_PAGE_RE — which resolves them to the SAME task.html / idea.html
+  // shells — and matched no gate at all. The shell carries no data and every
+  // read behind it is gated server-side, so this closed an inconsistency rather
+  // than an exposure; the point is that one URL cannot be two tiers at once.
   const SIGNEDIN_BUILDERS_PAGE_RE =
-    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|studio|ideas|collab|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
+    /^\/builders\/(?:work|pair|settings|atlas|modules|goals|roadmap|copy-desk|studio|ideas|collab|task|idea|primer(?:\.md)?|diagrams)(?:\.html)?\/?$/;
   // The diagram image assets under /builders/diagrams/ ride the same tier as the
   // page that embeds them.
   const SIGNEDIN_BUILDERS_PREFIX_RE = /^\/builders\/diagrams\//;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.759'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.761'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_page_gate_map.mjs

@@ -122,15 +122,15 @@ const ORACLE = {
   '/builders/drachmae': null,
   '/builders/profile': null,
 
-  // NOT deliberate — recorded because it is true, and filed as idea 1000907
-  // (task 1003448). The detail pages are addressed by a second segment, and
-  // /builders/task/:id and /builders/idea/:id are both gated at signed-in; the
-  // id-less slugs still resolve to the same shells through BUILDERS_PAGE_RE and
-  // match no gate. No data rides the shell and every read behind it is gated
-  // server-side, so this is an inconsistency rather than an exposure — but it is
-  // a row that should turn into a real gate (or a redirect) when that is decided.
-  '/builders/task': null,
-  '/builders/idea': null,
+  // The bare detail slugs, gated by task 1003629 — the decision idea 1000907
+  // (task 1003448) asked for. They resolve to the same task.html / idea.html
+  // shells their /:id forms do, so they now sit on the same tier: the id-less
+  // form was never a different page, only a different spelling that the
+  // id-requiring TASK_DETAIL_PAGE_RE / IDEA_DETAIL_PAGE_RE could not see. A
+  // gate, not a redirect, because the shell is a real page at signed-in tier
+  // and redirecting would have to invent an id it does not have.
+  '/builders/task': 'requireBuilderPage',
+  '/builders/idea': 'requireBuilderPage',
 
   // Gone, not public — the hall ships no my-projects page at all since task
   // 1003308 (owner's decision: "my projects" is a user-level page the hub owns,

package/tests/linkify_refs.mjs

@@ -311,5 +311,75 @@ t('discoverDocs finds CLAUDE.md, recurses docs/ subdirs (only .md), skips the ge
   }
 });
 
+// ---- the ordinal-prose guard (task 1002975) --------------------------------
+//
+// THE BUG task 1002974 had to repair a committed doc for: with no context word, a
+// bare `#N` was linkified on ID EXISTENCE ALONE. "side door #1" became a link to
+// task 1; its sibling "side door #2" survived only because no id 2 exists. Luck,
+// not grammar.
+//
+// The rule is NOT "a preceding noun means skip" — measured over every committed
+// .md, that would leave ~49 genuine refs bare ("the #506", "by #435"), which is
+// the GitHub-mis-autolink harm this script exists to prevent. It is a WIDTH rule:
+// no context word AND a bare word immediately before AND at most two digits.
+// In the corpus all 28 word-preceded 1–2 digit refs are ordinals; every
+// word-preceded 3+ digit ref is a real task.
+
+t('ordinal prose after a noun is left alone — the reported "side door #1"', () => {
+  const ids = new Set([1, 2]);
+  assert.equal(run('the side door #1 is open', ids), 'the side door #1 is open');
+  assert.equal(run('the side door #2 is open', ids), 'the side door #2 is open');
+});
+
+t('the ordinals found in our OWN docs are left alone', () => {
+  const ids = new Set([1, 4, 5, 11]);
+  for (const s of [
+    'joins rate-limit.js as limiter #4: 120 reads',
+    'ADR 0083 §Decision #4 forbids kernel machinery from naming one',
+    'live proof against a local origin (idea fixture #1)',
+    'the edge cookie-strip rule (ADR 0053 / SR#11)',   // unspaced — still ordinal prose
+  ]) assert.equal(run(s, ids), s, s);
+});
+
+t('a WORD-preceded ref of three or more digits still linkifies — the width is what separates them', () => {
+  const ids = new Set([506, 435]);
+  assert.equal(run('the #506 evaluator', ids), `the ${link(506)} evaluator`);
+  assert.equal(run('captured by #435 last night', ids), `captured by ${link(435)} last night`);
+});
+
+t('a SMALL ref with no preceding word still linkifies — the noun is half the rule', () => {
+  const ids = new Set([7]);
+  assert.equal(run('#7 is the row', ids), `${link(7)} is the row`);
+  assert.equal(run('see (#7) for detail', ids), `see (${link(7)}) for detail`);
+});
+
+t('an explicit entity word still wins over the ordinal guard', () => {
+  // "task #3" is a real ref even though it is one digit after a word: classifyKind
+  // runs first, so the guard never sees it.
+  const ids = new Set([3]);
+  assert.equal(run('task #3 sat in blocked for days', ids), `task ${link(3)} sat in blocked for days`);
+});
+
+t('a REFERRING word is not a noun — "see #2" still linkifies', () => {
+  // The Stop hook classifies by calling linkifyText, so this is also what stops it
+  // blocking a real bare ref in chat. tests/stop_refcheck.mjs went red on exactly
+  // this string when the first cut of the guard treated every preceding word as a
+  // noun — which is how the omission was found.
+  const ids = new Set([2]);
+  for (const [s, expect] of [
+    ['see #2 for details', `see ${link(2)} for details`],
+    ['from #2 onward', `from ${link(2)} onward`],
+    ['landed in #2 last week', `landed in ${link(2)} last week`],
+  ]) assert.equal(run(s, ids), expect, s);
+});
+
+t('the guard is reported as its own skip reason, not folded into not-a-task', () => {
+  const stats = { skipped: {}, linked: 0, rewritten: 0, unlinked: 0 };
+  linkifyText('the side door #1 is open', new Set([1]), stats);
+  assert.equal(stats.skipped['ordinal-prose'], 1);
+  assert.equal(stats.skipped['not-a-task'], undefined,
+    'an ordinal is skipped BECAUSE it reads as prose, not because the id is missing');
+});
+
 console.log(`\nlinkify_refs: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);