@bongos/core 1.19.766 → 1.19.768

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.766",
-  "core_contract": "1.19.766",
-  "source_commit": "02a01e26d1d999916c8c67e1e02b06d0db40b694",
+  "core_version": "1.19.768",
+  "core_contract": "1.19.768",
+  "source_commit": "ec2107bdda1e0c2ee8404d14e539b83a836f767d",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T13:48:32.669Z",
+  "built_at": "2026-09-16T14:46:45.582Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2122,
+    "functional_verbatim": 2123,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2630,
-  "tree_sha256": "56708a327bb43ff2237f2ef0cdd0fac079947882699533e825262e7a16bcf724",
+  "file_count": 2631,
+  "tree_sha256": "9d2871bffc966902b2a18d7c59fc92a2e5ea137e0bee5675716ca3fbee9e01ef",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2502,7 +2502,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "f59041018367ebd25642c8f94c6ab2ad429fc67b2e917e5706185186717b0403"
+      "sha256": "9369c319c356283bdce655d126e78f339c9a329ecefc02d17c2997c45e583475"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "10fb4078df266a5663d8079411fdf7698adb1aa8e20a19ca63ff722e1ecb8134"
+      "sha256": "5c95283ebfac1200dcabcba2fa712b6b041be345412b92cd1f896e3648d9ecd0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7577,12 +7577,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6e4cfa58c41e8fbe29dc94bbe4bd7a4eafedb88034b7d1ba3334d4a0764f5b56"
+      "sha256": "4f7ef5cc202176fb1c83a20baea17017b6adb0892051832a4bd6a440d57f1fcc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b61349c8315ac531b941ca35f84a7323b2192e0ab7507c4d76e1c592c2a9f2e7"
+      "sha256": "ee2355bc92153c9c139cf79e19f22b80dda73a5a2abdd102b67830cb3bee0d14"
     },
     {
       "path": "public-docs/index.html",
@@ -7754,6 +7754,11 @@
       "mode": "0000644",
       "sha256": "4646bd6da8be2d2c40c1063bba47f5fdce0f2f63143e26fc16e36ea941adbc88"
     },
+    {
+      "path": "scripts/gds/backup-dropin-sweep.sh",
+      "mode": "0000644",
+      "sha256": "bfbac57a3e282e1b482a967733eb8f39a15d97ffc8c24b4348370e4a11acc160"
+    },
     {
       "path": "scripts/gds/backup.js",
       "mode": "0000644",
@@ -8437,7 +8442,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "87a9abe0f4744a0b3a3b5cc2e326ff2adb8cba3e559228cca0798e40feaee8f6"
+      "sha256": "bf403052607f7cce560633fc11d03f51ecf1e9fc1d32e4d6c601c6406787a143"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -9397,7 +9402,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9c4c56d73c466a19a699f6c37e439d54d88211a363a869f9d87e3e840f493a2a"
+      "sha256": "163989f8fd93a919241ac12e7627303618fc6d2d47b75f79e1b6fb875874a534"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12057,7 +12062,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "245deb7b090f528180dde1457b821a8c8c2bd74a643524f441519859659643e8"
+      "sha256": "5f7ec2483f8564dc9561f0becdfc36166bca5021b7f964db6d6e40d62108e041"
     },
     {
       "path": "tests/provision_restart.mjs",

package/docs/file-map.md

@@ -187,6 +187,7 @@
 │       ├── seed-v3-tasks.js     ← V3 Planning Session #1: 80 net-new GDS-V3 tasks (V3.R01–V3.R89) + 10 idea_inbox promotions; idempotent on source_ref
 │       ├── backfill-cost.js     ← read art ledger → POST /api/gds/cost (idempotent)
 │       ├── smoke-write.sh       ← write-path smoke (create→claim→ship round-trip)
+│       ├── backup-dropin-sweep.sh ← (task 1003930) control-plane sweep: retires the temporary task-1003925 backup drop-in from each project whose pinned core carries the fix (1.19.750+), proving one backup succeeds without it first; survey by default, `--apply` to act; re-run after each pin moves
 │       ├── smoke-gds.js         ← public-surface + 401-check smoke test (asserts /api/pms/* now 404s — removed in V3.R01-followup #308)
 │       ├── box.js               ← (#598/ADR 0031) per-builder dev box lifecycle CLI: provision·park·wake·deprovision·sweep-idle·sweep-dormant·status (dry-run default, --apply to act; rank-gated)
 │       ├── smoke-box.sh         ← (#598) hermetic box-lifecycle smoke (no DB/DO/network): runs tests/boxes.mjs + tests/cf_tunnel.mjs (#771 named tunnel) + route-rank + module-load

package/docs/module-api-changelog.md

@@ -2006,5 +2006,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.764 with no explicit bump. run 35102327521. (task 1002620)
   1.19.766 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.765 with no explicit bump. run 35104246900. (task 1002620)
+  1.19.767 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.766 with no explicit bump. run 35109111074. (task 1002620)
+  1.19.768 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.767 with no explicit bump. run 35110800163. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.766",
+  "version": "1.19.768",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.766",
+      "version": "1.19.768",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.766",
+  "version": "1.19.768",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/backup-dropin-sweep.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# scripts/gds/backup-dropin-sweep.sh — retire the TEMPORARY task-1003925 backup drop-ins
+# once a project's pinned core carries the fix (task 1003930, ADR 0285 follow-up).
+#
+# WHY. Before the nightly-backup fix (task 1003925, core 1.19.750) reached any
+# project, the 10 live project backup units on the control plane got a systemd
+# drop-in — /etc/systemd/system/<slug>-db-backup.service.d/task-1003925-min-bytes.conf
+# (the backup script's min-bytes override, `*_BACKUP_MIN_BYTES=4096`) — so their
+# small-but-valid dumps stopped being rejected.
+# That workaround lives outside every repo, nothing removes it, and while it stays it
+# hides whether the shipped fix actually works per project. Projects move to the fixed
+# core one pin at a time, so this is a SWEEP to re-run after each pin moves, not a
+# one-shot: each run retires only the drop-ins whose project can prove it no longer
+# needs one (a backup run succeeds without it), and names the rest.
+#
+# Run on the control plane as a sudoer:
+#   bash scripts/gds/backup-dropin-sweep.sh            # survey only — read-only, no sudo writes
+#   bash scripts/gds/backup-dropin-sweep.sh --apply    # retire the eligible drop-ins + clear ghosts
+#
+# --apply, per eligible project (pinned core >= FIX_VERSION and drop-in present):
+#   rm the drop-in, daemon-reload, `systemctl start <slug>-db-backup.service`, wait for it,
+#   and require exit 0 AND a new dump under /var/backups/gds — else the drop-in is put back
+#   and the project is reported, so a project is never left with no backup at all.
+# Then: `systemctl reset-failed` on any *-db-backup unit whose files are gone (a torn-down
+# project's ghost; teardown removes the files but not the failed state — task 1003940).
+set -uo pipefail
+
+FIX_VERSION="${FIX_VERSION:-1.19.750}"
+DROPIN=task-1003925-min-bytes.conf
+BACKUP_DIR=/var/backups/gds
+APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
+
+# The safety copies of retired drop-ins live in a root-owned, mode-0700, mktemp-named
+# dir for the length of one run — never a predictable /tmp/<slug> path a lower-privileged
+# local account could pre-stage a symlink at (CWE-377 / CWE-367 on a shared box). Created
+# only under --apply; removed on exit whatever happened.
+WORK=""
+if [ "$APPLY" = 1 ]; then
+  WORK=$(sudo -n mktemp -d /var/tmp/backup-dropin-sweep.XXXXXX) || { echo "cannot create a root-owned work dir"; exit 1; }
+  trap 'sudo -n rm -rf "$WORK"' EXIT
+fi
+
+# The project's pinned core version: the installed inner manifest under its own checkout.
+core_of() {
+  local slug=$1 pj
+  for pj in "/srv/cloudbongos/$slug/node_modules/@bongos/core/package.json" "/home/lars/$slug/node_modules/@bongos/core/package.json"; do
+    if sudo -n test -r "$pj"; then sudo -n node -e "console.log(require(process.argv[1]).version)" "$pj" 2>/dev/null && return; fi
+  done
+  echo "unknown"
+}
+# semver-ish: is $1 >= $2 ? (sort -V puts the smaller first)
+at_least() { [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -1)" = "$2" ]; }
+# The slug rides as a positional argument, never interpolated into the sh -c string.
+dump_count() { sudo -n sh -c 'ls "$1"-*.sql.gz 2>/dev/null | wc -l' _ "$BACKUP_DIR/$1"; }
+
+retired=(); kept=(); failed=()
+echo "== drop-ins vs pinned core (fix = $FIX_VERSION) =="
+for d in /etc/systemd/system/*-db-backup.service.d; do
+  [ -f "$d/$DROPIN" ] || continue
+  unit=$(basename "$d" .service.d); slug=${unit%-db-backup}
+  core=$(core_of "$slug")
+  if [ "$core" != "unknown" ] && at_least "$core" "$FIX_VERSION"; then verdict="ELIGIBLE"; else verdict="keeps drop-in"; fi
+  printf '  %-24s core=%-10s %s\n' "$slug" "$core" "$verdict"
+  if [ "$verdict" != "ELIGIBLE" ]; then kept+=("$slug ($core)"); continue; fi
+  [ "$APPLY" = 1 ] || { retired+=("$slug (would retire)"); continue; }
+  before=$(dump_count "$slug")
+  sudo -n cp "$d/$DROPIN" "$WORK/$slug.conf"
+  sudo -n rm -f "$d/$DROPIN"; sudo -n rmdir "$d" 2>/dev/null || true
+  sudo -n systemctl daemon-reload
+  # Type=oneshot (provision-units.js backupService): `start` blocks until the dump script exits.
+  sudo -n systemctl start "$unit.service"
+  after=$(dump_count "$slug")
+  if systemctl show -p Result --value "$unit.service" | grep -qx success && [ "$after" -gt "$before" ]; then
+    retired+=("$slug ($core; dumps $before→$after)")
+  else
+    sudo -n install -D -m 0644 "$WORK/$slug.conf" "$d/$DROPIN"; sudo -n systemctl daemon-reload
+    failed+=("$slug ($core; backup did not succeed without it — drop-in restored)")
+  fi
+done
+
+echo; echo "== failed *-db-backup units (ghosts of torn-down projects) =="
+ghosts=$(systemctl --failed --no-legend 2>/dev/null | awk '/db-backup/ {print $1 == "●" ? $2 : $1}')
+if [ -z "$ghosts" ]; then echo "  (none)"; else
+  for u in $ghosts; do
+    if [ -e "/etc/systemd/system/$u" ]; then echo "  $u: unit file still present — a real failure, not a ghost; left alone"; continue; fi
+    if [ "$APPLY" = 1 ]; then sudo -n systemctl reset-failed "$u" && echo "  $u: ghost cleared"; else echo "  $u: ghost (would reset-failed)"; fi
+  done
+fi
+
+echo; echo "== summary =="
+echo "  retired (${#retired[@]}): ${retired[*]:-none}"
+echo "  kept    (${#kept[@]}): ${kept[*]:-none}"
+echo "  failed  (${#failed[@]}): ${failed[*]:-none}"
+[ "$APPLY" = 1 ] || echo "  (survey only — re-run with --apply to act)"
+[ "${#failed[@]}" -eq 0 ]

package/scripts/gds/provision.js

@@ -1033,12 +1033,11 @@ async function teardownInstance(inst, deps) {
   if (inst.hosting_shape !== 'dedicated') {
     boxExec(`${sudoP}systemctl disable --now ${inst.slug}`, { allowFail: true });
     boxExec(`${sudoP}rm -f ${serviceUnitPath(inst)}`, { allowFail: true });
-    // Stop + remove the nightly backup units too (task 2213). The backup DIR + its
-    // dumps are left in place — like the DB below, they are precious data a teardown
-    // must not silently destroy.
+    // Stop + remove the nightly backup units too (task 2213; the dir + dumps stay — precious data, like the DB below), then reset-failed (task 1003940): a removed unit's FAILED state outlives its file, so `systemctl --failed` listed torn-down ghosts for weeks.
     boxExec(`${sudoP}systemctl disable --now ${backupUnitName(inst)}.timer`, { allowFail: true });
     boxExec(`${sudoP}rm -f ${backupServicePath(inst)} ${backupTimerPath(inst)}`, { allowFail: true });
     boxExec(`${sudoP}systemctl daemon-reload`, { allowFail: true });
+    boxExec(`${sudoP}systemctl reset-failed ${inst.slug}.service ${backupUnitName(inst)}.service`, { allowFail: true });
     // Left for an operator (data is precious), naming ONLY what this row created —
     // teardown now takes 'requested'/'error'. `port` + `domain` stay held: ADR 0181.
     const dumps = inst.db_name ? [`dropdb ${dbName(inst)}`, `prune ${CONFIG.backupDir}/${dbName(inst)}-*.sql.gz`] : [];

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.766'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.768'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -1485,6 +1485,18 @@ await ta('teardownInstance(privileged): systemctl + rm-under-/etc are sudo-prefi
   // task 2213: the backup units come down too (the dumps + dir are left in place)
   assert.match(joined, /sudo systemctl disable --now mercury-db-backup\.timer/);
   assert.match(joined, /sudo rm -f \/etc\/systemd\/system\/mercury-db-backup\.service \/etc\/systemd\/system\/mercury-db-backup\.timer/);
+  // task 1003940: a removed unit's FAILED state outlives its file — clear it, AFTER the rm + reload,
+  // for both the instance unit and its backup unit (the two ghosts task 1003930 found on the box).
+  assert.match(joined, /sudo systemctl reset-failed mercury\.service mercury-db-backup\.service/);
+  const idx = (re) => cmds.findIndex((c) => re.test(c));
+  assert.ok(idx(/rm -f .*mercury-db-backup\.service/) < idx(/daemon-reload/), 'rm before reload');
+  assert.ok(idx(/daemon-reload/) < idx(/reset-failed/), 'reset-failed after the reload that forgets the file — reset first and the stopped unit could fail again');
+});
+
+await ta('teardownInstance(dedicated): no systemd steps at all, so no reset-failed either (its own droplet)', async () => {
+  const { deps, cmds } = recorder();
+  await P.teardownInstance({ ...coTenant, hosting_shape: 'dedicated', droplet_id: 9 }, deps);
+  assert.ok(!cmds.some((c) => /reset-failed|daemon-reload|disable --now/.test(c)), cmds.join(' | '));
 });
 
 await ta('teardownInstance(default): NO sudo (bare, unchanged)', async () => {