@bongos/core 1.19.775 → 1.19.776

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.775",
-  "core_contract": "1.19.775",
-  "source_commit": "02a65922112e4360b309af219912dfbaae134134",
+  "core_version": "1.19.776",
+  "core_contract": "1.19.776",
+  "source_commit": "c0b7c8b7cbf3c7bc785585da449da6ea57197c32",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T18:20:46.880Z",
+  "built_at": "2026-09-16T18:38:32.418Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 486,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2662,
-  "tree_sha256": "98ff660bb87b9156a0e2535a91c5edf19a13b27736ca5c2a95982ce6e64f0ba4",
+  "tree_sha256": "c7dff0b9c97a50075315c645e421fe4fac5bfa6d21bf5c6cdfaea55e04dccd5c",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1957,7 +1957,7 @@
     {
       "path": "docs/adr/0290-disconnect-is-the-owner-initiated-exception-to-address-retention.md",
       "mode": "0000644",
-      "sha256": "a9558eccfabc69b85388c0aa7e7f1604d9dd7fa946c1761155cb8077d4c58d72"
+      "sha256": "37ab80018f5d9e6fdb35271be80ca07f10e6e593ef33b9a7a0a30fe9ea8c5fb3"
     },
     {
       "path": "docs/adr/README.md",
@@ -2527,7 +2527,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0868d9c27813842952237812a33990e846e6d8019be740290ee1ac49f3b19e0a"
+      "sha256": "7112a78b80e84df9950cdde4bc399b4c82f54138c044c1291b37c884def9f5f0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7627,12 +7627,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6be6f24971120806165359b15deb4042a43de963b54a09c1c25108383a11197c"
+      "sha256": "02c6bd2ec2e4afdc61d69e399a42ee98e762d908c69a3b84c9d27e8823b1f6cf"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "14e4c485f0795f8138ff062f0e1bf92740ddc2349117f8ef0d35570f4a9b672e"
+      "sha256": "2a771101f553f4e0207b498d8172bcef587e9115fbb3ff301539851f282e99ba"
     },
     {
       "path": "public-docs/index.html",
@@ -7987,7 +7987,7 @@
     {
       "path": "scripts/gds/db-backup-nightly.sh",
       "mode": "0000644",
-      "sha256": "ff4785dbde6a5c52036ce4c4aacca317c62e725f49d3e32201909ec444d85d44"
+      "sha256": "93f0b743b90a0cfdc91806ecb10da20456b98c0fac0f2b8eb3d690bccf79e532"
     },
     {
       "path": "scripts/gds/db-backup-offsite.sh",
@@ -8487,7 +8487,7 @@
     {
       "path": "scripts/gds/provision-disconnect.js",
       "mode": "0000644",
-      "sha256": "c849ceda1769145879cb8da61186a39beb1ea48bfe1cd3eb0406eb668052aadb"
+      "sha256": "81cdd20b43aa1fc8b39a4fa06aada292aa00e84724feb803ba96bf15ce92cca9"
     },
     {
       "path": "scripts/gds/provision-net.js",
@@ -9492,7 +9492,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "885acafa5a2527e8ede987295a14a562feaa93dc6c9bdc2e2284e6d5d98c2999"
+      "sha256": "74ef2cad88c2d19fb73139455608b8e200f22f7e835c925910f6e28b3590c2a0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10357,7 +10357,7 @@
     {
       "path": "tests/db_backup_nightly.mjs",
       "mode": "0000644",
-      "sha256": "020dc551d105cc4a29e0f9c750a03cd14a91511d3edc47eb6719a1e430461936"
+      "sha256": "cb731d19610530cc07457271aed57d5e04bec3d42bf85f246601b6cbdd02b3fd"
     },
     {
       "path": "tests/dead_deps.mjs",

package/docs/adr/0290-disconnect-is-the-owner-initiated-exception-to-address-retention.md

@@ -35,6 +35,6 @@ A failed erase or catalog step returns a retryable `{ ok:false }`; a teardown th
 - The manage page's copy changed with the capability. The teardown truth now ends "Taking it offline erases nothing." rather than "Nothing here erases a project.", and the fold points at the new card instead of admitting the capability is missing.
 - The `project.catalog` port has three verbs. `tests/catalog_only_client.mjs` still pins the list.
 - If the runner dies mid-disconnect, the reconcile sweep re-enqueues a *teardown* for a `tearing_down` row, not a disconnect. The project is left offline, with its row, and the owner presses Disconnect again. This is accepted rather than giving the reconcile a memory of intent.
-- The nightly prune's `<db>-*.sql.gz` glob can still reach a longer-named sibling's dumps older than 30 days. It is filed as its own row, not fixed here.
+- The nightly prune's `<db>-*.sql.gz` glob could still reach a longer-named sibling's dumps older than 30 days. It was filed as its own row and fixed in [task 1003948](https://cloudbongos.com/builders#/task/1003948): the prune and its retained count now match the same exact filename.
 
 Proofs: `tests/provisioning_disconnect.mjs` (queue + route), `tests/provision_disconnect.mjs` (runner order, shapes, failure, guards), `tests/project_catalog_forget.mjs` (claim rules), `tests/hub_disconnect_ui.mjs` + the kit probe (the card).

package/docs/module-api-changelog.md

@@ -2024,5 +2024,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.773 with no explicit bump. run 35132992149. (task 1002620)
   1.19.775 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.774 with no explicit bump. run 35133750943. (task 1002620)
+  1.19.776 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.775 with no explicit bump. run 35135604764. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.775",
+  "version": "1.19.776",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.775",
+      "version": "1.19.776",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.775",
+  "version": "1.19.776",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/db-backup-nightly.sh

@@ -3,7 +3,7 @@
 #
 # Runs as user `lars` via the gds-db-backup.timer systemd unit (see
 # scripts/gds/gds-db-backup.timer + .service in this repo). Output lands
-# in /var/backups/gds/ as YYYY-MM-DD-HHMMSS.sql.gz (UTC timestamp), and
+# in /var/backups/gds/ as <db>-YYYY-MM-DDTHHMMSSZ.sql.gz (UTC timestamp), and
 # files older than 30 days are pruned.
 #
 # Authentication: peer auth via the local Unix socket — the invoking unix
@@ -59,6 +59,10 @@ RETENTION_DAYS="${GDS_BACKUP_RETENTION_DAYS:-30}"
 # Timestamp format. UTC so dumps sort sanely regardless of TZ.
 TS=$(date -u +"%Y-%m-%dT%H%M%SZ")
 OUT="${BACKUP_DIR}/${DB_NAME}-${TS}.sql.gz"
+# Exactly the name above. Every project's unit shares BACKUP_DIR, so a looser
+# `${DB_NAME}-*` would let `test` prune and count `test-nk`'s dumps (task 1003948).
+D='[0-9]'
+DUMP_GLOB="${DB_NAME}-${D}${D}${D}${D}-${D}${D}-${D}${D}T${D}${D}${D}${D}${D}${D}Z.sql.gz"
 
 # ---- preconditions ----------------------------------------------------------
 
@@ -173,7 +177,7 @@ fi
 # Done AFTER the new dump lands so a streak of failed runs can't erase
 # everything: we never delete on a day we didn't successfully dump.
 PRUNED=$(find "$BACKUP_DIR" -maxdepth 1 -type f \
-    -name "${DB_NAME}-*.sql.gz" \
+    -name "$DUMP_GLOB" \
     -mtime +"${RETENTION_DAYS}" \
     -print -delete | wc -l)
 
@@ -183,5 +187,5 @@ fi
 
 # ---- emit a one-line summary for journald + monitoring ---------------------
 
-REMAINING=$(find "$BACKUP_DIR" -maxdepth 1 -type f -name "${DB_NAME}-*.sql.gz" | wc -l)
+REMAINING=$(find "$BACKUP_DIR" -maxdepth 1 -type f -name "$DUMP_GLOB" | wc -l)
 echo "[$(date -u +%FT%TZ)] gds-db-backup: ok · ${REMAINING} dump(s) retained · ${BYTES} bytes latest"

package/scripts/gds/provision-disconnect.js

@@ -28,8 +28,8 @@ const { catalogOriginForInstance, ownerGithubIdForInstance } = require('../../mo
 const { deleteInstance } = require('../../modules/provisioning/disconnect.js');
 
 // The dump filename db-backup-nightly.sh writes — <db>-YYYY-MM-DDTHHMMSSZ.sql.gz — matched
-// EXACTLY. The nightly prune's own `<db>-*.sql.gz` would let a project named `test` erase
-// `test-nk`'s dumps, which is harmless for a 30-day prune and unacceptable for an erase. PURE.
+// EXACTLY, as the nightly prune's DUMP_GLOB does (task 1003948): a looser `<db>-*.sql.gz` would
+// let a project named `test` erase `test-nk`'s dumps. PURE.
 function dumpGlob(inst) {
   const d = '[0-9]';
   return `${dbName(inst)}-${d.repeat(4)}-${d.repeat(2)}-${d.repeat(2)}T${d.repeat(6)}Z.sql.gz`;

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.775'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.776'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/db_backup_nightly.mjs

@@ -29,12 +29,19 @@ const ENV = 'gds_backup_'.toUpperCase();
 // A fake pg_dump: a plain-format dump of `rows` rows, closed the way pg_dump closes one
 // (including the \unrestrict line patched servers append) unless it is `cut` short, and
 // exiting `exitCode`.
-function runBackup({ rows = 40, cut = false, exitCode = 0, env = {} } = {}) {
+// `seed` pre-places dumps in the shared dir as [filename, ageInDays].
+function runBackup({ rows = 40, cut = false, exitCode = 0, env = {}, seed = [] } = {}) {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'db-backup-'));
   const bin = path.join(tmp, 'bin');
   const dir = path.join(tmp, 'backups');
   fs.mkdirSync(bin);
   fs.mkdirSync(dir);
+  for (const [name, ageDays] of seed) {
+    const f = path.join(dir, name);
+    fs.writeFileSync(f, '');
+    const t = new Date(Date.now() - ageDays * 86400000);
+    fs.utimesSync(f, t, t);
+  }
   const body = Array.from({ length: rows }, (_, i) => `INSERT INTO public.t VALUES (${i});`).join('\n');
   const close = cut ? '' : '\n--\n-- PostgreSQL database dump complete\n--\n\n\\unrestrict abc123\n';
   fs.writeFileSync(path.join(bin, 'pg_dump'),
@@ -73,6 +80,19 @@ test('an explicit operator size floor is still enforced', { skip }, () => {
   assert.match(r.stderr, /floor/);
 });
 
+test('the prune and the count reach only this database\'s own dumps, never a longer-named sibling\'s (task 1003948)', { skip }, () => {
+  const r = runBackup({ seed: [
+    ['smallproj-2026-01-01T000000Z.sql.gz', 40],
+    ['smallproj-nk-2026-01-01T000000Z.sql.gz', 40],
+    ['smallproj-2-2026-09-01T000000Z.sql.gz', 2],
+  ] });
+  assert.equal(r.status, 0, r.stderr);
+  assert.ok(!r.dumps.includes('smallproj-2026-01-01T000000Z.sql.gz'), 'its own expired dump is pruned');
+  assert.ok(r.dumps.includes('smallproj-nk-2026-01-01T000000Z.sql.gz'), 'a sibling\'s expired dump is left for the sibling\'s own unit');
+  assert.match(r.stdout, /pruned 1 dump\(s\)/);
+  assert.match(r.stdout, /ok · 1 dump\(s\) retained/, 'the count is this database\'s dumps only');
+});
+
 test('no fixed size floor is baked in for every instance', () => {
   const src = fs.readFileSync(SCRIPT, 'utf8');
   assert.doesNotMatch(src, new RegExp(`${ENV}MIN_BYTES:-[1-9]`), 'a default floor fails every database smaller than it');