@bongos/core 1.19.788 → 1.19.789

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.788",
-  "core_contract": "1.19.788",
-  "source_commit": "92849625024c376906ce07c3c0c0ca7a3d680548",
+  "core_version": "1.19.789",
+  "core_contract": "1.19.789",
+  "source_commit": "bf58d21c806de6d4a0151383543d1388131c90a1",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T22:46:46.860Z",
+  "built_at": "2026-09-16T22:50:30.953Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 484,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2669,
-  "tree_sha256": "de7ca524df98188a2d7081d557c66df028de4810b9e2fccd1e052d3db4cc787a",
+  "tree_sha256": "7ee2b678f3696611d42205ebc827862fc5750a01a8c6424fbb1e10bfe7b7ede2",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2517,7 +2517,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "67cecf319da71f951791242844391a055cbf58a76b1490b8fd0818258e0937ae"
+      "sha256": "465dc47c90068c0b1dca4d0f2eb0571d34c81416db376048c47ea4bc44fa70a8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2777,7 +2777,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "408b4792ffb869f2fa13201485c1ab5b8306b93996bb75f01b4117de3fd39303"
+      "sha256": "041955ed109343181ea563e47e905c59e3bbd052e4dc3988b5ea34fbe5029f16"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -7627,12 +7627,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "49f7824295dab411ce5b50f1d5f37837439ee56ca2f66b90b16c93dd0d4dae58"
+      "sha256": "20b6df536012185619c495297c7ab916e26abeb9172fa8b0b9d7ee5ecfc2407a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a9dd34b4fde96d0c2486b92cf898b95b6b6570784d1d3f7019cdd4e8acfe3776"
+      "sha256": "d8456ebb3015586d8a310448bbb75a715fbc5743722ad33cb4f7e5658ff2b250"
     },
     {
       "path": "public-docs/index.html",
@@ -9497,7 +9497,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "9ba56c6268099a478b0af08849ee7cecce87b2650bd1d82757614bd688651900"
+      "sha256": "d2bb1eda91a651b8b9761e0b1b5ecea7cecba84472565ecbf016f33f34f5f7ec"
     },
     {
       "path": "src/module-loader/catalog.js",

package/docs/module-api-changelog.md

@@ -2050,5 +2050,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.786 with no explicit bump. run 35158163962. (task 1002620)
   1.19.788 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.787 with no explicit bump. run 35159266737. (task 1002620)
+  1.19.789 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.788 with no explicit bump. run 35159544354. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/upgrading-the-core.md

@@ -110,6 +110,8 @@ node .claude/scheduled-tasks/core-update-subscription/subscribe.js --apply    #
 
 Each subscribed instance: read its installed core → ask the registry (`npm view`, no credential needed — the package is public) → resolve the newest version its channel permits → if newer, `bongos upgrade --to <v> --registry` with **auto-rollback ON**. It prints one line per instance plus a tally; a non-zero exit means an upgrade failed (already auto-reverted).
 
+> **Enrolling a `file:`-pinned instance resolves NOTHING — convert the pin first** (task 1003915). A scaffolded co-tenant declares its core as `"@bongos/core": "file:vendor/bongos-core-<v>.tgz"`, a local path with no registry channel to follow, so the sweep has nothing to compare against and the instance sits frozen while the roster reports it enrolled. The conversion is not a separate chore: one manual `bongos upgrade --to <v> --registry` rewrites the pin to a bare registry semver on its way through, and every later sweep then works. Measured on the cloudbongos droplet 2026-09-13, **20 of 22 co-tenants** were `file:`-pinned, which is why enrolment alone had never moved any of them.
+
 **Triple-gated, so nothing moves by accident:** the `core-update-subscription` routine is `requiresAutonomy: true` + **default OFF** in [`config/scheduled-routines.json`](../../config/scheduled-routines.json), the roster ships empty, and every upgrade is health-gated. Arm it by enabling the routine's timer on the control plane once autonomy is on.
 
 **Not covered:** multi-host / SSH orchestration across a real fleet (the deferred fleet-control-plane epic, task [#1948](https://example.com/builders#/task/1948)); and *publishing* new patches, which stays a gated owner step (ADR 0134) — a follow-up task decides whether merges auto-publish.
@@ -119,7 +121,11 @@ Each subscribed instance: read its installed core → ask the registry (`npm vie
 - **`--registry` needs no credential at all** (task 1003878). `@bongos/core` is **public** on npm (task 1003872), so `bongos upgrade --registry` resolves it from the default registry like any other dependency — no token, no login, and no instance `.npmrc`. An install failure on this path is therefore a *real* failure (network, registry outage, or a version that was never published), never a missing credential.
   *History, so the symptom is recognisable on an old instance:* the core used to publish private, and the instance `.npmrc` read `_authToken=<redacted> npm gives that per-project key precedence, so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** — npm went anonymous, the private core 404'd, and the error blamed a credential the box actually held. Task 1002754 worked around it by resolving the token in-process; task 1003878 deleted the whole mechanism along with the `.npmrc` that caused it. An instance still carrying a committed `.npmrc` from a pre-1003878 scaffold can safely delete it.
 - **A green `publish` run is not evidence of a publish.** The publish-on-merge lane succeeds on its no-op paths too (cascade terminator, armed-gate). Read the run's **job summary**, which now states the verdict explicitly: `PUBLISHED @bongos/core@<v>` vs `NO-OP — nothing was published this run`.
-- **`PGDATABASE` is load-bearing on a co-tenant droplet.** `migrate.sh` defaults `PGDATABASE` to `example` — **production**. Always set `PGDATABASE=<instance-db>` explicitly, or you migrate the wrong database.
+- **`PGDATABASE` is load-bearing on a co-tenant droplet.** `migrate.sh` defaults `PGDATABASE` to `example` — **production**. Always set `PGDATABASE=<instance-db>` explicitly, or you migrate the wrong database. The dry run checks this *before* the pin moves, so `--dry-run` first costs seconds and saves a full rollback.
+- **The pin push to a co-tenant's `origin` always fails, and that is not the bump failing.** A co-tenant's remote is `git@github-instances:example-owner/<slug>.git` and the alias carries no usable key, so `--commit-pin` commits locally and the push is refused — reported as a failure even though the core installed, restarted, passed its health check and is serving. Read the **served version** before believing the tally.
+- **⚠ An enrolled co-tenant upgrades ONCE, then wedges itself out of the sweep** (proven on `charter` 2026-09-16, task 1003915). The upgrade's own *materialize* and *regen doc assets* steps rewrite tracked files (`.claude/skills/*`, `clients/*` — 14 of them), and the pin-commit step commits only `package.json`/`package-lock.json`. So a bump that genuinely succeeded — installed, restarted, health 200, **serving** the new core — exits `failed=1`, and the **next** sweep refuses the instance: `worktree not clean and the changes are NOT the pin … skipped, a human needs to look`. Every later run skips it, and a skip is not a failure in the tally, so nothing surfaces it. Until this is fixed, `git add -A && git commit` inside the instance after each sweep; that un-wedges it immediately.
+- **Survey co-tenant git state as `lars`, never as root.** `ssh cloudbongos` lands you as root, where `git config --get remote.origin.url` on a `lars`-owned repo returns **nothing** — which reads exactly like "this instance has no remote" and is wrong. They do: `git@github-instances:example-owner/<slug>.git`. Prefix every probe with `sudo -u lars`.
+- **A scaffold's `migrate` script is not guaranteed.** 21 of the 22 co-tenants have `scripts.migrate`; `mercury` has **no `scripts` block at all** and is started directly by its systemd `ExecStart`, so the normal lane cannot complete on it. `--skip-migrate` gets the install through but silently skips every schema change in the window — check what that window carries before reaching for it, rather than after.
 - **The health check polls the restart** (fixed in task [#1984](https://example.com/builders#/task/1984)). The service binds its port ~1s after `systemctl restart`, so `--health-url` now polls up to ~30s for a 2xx before reporting a warning — an immediate `fetch failed` no longer means a failed upgrade. (Pre-1984 cores fetched once and spuriously reported `fetch failed`; there, confirm with `is-active` + a manual `curl`.)
 - **The ledger auto-inserts via `PGDATABASE` too** (fixed in task [#1984](https://example.com/builders#/task/1984)). A consumer on `PGDATABASE` + peer auth now gets its `core_upgrades` row written automatically — the channel delegates the insert to `psql -d "$PGDATABASE"`, exactly like `migrate.sh`, so no manual `psql INSERT` is needed. (`DATABASE_URL` still works, via the `pg` driver.) Pre-1984 cores only auto-wrote with `DATABASE_URL`; on those, record the row manually.
 - **No deploy key on the droplet** → deploys/upgrades ride a `git bundle`, not `git pull` (idea 509).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.788",
+  "version": "1.19.789",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.788",
+      "version": "1.19.789",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.788",
+  "version": "1.19.789",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.788'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.789'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');