@bongos/core 1.19.800 → 1.19.801

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.800",
-  "core_contract": "1.19.800",
-  "source_commit": "61c8980e6b9f6fb0cbd611f41520cbcae4780f11",
+  "core_version": "1.19.801",
+  "core_contract": "1.19.801",
+  "source_commit": "9cb40ed355c3f8bb4d4b67fbc6e6ba939793827a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T02:01:42.605Z",
+  "built_at": "2026-09-17T02:11:49.566Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 487,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2699,
-  "tree_sha256": "0d54a704f2ba5c26c517372981337570ff4a70da884edee06ef52c30e836fda3",
+  "tree_sha256": "2587f0458e02facb77f933eab7710e8b69181347c171c7cc65600840dc02b6ce",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2532,7 +2532,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "07a1c706c1ddc1d0c51da0737e861e8af59c0a50caa9119cfca43f1ad3fde6ba"
+      "sha256": "3b499ff68308c4d7cab67302718a4c853209e02543f016b4ff710c94436e98a2"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7712,12 +7712,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2fa689bfe81f60fd4b8ca8e0304b2eac417c172af397d23c1de3427e0a6544a5"
+      "sha256": "c276ff38b81a024e50fce58a6f52594a7927a2dfddd50665cd6dd75df09ad73c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2e40419061babf39395a90a2b45c7c7409e1acce44e86984a3913dd6010a485a"
+      "sha256": "e2e2a9e07886e3e8a7c77787d04ed7e8160fd682b1d4aace12914f93a93b358f"
     },
     {
       "path": "public-docs/index.html",
@@ -8977,7 +8977,7 @@
     {
       "path": "scripts/gds/ship-honesty.js",
       "mode": "0000644",
-      "sha256": "3ab4816fdd43d589cda73698a514f8e23103be166c1650fd24beeee9f529bb5b"
+      "sha256": "f9cafe9726d6cedc398dc9898e33a9d2d5eca32354661b58d7f820e195d59137"
     },
     {
       "path": "scripts/gds/ship-io.js",
@@ -8997,7 +8997,7 @@
     {
       "path": "scripts/gds/ship-merge.js",
       "mode": "0000644",
-      "sha256": "b602b4cf8f0e66610991237e1cb7ade9cd5c14659b155ce3512268d40ae670eb"
+      "sha256": "99401464922cc545681786e59ebdc5ad35ec5578f7562c7986e458af797e85ab"
     },
     {
       "path": "scripts/gds/ship-preflight-steps.js",
@@ -9602,7 +9602,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0a1e5d3b5db82b4a63d3936fd70ff4e079a1eef0b81b8d7041fcb3f1aaffc109"
+      "sha256": "de45933f1b58f0a41a36b2de49fc55f758c34e42b48c2599d2dd4d1afad9a88d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12927,7 +12927,7 @@
     {
       "path": "tests/ship_cannot_lie.mjs",
       "mode": "0000644",
-      "sha256": "55e94ed59bc1bd19e4a3dd0e9a9a415dde659c5d71af0dd827d1b288e66de3c7"
+      "sha256": "55adaf198cd21d4f267f1f50c8e31e176d4b2f037a87abc5a7d10e5df0d123d2"
     },
     {
       "path": "tests/ship_card.mjs",

package/docs/module-api-changelog.md

@@ -2074,5 +2074,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.798 with no explicit bump. run 35170980369. (task 1002620)
   1.19.800 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.799 with no explicit bump. run 35172784518. (task 1002620)
+  1.19.801 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.800 with no explicit bump. run 35173442594. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.800",
+  "version": "1.19.801",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.800",
+      "version": "1.19.801",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.800",
+  "version": "1.19.801",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-honesty.js

@@ -249,9 +249,66 @@ function staleSummaryNotice(taskId, storedSummary) {
   ];
 }
 
+// ---- a --db-only that cannot apply must SAY so (task 1003959) ---------------
+//
+// THE FIFTH SILENCE, and the only one that is not about prose: a flag the
+// operator typed, dropped without a word. zeroCommitVerdict(commitsAhead, dbOnly)
+// consults dbOnly ONLY at zero commits ahead — with commits ahead the verdict is
+// 'has-commits' and the run falls through to the ordinary merge/PR path, which
+// never receives dbOnly at all.
+//
+// The BEHAVIOUR is right and stays: a branch carrying real commits must be
+// merged, not waved through as an empty ship. What was missing is the sentence
+// saying so, and its absence is expensive out of proportion to its size — task
+// 1003229 was filed against --db-only and survived for days on the strength of
+// it. The reporter's flag was dropped here, their PR then failed to land for an
+// unrelated reason (the reconciler, task 1002723), and with nothing in the
+// output distinguishing an honoured flag from an ignored one, every visible sign
+// pointed at --db-only.
+//
+// So: a notice, not a refusal and not a behaviour change — the same posture as
+// staleSummaryNotice above, and testable for the same reason. It names the path
+// actually being taken, because "your flag was ignored" without "and here is
+// what is happening instead" only moves the confusion.
+//
+// Returns [] when the flag was HONOURED (zero commits ahead) or never passed —
+// a notice that fires on the happy path is noise.
+function dbOnlyIgnoredNotice(taskId, { dbOnly = false, commitsAhead = '0', branch = '', deployMode = 'laptop' } = {}) {
+  if (!dbOnly) return [];
+  // The one case the flag really covers. gitOk returns null when the count could
+  // not be read, which zeroCommitVerdict already treats as 'has-commits' — keep
+  // that reading rather than inventing a second opinion about the same branch.
+  if (String(commitsAhead) === '0') return [];
+
+  // Branch names and a git count both reach a TERMINAL here. git forbids control
+  // characters in a refname, so this strips nothing in practice — but the notice
+  // exists to be believed, and one that could be repainted from below by its own
+  // subject would be the wrong thing to have built.
+  const clean = (s) => String(s == null ? '' : s).replace(/[\u0000-\u001f\u007f-\u009f]/g, ' ').replace(/\s+/g, ' ').trim();
+  const head = clean(branch) || 'this branch';
+  const n = Number(clean(commitsAhead));
+  const ahead = Number.isInteger(n) && n > 0
+    ? `${n} commit${n === 1 ? '' : 's'} ahead of origin/main`
+    : 'ahead of origin/main';
+  // Name the real path, not a generic one — 'ci' lands by PR and never touches
+  // the operator's main worktree; 'laptop' merges and deploys from this machine.
+  const instead = deployMode === 'ci'
+    ? `pushing ${head} and landing it by PR, with CI deploying`
+    : `pushing ${head}, merging it into main here and deploying`;
+
+  return [
+    `⚠ --db-only was passed, but ${head} is ${ahead} — the flag does not apply and is being IGNORED.`,
+    `  Shipping the normal way instead: ${instead}. Nothing is skipped and nothing is stranded.`,
+    '  --db-only only covers a ship with NOTHING to merge — work written straight to the prod DB.',
+    '  If you expected a zero-commit ship, this is the branch disagreeing; see what is on it:',
+    '    git log --oneline origin/main..HEAD',
+    `  Then re-ship when the branch is what you meant:  node scripts/gds/ship.js ${taskId}`,
+  ];
+}
+
 module.exports = {
   resolveProse, markShipProgress, fatalRecoveryLines, smokeGateMessages,
-  proseFlagPresent, regradeNotesRefusal, staleSummaryNotice,
+  proseFlagPresent, regradeNotesRefusal, staleSummaryNotice, dbOnlyIgnoredNotice,
   _resetForTest: () => { shipProgress = { stage: 'preflight', taskId: null }; },
   _peekForTest: () => shipProgress,
 };

package/scripts/gds/ship-merge.js

@@ -26,9 +26,15 @@ const {
   landed,
 } = require('./ship-land.js');
 const { runSmoke } = require('./ship-grade.js');
+const { dbOnlyIgnoredNotice } = require('./ship-honesty.js');
 const { currentBranch, mainWorktreeBusy, regenerateApiClient, regenerateApiDocs, regenerateDiagrams, regenerateFileMap, regenerateRepoMap, regenerateSessionIndex } = require('./ship-regen.js');
 const { REPO_ROOT } = require('./ship-state.js');
 
+// zeroCommitVerdict — dbOnly is deliberately consulted ONLY at zero commits
+// ahead: a branch carrying real commits must be merged, whatever flag was typed.
+// That asymmetry is correct and is not a bug — but it means an explicitly-passed
+// --db-only can be DROPPED, so mergeLocally pairs this with dbOnlyIgnoredNotice
+// (task 1003959) rather than letting the drop happen in silence.
 function zeroCommitVerdict(commitsAhead, dbOnly) {
   if (commitsAhead !== '0') return 'has-commits';
   return dbOnly ? 'db-only' : 'refuse';
@@ -141,6 +147,11 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
   }
   const commitsAhead = gitOk('git rev-list origin/main..HEAD --count');
   const verdict = zeroCommitVerdict(commitsAhead, dbOnly);
+  // task 1003959: the verdict above drops an explicitly-passed --db-only when the
+  // branch has commits. Say so HERE — before the push, the merge and the deploy —
+  // so the operator learns their flag did not apply while the run can still be
+  // stopped, not from a PR that landed differently than they expected.
+  for (const line of dbOnlyIgnoredNotice(taskId, { dbOnly, commitsAhead, branch, deployMode })) console.log(line);
   if (verdict === 'refuse') {
     // task 391 (idea #37): the old code short-circuited ANY zero-commit branch
     // straight to shipped — silently advancing a claim with empty/wrong touches[]

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.800'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.801'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/ship_cannot_lie.mjs

@@ -21,6 +21,10 @@
 // (4) --regrade must not silently REUSE the failed attempt's summary. The same
 //     silence as (3) from the other side: prose the builder never handed over,
 //     published as though they had (task 1003693).
+//
+// (5) An explicitly-passed --db-only that cannot apply must say so. The same
+//     silence again, and the first one that is not about prose: a flag the
+//     operator typed, dropped by the merge leg without a word (task 1003959).
 import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
@@ -30,7 +34,7 @@ const require = createRequire(import.meta.url);
 const { argText } = require('../scripts/gds/cli-lib.js');
 const {
   fatalRecoveryLines, markShipProgress, _peekForTest,
-  proseFlagPresent, regradeNotesRefusal, staleSummaryNotice,
+  proseFlagPresent, regradeNotesRefusal, staleSummaryNotice, dbOnlyIgnoredNotice,
 } = require('../scripts/gds/ship-honesty.js');
 
 // Injected IO so no case touches the filesystem.
@@ -371,3 +375,88 @@ test('the notice is wired into the regrade path, before any grade spend', () =>
   const preflight = code.indexOf('preflight(claimLike');
   assert.ok(preflight !== -1 && call < preflight, 'and prints before the preflight and the panel');
 });
+// ── (5) a --db-only that cannot apply says so (task 1003959) ─────────────────
+//
+// The same silence as (3) and (4) from a third side, and the only one that is
+// not about prose: a flag the operator TYPED, dropped without a word.
+// zeroCommitVerdict consults dbOnly only at zero commits ahead, so with commits
+// ahead the ordinary merge/PR path runs and never sees the flag. That path is
+// correct; the silence is what let task 1003229 sit open against --db-only while
+// the real stall was elsewhere (task 1002723).
+
+test('the dropped --db-only notice names the flag, the branch and the path taken instead', () => {
+  const lines = dbOnlyIgnoredNotice(1003959, {
+    dbOnly: true, commitsAhead: '3', branch: 'task-1003959', deployMode: 'ci',
+  });
+  const text = lines.join('\n');
+  // The whole deliverable: the operator must be able to tell an honoured flag
+  // from an ignored one by reading the output.
+  assert.match(text, /--db-only/, 'names the flag that was dropped');
+  assert.match(text, /IGNORED/, 'and says plainly that it was');
+  assert.match(text, /3 commits ahead of origin\/main/, 'names why it does not apply');
+  assert.match(text, /task-1003959/, 'and which branch disagreed');
+  // "your flag was ignored" without "and here is what happens instead" only
+  // moves the confusion one step.
+  assert.match(text, /landing it by PR/, 'names the path actually being taken');
+  assert.match(text, /nothing is stranded/i, 'and says the ship is not in danger');
+  // A notice that names no next step is noise with a warning sign on it.
+  assert.match(text, /git log --oneline origin\/main\.\.HEAD/, 'names a runnable way to check the branch');
+  assert.match(text, /ship\.js 1003959/, 'and the re-ship with the real task id');
+});
+
+test('the notice names the LAPTOP path when that is the one being taken', () => {
+  // Naming a PR land on a box that is about to merge and deploy locally would be
+  // a second untruth told while correcting the first.
+  const laptop = dbOnlyIgnoredNotice(7, { dbOnly: true, commitsAhead: '1', branch: 'task-7', deployMode: 'laptop' }).join('\n');
+  assert.match(laptop, /merging it into main here and deploying/, 'the local merge chain');
+  assert.ok(!/by PR/.test(laptop), 'and not the PR path it is not taking');
+  assert.match(laptop, /1 commit ahead/, 'singular reads as English');
+});
+
+test('the notice is silent when the flag was honoured, or never passed', () => {
+  // Zero commits ahead IS the case --db-only covers: the flag applied, nothing
+  // was dropped, and warning there would train the builder to skip the notice.
+  assert.deepEqual(dbOnlyIgnoredNotice(1, { dbOnly: true, commitsAhead: '0', branch: 'task-1' }), []);
+  for (const ahead of ['0', '4', null, undefined]) {
+    assert.deepEqual(dbOnlyIgnoredNotice(1, { dbOnly: false, commitsAhead: ahead }), [], 'no flag, no notice');
+  }
+  assert.deepEqual(dbOnlyIgnoredNotice(1), [], 'and a bare call cannot fire it');
+});
+
+test('an unreadable commit count still produces a truthful notice', () => {
+  // gitOk returns null when the count cannot be read, and zeroCommitVerdict
+  // already reads that as 'has-commits'. The notice must not invent "null
+  // commits ahead" — it drops the number and keeps the claim.
+  const lines = dbOnlyIgnoredNotice(9, { dbOnly: true, commitsAhead: null, branch: null });
+  const text = lines.join('\n');
+  assert.ok(lines.length > 0, 'an unreadable count is still an ignored flag');
+  assert.ok(!/null|NaN|undefined/.test(text), 'and never says so out loud');
+  assert.match(text, /this branch is ahead of origin\/main/, 'falls back to the claim without a count');
+
+  // The one place a branch name reaches a TERMINAL. git forbids control
+  // characters in a refname, so this strips nothing in practice — but a notice
+  // that could be repainted by its own subject is the wrong thing to have built.
+  const esc = dbOnlyIgnoredNotice(11, { dbOnly: true, commitsAhead: '2', branch: 'task\u001b[31m-11\u0007' }).join(' ');
+  assert.ok(!/[\u0000-\u001f\u007f-\u009f]/.test(esc), 'terminal control characters are stripped before display');
+});
+
+test('the notice is wired into the merge leg, before the push', () => {
+  // The (1) lesson again: a helper nothing calls is not a fix. And the ORDER is
+  // load-bearing for the same reason the --notes refusal's is — a warning read
+  // after the branch has already been pushed and merged cannot stop that run.
+  const src = readFileSync(new URL('../scripts/gds/ship-merge.js', import.meta.url), 'utf8');
+  assert.match(src, /require\('\.\/ship-honesty\.js'\)/, 'ship-merge imports the notice');
+  const merge = src.slice(src.indexOf('async function mergeLocally'));
+  const code = merge.replace(/\/\/[^\n]*/g, ''); // comments describe, they do not print
+
+  const call = code.indexOf('dbOnlyIgnoredNotice(taskId,');
+  assert.ok(call !== -1, 'mergeLocally emits the notice');
+  // It must be fed the real values, not a re-derived opinion about the branch.
+  assert.match(code.slice(call, call + 200), /dbOnly, commitsAhead, branch, deployMode/,
+    'from the same values the verdict was computed from');
+  // Every path out of the verdict is downstream of it: the refusal, the empty
+  // ship, the ci land and the laptop push.
+  for (const after of ["=== 'refuse'", "=== 'ci'", "gitArgvOk(['push'"]) {
+    assert.ok(call < code.indexOf(after), `prints before ${after}`);
+  }
+});