@bongos/core 1.19.828 → 1.19.829

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.828",
-  "core_contract": "1.19.828",
-  "source_commit": "1468eede4d69ff51f17aca93df0be9ce3e7c61d4",
+  "core_version": "1.19.829",
+  "core_contract": "1.19.829",
+  "source_commit": "5e752a914c7b9d8e6a0a2d433c4489eae62a201f",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T14:06:18.434Z",
+  "built_at": "2026-09-17T14:33:33.476Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 491,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2241,
+    "functional_verbatim": 2242,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2758,
-  "tree_sha256": "bf97a7d239bc1b9ea00eef896ec4b06c6c598d7d4db056e25bb24066862bd6a3",
+  "file_count": 2759,
+  "tree_sha256": "d2c620df0cd6ca7d45a6da686f8faae022490ec620e93678796d350e2a8f78d3",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2552,7 +2552,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1b25950c5cbc4a0495bc7ae5aa052980032732201e87fd4db19c2d00a0497659"
+      "sha256": "031987fb991bfd88d12ce55f8408abd54fa7c0ae14aeb06773590ce347765fe9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2817,7 +2817,7 @@
     {
       "path": "docs/recipes/windows-builders.md",
       "mode": "0000644",
-      "sha256": "eef830271b0e77a161c61759970346b63730d3e6049b4944d24586abadb843de"
+      "sha256": "85823a0b17b646da4b17596c78819da8e7342f24395dcc2e3ea82b5e07c25cba"
     },
     {
       "path": "docs/recipes/work-on-a-task-from-your-dev-box.md",
@@ -7837,12 +7837,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "233324094e9598241150aa565dbbe7ea26d977714a940b5c4e0d595ab42428da"
+      "sha256": "8af9d6b81006a300da6bb7df13c0114e0a94882a25715a314c31daa8039943aa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6e817e4918c137b1d910514c7155c0a22d7c5558b9ba9934892916df07e90b78"
+      "sha256": "facb74c30d620f2cecc5b3476752741626fc11fb5f3a19f0736eee180404e301"
     },
     {
       "path": "public-docs/index.html",
@@ -8887,7 +8887,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "be80f6ea38abdbc71f5f718b51db9a54b931745859e885ea1a97ff9465a81596"
+      "sha256": "1bbffb825eae2d4253a0f2562609fc158c0307e6120bc83fd659890cdbcff2d6"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -9762,7 +9762,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "32383a56130d07528e7c21e2867c7285a18e4bf7d4dc1d120e510b0f76e4db7c"
+      "sha256": "9d2cc3cc105693debf99590994668c2060c0d39ecca4fa14b217c87eb1fb2ca4"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13639,6 +13639,11 @@
       "mode": "0000644",
       "sha256": "024c65f27b684bc3a00181cd72df7e7152af3372c9338d9a38f0a1200c25b678"
     },
+    {
+      "path": "tests/unit_runner_teardown_abort.mjs",
+      "mode": "0000644",
+      "sha256": "b10a938bb1b229ba03e9e8ba80b04e6d8f8686d25a2b71e2cafa50eba63a2b21"
+    },
     {
       "path": "tests/update_channel.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2130,5 +2130,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.826 with no explicit bump. run 35230339528. (task 1002620)
   1.19.828 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.827 with no explicit bump. run 35231300810. (task 1002620)
+  1.19.829 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.828 with no explicit bump. run 35234300466. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/windows-builders.md

@@ -119,34 +119,26 @@ listed as expected-red for a matter of hours: the list was written the same day
 deps in the worktree" family and task 1003616 fixed it on 2026-09-07 (see the walk-up section
 below).
 
-**THREE suites are INTERMITTENT on a Windows box, so neither a green run nor a red one settles
-anything on its own.** Two of the three are on the baseline above; the third is NOT, and keeping
-that distinction straight is the whole point of this paragraph — "intermittent" is a property of a
-suite, not a licence to add it to the expected-red list.
-
-*Intermittent AND on the list:* `session_caps` and `search_isolation` exit `3221226505`
-(`0xC0000409`, STATUS_STACK_BUFFER_OVERRUN) — the process dies during teardown *after* its
-assertions have all passed, so whether the suite counts them as failures depends on timing. Both
-directions are now on record. Task 1003529: `session_caps` passed inside a full
-`run-unit-tests.js` sweep and failed twice in a row when run on its own, minutes apart. Task
-1003860, two sweeps minutes apart on one unchanged tree: `session_caps` was RED in the first and
-GREEN in the second, plus green twice standalone — so the same tree answers 9 failures or 8
-depending on nothing you did, and `search_isolation` was red in both. Task 1003827 is still open
-and nothing on main has touched either. This is the `cliExit` class documented in
-[scripts/gds/CLAUDE.md](../../scripts/gds/CLAUDE.md) — a hard exit while handles are still closing.
-Do not mark either fixed on the strength of one green sweep, and do not let their noise cover a
-real regression: diff by name AND re-run the individual suite.
-
-*Intermittent but NOT on the list:* `<redacted>` (task 1003860). It failed inside one
-full sweep on 2026-09-12 and has not reproduced since — green standalone 7-of-7 then, and green in
-both full sweeps and three more standalone runs when the baseline was re-measured. It binds an
-ephemeral socket (`app.listen(0)`) and calls `server.close()` without awaiting it, so it is the
-same teardown-timing class as the two above. Know the name, so a red here does not send you
-hunting your own diff — but it stays OFF the expected-red list, because it is green on
-`origin/main`. **A suite that reds once and then will not reproduce is not a baseline entry.**
-Promoting a one-off red to a known name buys nothing and gives a genuine regression somewhere to
-hide; `git_merge_regen` below is the case that cost a whole session. Re-run this one alone before
-you touch anything.
+**The teardown-abort class no longer reads red (task 1003845).** On Windows + Node 24 a suite that
+hard-exits after serving HTTP can print a clean verdict and then die natively —
+`Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)`, exit `127` or `3221226505`
+(`0xC0000409`). This is the `cliExit` class documented in
+[scripts/gds/CLAUDE.md](../../scripts/gds/CLAUDE.md). Timing decides it:
+`provisioning_github_app_routes` aborted 5 runs of 6, and in task 1003860 one unchanged tree
+answered 9 failures in one sweep and 8 in the next. A new failure could take a vanished one's
+place and the count would not move. `run-unit-tests.js` now recognises the abort by that stderr
+signature **plus** the suite's own verdict: its last line must read `N passed, 0 failed`, and no
+line may start with `FAIL`. Such a suite prints
+`ok    <name> (clean verdict, then libuv teardown abort, exit …)` and is named on its own summary
+line, never in `FAILED`. That stops `search_isolation` (on the list above) flapping. It does the same
+for `session_caps`, which task 1003827 also fixed outright, and for `<redacted>`,
+`provisioning_github_app_routes` and `task_visual_route_gate`, which all aborted in the
+2026-09-17 sweep. The match is on the signature, not on a list of names. An abort with no clean
+verdict (a crash mid-run, or a summary that is not the last thing printed) still reads `FAIL`.
+
+**A suite that reds once and then will not reproduce is not a baseline entry.** Promoting a one-off
+red to a known name buys nothing and gives a genuine regression somewhere to hide; `git_merge_regen`
+below is the case that cost a whole session. Re-run the suite alone before you touch anything.
 
 Two warnings about that list, both paid for:
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.828",
+  "version": "1.19.829",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.828",
+      "version": "1.19.829",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.828",
+  "version": "1.19.829",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -191,6 +191,24 @@ const KNOWN_FAILING = new Set([
   'served_paths_shipped',
 ]);
 
+// Task 1003845: on Windows + Node 24 a suite that hard-exits after serving HTTP can
+// print a clean verdict and THEN abort natively (the cliExit class in
+// scripts/gds/CLAUDE.md), exiting 127 or 0xC0000409 depending on timing. Counted as
+// FAILED, these swap in and out of a Windows baseline, so a new failure can hide
+// behind a vanished one. Recognised by signature plus the suite's own verdict —
+// never by a list of names, which docs/recipes/windows-builders.md shows goes stale
+// in hours. Only the `N passed, M failed` summary counts as a verdict: node:test
+// suites set exitCode rather than hard-exiting, so they do not hit this.
+const LIBUV_TEARDOWN_ABORT = /Assertion failed: !\(handle->flags & UV_HANDLE_CLOSING\)/;
+
+function isCleanTeardownAbort(stdout, stderr) {
+  if (!LIBUV_TEARDOWN_ABORT.test(stderr)) return false;
+  // Line-leading only: a passing case titled "... is FAIL-CLOSED" is not a failure.
+  if (/^\s*FAIL\b/m.test(stdout)) return false;
+  const lastLine = stdout.trim().split('\n').pop();
+  return /\b[1-9]\d* passed, 0 failed\s*$/.test(lastLine);
+}
+
 // Discover modules/<key>/tests/*.mjs. Pure-ish (reads disk; `isEnabled` is
 // injected so this is unit-testable with zero real modules/ or DB config —
 // mirrors the injected-dependency pattern the module loader itself uses).
@@ -266,6 +284,7 @@ function main() {
   const total = files.length + moduleTests.length;
 
   const failures = [];
+  const teardownAborts = [];
   const runOne = (displayName, filePath) => {
     try {
       execFileSync(process.execPath, [filePath], {
@@ -283,8 +302,13 @@ function main() {
       console.log(`  ok    ${displayName}`);
     } catch (err) {
       const why = err.killed ? 'TIMEOUT' : `exit ${err.status}`;
-      console.log(`  FAIL  ${displayName} (${why})`);
       const stdoutText = (err.stdout ? err.stdout.toString() : '').trim();
+      if (!err.killed && isCleanTeardownAbort(stdoutText, err.stderr ? err.stderr.toString() : '')) {
+        console.log(`  ok    ${displayName} (clean verdict, then libuv teardown abort, ${why})`);
+        teardownAborts.push(displayName);
+        return;
+      }
+      console.log(`  FAIL  ${displayName} (${why})`);
       // The actual failures first: the file's own FAIL lines, then its stdout
       // tail (the last failure's assertion detail + summary), both bounded.
       const failLines = stdoutText ? stdoutText.split('\n').filter((l) => /\bFAIL\b/.test(l)).slice(0, 5) : [];
@@ -323,6 +347,9 @@ function main() {
 
   const label = integrationMode ? 'run-unit-tests --integration' : 'run-unit-tests';
   console.log('');
+  if (teardownAborts.length) {
+    console.log(`${label}: ${teardownAborts.length} passed but aborted in libuv teardown (not failures; task 1003845) — ${teardownAborts.join(', ')}`);
+  }
   if (failures.length === 0) {
     console.log(`${label}: all ${total} passed.`);
     process.exit(0);
@@ -333,4 +360,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { discoverModuleTests };
+module.exports = { discoverModuleTests, isCleanTeardownAbort };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.828'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.829'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/unit_runner_teardown_abort.mjs

@@ -0,0 +1,67 @@
+// tests/unit_runner_teardown_abort.mjs
+//
+// The unit runner tells a libuv TEARDOWN abort apart from a failing suite (task 1003845).
+//
+// On Windows + Node 24 a suite that hard-exits after serving HTTP can print a clean
+// verdict and THEN die natively:
+//
+//   Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c, line 76
+//
+// exit 127 or 0xC0000409, nondeterministically. tests/provisioning_github_app_routes.mjs
+// did it 5 runs of 6 on origin/main, and 51 suites share that shape. Counted as FAILED,
+// these swap in and out of a Windows baseline with timing, so a genuinely new failure
+// can take a vanished one's place without the count moving.
+//
+// The runner recognises the class by its stderr signature AND the suite's own clean
+// verdict, never by a curated list of names. The cases below are the ways that pairing
+// must refuse: a real failure is never allowed to read as teardown noise.
+//
+// Run:  node --test tests/unit_runner_teardown_abort.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { isCleanTeardownAbort } from '../scripts/gds/run-unit-tests.js';
+
+// Captured from a real aborted run of tests/provisioning_github_app_routes.mjs.
+const ABORT_76 = 'Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\\win\\async.c, line 76\r\n';
+const ABORT_94 = 'Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\\win\\async.c, line 94\r\n';
+const CLEAN = '  PASS  non-numeric :id → 400 bad_id (never a 500)\n\nprovisioning github-app routes: 23 passed, 0 failed\n';
+
+test('a clean verdict followed by the libuv abort is teardown noise', () => {
+  assert.equal(isCleanTeardownAbort(CLEAN, ABORT_76), true);
+  assert.equal(isCleanTeardownAbort('  PASS  a\n\n9 passed, 0 failed\n', ABORT_94), true);
+});
+
+test('the abort does not excuse a verdict that reports failures', () => {
+  assert.equal(isCleanTeardownAbort('  PASS  a\n  FAIL  b\n\n22 passed, 1 failed\n', ABORT_76), false);
+});
+
+test('a FAIL line outranks a summary that claims zero failures', () => {
+  assert.equal(isCleanTeardownAbort('  FAIL  b\n\n23 passed, 0 failed\n', ABORT_76), false);
+});
+
+test('FAIL inside a passing case title is not a FAIL line', () => {
+  // tests/search_isolation.mjs prints exactly this and passes.
+  const stdout = '  ok  rank helper is FAIL-CLOSED: unknown/missing rank → least privilege only\n\n5 passed, 0 failed\n';
+  assert.equal(isCleanTeardownAbort(stdout, ABORT_76), true);
+});
+
+test('an ordinary non-zero exit with no abort signature stays a failure', () => {
+  assert.equal(isCleanTeardownAbort(CLEAN, ''), false);
+  assert.equal(isCleanTeardownAbort(CLEAN, 'Error: listen EADDRINUSE\n'), false);
+});
+
+test('an abort with no verdict at all is a crash, not noise', () => {
+  assert.equal(isCleanTeardownAbort('  PASS  a\n', ABORT_76), false);
+  assert.equal(isCleanTeardownAbort('', ABORT_76), false);
+});
+
+test('the verdict must be the LAST thing the suite printed', () => {
+  // A mid-file section summary does not vouch for whatever ran after it.
+  const midFile = 'section one: 4 passed, 0 failed\n  PASS  c\nnext section starting\n';
+  assert.equal(isCleanTeardownAbort(midFile, ABORT_76), false);
+});
+
+test('a suite that asserted nothing is not vouched for', () => {
+  assert.equal(isCleanTeardownAbort('\n0 passed, 0 failed\n', ABORT_76), false);
+});