@bongos/core 1.19.849 → 1.19.850

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.849",
-  "core_contract": "1.19.849",
-  "source_commit": "a027efb6aa355bb0aa4454dba3a3e2de3627f108",
+  "core_version": "1.19.850",
+  "core_contract": "1.19.850",
+  "source_commit": "232e375d3248cfc923d287f61d29cb6c5f59c5d9",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T20:09:50.093Z",
+  "built_at": "2026-09-17T20:32:54.381Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 496,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2798,
-  "tree_sha256": "894ee6e6b895465db909d512fe4cff3a9ac80665702d069dcdb6c5cafdc61050",
+  "tree_sha256": "12391d158894c3d0cb4e4073c3939f9c3e83705fa0406663fe5a30859fba4af4",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2582,7 +2582,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5795b2567e4a68c109fb1c36a46346dd3b40ded0ea206d4368ec58cd23916849"
+      "sha256": "6c3496a323791d9b6bfc8e86faba4e433a51091e5a9d12b85ede0b207d8057a5"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7907,12 +7907,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3a5f72a3b77cc19f6404799e646685ee91e3996ebb614b66b756722a6c23edc5"
+      "sha256": "1e217b4d7975b9c295c2806a83a5817f93fc38a0786a1976fe8ec19aac141b50"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "61c0a90cce564a70963e5ab3b301e6349e89c135e56767a94107df0817a42c31"
+      "sha256": "6943316e63bef1a867ea04e705e42a9aa28a50e2cded10e16874899c61f69f03"
     },
     {
       "path": "public-docs/index.html",
@@ -9852,7 +9852,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2b2515e91e33976af14b7538bff4d39a0ea053a33b84fb86a848254a4c3e9af7"
+      "sha256": "d2a5ba427ce014f7940e2757f06541e25275e0c4f59c0b9c5026396c795e41f2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13022,7 +13022,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "0cd9f335da162c3562c099a2dbe4375b009f5a8a8321f4ef84b7a577be816bdc"
+      "sha256": "f1cb5f34e9ecbd072b56840facdc57ca2b9d2fa6efc48427ce738cc65a72011f"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",

package/docs/module-api-changelog.md

@@ -2172,5 +2172,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.847 with no explicit bump. run 35267380720. (task 1002620)
   1.19.849 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.848 with no explicit bump. run 35269098215. (task 1002620)
+  1.19.850 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.849 with no explicit bump. run 35271402682. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.849",
+  "version": "1.19.850",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.849",
+      "version": "1.19.850",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.849",
+  "version": "1.19.850",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.849'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.850'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/reward_gate.mjs

@@ -162,14 +162,28 @@ t('promote route AUTO-ASSIGNS then proceeds (no 409 refusal for missing reward)'
 t('claim path AUTO-ASSIGNS inside the FOR UPDATE transaction (never refuses)', () => {
   const start = dbSrc.indexOf('async function claimTask');
   assert.ok(start >= 0, 'claimTask not found');
-  // The window is a slice heuristic, not a contract: it only has to cover the
-  // pre-flight half of claimTask (which spans ~13k chars). Widened 5000 -> 6000 in
-  // BV1.R106, when the permission-expressed claim gate pushed the reward-gate block
-  // past the old edge; 6000 -> 7000 in task 1002613, when the enriched
-  // rank_too_low_for_task denial did the same; 7000 -> 8500 in task 1003137, when
-  // the goal-membership gate landed between the rank gates and deps. Keep it
-  // comfortably below the claimTasksBatch boundary (~16.5k chars in).
-  const body = dbSrc.slice(start, start + 8500);
+  // Scan the REAL claimTask body — from its declaration to the next top-level
+  // function (claimTasksBatch) — rather than a fixed byte window, the same fix the
+  // createTask and POST /tasks siblings below already carry.
+  //
+  // The byte window was widened four times for four UNRELATED features: 5000 -> 6000
+  // in BV1.R106 (the permission-expressed claim gate), 6000 -> 7000 in task 1002613
+  // (the enriched rank_too_low_for_task denial), 7000 -> 8500 in task 1003137 (the
+  // goal-membership gate). Each time, an edit to claimTask's PREFLIGHT pushed the
+  // reward block past the edge and red a test about rewards — and the message,
+  // "claimTask must consult the auto-assign decision", pointed the reader at the
+  // reward gate instead of at their own change. Task 1003294 paid the tax again with
+  // a five-line comment (margin was down to ~125 chars) and had to trim prose to get
+  // green. The comment above USED to name claimTasksBatch as the real bound; it was
+  // simply never what the code measured. Now it is, so the window grows with the
+  // function and this line stops needing maintenance.
+  //
+  // A missing anchor fails LOUDLY rather than falling back to a byte count: a silent
+  // fallback would reintroduce exactly the failure mode being removed here.
+  const end = dbSrc.indexOf('async function claimTasksBatch', start);
+  assert.ok(end > start,
+    'claimTasksBatch boundary not found — reward_gate can no longer bound claimTask; re-anchor this slice');
+  const body = dbSrc.slice(start, end);
   assert.match(body, /rewardGateAssignment\(task\)/, 'claimTask must consult the auto-assign decision');
   assert.match(body, /UPDATE tasks SET credits_reward/, 'claimTask must persist the assigned reward in-tx');
   // it must SELECT the columns the gate needs.