@bongos/core 1.19.852 → 1.19.853

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.852",
-  "core_contract": "1.19.852",
-  "source_commit": "bf625696dfb7d52ffce6a01a498a5f9bb7fdfa75",
+  "core_version": "1.19.853",
+  "core_contract": "1.19.853",
+  "source_commit": "23d160b78996d913c0510928995bae59a1ae6832",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T21:07:34.757Z",
+  "built_at": "2026-09-17T21:14:11.854Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 497,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2801,
-  "tree_sha256": "d02b8c530b080946a1eeca76fc4a81f1cee5c8d893f9f41639fb880495862380",
+  "tree_sha256": "cfc90395d496db6fa9ae34f98458137adcc184faa73c806f2bfdba99027d74ff",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2587,7 +2587,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "75cf389b149eecb2feb08521e846ec486059c4b2b56f01ec3d6d46f62e89ecf9"
+      "sha256": "cd9e820a59b864c0b7c48431cbfe39edfeb421fcb807d24679a768c217373720"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7912,12 +7912,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "197f6af6f83b766818989ee6f6fb71723dcf8420ddd190c18703e8c26b5aa889"
+      "sha256": "d6109cde0d5b5a6a8667252455ec1221dbcd4891b4937bfd240743990d0a354a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "065f7ae763810587db17bc9522c11f8672ef9b9689a1cb8630debc9e12ae586e"
+      "sha256": "e4c6a0d643d7fbf5c9220a2449763f4cbd0b05594eec7fec5d1fffd7e691c54c"
     },
     {
       "path": "public-docs/index.html",
@@ -9857,7 +9857,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "82b3a923d967a361a85d409528a785f2e70434289ee10cf25f3fd1e580eddacb"
+      "sha256": "239294e8e4023ccc05619cd66992afebfceea6453821ec3ee7ceb8cabb540cf7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12932,7 +12932,7 @@
     {
       "path": "tests/rank_gate.mjs",
       "mode": "0000644",
-      "sha256": "78626dc42e6d31685352e43e1e8e094a904f59d9d0562caf6b6e126934df973f"
+      "sha256": "05e193a23bb1218c1c96a4f4bbc734f2f09a6dd76434eb59750014277f0cef3b"
     },
     {
       "path": "tests/rank_roles_audit.mjs",

package/docs/module-api-changelog.md

@@ -2178,5 +2178,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.850 with no explicit bump. run 35274042996. (task 1002620)
   1.19.852 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.851 with no explicit bump. run 35274827497. (task 1002620)
+  1.19.853 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.852 with no explicit bump. run 35275456041. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.852",
+  "version": "1.19.853",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.852",
+      "version": "1.19.853",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.852",
+  "version": "1.19.853",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.852'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.853'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/rank_gate.mjs

@@ -323,12 +323,41 @@ const __dir = dirname(fileURLToPath(import.meta.url));
 // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
 const dbSrc = lifecycleDbSource();
 
-t('every live rank appears in the claimable CASE at its REQUIRES_RANK_TIER value', () => {
-  // Isolate the listClaimableTasks function body so we don't match CASE
-  // expressions elsewhere in db.js.
+// Isolate the listClaimableTasks function body so we don't match CASE expressions
+// elsewhere in the lifecycle data layer.
+//
+// ANCHORED TO THE NEXT TOP-LEVEL FUNCTION, not to a byte count (task 1004015; the
+// same fix task 1004002 landed in tests/reward_gate.mjs). The window used to be
+// `start + 4000`, and listClaimableTasks measures 12019 chars — so the slice carried
+// a THIRD of the function it claims to scan.
+//
+// That is a false RED for the positive assertion below (the last WHEN clause it needs
+// sits at +3400, leaving 600 characters of margin before an unrelated feature pushes
+// it out of frame — reward_gate was widened four times for exactly that). It is a
+// false GREEN for the NEGATIVE assertions in the next test, which is the worse half:
+// a stale pre-thetes mapping living anywhere past +4000 — two thirds of the body —
+// passes a test whose entire purpose is to catch it.
+//
+// The boundary lookup is ASSERTED rather than defaulted: if listActiveClaims is ever
+// renamed or moved, this fails loudly and names the fix, instead of silently falling
+// back to a byte window and reinstating the bug.
+// LAZY, and called from inside each t() — deliberately not an IIFE evaluated at module
+// load. Every assertion in this file lives inside a t() closure so a failure is caught,
+// named and counted while the other ~30 tests below still run. An assert at top level
+// would throw at IMPORT time in exactly the case it guards (listActiveClaims renamed),
+// aborting the file before any downstream test registers — trading a false green for a
+// silent loss of the rest of the suite.
+const claimableBody = () => {
   const start = dbSrc.indexOf('async function listClaimableTasks');
-  assert.ok(start >= 0, 'listClaimableTasks not found in db.js');
-  const body = dbSrc.slice(start, start + 4000);
+  assert.ok(start >= 0, 'listClaimableTasks not found in the lifecycle data layer');
+  const end = dbSrc.indexOf('async function listActiveClaims', start);
+  assert.ok(end > start,
+    'listActiveClaims boundary not found — re-anchor this slice to whatever function now follows listClaimableTasks');
+  return dbSrc.slice(start, end);
+};
+
+t('every live rank appears in the claimable CASE at its REQUIRES_RANK_TIER value', () => {
+  const body = claimableBody();
   for (const [rank, tier] of Object.entries(db.REQUIRES_RANK_TIER)) {
     const re = new RegExp(`WHEN '${rank}' THEN ${tier}\\b`);
     assert.ok(re.test(body),
@@ -338,8 +367,7 @@ t('every live rank appears in the claimable CASE at its REQUIRES_RANK_TIER value
 });
 
 t('the claimable CASE no longer carries the pre-thetes archon=3/metic=2 scale', () => {
-  const start = dbSrc.indexOf('async function listClaimableTasks');
-  const body = dbSrc.slice(start, start + 4000);
+  const body = claimableBody();
   assert.ok(!/WHEN 'archon' THEN 3\b/.test(body),
     "stale archon=3 mapping present — CASE not migrated to the 4-rank scale");
   assert.ok(!/WHEN 'metic' THEN 2\b/.test(body),