@bongos/core 1.19.855 → 1.19.856

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.855",
-  "core_contract": "1.19.855",
-  "source_commit": "ea9bbb312aedb67961f643df3927bd9c3611d451",
+  "core_version": "1.19.856",
+  "core_contract": "1.19.856",
+  "source_commit": "8ced2a661e8458ae529e81df4cb0b11dfeaf7a96",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T21:30:54.480Z",
+  "built_at": "2026-09-17T21:40:29.636Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 498,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2804,
-  "tree_sha256": "f9cc99e0ebd1bf3f55d448b2204c056c832f6360a4941393b640f1db34e99093",
+  "tree_sha256": "1e26bfc7f80b78ac9e275889e16baadad82668019aaa672e01afe52675d9a93e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2592,7 +2592,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e272f0cf7f1826cdfedeb48806e9cec9caf6b926793d5308d5de9e137d47cb76"
+      "sha256": "18a196415acd0b8dcd475f37b816c7a652cb11a7b59d2083e823035ef1d69b22"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7917,12 +7917,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7e2895e4342846fb96f477f37493b4f813d0562e1882a7ce204f54c2787bc815"
+      "sha256": "8cb63b3dfdca80c3fb67143017904b69db150b3f762bc499f8cb23daa83cf800"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "11f9ed62bce433c5f300faa1c4c052b810276df34ec1dcdca2d022a6e04e6370"
+      "sha256": "0322ae3ab7c17a95862bd90db75181a061b1d8f9d39e988c6f93d2fdfa7b964e"
     },
     {
       "path": "public-docs/index.html",
@@ -8287,7 +8287,7 @@
     {
       "path": "scripts/gds/copy-inventory.js",
       "mode": "0000644",
-      "sha256": "7269164648fc1d00e1bf3272a82f933a5f8da228e562e00848dbc29c671d3e94"
+      "sha256": "5317a97fce3dfe9cd4101bb0d8fd7928fdd6ab2298297e2e42ec0f859a2f34f5"
     },
     {
       "path": "scripts/gds/coreB-carve-proof.sh",
@@ -9867,7 +9867,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "210e06e3e19060630a7d73a98aeceb948eb47b6690435d5ad8b624b0b1f05bc2"
+      "sha256": "bc5ad349fe8a4d7307d9caa042fe3e1d2454f04bc540014037b52d4f7e0482b0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10717,7 +10717,7 @@
     {
       "path": "tests/copy_inventory.mjs",
       "mode": "0000644",
-      "sha256": "716aa03c5e93b71aec0c7e6fe646e5abd702b8b6ffda0ef6235a804d2c17a0ca"
+      "sha256": "e621021bdab92a17c9f0f0760ced4c2f2c955ef3df91fb584a7a398c46a717aa"
     },
     {
       "path": "tests/core_upgrade_door.mjs",

package/docs/module-api-changelog.md

@@ -2184,5 +2184,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.853 with no explicit bump. run 35276402271. (task 1002620)
   1.19.855 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.854 with no explicit bump. run 35277047800. (task 1002620)
+  1.19.856 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.855 with no explicit bump. run 35277927951. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.855",
+  "version": "1.19.856",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.855",
+      "version": "1.19.856",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.855",
+  "version": "1.19.856",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-inventory.js

@@ -40,6 +40,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
+const { sameContent } = require('./gen-freshness'); // eol-insensitive freshness (CRLF checkouts)
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // Repo-relative paths that end up INSIDE the checked-in artifacts are joined with
@@ -485,30 +486,24 @@ function renderReport(reg) {
   return L.join('\n');
 }
 
-// Line-ending-blind view of a file's text, for the --check compare ONLY (task 1003619).
-// Why: the generator emits LF, and --check string-compares that against the file on
-// disk. A Windows checkout hands back CRLF, so the compare reported STALE forever on
-// content that was byte-identical in the index — a permanently red /ship-check gate,
-// which teaches builders to wave past the one check that catches a REAL stale artifact.
-// .gitattributes now pins this pair to eol=lf, but that only governs FUTURE checkouts:
-// a file already sitting CRLF in an existing worktree stays CRLF until renormalized,
-// so the checker must not care either way. Freshness is a question about CONTENT.
-// Not used on the write path — generated files are still written with LF endings.
-function lf(s) {
-  return s.replace(/\r\n/g, '\n');
-}
-
 // Is the artifact on disk still what the generator would write? Freshness is a
-// question about CONTENT, so CRLF-vs-LF is not a difference — see lf() above for
-// why that mattered. A missing file (`have === null`) is stale by definition.
-// Only \r\n is folded, NOT a lone \r: no tool in this repo emits classic-Mac
-// endings, and treating a bare \r as a newline would let a genuinely corrupt file
-// read as fresh. Pure + exported so the decision is unit-testable without writing
-// to the committed artifacts (same shape as shouldRefuseSessionClaim in
-// modules/lifecycle/routes/claims.js).
+// question about CONTENT, so CRLF-vs-LF is not a difference — the eol-blind compare
+// is gen-freshness.sameContent, shared with the other six generators, and its header
+// carries the full why (task 1003619 hit it here: a Windows checkout reads back the
+// CRLF git wrote, so a byte compare reported STALE forever on content that was
+// byte-identical in the index — a permanently red gate teaches builders to wave past
+// the one check that catches a REAL stale artifact). Only \r\n is folded, NOT a lone
+// \r, so a genuinely corrupt file cannot read as fresh.
+//
+// The one thing that is local, and the reason this wrapper exists rather than a bare
+// sameContent() at the call site: a MISSING file is stale by definition. sameContent
+// would coerce a null `have` to '' and call it fresh against an empty `want`.
+// Not used on the write path — generated files are still written with LF endings.
+// Pure + exported so the decision is unit-testable without writing to the committed
+// artifacts (same shape as shouldRefuseSessionClaim in modules/lifecycle/routes/claims.js).
 function matchesGenerated(have, want) {
   if (have === null || have === undefined) return false;
-  return lf(have) === lf(want);
+  return sameContent(have, want);
 }
 
 function write({ check = false } = {}) {
@@ -551,5 +546,5 @@ if (require.main === module) {
 module.exports = {
   SURFACES, COPY_ATTRS, BLIND_SPOTS, REGISTRY_REL, REPORT_REL,
   cmp, stableId, looksLikeCopy, lineIndex, lineAt, stripEmbedded, fromHtml, fromJs, filesFor,
-  buildRegistry, renderReport, write, lf, matchesGenerated,
+  buildRegistry, renderReport, write, matchesGenerated,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.855'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.856'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');