@bongos/core 1.19.855 → 1.19.857

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.855",
-  "core_contract": "1.19.855",
-  "source_commit": "ea9bbb312aedb67961f643df3927bd9c3611d451",
+  "core_version": "1.19.857",
+  "core_contract": "1.19.857",
+  "source_commit": "b591a81b627f40ec9e0d235d201b1f54f21ea1bf",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T21:30:54.480Z",
+  "built_at": "2026-09-17T21:51:29.538Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 498,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2804,
-  "tree_sha256": "f9cc99e0ebd1bf3f55d448b2204c056c832f6360a4941393b640f1db34e99093",
+  "tree_sha256": "6d87cce28c4d7d99fab00dce29c6654aa1e59ebbff7c20ece7de301410c34332",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -452,7 +452,7 @@
     {
       "path": "docs/adr/0008-family-based-tile-generation.md",
       "mode": "0000644",
-      "sha256": "6742a4c2b85ca10e4c21759d664cea87e8bd6c03f404ab16312cd4266355df8d"
+      "sha256": "7440b1e58ca873eb2b47fdb93dffd97a17d04a3df4729434e8a249068fd3eaaa"
     },
     {
       "path": "docs/adr/0008-google-chat-oauth-user-auth.md",
@@ -2592,7 +2592,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e272f0cf7f1826cdfedeb48806e9cec9caf6b926793d5308d5de9e137d47cb76"
+      "sha256": "6039f82c978097f35c3be7357b99c225fd678ca31692b09a130a5389112735dd"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7917,12 +7917,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7e2895e4342846fb96f477f37493b4f813d0562e1882a7ce204f54c2787bc815"
+      "sha256": "73c27e08b25249cef8ec8eb6a17f45c8f73c6eb75459aa852129456893485446"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "11f9ed62bce433c5f300faa1c4c052b810276df34ec1dcdca2d022a6e04e6370"
+      "sha256": "6a45a64683e79505a88ad297424ff463068def3a2b92ba9a417b7d119941640a"
     },
     {
       "path": "public-docs/index.html",
@@ -8287,7 +8287,7 @@
     {
       "path": "scripts/gds/copy-inventory.js",
       "mode": "0000644",
-      "sha256": "7269164648fc1d00e1bf3272a82f933a5f8da228e562e00848dbc29c671d3e94"
+      "sha256": "5317a97fce3dfe9cd4101bb0d8fd7928fdd6ab2298297e2e42ec0f859a2f34f5"
     },
     {
       "path": "scripts/gds/coreB-carve-proof.sh",
@@ -9867,7 +9867,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "210e06e3e19060630a7d73a98aeceb948eb47b6690435d5ad8b624b0b1f05bc2"
+      "sha256": "f3e4186d676d49a57c8b8cbe857c25c0632ebf7e6f0991380ee746d995b75e45"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10717,7 +10717,7 @@
     {
       "path": "tests/copy_inventory.mjs",
       "mode": "0000644",
-      "sha256": "716aa03c5e93b71aec0c7e6fe646e5abd702b8b6ffda0ef6235a804d2c17a0ca"
+      "sha256": "e621021bdab92a17c9f0f0760ced4c2f2c955ef3df91fb584a7a398c46a717aa"
     },
     {
       "path": "tests/core_upgrade_door.mjs",

package/docs/adr/0008-family-based-tile-generation.md

@@ -3,7 +3,7 @@
 - **Status:** Accepted
 - **Date:** 2026-05-09
 - **Deciders:** Lars
-- **Supersedes (in part):** the per-tile generation flow described in the Phase-1 pixel-art pipeline (see [docs/recipes/pixel-art-pipeline.md](../recipes/pixel-art-pipeline.md)), which remains in service for atomic tiles that have not yet been migrated.
+- **Supersedes (in part):** the per-tile generation flow described in the Phase-1 pixel-art pipeline (see `docs/recipes/pixel-art-pipeline.md` — host content, stripped from the neutral core at extraction in b6ee5d29, so the path no longer resolves here), which remains in service for atomic tiles that have not yet been migrated.
 
 ## Context
 

package/docs/module-api-changelog.md

@@ -2184,5 +2184,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.853 with no explicit bump. run 35276402271. (task 1002620)
   1.19.855 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.854 with no explicit bump. run 35277047800. (task 1002620)
+  1.19.856 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.855 with no explicit bump. run 35277927951. (task 1002620)
+  1.19.857 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.856 with no explicit bump. run 35278916322. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.855",
+  "version": "1.19.857",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.855",
+      "version": "1.19.857",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.855",
+  "version": "1.19.857",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/copy-inventory.js

@@ -40,6 +40,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
+const { sameContent } = require('./gen-freshness'); // eol-insensitive freshness (CRLF checkouts)
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // Repo-relative paths that end up INSIDE the checked-in artifacts are joined with
@@ -485,30 +486,24 @@ function renderReport(reg) {
   return L.join('\n');
 }
 
-// Line-ending-blind view of a file's text, for the --check compare ONLY (task 1003619).
-// Why: the generator emits LF, and --check string-compares that against the file on
-// disk. A Windows checkout hands back CRLF, so the compare reported STALE forever on
-// content that was byte-identical in the index — a permanently red /ship-check gate,
-// which teaches builders to wave past the one check that catches a REAL stale artifact.
-// .gitattributes now pins this pair to eol=lf, but that only governs FUTURE checkouts:
-// a file already sitting CRLF in an existing worktree stays CRLF until renormalized,
-// so the checker must not care either way. Freshness is a question about CONTENT.
-// Not used on the write path — generated files are still written with LF endings.
-function lf(s) {
-  return s.replace(/\r\n/g, '\n');
-}
-
 // Is the artifact on disk still what the generator would write? Freshness is a
-// question about CONTENT, so CRLF-vs-LF is not a difference — see lf() above for
-// why that mattered. A missing file (`have === null`) is stale by definition.
-// Only \r\n is folded, NOT a lone \r: no tool in this repo emits classic-Mac
-// endings, and treating a bare \r as a newline would let a genuinely corrupt file
-// read as fresh. Pure + exported so the decision is unit-testable without writing
-// to the committed artifacts (same shape as shouldRefuseSessionClaim in
-// modules/lifecycle/routes/claims.js).
+// question about CONTENT, so CRLF-vs-LF is not a difference — the eol-blind compare
+// is gen-freshness.sameContent, shared with the other six generators, and its header
+// carries the full why (task 1003619 hit it here: a Windows checkout reads back the
+// CRLF git wrote, so a byte compare reported STALE forever on content that was
+// byte-identical in the index — a permanently red gate teaches builders to wave past
+// the one check that catches a REAL stale artifact). Only \r\n is folded, NOT a lone
+// \r, so a genuinely corrupt file cannot read as fresh.
+//
+// The one thing that is local, and the reason this wrapper exists rather than a bare
+// sameContent() at the call site: a MISSING file is stale by definition. sameContent
+// would coerce a null `have` to '' and call it fresh against an empty `want`.
+// Not used on the write path — generated files are still written with LF endings.
+// Pure + exported so the decision is unit-testable without writing to the committed
+// artifacts (same shape as shouldRefuseSessionClaim in modules/lifecycle/routes/claims.js).
 function matchesGenerated(have, want) {
   if (have === null || have === undefined) return false;
-  return lf(have) === lf(want);
+  return sameContent(have, want);
 }
 
 function write({ check = false } = {}) {
@@ -551,5 +546,5 @@ if (require.main === module) {
 module.exports = {
   SURFACES, COPY_ATTRS, BLIND_SPOTS, REGISTRY_REL, REPORT_REL,
   cmp, stableId, looksLikeCopy, lineIndex, lineAt, stripEmbedded, fromHtml, fromJs, filesFor,
-  buildRegistry, renderReport, write, lf, matchesGenerated,
+  buildRegistry, renderReport, write, matchesGenerated,
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.855'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.857'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');