@bongos/core 1.19.858 → 1.19.859

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.858",
-  "core_contract": "1.19.858",
-  "source_commit": "afc4e781c80a292d23180b498c8a15f9483bcedb",
+  "core_version": "1.19.859",
+  "core_contract": "1.19.859",
+  "source_commit": "88f0482054c54e919261f2a12807d600816ed82a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T22:01:14.430Z",
+  "built_at": "2026-09-17T22:12:12.572Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 498,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2804,
-  "tree_sha256": "34a2816607bed641f30b7a13611a257ff4330ca477e9b6fb6e03ed7137e20ad5",
+  "tree_sha256": "b78ad9f6f954e75b5baea41887323131be92e116c1966a2199cca319f8b0b875",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1277,7 +1277,7 @@
     {
       "path": "docs/adr/0161-publish-on-merge.md",
       "mode": "0000644",
-      "sha256": "c96d62b3b9eb4945cd7e55ccc361c230f5c5ca559d187d6156c330e0f9f30e49"
+      "sha256": "c3da608c2b3d17ceb9208abfadd8ed218654fcc67cc545528683da8a624834a0"
     },
     {
       "path": "docs/adr/0162-review-gates-retired-rank-consistent-ci-only.md",
@@ -2062,12 +2062,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "4f6e17550f44d1974e98338d2ab1bd59bce9681c741ebbcdad7c35d5105d1c10"
+      "sha256": "ae1018c0897a5358ea2c5a37aeab4a693400a5c2e3ac8e02eb8fbc805dbd0af0"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "cdfb4dc21b70a0b6ddba18951431a44e103e95be84ebb07e6fcba3ad2030379a"
+      "sha256": "34b45e28825cdd2cc46087b6aa96fae19931da5561275ba2df7f5121daf23d6a"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2592,7 +2592,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "56c034df0c7eb96ada2eed6aa17ce5e3485716901c6215c72eb247276a091ca9"
+      "sha256": "1e68c4750a4f88d910f87d06d8f99acaabe7c8c0c393a3da8b94ecd9b3b32ca8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4952,7 +4952,7 @@
     {
       "path": "modules/hall-ui/public/goals-page.js",
       "mode": "0000644",
-      "sha256": "70846002f577ca160ea9f819e1ea550b7c79f80b4f0f29780e959613f388d46e"
+      "sha256": "22511ab390f5b4664f6754b9c025d8949b5708b0a106e978f32aa7b49bb93938"
     },
     {
       "path": "modules/hall-ui/public/goals-render.js",
@@ -5472,7 +5472,7 @@
     {
       "path": "modules/hall-ui/public/work.js",
       "mode": "0000644",
-      "sha256": "6e72e2bdb5016937ccace00ec085265b0e71488d98f33883e2b4e0cc01117ce8"
+      "sha256": "ea864a92f67de2a6d715a7372bd7b4ed5d05b90e4f6864b634b71342ed2debe8"
     },
     {
       "path": "modules/hall-ui/public/work.states.json",
@@ -7917,12 +7917,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "66f32ef74e691565c2cb563b55bf7276e51a0fb60ac2e993a92ed490e4124191"
+      "sha256": "2d544ea0fed5368d5c140a2e44b18b8265be912369bd47dcf78b5fcfaef6d739"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "52c154531637a295f97e1352c9506ab2096351f701953d257097a94bef201ccf"
+      "sha256": "3aa07b12e96b6217ec805ae73ff8d535d1ac92c4c5d00d6074d8e92afd2672cb"
     },
     {
       "path": "public-docs/index.html",
@@ -8192,7 +8192,7 @@
     {
       "path": "scripts/gds/bump-version.js",
       "mode": "0000644",
-      "sha256": "18cdfd285c4037da0f60d53bf8736aa6e6185022c79533ed81a4c9aa9a370392"
+      "sha256": "62c5350636e3606c577fb134150db464ddc2eb3c5ce22b063a13dae3748a500e"
     },
     {
       "path": "scripts/gds/capture.js",
@@ -9332,7 +9332,7 @@
     {
       "path": "scripts/gds/smoke-dependencies.sh",
       "mode": "0000644",
-      "sha256": "451d843d1bba784dff10979a8fe7fd25bd5cdb2a0a00cc4e6e00eb84896f9aee"
+      "sha256": "de4dd849f6b4b641f33c4df0672f42c83c3012b8458c618af1c6add9dfb32734"
     },
     {
       "path": "scripts/gds/smoke-gds.js",
@@ -9867,7 +9867,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "afc74def8759f073e583a0ec5677587d849e1d8534f704bd1560cb018a16dc10"
+      "sha256": "6c6509130bcd722c09a1aca7f9b4f9bcd82200c2e47b9b68659d0b831ac606e5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10502,7 +10502,7 @@
     {
       "path": "tests/bump_version.mjs",
       "mode": "0000644",
-      "sha256": "1a96e58f266d58dfc0f5fc9381df4b3348171b5cfe81e91161d884b34208ee6c"
+      "sha256": "6540646400fb4464ee823b841f908f8577d170f60c4b4928fbbfc2a3746b76d4"
     },
     {
       "path": "tests/canonical_profile_url.mjs",
@@ -11652,7 +11652,7 @@
     {
       "path": "tests/hall_error_envelope.mjs",
       "mode": "0000644",
-      "sha256": "1d9c1d345a6fe25eacf810703a3e7f9f3b33f8e982aef49364e19eb4469de668"
+      "sha256": "57a013b7955cdfe0edf19fcdf24dbfdfda60be625c94d2c32f258772cbd5e140"
     },
     {
       "path": "tests/hall_kit_charts.mjs",

package/docs/adr/0161-publish-on-merge.md

@@ -22,6 +22,12 @@ The consumption side (ADR 0136's subscription) was never the problem; supply was
 
 1. **Every merge to `main` publishes.** A `publish` workflow fires on the `unit` check succeeding on a main push (never on a red suite), builds via `package-core` — the fail-closed no-leak gate and `--self-verify` pin check run inside the build — publishes (restricted), and tags `core-v<version>`.
 2. **CI bumps PATCH only.** When a merge lands without a human bump, `scripts/gds/bump-version.js` bumps the patch and writes the changelog line (shape-preserving; pinned by `tests/bump_version.mjs`). A **minor or major stays a deliberate in-task human edit** — it is a statement about the doorway surface, and it decides what patch-channel subscribers receive unattended (ADR 0136). CI is not allowed to make that call.
+
+   **The promise was unkeepable until task 1003526 (2026-09-17).** A branch that hand-bumped had no commit shape the lane recognised, so `tests/bump_version.mjs`'s LIVE check failed its own PR's `unit` check by construction — that is what killed task 1003044's first ship (PR #391) — and had one merged, `publish.yml`'s record step (point 5) fires only when *CI* bumped, so the hand-cut version would have been re-packed by every later merge and **nothing new would ever have published again**. A stalled lane, not just a blocked PR. The owner chose to teach the lane the human shape rather than retire the promise.
+
+   A human release is now a first-class commit: `release: core X.Y.Z — <reason>`, matched by `HUMAN_RELEASE_COMMIT_RE` — deliberately the complement of the CI carrier's `RELEASE_COMMIT_RE`, so no subject reads as both. The two predicates now answer **different questions**, which is the correction: `isReleaseCommit` (the cascade terminator) says **no** to a human carrier, because that version is new and still needs packaging; `laneReleasedVersions` says **yes**, because the number is claimed and the lane must not publish onto it. Forcing them to agree was the defect.
+
+   The cost is one version number: declaring 1.20.0 publishes **1.20.1**, because `publish.yml` reads `taken=true`, bumps one patch past the claim, and records its own carrier — which is exactly what keeps the lane moving. Publishing the declared number *exactly* would mean teaching the record step to fire without a bump, and `.github/` is a protected surface on the lane that already minted-and-lost 1.19.716–723; the digit is not worth that edit. The minor/major signal downstream consumers actually read is preserved.
 3. **Token custody reverses, knowingly.** A standing npm **write** Automation token (`NPM_TOKEN`) and a fine-grained **contents:write** PAT (`RELEASE_PUSH_TOKEN`, for the bump commit — the default `GITHUB_TOKEN` cannot push past the required `unit` check) live as GitHub Actions secrets. This is exactly the surface 0137 declined; the owner accepted it with the incidents as evidence. **Superseded for the npm half at task 1003202 (2026-08-25):** the write token is gone — the lane publishes via OIDC trusted publishing (ADR 0180), so no long-lived npm credential exists to steal. `RELEASE_PUSH_TOKEN` remains, as the bump commit still needs contents:write. Mitigations: the lane is **default-inert** behind the repo variable `PUBLISH_ON_MERGE=1` (an owner kill-switch symmetrical to `gating.js`), packages publish `restricted`, and the no-leak gate structurally cannot upload a leaking artifact.
 4. **Idempotent by version-compare.** The bump commit re-triggers `unit` → `publish`, which then finds HEAD's version already on npm and no-ops. npm's duplicate-version rejection is the backstop; concurrent merges queue behind a no-cancel concurrency group.
 5. **The bump commit is pushed only after the tarball is on the registry** (amended at task 1003914, 2026-09-13). The bump is *committed* before `package-core` runs — it stamps the version found at the ref — but the **push is the last step**, after `npm publish` returns. Originally it ran first, which made a pack or publish failure permanently lossy: `main` declared a version the registry never had, and the cascade terminator (point 4) then no-opped every following run, so only a fresh work merge could move on — bumping *past* the hole. Versions 1.19.716–723 were minted and lost exactly that way during a three-hour leak-gate fault (task 1003873). Pushing last makes the failure discard a purely local commit, and the next run retries the **same** version.

package/docs/copy-inventory.md

@@ -54,7 +54,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `e57ec24e13ef` | 4x | Sign in with GitHub | modules/hall-ui/public/hall-render.js:275, modules/hall-ui/public/hall-render.js:346, modules/hall-ui/public/hall-render.js:415 |
 | `2ae36be1c531` | 4x | Start a project | modules/public-landing/public/index.html:727, modules/public-landing/public/index.html:891, modules/public-landing/public/projects.html:509 |
 | `eff70e59d12e` | 4x | Task {…} | modules/hall-ui/public/task.js:494, modules/hall-ui/public/task.js:530, modules/hall-ui/public/task.js:959 |
-| `b31fc908c962` | 4x | You claimed #{…}. Open a terminal to start work. | modules/hall-ui/public/goals-page.js:418, modules/hall-ui/public/goals-page.js:515, modules/hall-ui/public/work.js:904 |
+| `b31fc908c962` | 4x | You claimed #{…}. Open a terminal to start work. | modules/hall-ui/public/goals-page.js:418, modules/hall-ui/public/goals-page.js:517, modules/hall-ui/public/work.js:904 |
 | `1de02052abf2` | 3x | Available from the {…} rank up. | modules/hall-ui/public/gate.js:222, modules/hall-ui/public/government.js:882, modules/hall-ui/public/harbor.js:340 |
 | `08afb1257b71` | 3x | Back to home | modules/hall-ui/public/drachmae.html:87, modules/hall-ui/public/primer.html:90, modules/hall-ui/public/primer.js:283 |
 | `118026595c16` | 3x | Board Room | modules/hall-ui/public/board-room.html:19, modules/hall-ui/public/board-room.html:19, modules/hall-ui/public/board-room.html:31 |
@@ -65,7 +65,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `f6f68ba322be` | 3x | Open {…} | modules/hall-ui/public/goal-inbox.js:53, modules/hall-ui/public/goal-inbox.js:69, modules/hall-ui/public/goals.js:67 |
 | `e08628967f2f` | 3x | Project settings | modules/hall-ui/public/project-settings.html:15, modules/hall-ui/public/project-settings.html:15, modules/hall-ui/public/project-settings.html:26 |
 | `45f7bea67776` | 3x | Reading the project’s settings… | modules/public-landing/public/projects.html:791, modules/public-landing/public/projects.html:806, modules/public-landing/public/projects.html:825 |
-| `aa4db91b5732` | 3x | Released #{…}. It returns to the queue. | modules/hall-ui/public/goals-page.js:538, modules/hall-ui/public/work.js:945, modules/hall-ui/public/work.js:998 |
+| `aa4db91b5732` | 3x | Released #{…}. It returns to the queue. | modules/hall-ui/public/goals-page.js:540, modules/hall-ui/public/work.js:945, modules/hall-ui/public/work.js:998 |
 | `df38941b25a6` | 3x | Sign in with GitHub | modules/public-landing/public/projects.html:621, modules/public-landing/public/projects.html:693, modules/public-landing/public/projects.html:994 |
 | `e9a366866022` | 3x | This goal is not open. | modules/hall-ui/public/goals-render.js:1279, modules/hall-ui/public/goals-render.js:1301, modules/hall-ui/public/goals-render.js:1317 |
 | `ed394c66d49c` | 3x | What the choice changes | modules/public-landing/public/projects.html:849, modules/public-landing/public/projects.html:908, modules/public-landing/public/projects.html:920 |
@@ -487,7 +487,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9e70797b7e97` | certain | Goal id | `modules/hall-ui/public/goals-render.js:824` |
 | `529460e82058` | certain | Goal invitations to you | `modules/hall-ui/public/goal-inbox.js:113` |
 | `e2a9e33abe60` | certain | Goal tasks | `modules/hall-ui/public/goals.html:136` |
-| `e0bc28d10785` | certain | Goals could not be loaded. Refresh to try again. | `modules/hall-ui/public/goals-page.js:896` |
+| `e0bc28d10785` | certain | Goals could not be loaded. Refresh to try again. | `modules/hall-ui/public/goals-page.js:898` |
 | `4517f2253d0f` | certain | Goals couldn’t be loaded just now. Refresh to try again. | `modules/hall-ui/public/goals.js:121` |
 | `6a85997bda21` | certain | Goals created | `modules/hall-ui/public/profile.html:145` |
 | `2ed2cb8fbffd` | certain | Goals page | `modules/hall-ui/public/goals.js:94` |
@@ -546,7 +546,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `5c2e2bcbd5fb` | certain | In Progress | `modules/hall-ui/public/work.html:95` |
 | `75cfcdd41661` | certain | In this primer | `modules/hall-ui/public/primer.html:58` |
 | `3102d1d90c98` | certain | Intel Mac? | `modules/hall-ui/public/settings.html:227` |
-| `dad3388b49c9` | certain | Invitation rescinded. | `modules/hall-ui/public/goals-page.js:692` |
+| `dad3388b49c9` | certain | Invitation rescinded. | `modules/hall-ui/public/goals-page.js:694` |
 | `12561be47da9` | certain | Invitation sent — they join once they accept. | `modules/hall-ui/public/goals-render.js:1261` |
 | `24f9e88c21f6` | certain | Invite by GitHub username | `modules/hall-ui/public/watch.js:295` |
 | `b9cb720ad5d1` | certain | Invited? Sign in | `modules/hall-ui/public/hall-render.js:286` |
@@ -821,10 +821,10 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `dba9d3f3af13` | certain | Recorded sessions | `modules/hall-ui/public/sessions.html:55` |
 | `b40c4a61070e` | certain | Records your decision only — there is no marketplace yet, and nothing is listed anywhere. | `modules/hall-ui/public/settings.html:326` |
 | `58af483d7a84` | certain | Release task {…} | `modules/hall-ui/public/goals-render.js:348` |
-| `6f86e17007c6` | certain | Release your claim on #{…}? It returns to the queue and no {…} are earned. | `modules/hall-ui/public/goals-page.js:533` |
+| `6f86e17007c6` | certain | Release your claim on #{…}? It returns to the queue and no {…} are earned. | `modules/hall-ui/public/goals-page.js:535` |
 | `6f86e17007c6` | certain | Release your claim on #{…}? It returns to the queue and no {…} are earned. | `modules/hall-ui/public/work.js:990` |
 | `975ffb256651` | certain | Release {…}? {…} to the queue and no {…} are earned. | `modules/hall-ui/public/work.js:939` |
-| `aa4db91b5732` | certain | Released #{…}. It returns to the queue. | `modules/hall-ui/public/goals-page.js:538` |
+| `aa4db91b5732` | certain | Released #{…}. It returns to the queue. | `modules/hall-ui/public/goals-page.js:540` |
 | `aa4db91b5732` | certain | Released #{…}. It returns to the queue. | `modules/hall-ui/public/work.js:945` |
 | `aa4db91b5732` | certain | Released #{…}. It returns to the queue. | `modules/hall-ui/public/work.js:998` |
 | `c49f9b9f8864` | certain | Remake or tweak | `modules/hall-ui/public/studio.js:182` |
@@ -918,7 +918,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9bea6404e6e1` | certain | Sign in | `modules/hall-ui/public/profile.js:208` |
 | `9bea6404e6e1` | certain | Sign in | `modules/hall-ui/public/settings.html:42` |
 | `2f12d46f96ca` | certain | Sign in from the app. | `modules/hall-ui/public/hall-render.js:779` |
-| `19ab56cc3932` | certain | Sign in to filter to your goals | `modules/hall-ui/public/goals-page.js:873` |
+| `19ab56cc3932` | certain | Sign in to filter to your goals | `modules/hall-ui/public/goals-page.js:875` |
 | `969f95f183ca` | certain | Sign in to the platform once to activate your profile before connecting. | `modules/hall-ui/public/profile-connections.js:220` |
 | `b057dfbf49c5` | certain | Sign in when Claude prompts you. | `modules/hall-ui/public/hall-render.js:779` |
 | `e57ec24e13ef` | certain | Sign in with GitHub | `modules/hall-ui/public/hall-render.js:275` |
@@ -1156,7 +1156,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `52e93bbc07a6` | certain | You are already a member of this goal. | `modules/hall-ui/public/goals-render.js:1360` |
 | `46b1265ef172` | certain | You are not a member of this goal. | `modules/hall-ui/public/goals-render.js:1316` |
 | `b31fc908c962` | certain | You claimed #{…}. Open a terminal to start work. | `modules/hall-ui/public/goals-page.js:418` |
-| `b31fc908c962` | certain | You claimed #{…}. Open a terminal to start work. | `modules/hall-ui/public/goals-page.js:515` |
+| `b31fc908c962` | certain | You claimed #{…}. Open a terminal to start work. | `modules/hall-ui/public/goals-page.js:517` |
 | `b31fc908c962` | certain | You claimed #{…}. Open a terminal to start work. | `modules/hall-ui/public/work.js:904` |
 | `b31fc908c962` | certain | You claimed #{…}. Open a terminal to start work. | `modules/hall-ui/public/work.js:974` |
 | `bcf33947aff6` | certain | You created this task and it is already retired. | `modules/hall-ui/public/task.js:767` |

package/docs/copy-registry.json

@@ -282,7 +282,7 @@
       "occurrences": 4,
       "at": [
         "modules/hall-ui/public/goals-page.js:418",
-        "modules/hall-ui/public/goals-page.js:515",
+        "modules/hall-ui/public/goals-page.js:517",
         "modules/hall-ui/public/work.js:904",
         "modules/hall-ui/public/work.js:974"
       ]
@@ -403,7 +403,7 @@
       "text": "Released #{…}. It returns to the queue.",
       "occurrences": 3,
       "at": [
-        "modules/hall-ui/public/goals-page.js:538",
+        "modules/hall-ui/public/goals-page.js:540",
         "modules/hall-ui/public/work.js:945",
         "modules/hall-ui/public/work.js:998"
       ]
@@ -1270,7 +1270,7 @@
       "text": "Release your claim on #{…}? It returns to the queue and no {…} are earned.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/goals-page.js:533",
+        "modules/hall-ui/public/goals-page.js:535",
         "modules/hall-ui/public/work.js:990"
       ]
     },
@@ -5476,7 +5476,7 @@
       "surface": "builders-hall",
       "text": "Goals could not be loaded. Refresh to try again.",
       "file": "modules/hall-ui/public/goals-page.js",
-      "line": 896,
+      "line": 898,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6007,7 +6007,7 @@
       "surface": "builders-hall",
       "text": "Invitation rescinded.",
       "file": "modules/hall-ui/public/goals-page.js",
-      "line": 692,
+      "line": 694,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8482,7 +8482,7 @@
       "surface": "builders-hall",
       "text": "Release your claim on #{…}? It returns to the queue and no {…} are earned.",
       "file": "modules/hall-ui/public/goals-page.js",
-      "line": 533,
+      "line": 535,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -8509,7 +8509,7 @@
       "surface": "builders-hall",
       "text": "Released #{…}. It returns to the queue.",
       "file": "modules/hall-ui/public/goals-page.js",
-      "line": 538,
+      "line": 540,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -9355,7 +9355,7 @@
       "surface": "builders-hall",
       "text": "Sign in to filter to your goals",
       "file": "modules/hall-ui/public/goals-page.js",
-      "line": 873,
+      "line": 875,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -11497,7 +11497,7 @@
       "surface": "builders-hall",
       "text": "You claimed #{…}. Open a terminal to start work.",
       "file": "modules/hall-ui/public/goals-page.js",
-      "line": 515,
+      "line": 517,
       "origin": "js-notice",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -2190,5 +2190,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.856 with no explicit bump. run 35278916322. (task 1002620)
   1.19.858 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.857 with no explicit bump. run 35279781206. (task 1002620)
+  1.19.859 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.858 with no explicit bump. run 35280770718. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/goals-page.js

@@ -428,8 +428,10 @@
       // or the flat legacy shape, via the same normalizers friendlyClaimError uses.
       const det = errDetails(err.data);
       if (err.status === 409 && errCode(err.data) === 'batch_failed') {
-        const failures = Array.isArray(det.failures) ? det.failures
-          : (Array.isArray(err.data && err.data.failures) ? err.data.failures : []);
+        // One read covers both envelopes: errDetails returns error.details on the ADR
+        // 0116 shape and the raw body on the flat legacy one, so a second
+        // `err.data.failures` fallback here is unreachable (task 1003657).
+        const failures = Array.isArray(det.failures) ? det.failures : [];
         const lines = failures.map((f) => `#${f.task_id} (${friendlyBatchReason(f)})`);
         toast(lines.length
           ? `The batch could not be claimed — ${lines.join('; ')}.`

package/modules/hall-ui/public/work.js

@@ -914,9 +914,9 @@
       // against an object, so an all-or-nothing batch refusal rendered as the generic toast
       // and the per-task reasons were dropped on the floor.
       if (err.status === 409 && errCode(err.data) === 'batch_failed') {
+        // One read covers both envelopes — errDetails falls back to the body (task 1003657).
         const bdet = errDetails(err.data);
-        const failures = Array.isArray(bdet.failures) ? bdet.failures
-          : (Array.isArray(err.data && err.data.failures) ? err.data.failures : []);
+        const failures = Array.isArray(bdet.failures) ? bdet.failures : [];
         const lines = failures.map((f) => `#${f.task_id} (${friendlyBatchReason(f)})`);
         toast(lines.length
           ? `The batch could not be claimed — ${lines.join('; ')}.`

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.858",
+  "version": "1.19.859",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.858",
+      "version": "1.19.859",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.858",
+  "version": "1.19.859",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/bump-version.js

@@ -152,16 +152,70 @@ function isReleaseCommit(subject) {
 // so a failed publish left main declaring a version the registry never had, the
 // cascade terminator no-opped every following run, and only a fresh work merge
 // moved past it. That is how 1.19.716-723 were minted and lost (2026-09-13).
+// HUMAN_RELEASE_COMMIT_RE — a release commit a PERSON wrote (task 1003526).
+//
+// ADR 0161 §2 promises "a minor or major stays a deliberate in-task human edit".
+// The lane could not keep that promise: a branch that hand-bumped to 1.20.0 had no
+// commit shape the lane recognised, so the LIVE test below failed its own PR's
+// `unit` check by construction (that is what killed task 1003044's first ship,
+// PR #391) and, had it merged, publish.yml would have packaged 1.20.0 forever
+// without ever recording it — its record step fires only when CI itself bumped,
+// so every later merge would re-pack the same taken version and NOTHING NEW WOULD
+// EVER PUBLISH AGAIN. A stalled lane, not just a blocked PR.
+//
+// So a human release is now a first-class shape: `release: core X.Y.Z — <reason>`
+// that is NOT this lane's own carrier phrase. Deliberately the complement of
+// RELEASE_COMMIT_RE, so no subject can ever be read as both.
+const HUMAN_RELEASE_COMMIT_RE = /^release: core \d+\.\d+\.\d+ \u2014 (?!CI auto-patch carrier \(publish-on-merge)\S/;
+
+function isHumanReleaseCommit(subject) {
+  return HUMAN_RELEASE_COMMIT_RE.test(String(subject == null ? '' : subject));
+}
+
+// laneReleasedVersions answers "is this version SPOKEN FOR?" — which is a different
+// question from isReleaseCommit's "did this lane already publish everything at this
+// HEAD?", and task 1003526 is where the difference started to matter.
+//
+// They used to share RELEASE_COMMIT_RE, and the old comment treated that as the
+// invariant. It is not: the two callers want OPPOSITE answers for a human release
+// commit, and keeping them identical is exactly what made a human minor impossible.
+//
+//   • the cascade terminator (isReleaseCommit) must say NO — a human-declared
+//     version is new and still needs publishing. Saying yes would no-op the run and
+//     the version would be bumped but never packaged (the 1.19.0 hole).
+//   • this function must say YES — the number is claimed, so the lane must not try
+//     to publish onto it. publish.yml reads that as taken=true, auto-bumps one patch
+//     past it, publishes THAT, and records its own carrier. The lane keeps moving
+//     and the human still gets their minor: 1.19.x → (declare 1.20.0) → 1.20.1.
+//
+// A human therefore spends a version number to change the minor/major digit. That is
+// the whole cost of keeping this inside bump-version.js: publishing 1.20.0 EXACTLY
+// would mean teaching publish.yml's record step to fire without a bump, and that file
+// is a protected surface on the lane that already minted-and-lost 1.19.716-723. Not
+// worth it for a digit.
+//
+// BOTH failure directions stay safe, which is what makes this acceptable here. A
+// subject wrongly counted → the lane bumps PAST a free version (a gap, harmless). A
+// real release missed → npm refuses the duplicate and publish.yml's already-present
+// branch records it (task 1003914). Neither direction can double-publish.
 function laneReleasedVersions(subjects = []) {
   const out = new Set();
   for (const subject of subjects) {
     const line = String(subject == null ? '' : subject);
-    if (!RELEASE_COMMIT_RE.test(line)) continue;
+    if (!RELEASE_COMMIT_RE.test(line) && !HUMAN_RELEASE_COMMIT_RE.test(line)) continue;
     const m = /^release: core (\d+\.\d+\.\d+) /.exec(line);
     if (m) out.add(m[1]);
   }
   return out;
 }
 
-module.exports = { bumpPatch, CONST_RE, RELEASE_COMMIT_RE, isReleaseCommit, laneReleasedVersions };
+module.exports = {
+  bumpPatch,
+  CONST_RE,
+  RELEASE_COMMIT_RE,
+  HUMAN_RELEASE_COMMIT_RE,
+  isReleaseCommit,
+  isHumanReleaseCommit,
+  laneReleasedVersions,
+};
 if (require.main === module) main();

package/scripts/gds/smoke-dependencies.sh

@@ -12,7 +12,7 @@
 #   7. Claim B, ship B (active → completed → confirmed → shipped)
 #   8. Verify A auto-promoted backlog→ready (or stays ready if step 5 ran)
 #   9. Claim A — succeeds
-#  10. Release A + clean up
+#  10. Release A, abandon A (B is shipped and cannot be abandoned)
 #
 # Run from any environment with a valid CLI session (/builder-setup).
 # Requires curl.
@@ -77,8 +77,38 @@ echo "  A status: $A_STATUS"
 echo "=== 8. Claim A — must succeed now ==="
 node scripts/gds/claim.js "$A_ID" --worktree "smoke-$SUFFIX-A"
 
-echo "=== 9. Cleanup (release A; mark both abandoned) ==="
+echo "=== 9. Cleanup — abandon A; B is shipped and stays ==="
+# task 1004026: this step used to ANNOUNCE "release A; mark both abandoned" and then
+# only release A. Neither task reached a terminal state, so every run leaked two
+# __smoke__ rows into the live tasks table — invisibly, because anyone grepping the
+# cleanup step read a line saying both were handled.
+#
+# "mark both abandoned" was never possible. B is SHIPPED by step 6, and the abandon
+# route refuses shipped work (cannot_abandon_shipped) because shipped rows are
+# immutable history. Only A can reach a terminal state here, so the echo now states
+# what the code does instead of the reverse.
+#
+# Follows scripts/gds/smoke-write.sh's cleanup (task 1002018): abandon is the right
+# terminal state for a smoke row, and cleanup is STRICTLY best-effort. task.abandon is
+# floor-metic (ADR 0152), so a Xenos/Thetes token gets a 403 here while every assertion
+# above genuinely passed — a cleanup that cannot run must never turn a passing smoke
+# into a failing one. Hence the `|| true` and the reported-not-raised status codes.
+# Reaching this line at all means every assertion passed: the script is `set -e` and
+# each check above exits non-zero on failure, so a FAILED run stops earlier and leaves
+# both rows in place for inspection, which is the same deliberate choice smoke-write makes.
 node scripts/gds/release.js "$A_ID" --reason "smoke cleanup" || true
 
+A_CLEANUP_CODE=$(curl -sS -o /dev/null -w '%{http_code}' -X POST \
+  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  --data '{"reason":"smoke cleanup (task 1004026) - dependency smoke passed; the throwaway row has served its purpose"}' \
+  "$BASE/api/bongos/tasks/$A_ID/abandon") || true
+case "${A_CLEANUP_CODE:-000}" in
+  2*)  echo "  PASS cleaned up throwaway task #$A_ID (abandoned)" ;;
+  403) echo "  SKIP cleanup — task.abandon needs Metic+ (ADR 0152); task #$A_ID left in the ledger" ;;
+  000) echo "  SKIP cleanup — POST /tasks/$A_ID/abandon got no response; task #$A_ID left in the ledger" ;;
+  *)   echo "  SKIP cleanup — POST /tasks/$A_ID/abandon returned HTTP $A_CLEANUP_CODE; task #$A_ID left in the ledger" ;;
+esac
+echo "  NOTE task #$B_ID is SHIPPED and is deliberately left in the ledger — the abandon route refuses shipped work (cannot_abandon_shipped)."
+
 echo
 echo "ALL SMOKE STEPS PASSED."

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.858'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.859'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bump_version.mjs

@@ -276,14 +276,21 @@ test('laneReleasedVersions reads the versions this lane announced', () => {
   assert.equal(v.has('1.19.369'), false, 'a version never announced must read as free');
 });
 
-test('a HUMAN release commit is NOT counted — that version still needs publishing', () => {
-  // The same distinction RELEASE_COMMIT_RE was written to make for the cascade
-  // terminator. Counting it here would skip the publish of a hand-cut release.
+test('a HUMAN release commit IS counted — the lane bumps past it rather than onto it', () => {
+  // REVERSED by task 1003526. This test used to assert the opposite, reasoning that
+  // "counting it here would skip the publish of a hand-cut release". The skip is real
+  // but it is not a loss: publish.yml reads taken=true, bumps ONE PATCH past the
+  // declared number, publishes that, and records its own carrier. The human's minor
+  // ships as 1.20.1 and the lane keeps moving.
+  //
+  // Not counting it is what actually lost releases. publish.yml's record step fires
+  // only when CI itself bumped, so a published-but-unrecorded 1.20.0 would be re-packed
+  // by every later merge and nothing new would ever reach the registry again.
   const v = bump.laneReleasedVersions([
     'release: core 1.19.2 — carrier for the init-blocker fixes',
     'release: core 1.20.0 — hand-cut minor',
   ]);
-  assert.equal(v.size, 0);
+  assert.deepEqual([...v].sort(), ['1.19.2', '1.20.0']);
 });
 
 test('malformed and empty input yields an empty set, never a throw', () => {
@@ -295,19 +302,49 @@ test('malformed and empty input yields an empty set, never a throw', () => {
   assert.equal(bump.laneReleasedVersions([null, undefined, '', 42]).size, 0);
 });
 
-test('laneReleasedVersions and isReleaseCommit agree on what a lane release looks like', () => {
-  // They share RELEASE_COMMIT_RE on purpose: if one ever recognises a subject the
-  // other does not, the cascade terminator and the version check disagree about
-  // the same commit, and the lane either double-publishes or silently no-ops.
+test('a human release commit is SPOKEN FOR but does not terminate the cascade', () => {
+  // task 1003526. These two predicates used to share RELEASE_COMMIT_RE, and the old
+  // test asserted they must always agree. That assertion was the bug: the two callers
+  // need OPPOSITE answers for a human release, and forcing them to agree is precisely
+  // what made ADR 0161 §2's promised minor/major impossible to land.
+  const human = 'release: core 1.20.0 — minor: new doorway export (task 1003526)';
+
+  // NO: it is not this lane's own carrier, so publish.yml must NOT no-op — the
+  // version is new and still has to be packaged. Saying yes here is the 1.19.0 hole.
+  assert.equal(bump.isReleaseCommit(human), false);
+  assert.equal(bump.isHumanReleaseCommit(human), true);
+
+  // YES: the number is claimed, so the lane must not publish onto it. publish.yml
+  // reads taken=true, bumps one patch past it, and records its own carrier — which
+  // is what keeps the lane moving instead of re-packing a taken version forever.
+  assert.equal(bump.laneReleasedVersions([human]).has('1.20.0'), true);
+});
+
+test('the CI carrier still both terminates the cascade and counts as released', () => {
+  const ci = 'release: core 1.19.368 — CI auto-patch carrier (publish-on-merge, ADR 0161)';
+  assert.equal(bump.isReleaseCommit(ci), true);
+  assert.equal(bump.isHumanReleaseCommit(ci), false, 'the two shapes must never both match');
+  assert.equal(bump.laneReleasedVersions([ci]).has('1.19.368'), true);
+});
+
+test('an ordinary commit is neither shape', () => {
+  const no = 'chore: not a release at all';
+  assert.equal(bump.isReleaseCommit(no), false);
+  assert.equal(bump.isHumanReleaseCommit(no), false);
+  assert.equal(bump.laneReleasedVersions([no]).size, 0);
+});
+
+test('a hand-bumped branch passes the LIVE check its own PR runs', () => {
+  // The regression that killed task 1003044's first ship (PR #391): the branch bumped
+  // CORE_VERSION to a minor, no commit shape declared it, and the LIVE test below
+  // failed the PR's own `unit` check by construction. With the human carrier in the
+  // branch's log the same check now passes.
   const subjects = [
+    'release: core 1.20.0 — minor: new doorway export (task 1003526)',
+    'feat: the doorway export itself',
     'release: core 1.19.368 — CI auto-patch carrier (publish-on-merge, ADR 0161)',
-    'release: core 1.19.2 — carrier for the init-blocker fixes',
-    'chore: not a release at all',
   ];
-  for (const s of subjects) {
-    const counted = bump.laneReleasedVersions([s]).size === 1;
-    assert.equal(counted, bump.isReleaseCommit(s), `disagreement on: ${s}`);
-  }
+  assert.equal(bump.laneReleasedVersions(subjects).has('1.20.0'), true);
 });
 
 test('LIVE: the version HEAD declares is one this lane already released', () => {

package/tests/hall_error_envelope.mjs

@@ -108,6 +108,23 @@ await t('errDetails takes error.details, else falls back to the BODY (flat shape
   assert.deepEqual(errDetails({ error: 'c', conflicts: [{ title: 'B' }] }).conflicts, [{ title: 'B' }]);
 });
 
+await t('one errDetails read covers batch failures on BOTH shapes (task 1003657)', () => {
+  const { errDetails } = loadOTB();
+  const failures = [{ task_id: 7, reason: 'ALREADY_CLAIMED' }];
+  // This is the assertion that makes the second fallback deletable. work.js and
+  // goals-page.js used to read `det.failures` and THEN `err.data.failures`; the
+  // second branch can never run, because errDetails returns error.details on the
+  // ADR 0116 shape and the raw BODY on the flat legacy one — so `.failures` is
+  // reachable through one read either way. If a future errDetails stops falling
+  // back to the body, this fails and the callers need their fallback back.
+  assert.deepEqual(errDetails({ error: { code: 'batch_failed', details: { failures } } }).failures, failures);
+  assert.deepEqual(errDetails({ error: 'batch_failed', failures }).failures, failures);
+  // And the shape that would have made the fallback reachable — nested details
+  // alongside a top-level failures list — is not one the server can emit:
+  // src/bongos/api-errors.js envelope() puts nothing but `error` at the top level.
+  assert.equal(errDetails({ error: { code: 'batch_failed', details: {} } }).failures, undefined);
+});
+
 await t('the readers survive hostile / empty input without throwing', () => {
   const { errCode, errMessage, errDetails } = loadOTB();
   for (const bad of [undefined, null, {}, { error: null }, { error: 0 }, { error: [] }, 'str', 42]) {