@bongos/core 1.19.870 → 1.19.871

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.870",
-  "core_contract": "1.19.870",
-  "source_commit": "3f3a8f1a641ec7e951dbc4be16c5393245267cc4",
+  "core_version": "1.19.871",
+  "core_contract": "1.19.871",
+  "source_commit": "67620593f1ed87465a216fd10c1da6f3e612e683",
   "source_ref": "HEAD",
-  "built_at": "2026-09-18T19:58:09.397Z",
+  "built_at": "2026-09-18T20:45:57.710Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 500,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2812,
-  "tree_sha256": "6c70260465a8be8139d283648111c991a1e4f685776de07905880ba2ebbdae9b",
+  "tree_sha256": "20310f17dfaa6daa96b4a95d76e600e86e47d3f50c26ff8e5c61e99ad8bed267",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2602,7 +2602,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ac508e1b84ecb0425f8139f5949c3253aa83565fdc649dc42737bc6aa348ccf0"
+      "sha256": "942c02c95b11974a2dfa23288232af47dc505fcc1ea9aa7fa5e7bcb9c9637b63"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7927,12 +7927,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "55e245ef92f27beb20d11ef866d8264893f33d3e0e6021e84ac8bc5f9c5b2822"
+      "sha256": "a286ed3d44baa4e0996d95f9a822b8d1ea89d4b2703dc4df98f4a694ae6a80fc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a0d3158d2589f76b783a67698b13cc78affd260b50dfffdcbc18626a5311eaee"
+      "sha256": "ad919bbaaf5a3d1cb95005c9b45a9d6feb7b3aeae20d575deb24a66d7318ef53"
     },
     {
       "path": "public-docs/index.html",
@@ -9882,7 +9882,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e6b37c96d4027d5093b6cecb603c743988b711883c4cb65209b8ca109eb34875"
+      "sha256": "56a6a61c2947942ec791acd5efda2ff62684d4f543f80249cfdead156d8ff4ea"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11352,7 +11352,7 @@
     {
       "path": "tests/goal_subtitle.mjs",
       "mode": "0000644",
-      "sha256": "85f4b99edb85d2e04d0029d9962a2870889c747de1ae0781290688bd4cc03de3"
+      "sha256": "90f27cd81c785d81b89bb7242d2e6a1e6a96e6c01a9422a3a841439dfab5433c"
     },
     {
       "path": "tests/goal_suggest.mjs",

package/docs/module-api-changelog.md

@@ -2214,5 +2214,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.868 with no explicit bump. run 35382740500. (task 1002620)
   1.19.870 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.869 with no explicit bump. run 35388809554. (task 1002620)
+  1.19.871 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.870 with no explicit bump. run 35393164740. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.870",
+  "version": "1.19.871",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.870",
+      "version": "1.19.871",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.870",
+  "version": "1.19.871",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.870'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.871'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_subtitle.mjs

@@ -184,6 +184,27 @@ test('an unset subtitle is hidden; a set one is shown trimmed', () => {
   assert.equal(els.sub.textContent, 'the grep path');
 });
 
+// goalTitleRegions — where the row's title ends and the card's begins, as an
+// ANCHOR rather than a byte count (task 1004036).
+//
+// The assertion below and the vacuity guard further down BOTH derive the row's
+// region from here, deliberately. The previous shape asserted subtitleAttr(g)
+// absent from a 160-char window while the row's real region measured 766 — 21%
+// of the span it claimed to check — and a negative assertion passes when it
+// finds nothing, which is also what it does when it is looking in the wrong
+// place. Injecting the tooltip into the row left it passing.
+//
+// One derivation, not two: a guard that recomputed the region itself would stay
+// green while the assertion it claims to protect was narrowed back. Narrow this
+// function and the guard fails, which is the only arrangement that makes the
+// guard worth having.
+function goalTitleRegions(js) {
+  const row = js.indexOf('class="gr-title"');
+  const card = js.indexOf('class="goal-card__title gr-title"');
+  assert.ok(card > row, 'card title boundary not found — re-anchor this slice to whatever now follows the row title');
+  return { row, card, rowRegion: js.slice(row, card) };
+}
+
 test('on a LIST the subtitle is a visible line; on the CARD it stays a tooltip', () => {
   // task 1003206: the row/card painters moved to goals-render.js — the second half
   // of the carve goals-lib.js began — so read the family, not one filename.
@@ -197,15 +218,38 @@ test('on a LIST the subtitle is a visible line; on the CARD it stays a tooltip',
   // task 1003307 gave the ROW its line back on the owner's call: 35 of 72 goals
   // carry a subtitle, and a tooltip does not exist on a touch screen. The CARD
   // has no room for a line, so it keeps the tooltip (task 1003224's shape).
-  const row = js.indexOf('class="gr-title"');
+  const { row, card, rowRegion } = goalTitleRegions(js);
   assert.ok(row > 0, 'the row title is still rendered');
-  assert.match(js.slice(row, row + 200), /subtitleLine\(g\)/, 'the row renders the visible line');
-  assert.doesNotMatch(js.slice(row, row + 160), /subtitleAttr\(g\)/, 'the row does not also carry the tooltip');
-  const card = js.indexOf('class="goal-card__title gr-title"');
   assert.ok(card > 0, 'the card title is still rendered');
+  assert.match(rowRegion, /subtitleLine\(g\)/, 'the row renders the visible line');
+  assert.doesNotMatch(rowRegion, /subtitleAttr\(g\)/, 'the row does not also carry the tooltip');
   assert.match(js.slice(card, card + 160), /subtitleAttr\(g\)/, 'the card carries the tooltip');
 });
 
+// ---- the negative assertion above is not vacuous (task 1004036) -------------
+// A negative assertion passes when it finds nothing, which is also what it does
+// when it is looking in the wrong place — so one that has never been watched
+// FAIL is not evidence of anything. The previous shape checked subtitleAttr(g)
+// was absent from a 160-char window while the row's real region measured 766,
+// so it verified 21% of the span it claimed to; injecting the tooltip into the
+// row left it passing. This case does that injection and requires the anchored
+// region to catch it. It guards the ASSERTION, not the page.
+test('the row/tooltip check CATCHES a row that carries the tooltip', () => {
+  const js = goalsPageSource();
+  const { row, card } = goalTitleRegions(js);
+
+  // Inject the forbidden attribute INSIDE the row's region but past the old
+  // 160-char window — the exact regression the assertion exists to catch.
+  const at = row + Math.floor((card - row) / 2);
+  const broken = js.slice(0, at) + ' title="${subtitleAttr(g)}" ' + js.slice(at);
+
+  // Through the SAME derivation the assertion uses, so narrowing it reds here.
+  assert.throws(
+    () => assert.doesNotMatch(goalTitleRegions(broken).rowRegion, /subtitleAttr\(g\)/),
+    'the row region does not notice a tooltip added to the row — the check is vacuous again',
+  );
+});
+
 test('every CSS token the new styles use actually exists', () => {
   // copy-desk.css shipped with --line and --panel, which style.css never
   // defines, so its fallbacks rendered as nothing (idea 1000821).