@bongos/core 1.19.922 → 1.19.924

package/modules/ideas/idea-state.js

@@ -0,0 +1,254 @@
+// modules/ideas/idea-state.js — THE FIVE STATES (task 1004103 / BV2.R17,
+// goal 1000095, criterion `ideator-sky-tells-the-truth`; spec
+// docs/specs/bongos-v2-ideator-surface.md decisions 4, 19 and 20; the object
+// vocabulary is docs/design/ideator-surface-direction.md §"The five objects";
+// ADR 0322, under ADR 0321 + 0313).
+//
+// star / protostar / satellite / remnant / cold body. Every one of them is
+// DERIVED here, from facts the ledger already holds, so that no surface has to
+// infer one — which is the done-when. Three surfaces are about to draw these
+// (the room, the descent, the sky) and a state decided three times is three
+// states: the sky would say a thought went out while the room beside it still
+// called it alive, with nothing erroring and no way to tell which was right.
+//
+// THE FACTS, AND WHERE EACH COMES FROM:
+//
+//   idea_inbox.status            'open' | 'promoted' | 'discarded' | 'merged'
+//                                — the triage verdict (core_195).
+//   brightness.hasWork           has this thought been paid for anything at all
+//   brightness.share             how much of that payout is still alive
+//   brightness.attributable      whether the removal facts could be read
+//                                — all three from economy's idea-brightness.js,
+//                                reached through the `reward` port.
+//   tasks[].goal_id / .status    the BINDING home and whether it awaits a nod
+//                                — from the trail's lineage join.
+//
+// THE ORDER OF THE TESTS IS THE DESIGN, and each step below is a decision
+// someone could reasonably have made the other way:
+//
+// 1. MERGED WINS OVER EVERYTHING — a merged thought is a satellite even when it
+//    earned money of its own. `modules/ideas/trail-size.js` is emphatic that a
+//    merged idea keeps its OWN size (stream 1 books against the idea whose
+//    lineage row named the shipping task), and that stays true: this changes
+//    what the thought IS, never what it earned. The design's word is "it orbits
+//    that one now" — once folded, it is no longer its own point in the sky, and
+//    drawing it as an independent star beside the thought that absorbed it would
+//    show one idea twice.
+//
+// 2. WORK BEATS A DISCARD. A discarded idea that nevertheless caused shipped,
+//    paid work is not a cold body — the design defines that object as "it never
+//    ignited, so it has no size at all", which is a stated PROPERTY, and testing
+//    work first is what keeps the property true by construction instead of by
+//    hope. This is reachable: triage can discard a duplicate whose twin already
+//    routed and paid, and `updateIdea` never touches the ledger.
+//
+// 3. REMNANT NEEDS EVIDENCE, NEVER ITS ABSENCE. `share === 0` says the project
+//    confirmed every piece of this descent gone. `share === null` says the
+//    removal facts could not be read at all (lifecycle off, port unregistered) —
+//    brightness is explicit that those are different answers, and treating the
+//    second as the first would draw every star in the instance as a hollow ring
+//    the moment a module failed to mount. An unreadable idea with work is a
+//    star, carrying `attributable: false` so a surface can say the brightness is
+//    unknown rather than full.
+//
+// 4. A PROTOSTAR IS THE ABSENCE OF WORK, not the presence of a status. Both an
+//    'open' idea nobody has touched and a 'promoted' one whose task has not
+//    shipped yet are unignited, which is exactly right: ignition is being paid
+//    for something, not being converted into a row.
+//
+// POSITION IS A SEPARATE AXIS from the object, and it is the half the design
+// says the object alone cannot carry: a protostar INSIDE A WELL has a home and
+// awaits a nod; one in OPEN SPACE has nothing holding it. It is computed for
+// every state (a star has a position too) but it is only load-bearing for a
+// protostar, where it is the difference between "someone must act" and "nobody
+// has claimed this".
+//
+// WHY `suggested_goal_id` IS NOT A WELL. It sits on the row, it names a goal,
+// and it is the wrong fact: `projection.js` records that it is STRICTLY
+// ADVISORY — the routing HINT on a filing that did NOT convert, with the binding
+// home being `tasks.goal_id`. Reading it here would draw a protostar sitting
+// inside a well that never caught it, and put it in a nod queue no one can act
+// on because no task exists to promote.
+//
+// PURE. No DB, no clock, no port — the resolver takes facts and returns an
+// answer, the way `routing.js` takes a filing and returns a landing. The one
+// async function in the file is the trail attacher at the bottom, which fetches
+// the brightness half and then calls the pure one. `tests/idea_state.mjs` drives
+// every cell of the matrix DB-free because of that split.
+
+const api = require('../../src/module-api');
+
+// The five objects, spelled once. Exported so a renderer switches on the same
+// vocabulary the resolver emits rather than a hand-copied list of strings that
+// can drift by a hyphen.
+const IDEA_STATES = Object.freeze({
+  STAR: 'star',
+  PROTOSTAR: 'protostar',
+  SATELLITE: 'satellite',
+  REMNANT: 'remnant',
+  COLD_BODY: 'cold-body',
+});
+const IDEA_STATE_VALUES = Object.freeze(Object.values(IDEA_STATES));
+
+// The two positions. `null` is not a third one — it is "this thought has no
+// task in any goal", which IS open space; the field is never null.
+const IDEA_POSITIONS = Object.freeze({ WELL: 'well', OPEN_SPACE: 'open-space' });
+
+// The task status that means "routed into a goal, one Metic+ promote from
+// claimable" — the nod the landing matrix soft-lands every non-bug at
+// (`routing.js` HARD_LAND_KINDS). Spelled here rather than imported because
+// routing.js is about the DECISION to land and this is about reading the result
+// of one; the coupling is the status vocabulary, which is core's.
+const AWAITING_NOD_STATUS = 'backlog';
+
+// A positive integer id as it arrives off a row, where a bigint may be a string.
+// Never coerced with Number() — the guard economy's idea-size.js uses, for the
+// same precision reason.
+function idOf(v) {
+  return /^[1-9]\d*$/.test(String(v)) ? String(v) : null;
+}
+
+// taskFactsFromIdeaRow — the { goalId, status } pairs an idea's state depends
+// on, taken off a trail row.
+//
+// It lives here, with the resolver that consumes it, for the reason economy's
+// `descentRowsFromTrail` lives with the pricing rather than in the trail: a
+// hand-built projection at the call site is a copy that can quietly stop
+// carrying a field the consumer needs, and nothing errors when it does.
+//
+// BOTH SOURCES, because neither alone is complete. `lineage_tasks` is the full
+// answer for anything promoted since `ideas_task_lineage` existed (one idea can
+// become many tasks); `promoted_to_task_id` is the ONLY answer for promotions
+// that predate it. The legacy row is added only when the lineage does not
+// already name that task, so an idea carrying both is not counted twice.
+function taskFactsFromIdeaRow(row) {
+  const out = [];
+  const seen = new Set();
+  const lineage = Array.isArray(row && row.lineage_tasks) ? row.lineage_tasks : [];
+  for (const t of lineage) {
+    if (!t) continue;
+    const taskId = idOf(t.task_id);
+    if (taskId) seen.add(taskId);
+    out.push({ taskId, goalId: idOf(t.goal_id), status: t.status || null });
+  }
+  const legacyId = idOf(row && row.promoted_to_task_id);
+  if (legacyId && !seen.has(legacyId)) {
+    out.push({
+      taskId: legacyId,
+      goalId: idOf(row.promoted_task_goal_id),
+      status: row.promoted_task_status || null,
+    });
+  }
+  return out;
+}
+
+// resolveIdeaState — the whole decision, pure.
+//
+//   status        the idea's triage status
+//   hasWork       brightness.hasWork — has it been paid for anything
+//   share         brightness.share — the live fraction, or null if unreadable
+//   attributable  brightness.attributable — whether the removal facts were read
+//   tasks         taskFactsFromIdeaRow(row)
+//
+// Returns { state, position, wellGoalId, awaitingNod, brightness, hasWork,
+//           attributable }
+//
+// `brightness` is passed straight through so a surface drawing the object and
+// its dimness reads ONE answer: a renderer that took the state from here and the
+// share from somewhere else could draw a full-brightness remnant.
+//
+// A MISSING BRIGHTNESS IS NOT ZERO WORK. When the caller has no brightness at
+// all (the `reward` port is absent), `hasWork` arrives undefined and the idea
+// resolves on its status alone — an unignited-looking protostar — with
+// `attributable: false` saying the money could not be read. Defaulting `hasWork`
+// to false would be the same claim; the flag is what stops a surface from
+// stating it.
+function resolveIdeaState({ status = null, hasWork = false, share = null, attributable = false, tasks = [] } = {}) {
+  const list = Array.isArray(tasks) ? tasks : [];
+  // A well is a goal that actually HOLDS one of this thought's tasks.
+  const inGoal = list.find((t) => t && t.goalId);
+  const wellGoalId = inGoal ? inGoal.goalId : null;
+  const position = wellGoalId ? IDEA_POSITIONS.WELL : IDEA_POSITIONS.OPEN_SPACE;
+  // The nod is a property of a TASK, so it is asked of every task in a goal and
+  // not only of the one that named the well: an idea that became two tasks, one
+  // promoted and one still at backlog, still has something awaiting a person.
+  const awaitingNod = list.some((t) => t && t.goalId && t.status === AWAITING_NOD_STATUS);
+
+  const common = {
+    position,
+    wellGoalId,
+    awaitingNod,
+    brightness: share,
+    hasWork: hasWork === true,
+    attributable: attributable === true,
+  };
+
+  // 1. Folded into another thought — whatever else is true of it.
+  if (status === 'merged') return { state: IDEA_STATES.SATELLITE, ...common };
+
+  // 2/3. It ignited. Only CONFIRMED removal of the whole descent puts it out.
+  if (hasWork === true) {
+    const dead = attributable === true && share === 0;
+    return { state: dead ? IDEA_STATES.REMNANT : IDEA_STATES.STAR, ...common };
+  }
+
+  // 4. Declined at triage, having caused nothing.
+  if (status === 'discarded') return { state: IDEA_STATES.COLD_BODY, ...common };
+
+  // 5. Filed, not yet ignited. `position` is the half that matters here.
+  return { state: IDEA_STATES.PROTOSTAR, ...common };
+}
+
+// attachStateToTrail — hangs `state` on every idea of a trail page, in place,
+// mirroring attachDescentToTrail / attachSizeToTrail so the route composes the
+// three the same way.
+//
+// COMPOSED AFTER attachSizeToTrail, and that ordering saves a whole second
+// ledger read: size leaves `idea.size` carrying economy's own `byTask`
+// breakdown, which is exactly the input brightness takes its share of. Handing
+// it back means one query for the page rather than two. When an idea's size is
+// missing or carries no breakdown — the port was absent, so size is null —
+// brightness is asked for nothing and the ideas resolve on status alone.
+//
+// AN ABSENT PORT DOES NOT MAKE EVERY THOUGHT DARK. The state still resolves,
+// carrying `attributable: false`; what it must never do is silently claim the
+// sky is empty. Same posture trail-size.js takes with `size: null`.
+async function attachStateToTrail(ideas, { client = null } = {}) {
+  const list = Array.isArray(ideas) ? ideas : [];
+  if (list.length === 0) return list;
+
+  const reward = api.resolveOptional && api.resolveOptional('reward');
+  let brightnesses = null;
+  if (reward && typeof reward.ideaBrightnesses === 'function') {
+    const sizes = new Map();
+    for (const idea of list) {
+      if (idea && idea.size && idea.size.byTask instanceof Map) sizes.set(String(idea.id), idea.size);
+    }
+    brightnesses = await reward.ideaBrightnesses(
+      list.map((i) => i.id),
+      { client, ...(sizes.size === list.length ? { sizes } : {}) }
+    );
+  }
+
+  for (const idea of list) {
+    const b = brightnesses && brightnesses.get(String(idea.id));
+    idea.state = resolveIdeaState({
+      status: idea.status,
+      hasWork: b ? b.hasWork : false,
+      share: b ? b.share : null,
+      attributable: b ? b.attributable : false,
+      tasks: taskFactsFromIdeaRow(idea),
+    });
+  }
+  return list;
+}
+
+module.exports = {
+  IDEA_STATES,
+  IDEA_STATE_VALUES,
+  IDEA_POSITIONS,
+  AWAITING_NOD_STATUS,
+  taskFactsFromIdeaRow,
+  resolveIdeaState,
+  attachStateToTrail,
+};

package/modules/ideas/routes/inbox.js

@@ -43,6 +43,7 @@ const { attachDescentToTrail } = require('../trail-descent');
 // file for the same two reasons trail-descent.js is: inbox.js is at the size
 // ratchet, and a ledger read keyed by idea is a third relation again.
 const { attachSizeToTrail } = require('../trail-size');
+const { attachStateToTrail } = require('../idea-state');
 // The walk itself, published as the `ideas.descent` port below.
 const descent = require('../descent');
 // Full Idea capture (task 1002919 / BV1.R143): the template validator (R141)
@@ -644,6 +645,13 @@ module.exports = function buildInboxRouter() {
     // the number, and the number is a ledger read that does not depend on the
     // walk having run. One query for the whole page, through the `reward` port.
     await attachSizeToTrail(ideas);
+    // THE STATE — which of the five objects each thought is (BV2.R17). Last of
+    // the three, because it is the only one that reads the other two: it takes
+    // its share off the `byTask` breakdown size just left on the row, so the
+    // page pays for one ledger read rather than two. Derived here and not in the
+    // renderer — three surfaces are about to draw these, and a state inferred
+    // three times is three states.
+    await attachStateToTrail(ideas);
     return res.json({ builder_id: builderId, ideas, total, limit, offset });
   }, { errorCode: 'idea_trail_failed' }));
 

package/modules/ideas/trail.js

@@ -42,6 +42,16 @@ const { skillFrictionHiddenClause } = require('./skill-friction');
 // first. Both are returned: the lineage array is the complete answer, the legacy
 // column is the only answer for promotions that predate the lineage table. The
 // LATERAL is bounded by the page window, so this stays one query, not an N+1.
+//
+// `goal_id` RIDES ALONG ON BOTH TASK JOINS (task 1004103 / BV2.R17) because it
+// is what tells a protostar in a WELL from one in OPEN SPACE — the distinction
+// the design makes position carry, and the reason the nod queue is a thing a
+// person can see rather than a list someone must remember to open
+// (docs/design/ideator-surface-direction.md). It is the BINDING home for "which
+// goal"; `idea_inbox.suggested_goal_id`, already on the row, is a HINT about a
+// filing that did not convert and is deliberately not what ./idea-state.js
+// reads. Two nullable columns on joins the query already makes, so this costs
+// no round trip.
 const IDEA_TRAIL_DEFAULT_LIMIT = 20;
 const IDEA_TRAIL_MAX_LIMIT = 100;
 
@@ -68,6 +78,7 @@ async function listIdeaTrailForBuilder(builderId, { limit = IDEA_TRAIL_DEFAULT_L
     `SELECT ${IDEA_COLS_Q}, ${GRADE_COLS_Q},
             pt.title  AS promoted_task_title,
             pt.status AS promoted_task_status,
+            pt.goal_id AS promoted_task_goal_id,
             mi.title  AS merged_into_idea_title,
             mi.status AS merged_into_idea_status,
             COALESCE(lin.tasks, '[]'::json) AS lineage_tasks
@@ -78,7 +89,8 @@ async function listIdeaTrailForBuilder(builderId, { limit = IDEA_TRAIL_DEFAULT_L
        LEFT JOIN LATERAL (
          SELECT json_agg(json_build_object(
                   'task_id', l.task_id, 'origin', l.origin,
-                  'title', lt.title, 'status', lt.status
+                  'title', lt.title, 'status', lt.status,
+                  'goal_id', lt.goal_id
                 ) ORDER BY l.task_id) AS tasks
            FROM ideas_task_lineage l
            JOIN tasks lt ON lt.id = l.task_id

package/modules/provisioning/core-upgrade.js

@@ -124,8 +124,8 @@ function coreUpgradeFault(inst, to, live = null) {
  * is. So a second request is a conflict the route names, including when the open
  * intent is itself a core-upgrade.
  */
-async function enqueueCoreUpgrade(provisioning, db, instanceId, to, requestedBy) {
-  const { intent, created } = await provisioning.enqueueIntent(db, instanceId, 'core-upgrade', requestedBy, to);
+async function enqueueCoreUpgrade(provisioning, db, instanceId, to, requestedBy, action = 'core-upgrade') {
+  const { intent, created } = await provisioning.enqueueIntent(db, instanceId, action, requestedBy, to);
   if (created) return { intent, created: true };
   return { intent, created: false, conflict: 'open_intent' };
 }
@@ -172,7 +172,13 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
       // core_upgrades ledger (ADR 0293 D5): a privileged action with an
       // unattributed row is not acceptable here.
       const actor = `api:archon:${req.builder.id}`;
-      const r = await enqueueCoreUpgrade(provisioning, pool, id, to, actor);
+      // `dry_run: true` asks what the move WOULD do and moves nothing (task 1004121).
+      // Queued the same way as the move, through the same single-open-intent slot, so a
+      // preview cannot be requested on top of a move that is already running — and, just
+      // as deliberately, a preview occupies that slot only for as long as it takes.
+      const dryRun = req.body && req.body.dry_run === true;
+      const action = dryRun ? 'core-upgrade-preflight' : 'core-upgrade';
+      const r = await enqueueCoreUpgrade(provisioning, pool, id, to, actor, action);
       if (r.conflict) {
         return res.fail('intent_conflict', {
           status: 409,
@@ -181,9 +187,15 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
         });
       }
       await provisioning.recordEvent(pool, {
-        instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'core-upgrade',
-        detail: `core pin move to ${to} requested`, actor,
+        instanceId: id, ownerBuilderId: inst.owner_builder_id, event: action,
+        detail: dryRun ? `pre-flight check for ${to} requested` : `core pin move to ${to} requested`, actor,
       }).catch(() => {});
+      if (dryRun) {
+        return res.json({
+          ok: true, queued: true, action, target_version: to,
+          message: `Checking what moving to ${to} would do. Nothing is changed by this — the answer appears here when the check finishes.`,
+        });
+      }
       // No duration is promised and no success is claimed: this says the request
       // was RECORDED, which is the only thing true at this moment (ADR 0190 §7).
       return res.json({
@@ -213,6 +225,7 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
  */
 function previewFromSnapshot(inst, snap, openIntent) {
   const served = (snap && snap.served_version) || null;
+  const pf = (snap && snap.preflight) || null;
   const available = (snap && Array.isArray(snap.available) ? snap.available : []);
   const recommended = (snap && snap.recommended) || null;
   // Only what a move could actually go TO: newer than what is running, and admitted by
@@ -230,6 +243,12 @@ function previewFromSnapshot(inst, snap, openIntent) {
     // Named so the UI cannot accidentally render "up to date" over a missing reading.
     reading: served ? 'ok' : 'no_answer',
     observed_at: (snap && snap.observed_at) || null,
+    // What the upgrade SAYS it would do, from the runner's dry run (task 1004121).
+    // Withheld unless it was taken against the move now on offer: a verdict about
+    // 1.19.920 tells the owner nothing true about pressing a button that says 1.19.921,
+    // and a stale pass is worse than no answer because it reads as a guarantee.
+    preflight: pf && recommended && pf.target === recommended ? pf : null,
+    preflight_at: pf && recommended && pf.target === recommended ? (snap.preflight_at || null) : null,
     open_intent: openIntent ? { action: openIntent.action, state: openIntent.state, target_version: openIntent.target_version || null } : null,
   };
 }

package/modules/provisioning/migrations/provisioning_020_core_upgrade_preflight.sql

@@ -0,0 +1,53 @@
+-- provisioning_020_core_upgrade_preflight.sql — what the upgrade would say if you pressed it
+-- (task 1004121, ADR 0293 D4).
+--
+-- WHY THIS EXISTS. Step one of the deploy control's two-step was labelled "see what would
+-- change" and made no network call at all: it flipped a local flag and redrew one fixed
+-- sentence naming the two versions. Nothing was computed and no precondition was checked.
+--
+-- What that cost, on 2026-09-20: the owner pressed Upgrade four times across four
+-- instances. Every press restarted a live box, failed in pre-flight and rolled back, and
+-- the four failures were three DIFFERENT causes — a root Postgres role, an unresolvable
+-- database name (both task 1004119) and an unclean working tree (task 1004122). Each one
+-- is a pre-flight check, and `upgrade.js --dry-run` runs the whole pre-flight before it
+-- returns. Every one of them was reportable without restarting anything.
+--
+-- So the runner now performs that dry run on its own tick, beside the version probe it
+-- already takes, and caches the verdict here. Same division of labour as the columns
+-- next door (provisioning_019): facts the web tier may not go and look for itself, taken
+-- by the process that has a shell and read by the process that does not.
+--
+-- KEYED BY THE TARGET IT WAS RUN AGAINST. A verdict is only about one move. `target` is
+-- stored with it so the control can tell a live answer from one taken against a version
+-- that has since been superseded, rather than showing a stale pass over a new release.
+
+BEGIN;
+
+ALTER TABLE provisioning_core_version_snapshot
+  -- { target, ok, lines[], error } as the dry run reported it, or NULL when there was
+  -- nothing to preview (the box is current, so no move exists to check).
+  ADD COLUMN IF NOT EXISTS preflight jsonb,
+  -- When the dry run ran, which is NOT observed_at: the version probe is taken every
+  -- tick and this is only re-taken when there is a move to check. A control that
+  -- rendered one timestamp for both would age-stamp the verdict with the probe's clock.
+  ADD COLUMN IF NOT EXISTS preflight_at timestamptz;
+
+-- The intent vocabulary gains the ASKING action. The JS list (INTENT_ACTIONS) and this
+-- CHECK are two spellings of one vocabulary, and a widening that lands in only one of
+-- them fails at insert time, in production, on the first real use — which is exactly what
+-- tests/core_upgrade_door.mjs asserts against, and what it caught here.
+--
+-- The target_version CHECK from provisioning_018 is re-stated, not just left alone: it
+-- read `(action = 'core-upgrade') = (target_version IS NOT NULL)`, which would REFUSE a
+-- preflight intent for naming the version it is about to check.
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_action_check;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_action_check
+  CHECK (action IN ('provision', 'teardown', 'oauth-manifest', 'domain-attach',
+                    'settings-apply', 'restart', 'disconnect', 'core-upgrade',
+                    'core-upgrade-preflight'));
+
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_target_version_chk;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_target_version_chk
+  CHECK ((action IN ('core-upgrade', 'core-upgrade-preflight')) = (target_version IS NOT NULL));
+
+COMMIT;

package/modules/provisioning/provisioning.js

@@ -61,7 +61,7 @@ const PROJECT_TYPES = ['game', 'research', 'business', 'non-profit', 'not-sure']
 // 'disconnect' (task 1003249, migration provisioning_016): the owner's true delete — ./disconnect.js.
 // 'core-upgrade' (task 1003159, ADR 0293): move this instance's core pin — the owner's
 // deploy door. The web tier only QUEUES it; the control-plane runner performs it.
-const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade'];
+const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade', 'core-upgrade-preflight'];
 // Every state a teardown can be asked for — i.e. everything except the one
 // state where there is provably nothing left to release. DERIVED from
 // INSTANCE_STATES on purpose (task 1003042, walk finding N5): the old hand-kept

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.922",
+  "version": "1.19.924",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.922",
+      "version": "1.19.924",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.922",
+  "version": "1.19.924",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",