@bongos/core 1.19.985 → 1.19.986

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.985",
-  "core_contract": "1.19.985",
-  "source_commit": "83b55732b7a45bc4ac27e3f8b4872570c2453a43",
+  "core_version": "1.19.986",
+  "core_contract": "1.19.986",
+  "source_commit": "df54cfbda9edb7e3e5b7f953174e31e6a5b65bc4",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T18:23:03.534Z",
+  "built_at": "2026-09-23T18:36:30.871Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 518,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2389,
+    "functional_verbatim": 2390,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2933,
-  "tree_sha256": "a3e334e9c129ec8270c4874ec1df68f400624469cfb9652714507b7049ec07f5",
+  "file_count": 2934,
+  "tree_sha256": "8b898c04436c76259878da047c512541c0d0a03e9de13419b31e0a0d41ffa182",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2712,7 +2712,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "9a567bebe4a58d5b7efeb164ea93f3e134dc7859c12316e2319787ac3e22235c"
+      "sha256": "e779420483a2e19ea834a5995d1960296dad434fa158c1e46db3ee4e12b6569e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5802,7 +5802,7 @@
     {
       "path": "modules/lifecycle/db-ship.js",
       "mode": "0000644",
-      "sha256": "d280c54d35721d0a24090ab9cc3ac35d311d253d59d4ea57fb542e1232f5c744"
+      "sha256": "c239b8cb88087f7bdb860c876e3e924bc1efef3cdba0ddec0374f71f7f2082d5"
     },
     {
       "path": "modules/lifecycle/db-tasks.js",
@@ -8157,12 +8157,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e56dc24d5e58a71b9768ab10c269e8fb9fd40691fd92e8a205e6e0200204393b"
+      "sha256": "2fcebda4add1d874aee7ce5f756b37bb55485b6c001aaccde5b0f9624d4c0192"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e8489984d076fec6055a6c04a71ea53fe859deac7c8bd7c50acb59e45a00c748"
+      "sha256": "80d5c9a1504e44bfccb0e3bfb0fd38e99eed359118d9d48f12bf9cab895f0533"
     },
     {
       "path": "public-docs/index.html",
@@ -10187,7 +10187,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ee0aba3198c03fa51608e06ce5d5f483335085a1aded69fef7afd71f600dfea5"
+      "sha256": "17399ab568a9343c5c5cead3e1e467af941ec891ee117b424ad0e2ed10151731"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14382,7 +14382,12 @@
     {
       "path": "tests/task_merge.mjs",
       "mode": "0000644",
-      "sha256": "2a16f120729c641de65cccf79f1583e2d2e68b72bf10277310991c1787dde2bf"
+      "sha256": "716c421719fbf14a8024b7b34090ac50a8384fa3de9d35d1336f302c960c16c6"
+    },
+    {
+      "path": "tests/task_merge_route.mjs",
+      "mode": "0000644",
+      "sha256": "24d411385ae7f8f21a0ba0e785257888052b3539c234a04f5bde797628e05654"
     },
     {
       "path": "tests/task_ownership_gate.mjs",

package/docs/module-api-changelog.md

@@ -2444,5 +2444,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.983 with no explicit bump. run 35900593334. (task 1002620)
   1.19.985 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.984 with no explicit bump. run 35902000024. (task 1002620)
+  1.19.986 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.985 with no explicit bump. run 35903379073. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-ship.js

@@ -17,6 +17,7 @@ const seams = api;
 const doneWhen = require('./done-when.js');
 const { THETES_GRADUATION_THRESHOLD, maybeAutoGraduateToThetes, foldWorktreeName } = require('./db-rank-authz.js');
 const { mostRecentClaimHolderId, sealSessionLog, staleClaimHourPredicate } = require('./db-shared.js');
+const { LIVE_STATUSES } = require('./dead-deps.js');
 
 // shouldRefuseClaimResolve — may THIS caller resolve THIS claim? (task 1003767)
 //
@@ -1374,6 +1375,7 @@ async function mergeTask({ taskId, intoTaskId, reason }, deps = {}) {
         return {
           taskId, taskTitle: task.title, taskStatus: 'abandoned',
           mergedIntoTaskId: Number(task.merged_into_task_id), alreadyMerged: true,
+          strandedDependents: [],
         };
       }
       throw Object.assign(
@@ -1391,7 +1393,7 @@ async function mergeTask({ taskId, intoTaskId, reason }, deps = {}) {
     }
 
     const { rows: targetRows } = await client.query(
-      `SELECT id, merged_into_task_id FROM tasks WHERE id = $1`,
+      `SELECT id, merged_into_task_id FROM tasks WHERE id = $1 FOR UPDATE`,
       [intoTaskId]
     );
     if (targetRows.length === 0) {
@@ -1424,6 +1426,20 @@ async function mergeTask({ taskId, intoTaskId, reason }, deps = {}) {
       [taskId, intoTaskId, noteText]
     );
 
+    // Abandoned blocks its dependents forever (owner ruling 2026-08-21, see this
+    // module's CLAUDE.md), so the merge must say who it just stranded — the same
+    // report scripts/gds/abandon.js prints. Live dependents only; read inside the
+    // txn so it agrees with the row we just flipped.
+    const { rows: stranded } = await client.query(
+      `SELECT t.id, t.title, t.status
+         FROM dependencies d
+         JOIN tasks t ON t.id = d.from_id
+        WHERE d.from_kind = 'task' AND d.to_kind = 'task' AND d.to_id = $1
+          AND t.status = ANY($2::text[])
+        ORDER BY t.id`,
+      [taskId, [...LIVE_STATUSES]]
+    );
+
     await client.query('COMMIT');
     return {
       taskId,
@@ -1432,6 +1448,7 @@ async function mergeTask({ taskId, intoTaskId, reason }, deps = {}) {
       previousStatus: task.status,
       mergedIntoTaskId: Number(intoTaskId),
       alreadyMerged: false,
+      strandedDependents: stranded.map((r) => ({ id: String(r.id), title: r.title, status: r.status })),
     };
   } catch (err) {
     await client.query('ROLLBACK').catch(() => {});

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.985",
+  "version": "1.19.986",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.985",
+      "version": "1.19.986",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.985",
+  "version": "1.19.986",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.985'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.986'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/task_merge.mjs

@@ -48,7 +48,7 @@ const { test, summary } = makeRunner();
 function fakePool({
   status = 'ready', notFound = false, mergedInto = null,
   hasActiveClaim = false, targetNotFound = false, targetMergedInto = null,
-  updatedStatus = 'abandoned',
+  updatedStatus = 'abandoned', dependents = [],
 } = {}) {
   return makeSqlAwareClient((s, params) => {
     if (/^SELECT id, title, status, merged_into_task_id FROM tasks WHERE id = \$1 FOR UPDATE/.test(s)) {
@@ -57,9 +57,12 @@ function fakePool({
     if (/^SELECT id FROM claims WHERE task_id = \$1 AND released_at IS NULL/.test(s)) {
       return { rows: hasActiveClaim ? [{ id: 999 }] : [] };
     }
-    if (/^SELECT id, merged_into_task_id FROM tasks WHERE id = \$1/.test(s)) {
+    if (/^SELECT id, merged_into_task_id FROM tasks WHERE id = \$1 FOR UPDATE/.test(s)) {
       return { rows: targetNotFound ? [] : [{ id: params[0], merged_into_task_id: targetMergedInto }] };
     }
+    if (/^SELECT t\.id, t\.title, t\.status FROM dependencies d/.test(s)) {
+      return { rows: dependents };
+    }
     if (/^UPDATE tasks/.test(s)) {
       return { rows: [{ id: params[0], title: 'fixture bug', status: updatedStatus }] };
     }
@@ -194,5 +197,24 @@ await test('merge: a target that is itself merged elsewhere is refused, naming w
   assert.equal(all(pool._client.queries, /^UPDATE tasks/).length, 0);
 });
 
+await test('merge: the target row is read FOR UPDATE (no-chains guard is not a TOCTOU)', async () => {
+  const pool = fakePool({ status: 'ready' });
+  await mergeTask({ taskId: TASK, intoTaskId: TARGET }, { pool });
+  const q = find(pool._client.queries, /^SELECT id, merged_into_task_id FROM tasks WHERE id = \$1/);
+  assert.ok(q, 'target read must happen');
+  assert.match(String(q.sql).replace(/\s+/g, ' '), /FOR UPDATE/);
+});
+
+await test('merge: reports the live dependents it just stranded', async () => {
+  const dependents = [{ id: 5, title: 'blocked work', status: 'backlog' }];
+  const pool = fakePool({ status: 'ready', dependents });
+  const out = await mergeTask({ taskId: TASK, intoTaskId: TARGET }, { pool });
+  assert.deepEqual(out.strandedDependents, [{ id: '5', title: 'blocked work', status: 'backlog' }]);
+  const none = await mergeTask({ taskId: TASK, intoTaskId: TARGET }, { pool: fakePool({ status: 'ready' }) });
+  assert.deepEqual(none.strandedDependents, []);
+  const again = await mergeTask({ taskId: TASK, intoTaskId: TARGET }, { pool: fakePool({ status: 'abandoned', mergedInto: TARGET }) });
+  assert.deepEqual(again.strandedDependents, [], 'idempotent re-merge keeps the field shape');
+});
+
 // -------------------------------------------------------------------------
 summary();

package/tests/task_merge_route.mjs

@@ -0,0 +1,93 @@
+// tests/task_merge_route.mjs
+//
+// POST /tasks/:id/merge as an HTTP route (task 1003622). tests/task_merge.mjs
+// drives db.mergeTask directly; nothing there proves the route validates input,
+// maps each mergeTask error code to its status, or surfaces strandedDependents.
+// DB-free: db.mergeTask is stubbed on the cached module object.
+//
+// Run:  node --test tests/task_merge_route.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const db = require('../modules/lifecycle/db.js');
+const api = require('../src/module-api.js');
+
+let calls = [];
+let impl = async () => ({});
+db.mergeTask = async (args) => { calls.push(args); return impl(args); };
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, rank: 'metic' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+
+const express = require('express');
+const buildRouter = require('../modules/lifecycle/routes/tasks.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts) => { const o = typeof opts === 'number' ? { status: opts } : (opts || {}); res.status(o.status || 400).json({ error: { code, ...o } }); };
+  next();
+});
+app.use('/api/bongos', buildRouter());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const port = server.address().port;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const data = JSON.stringify(body);
+    const req = http.request({ host: '127.0.0.1', port, path: `/api/bongos${path}`, method: 'POST',
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(data);
+  });
+}
+
+const fail = (code, extra = {}) => async () => { throw Object.assign(new Error(code), { code, ...extra }); };
+
+test('success returns mergeTask result including strandedDependents', async () => {
+  calls = [];
+  impl = async () => ({ taskId: 10, mergedIntoTaskId: 20, strandedDependents: [{ id: '5', title: 't', status: 'backlog' }] });
+  const r = await post('/tasks/10/merge', { into_task_id: 20, reason: 'dup' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.ok, true);
+  assert.deepEqual(r.body.strandedDependents, [{ id: '5', title: 't', status: 'backlog' }]);
+  assert.deepEqual(calls, [{ taskId: 10, intoTaskId: 20, reason: 'dup' }]);
+});
+
+test('missing into_task_id is rejected before mergeTask runs', async () => {
+  calls = [];
+  const r = await post('/tasks/10/merge', {});
+  assert.equal(r.status, 400, r.raw);
+  assert.equal(calls.length, 0);
+});
+
+for (const [code, status, extra] of [
+  ['MERGE_SELF', 400, {}],
+  ['TASK_NOT_FOUND', 404, {}],
+  ['CANNOT_MERGE_SHIPPED', 409, {}],
+  ['ALREADY_MERGED', 409, { merged_into: '30' }],
+  ['TASK_HAS_ACTIVE_CLAIM', 409, {}],
+  ['MERGE_TARGET_NOT_FOUND', 404, {}],
+  ['MERGE_TARGET_MERGED', 409, { merged_into: '30' }],
+]) {
+  test(`${code} maps to HTTP ${status}`, async () => {
+    impl = fail(code, extra);
+    const r = await post('/tasks/10/merge', { into_task_id: 20 });
+    assert.equal(r.status, status, r.raw);
+  });
+}
+
+test('an unexpected error is a 500 merge_failed', async () => {
+  impl = fail('BOOM');
+  const r = await post('/tasks/10/merge', { into_task_id: 20 });
+  assert.equal(r.status, 500, r.raw);
+});
+
+test.after(() => server.close());