@bongos/core 1.20.38 → 1.20.40

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.38",
-  "core_contract": "1.20.38",
-  "source_commit": "4e110352a9549b0ec4a86787079a39a1c0a27fdc",
+  "core_version": "1.20.40",
+  "core_contract": "1.20.40",
+  "source_commit": "b2b1ab60800736f857d25d84bf91ee5bd53153fb",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T00:12:16.822Z",
+  "built_at": "2026-10-01T00:37:27.302Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 564,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2682,
+    "functional_verbatim": 2684,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3272,
-  "tree_sha256": "8cf3dc3be319db89ac23d13789c7a89044ccf38f1ca25e73a4c695474c40a7e1",
+  "file_count": 3274,
+  "tree_sha256": "c0d69a1151540d8702aca870e7ac26d1ed5e95c2b60eafed5a232c20fde50f71",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2222,7 +2222,7 @@
     {
       "path": "docs/adr/0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md",
       "mode": "0000644",
-      "sha256": "1c25e4c012e5321ffb2169e871fcbb2cea7bc823656959a6872a0af428674f3d"
+      "sha256": "7fe345d475d9540181d12544606c1c2cbfd5510e94c8fbf3599fc48d2790b3cb"
     },
     {
       "path": "docs/adr/0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md",
@@ -2302,12 +2302,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "d376dd1d521f621427743cf2793e7d616b022966e33b4b6461af348bd004f9ce"
+      "sha256": "0baae7f0f5f6a43b821d0624eff2d393bc4a76b68fc357077df2875c92548c86"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "2abdd8a8648a3dd0e5a4c42ae14ab8115c04b677340d82fe111fa6bf71aa0103"
+      "sha256": "b318f4f9fd9e4cc39c515543246c8ab6e5290428702c4be2770b9c0ab705fd9e"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2812,7 +2812,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ff5262fdb7e4a29789ab9c8d751dced1e1033c9419a9b504018fde02264575e9"
+      "sha256": "151589d412762bf79fe8fae3f48ae9ceb0a0052c0159860a1ed02a670101690c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2902,7 +2902,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "4b079c53c48506ee9e6b58c240a6aa5a38da883c33d30040d6f8b25f0f3cd62b"
+      "sha256": "430b53669889f1df1cfb99359ab3ae819dd8c7d37d716271dab516c39d11eb6d"
     },
     {
       "path": "docs/project-context.template.md",
@@ -6764,35 +6764,40 @@
       "mode": "0000644",
       "sha256": "ede907b6b579c3213eaf45d12320a8765aebaa11adc9b534e9402271c5eb39f7"
     },
+    {
+      "path": "modules/npm-release/preview/childlog.js",
+      "mode": "0000644",
+      "sha256": "ca1a26162ad5ac7b9dffa8442ebf932fb3c531730c271c40e1735cbe57263f11"
+    },
     {
       "path": "modules/npm-release/preview/commands.js",
       "mode": "0000644",
-      "sha256": "7c643624b4d801263cf89bad05a46396af0720b10c261ddc6eda7fdc2ad95f5b"
+      "sha256": "2dd2d3b901db52e5b6c00b1cedcefc258e93e23277f982102ed44ad980e236a8"
     },
     {
       "path": "modules/npm-release/preview/divert.js",
       "mode": "0000644",
-      "sha256": "f8b716868ff00ae1f14e38c4d2e8ddd32c660615b1c2b52a06d3b9b186c01825"
+      "sha256": "d7dd379f30685df8874102c40c4e68f1e7547ed85f2ec7bbaf3d98e0a7528bed"
     },
     {
       "path": "modules/npm-release/preview/env.js",
       "mode": "0000644",
-      "sha256": "7e61de63e251e46abd1387eab1dca2f4365a1665f5c3cf6507443529d6b1602d"
+      "sha256": "d9716eea3c3c233eb0397fa0976de9dfcb8a87a8e3b802c5bbea4e5568e691f9"
     },
     {
       "path": "modules/npm-release/preview/proxy.js",
       "mode": "0000644",
-      "sha256": "6c8a352990ffc241ab83075b4cb8f216a8d03cdcd39d19e99cb1a4eb25b55778"
+      "sha256": "8b68575faf04ee2905b31a9b9e2e584723666d313612ab80be3a189ea10c6f0d"
     },
     {
       "path": "modules/npm-release/preview/runtime.js",
       "mode": "0000644",
-      "sha256": "655f81b9365d812a2885d20d81f983cf034f980cc744adc00b0c6367b4f3e69c"
+      "sha256": "307b217847412c79adb453d078d29f9063a7a83d9c0afc1d43acaef685e9e482"
     },
     {
       "path": "modules/npm-release/preview/supervisor.js",
       "mode": "0000644",
-      "sha256": "d8015924501f0caf859c15ee1806335ebaedfb92ef98ac96f54d191bd14ce91f"
+      "sha256": "fd27648c4d75e03ec541f1295a05ffd05aae957bbf0748215497b624106cf12e"
     },
     {
       "path": "modules/npm-release/public/task-widget.js",
@@ -6802,17 +6807,17 @@
     {
       "path": "modules/npm-release/public/work.css",
       "mode": "0000644",
-      "sha256": "d0625e8cd454c7f58f86048bf243232ee368f6b667969b366fbb8e59d9a06c9c"
+      "sha256": "4c47bc82ceb37fe4e5f235923dc7df19b27bafd02079931b8a1b4a1581dd9a9b"
     },
     {
       "path": "modules/npm-release/public/work.js",
       "mode": "0000644",
-      "sha256": "6beec305cfe1bfbe7313614f812b6bdc3c82b40eb3c705a6491059c1d762a058"
+      "sha256": "7e24e12c9615e6310227a12620dc320777bcef82710d1cad68a0546e66c783c6"
     },
     {
       "path": "modules/npm-release/routes/preview.js",
       "mode": "0000644",
-      "sha256": "bf66245145f6f4888c4e23c4c4c7803e759553aff7c06a07b3604b17c91d9679"
+      "sha256": "bb2d1b5db4a13949d69177ad10bdd9d4a3e6ad77710317317e764358bc150551"
     },
     {
       "path": "modules/npm-release/routes/task-where.js",
@@ -7572,7 +7577,7 @@
     {
       "path": "modules/provisioning/render-standup.js",
       "mode": "0000644",
-      "sha256": "3746afcfc0c1573a4611e477547a6c9b4508f0c5591e92e44872e41df694c95a"
+      "sha256": "619653655d9e832771a10e2f0be0177787f5506abff73ccdd7266c2ae9ac8b3f"
     },
     {
       "path": "modules/provisioning/repo-private.js",
@@ -8172,7 +8177,7 @@
     {
       "path": "modules/public-landing/public/projects.html",
       "mode": "0000644",
-      "sha256": "2ca599fc5387dd42f236e89584522909446a236b862307b79066892c350b0c97"
+      "sha256": "e9ba493a5969fb4e544ea578a5ebd913885e30945b3ef08b76077620fda3b357"
     },
     {
       "path": "modules/public-landing/public/projects.probes.json",
@@ -9017,12 +9022,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "15875bc214ce563dd709373d004e6bef01c6772d4af9d2bea60ea6dfa75c4102"
+      "sha256": "9f46a8f738d89eb715a930ddb554bf6b1bd3d027a0851e356aed3c4545354f43"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9bb2fffbcfa6fcc80c8908ba1f3cf31f8f719b257fb04ffffe0ba8246dde5a3b"
+      "sha256": "b504322a4ccdf13821f15b0c09de9c9c44383bdfa54457925772af80d80445c7"
     },
     {
       "path": "public-docs/index.html",
@@ -9042,7 +9047,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "3b4689657b7c99996783f41184b5c3a936bbc18dceaef9329834b8bd4905dd15"
+      "sha256": "88bbf251ccd70e10dff2d818ed34eb8047ee80075856cde2da929f473ea03e89"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10047,7 +10052,7 @@
     {
       "path": "scripts/gds/provision-render.js",
       "mode": "0000644",
-      "sha256": "fecec876d1e7a325690a0877f0c1b1833dbf8dca1f8b4e427fe415cc2746aeb5"
+      "sha256": "2968e99d4761b2cfdcb04cfdbed601f2e971918f123721ee2c070d698064bb17"
     },
     {
       "path": "scripts/gds/provision-repo-auth.js",
@@ -10182,7 +10187,7 @@
     {
       "path": "scripts/gds/render-payload.js",
       "mode": "0000644",
-      "sha256": "87f987cd8530dc79eadee5854cbd3469a2a186671c18aa80b2ed7a74688dc243"
+      "sha256": "cfff58290a701e90865ee5f97955613000c9963c022f3392d996f8f67e707b72"
     },
     {
       "path": "scripts/gds/repo-metrics.js",
@@ -11197,7 +11202,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "99f0948af696a22d39d38c13e7eddcfd698bae85fde95824212fc98faf4c30d5"
+      "sha256": "e3bc53481c5c7f502e3fb43c06d8ceadae02c0c57edb504aab696fff1e50af7d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14342,12 +14347,17 @@
     {
       "path": "tests/npm_release_preview_commands.mjs",
       "mode": "0000644",
-      "sha256": "c6632d2c49f43abf9265fea35f704ab34969ea75e34f5e29fc4f06fee47dfcc4"
+      "sha256": "42c80d48506e3f815ea4ed1dce343f84fc12b2ac55c645ac39d5be415ab3261a"
+    },
+    {
+      "path": "tests/npm_release_preview_diagnosis.mjs",
+      "mode": "0000644",
+      "sha256": "9a246f9a29da48eaed7d0f19e156f1f63a48afb0277ab8ce02f7d6dc07c6d92b"
     },
     {
       "path": "tests/npm_release_preview_divert.mjs",
       "mode": "0000644",
-      "sha256": "be847731e116e9f5f15392668111596cbcbab74cae4f3da4ab92d780647cc9af"
+      "sha256": "154a7246124d65e9c0c487b9fd24b23d6786d2e9879cb9454ecdde50c618700d"
     },
     {
       "path": "tests/npm_release_preview_env.mjs",
@@ -14357,17 +14367,17 @@
     {
       "path": "tests/npm_release_preview_proxy.mjs",
       "mode": "0000644",
-      "sha256": "406a1183b9a799a79176191d510aa676558d569bcc6057f6164cb8857c56f4a3"
+      "sha256": "5aeb98a740acf5dc96ad456f72dfe7616a53a5a4c0ba306fa24764b5df299881"
     },
     {
       "path": "tests/npm_release_preview_routes.mjs",
       "mode": "0000644",
-      "sha256": "6e1e70a9917711a76e50f3b89d1f265fd0a169e5d0b3158f591e835cb74c2851"
+      "sha256": "187d0c93077dce3321c8063ccd04ea6033e46ee868e9530c9d6eaf5092b926a4"
     },
     {
       "path": "tests/npm_release_preview_supervisor.mjs",
       "mode": "0000644",
-      "sha256": "a2d12f36b6222b84b1a50504cb6a2b70114d0ab9f2c0bb90b9b22d6af8f3ab43"
+      "sha256": "d699b5b2a6b36169cfcdd925bf6b580c0238a6125174469a0129ca7945b1e69b"
     },
     {
       "path": "tests/npm_release_where.mjs",
@@ -14742,7 +14752,7 @@
     {
       "path": "tests/projects_hub_app_step.mjs",
       "mode": "0000644",
-      "sha256": "5708edce575bca30c00c29904726327ed74f74e4df7439e379f20e712d13232b"
+      "sha256": "c3d744459af82c770b04158b0cd3ec41cd2bb2f458c57992d80fde67d03565f4"
     },
     {
       "path": "tests/projects_hub_module_picker.mjs",
@@ -14757,7 +14767,7 @@
     {
       "path": "tests/projects_hub_render_connect.mjs",
       "mode": "0000644",
-      "sha256": "3c063d1250ef4c44da559ecdc8042d959be26b2a403ae22943dfcf2259234249"
+      "sha256": "41251f0c70ed1197155f01213d4bc0de8fb9c0ca5e4295dfc4b2fab6762823fb"
     },
     {
       "path": "tests/projects_hub_repo_private.mjs",
@@ -14822,7 +14832,7 @@
     {
       "path": "tests/provision_render.mjs",
       "mode": "0000644",
-      "sha256": "3b83ad643333cd97a23deea1fc0e61330fb5f30fe01b6332d8ca2010ab9c79d4"
+      "sha256": "0e513363137692678e03267676cb1637d9753f157a8f3702928c73b5c9e3afee"
     },
     {
       "path": "tests/provision_repo_private.mjs",

package/docs/adr/0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md

@@ -96,6 +96,7 @@ What keeps that exception narrow:
   IPAddressDeny` is the follow-up and needs the droplet.
 - A preview started by the live process is stopped when that process exits, but the copy is
   dropped only by the next start or stop. It is one fixed name, so it cannot pile up.
+- **Correction, 2026-09-30 (task 1004466): the proxy strips every upstream `Set-Cookie`.** Same origin means a cookie the child set replaced the live hall's own (`cb_stealth`, the session) and locked the owner out of `/deploy`. The child's cookies now stay with the child; the steering cookie is the only one this module writes, and its clear repeats the set's Path, SameSite and Secure.
 
 ## Consequences
 

package/docs/copy-inventory.md

@@ -2276,9 +2276,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `d22564a81b18` | certain | {{productName}} — projects | `modules/public-landing/public/projects.html:6` |
 | `2fd83f9a5669` | certain | {{productName}}: {{tagline}} | `modules/public-landing/public/index.html:22` |
 | `2fd83f9a5669` | certain | {{productName}}: {{tagline}} | `modules/public-landing/public/index.html:22` |
+| `2609873e46a5` | certain | — Render needs one; the usual one is filled in | `modules/public-landing/public/projects.html:1436` |
 | `5ee1b494eec3` | certain | — for signing in, and for the repositories your projects ship to. | `modules/public-landing/public/privacy.html:63` |
 | `39b7e60d327e` | certain | — it is on the map under its name, but nobody joins on their own: people ask, and you decide. | `modules/public-landing/public/projects.html:933` |
-| `ee96978f8d1b` | certain | — leave empty if there is none | `modules/public-landing/public/projects.html:1436` |
 | `5becfcad07c3` | certain | — people ask from the project’s hall, you approve each one from the hall’s Watch page, and then they sign in. | `modules/public-landing/public/projects.html:914` |
 | `9ac56aa4e540` | certain | — projects hosted by the platform run on servers rented from DigitalOcean, with their web address and traffic  | `modules/public-landing/public/privacy.html:65` |
 | `210963315141` | certain | — the place where the project gets built — at the address you just chose. There is nothing for you to set up. | `modules/public-landing/public/projects.html:1395` |

package/docs/copy-registry.json

@@ -20989,6 +20989,15 @@
       "origin": "html-title",
       "confidence": "certain"
     },
+    {
+      "id": "2609873e46a5",
+      "surface": "landing",
+      "text": "— Render needs one; the usual one is filled in",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1436,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
     {
       "id": "5ee1b494eec3",
       "surface": "landing",
@@ -21007,15 +21016,6 @@
       "origin": "html-text",
       "confidence": "certain"
     },
-    {
-      "id": "ee96978f8d1b",
-      "surface": "landing",
-      "text": "— leave empty if there is none",
-      "file": "modules/public-landing/public/projects.html",
-      "line": 1436,
-      "origin": "html-text",
-      "confidence": "certain"
-    },
     {
       "id": "5becfcad07c3",
       "surface": "landing",

package/docs/module-api-changelog.md

@@ -2733,5 +2733,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.36 with no explicit bump. run 36790298715. (task 1002620)
   1.20.38 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.37 with no explicit bump. run 36794921587. (task 1002620)
+  1.20.39 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.38 with no explicit bump. run 36796243918. (task 1002620)
+  1.20.40 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.39 with no explicit bump. run 36797045221. (task 1002620)
 ---------------------------------------------------------------------------
 ```