@bongos/core 1.21.100 → 1.21.102

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.100",
-  "core_contract": "1.21.100",
-  "source_commit": "8305d0876dae80fcb40694e6ec47fd7a58c39758",
+  "core_version": "1.21.102",
+  "core_contract": "1.21.102",
+  "source_commit": "f552db78c82ef1ca4418a9de313e150bb29ce4b1",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T12:41:06.123Z",
+  "built_at": "2026-10-09T13:15:03.097Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 592,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3640,
-  "tree_sha256": "3ffdbef90f1b79435d7c0d64b7ab8ae554d1d7fc99b18c7126a37465763e5a17",
+  "tree_sha256": "834d88c63001764c8ed72f393a6c49d3d123469f268cf129a13cab0b342e5ebe",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2872,7 +2872,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f69d36a5d32aab16dd006bc16c8117d481064c56528a989997dcb8f516c37daa"
+      "sha256": "b44e9230778cf7b2aafd8d7971fb862c00ab3c8c667da525dc83ceb6238a0908"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10132,12 +10132,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "989f100357f592179e3bace36ba999890b2f872b511d894606d6815c3c9fffe5"
+      "sha256": "4abc8512ca8578d3a43a7d915574dc473061e2e77cd20e3902c5478af77a671f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "028cf735e44c50e2e49fae8b3820d9163570c8e56fc324d429b22c8a01236c56"
+      "sha256": "7b6b52ae08358107e824752af2427b6efaa33d7ea5bcf9a0b464584eef6708a5"
     },
     {
       "path": "public-docs/index.html",
@@ -10157,7 +10157,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "0bd4355a927a990dc4cf27f748792e9c02f5feeb38bb55848aec90258ec95176"
+      "sha256": "947800c2b145b25a07f38bdfc1274ba9316de0b1bccc35e43de3ea2ddc44f7a3"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11932,7 +11932,7 @@
     {
       "path": "scripts/gds/worktree.js",
       "mode": "0000644",
-      "sha256": "69f167d079c1900568f740d8d4a1a2288f5ff47146634209f8a1a9350a3aa5e2"
+      "sha256": "40aa204dd081022580bbd016b1f2741ebfc4eb9324d4f60a2ac7da9636d813f1"
     },
     {
       "path": "scripts/hall-preview/README.md",
@@ -12432,7 +12432,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b56a3d392b5d31ada22d6c5cf12bb9c39514c4b707d5cb63239a4209b256c648"
+      "sha256": "090a1a041a5e03ddfd2bb4c93ff9e28407a1cb662da2492e3741450900282f44"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14752,7 +14752,7 @@
     {
       "path": "tests/guilds_db.mjs",
       "mode": "0000644",
-      "sha256": "8d8847a10fb1930a1c64acd66efb372acef0e742b0b5d804a994d003759f5248"
+      "sha256": "e964c8a42a1703eb4b9edb45ad16d99340fcb08c5d28b0cbc24f5e94313f5b61"
     },
     {
       "path": "tests/hall_approval_queue.mjs",
@@ -18207,7 +18207,7 @@
     {
       "path": "tests/worktree_helper.mjs",
       "mode": "0000644",
-      "sha256": "cac88e36d1e2ef2cbe2799275186f0787431b5b636fc52d1325b5dbbfcd56368"
+      "sha256": "0dea42cbad0d17eb63e516a6812050b239c51b0f2f2d13c3a949eff27ec44657"
     },
     {
       "path": "tests/world_tokens.mjs",

package/docs/module-api-changelog.md

@@ -3037,5 +3037,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.98 with no explicit bump. run 37927704012. (task 1002620)
   1.21.100 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.99 with no explicit bump. run 37931583687. (task 1002620)
+  1.21.101 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.100 with no explicit bump. run 37933684016. (task 1002620)
+  1.21.102 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.101 with no explicit bump. run 37935415352. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.100",
+  "version": "1.21.102",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.100",
+      "version": "1.21.102",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.100",
+  "version": "1.21.102",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9438,5 +9438,17 @@
       "id": "1004659",
       "text": "There is now a plain-language guide to how a project's government works: GOVERNMENT.md, linked from the README and the hall primer. It explains the four forms you can pick today, who votes and how many must agree, who decides"
     }
+  ],
+  "1.21.101": [
+    {
+      "id": "1004582",
+      "text": "Cleaning up a finished worktree no longer crashes on Linux and Mac machines. It used to stop halfway and leave the old workspace registered; now it removes the shortcut to the shared packages safely and carries on."
+    }
+  ],
+  "1.21.102": [
+    {
+      "id": "1004588",
+      "text": "The guilds test now sets up everything it needs on a brand-new database, so it runs all the way through instead of stopping early. It also checks, without needing a database, that its setup keeps up with the tables the guild c"
+    }
   ]
 }

package/scripts/gds/worktree.js

@@ -173,6 +173,24 @@ function nodeModulesState(wtPath) {
   return st.isSymbolicLink() ? 'junction' : 'real-dir';
 }
 
+// Remove a node_modules LINK without ever following it (task 1004582). rmdir is
+// only right for a Windows junction: on Linux/macOS (cloud containers) the link
+// is a plain symlink and rmdir throws ENOTDIR, leaving the worktree registered.
+// unlink removes the link itself on every platform — libuv unlinks a junction
+// too — and refuses a real directory outright, so it can never delete contents.
+// The win32 rmdir fallback covers a reparse point unlink will not take.
+function unlinkNodeModulesLink(linkPath, { platform = process.platform, fsImpl = fs } = {}) {
+  if (!fsImpl.lstatSync(linkPath).isSymbolicLink()) {
+    throw new Error(`${linkPath} is not a link — refusing to remove a real directory`);
+  }
+  try {
+    fsImpl.unlinkSync(linkPath);
+  } catch (e) {
+    if (platform !== 'win32' || (e.code !== 'EPERM' && e.code !== 'EISDIR')) throw e;
+    fsImpl.rmdirSync(linkPath); // on a junction, rmdir removes the LINK only
+  }
+}
+
 function resolveWorktreePath(root, nameOrPath) {
   const all = listWorktrees(root);
   const norm = (p) => path.resolve(p).replace(/\\/g, '/').toLowerCase();
@@ -296,8 +314,8 @@ function cmdRemove(root, argv) {
   const state = nodeModulesState(wtPath);
   for (const step of removalPlan({ nodeModulesState: state })) {
     if (step === 'unlink-junction') {
-      // rmdir on a junction removes the LINK only, never the target's contents.
-      fs.rmdirSync(path.join(wtPath, 'node_modules'));
+      // Removes the LINK only, never the target's contents — junction or symlink.
+      unlinkNodeModulesLink(path.join(wtPath, 'node_modules'));
       console.log('  removed node_modules junction (link only — the shared node_modules is untouched)');
     } else {
       const args = ['worktree', 'remove', ...(hasFlag('--force', argv) ? ['--force'] : []), wtPath];
@@ -427,4 +445,5 @@ if (require.main === module) main();
 
 module.exports = {
   worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition,
+  unlinkNodeModulesLink,
 };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.100'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.102'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/guilds_db.mjs

@@ -28,6 +28,56 @@ const here = dirname(fileURLToPath(import.meta.url));
 const MIG_DIR = join(here, '..', 'modules', 'platform-identity', 'migrations');
 const migrationSql = (f) => readFileSync(join(MIG_DIR, f), 'utf8');
 
+// The migrations this domain reads, all idempotent: accounts + consent,
+// handles, privacy, terms, connections (addressing), guilds, and the stored
+// guild totals getPublicGuild joins (027 — missing until task 1004588, so a
+// fresh Postgres died on "relation platform_identity_guild_totals does not
+// exist" before most assertions ran). 030 (engagements) is not read by guilds.js.
+const SETUP_MIGRATIONS = [
+  'platform_identity_001_tables.sql', 'platform_identity_007_profile_consent.sql',
+  'platform_identity_008_handle.sql', 'platform_identity_012_account_privacy.sql',
+  'platform_identity_015_connections.sql', 'platform_identity_019_terms_acceptance.sql',
+  'platform_identity_025_guilds.sql', 'platform_identity_027_guild_totals.sql',
+];
+
+// DB-FREE GUARD, run before the Postgres probe so it holds even where this file
+// skips (task 1004588). Every platform_identity_ table guilds.js reads or
+// writes — itself, plus the bodies of the functions it imports from ./guild-*
+// siblings — must be CREATEd by a setup migration; otherwise a fresh DB fails
+// mid-run, and a shared dev DB that already has the table hides it. Scoped to
+// the imported FUNCTIONS on purpose: guild-totals.js also holds the poller,
+// whose tables this test never exercises. A scan that finds nothing fails.
+{
+  const MOD_DIR = join(here, '..', 'modules', 'platform-identity');
+  const guildsSrc = readFileSync(join(MOD_DIR, 'guilds.js'), 'utf8');
+  const sources = [['guilds.js', guildsSrc]];
+  const reqRe = /const\s*\{([^}]+)\}\s*=\s*require\(\s*'\.\/(guild-[a-z-]+)(?:\.js)?'\s*\)/g;
+  for (const [, names, file] of guildsSrc.matchAll(reqRe)) {
+    const src = readFileSync(join(MOD_DIR, `${file}.js`), 'utf8');
+    for (const name of names.split(',').map((n) => n.trim()).filter(Boolean)) {
+      const start = src.search(new RegExp(`\\n(?:async\\s+)?function\\s+${name}\\b`));
+      assert.ok(start >= 0, `guard scan found function ${name} in ${file}.js`);
+      const rest = src.slice(start + 1);
+      const end = rest.search(/\n(?:async\s+)?function\s|\nmodule\.exports/);
+      sources.push([`${file}.js:${name}`, end < 0 ? rest : rest.slice(0, end)]);
+    }
+  }
+  const used = new Set();
+  const useRe = /\b(?:FROM|JOIN|INTO|UPDATE)\s+(platform_identity_[a-z0-9_]+)/gi;
+  for (const [, src] of sources) for (const m of src.matchAll(useRe)) used.add(m[1]);
+  const created = new Set();
+  const createRe = /CREATE TABLE IF NOT EXISTS\s+(platform_identity_[a-z0-9_]+)/gi;
+  for (const f of SETUP_MIGRATIONS) for (const m of migrationSql(f).matchAll(createRe)) created.add(m[1]);
+  const scanned = sources.map(([n]) => n);
+  assert.ok(scanned.includes('guild-totals.js:readGuildTotals'), `guard scan followed guilds.js's imports: ${scanned.join(', ')}`);
+  for (const t of ['platform_identity_guilds', 'platform_identity_guild_totals']) {
+    assert.ok(used.has(t), `guard scan saw ${t} (found: ${[...used].join(', ')})`);
+  }
+  const missing = [...used].filter((t) => !created.has(t));
+  assert.deepEqual(missing, [], `SETUP_MIGRATIONS creates no table for: ${missing.join(', ')}`);
+  console.log(`  ok  setup migrations create every table guilds.js uses (${used.size} tables; ${scanned.join(' + ')})`);
+}
+
 const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined });
 try {
   await pool.query('SELECT 1');
@@ -74,14 +124,8 @@ const openRows = async (slug, gid) => (await q(
 const pendingId = async (slug, gid) => (await openRows(slug, gid)).find((r) => r.status === 'pending')?.id;
 
 try {
-  // The migrations this domain reads, all idempotent: accounts + consent,
-  // handles, privacy, terms, connections (addressing), and guilds.
-  for (const f of [
-    'platform_identity_001_tables.sql', 'platform_identity_007_profile_consent.sql',
-    'platform_identity_008_handle.sql', 'platform_identity_012_account_privacy.sql',
-    'platform_identity_015_connections.sql', 'platform_identity_019_terms_acceptance.sql',
-    'platform_identity_025_guilds.sql',
-  ]) await q(migrationSql(f));
+  // The migrations this domain reads — see SETUP_MIGRATIONS above.
+  for (const f of SETUP_MIGRATIONS) await q(migrationSql(f));
   await q(migrationSql('platform_identity_025_guilds.sql')); // re-runnable
   await cleanup();
 

package/tests/worktree_helper.mjs

@@ -27,7 +27,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition } = require('../scripts/gds/worktree.js');
+const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState, shadowingNodeModules, huskDisposition, unlinkNodeModulesLink } = require('../scripts/gds/worktree.js');
 
 const HOUR = 60 * 60 * 1000;
 
@@ -118,16 +118,75 @@ test('nodeModulesState: absent / real-dir / junction classified from disk', () =
     fs.symlinkSync(target, link, 'junction');
     eq(nodeModulesState(wtJct), 'junction');
 
-    // Removing the link (the helper's unlink step) must not touch the target.
-    // win32 junctions need rmdir; a posix dir-symlink needs unlink — cover both
-    // so this file passes on Linux CI and the real Windows box alike.
-    try { fs.rmdirSync(link); } catch (_) { fs.unlinkSync(link); }
+    // Removing the link (the helper's own unlink step) must not touch the target.
+    // On Linux CI this is a plain dir-symlink — the case rmdir crashed on with
+    // ENOTDIR (task 1004582); on Windows it is a real junction.
+    unlinkNodeModulesLink(link);
+    eq(fs.existsSync(link), false, 'the link itself is gone');
     eq(fs.existsSync(path.join(target, 'canary.txt')), true, 'target survives link removal');
   } finally {
     fs.rmSync(base, { recursive: true, force: true });
   }
 });
 
+// The win32 rmdir fallback, driven through a fake fs so every platform runs it.
+function fakeFs(unlinkCode) {
+  const calls = [];
+  return {
+    calls,
+    lstatSync: () => ({ isSymbolicLink: () => true }),
+    unlinkSync: (p) => {
+      calls.push(['unlink', p]);
+      if (unlinkCode) { const e = new Error(unlinkCode); e.code = unlinkCode; throw e; }
+    },
+    rmdirSync: (p) => { calls.push(['rmdir', p]); },
+  };
+}
+
+test('unlinkNodeModulesLink: unlink succeeds → rmdir is never called', () => {
+  const f = fakeFs(null);
+  unlinkNodeModulesLink('L', { platform: 'linux', fsImpl: f });
+  eqArr(f.calls, [['unlink', 'L']]);
+});
+
+for (const code of ['EPERM', 'EISDIR']) {
+  test(`unlinkNodeModulesLink: win32 + ${code} falls back to rmdir`, () => {
+    const f = fakeFs(code);
+    unlinkNodeModulesLink('L', { platform: 'win32', fsImpl: f });
+    eqArr(f.calls, [['unlink', 'L'], ['rmdir', 'L']]);
+  });
+  test(`unlinkNodeModulesLink: non-win32 + ${code} rethrows, no rmdir`, () => {
+    const f = fakeFs(code);
+    let thrown = null;
+    try { unlinkNodeModulesLink('L', { platform: 'linux', fsImpl: f }); } catch (e) { thrown = e.code; }
+    eq(thrown, code);
+    eqArr(f.calls, [['unlink', 'L']]);
+  });
+}
+
+test('unlinkNodeModulesLink: win32 + any other code rethrows, no rmdir', () => {
+  const f = fakeFs('EBUSY');
+  let thrown = null;
+  try { unlinkNodeModulesLink('L', { platform: 'win32', fsImpl: f }); } catch (e) { thrown = e.code; }
+  eq(thrown, 'EBUSY');
+  eqArr(f.calls, [['unlink', 'L']]);
+});
+
+test('unlinkNodeModulesLink refuses a REAL directory and leaves it intact', () => {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'wt-helper-test-'));
+  try {
+    const real = path.join(base, 'node_modules');
+    fs.mkdirSync(real);
+    fs.writeFileSync(path.join(real, 'canary.txt'), 'x');
+    let threw = false;
+    try { unlinkNodeModulesLink(real); } catch (_) { threw = true; }
+    eq(threw, true, 'a real dir is refused');
+    eq(fs.existsSync(path.join(real, 'canary.txt')), true, 'its contents survive');
+  } finally {
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+});
+
 // ---- 3. removalPlan — junction-first ordering is the whole point ----
 
 test('junction node_modules: unlink FIRST, then git worktree remove', () => {