@bongos/core 1.21.117 → 1.21.118

package/docs/copy-registry.json

@@ -824,8 +824,8 @@
       "text": "Allow new releases and move to {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:254",
-        "modules/hall-ui/public/deploy.js:682"
+        "modules/hall-ui/public/deploy.js:257",
+        "modules/hall-ui/public/deploy.js:685"
       ]
     },
     {
@@ -1494,8 +1494,8 @@
       "text": "Move to {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:566",
-        "modules/hall-ui/public/deploy.js:728"
+        "modules/hall-ui/public/deploy.js:569",
+        "modules/hall-ui/public/deploy.js:731"
       ]
     },
     {
@@ -2084,8 +2084,8 @@
       "text": "Waiting to try core {…} again at {…}.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/deploy.js:214",
-        "modules/hall-ui/public/deploy.js:217"
+        "modules/hall-ui/public/deploy.js:217",
+        "modules/hall-ui/public/deploy.js:220"
       ]
     },
     {
@@ -2679,7 +2679,7 @@
       "surface": "builders-hall",
       "text": "(checked {…})",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 462,
+      "line": 465,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3003,7 +3003,7 @@
       "surface": "builders-hall",
       "text": "A known snag stopped the move to core {…}:",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 211,
+      "line": 214,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3021,7 +3021,7 @@
       "surface": "builders-hall",
       "text": "A move to core {…} failed{…} — this project has moved on since, and is serving {…} now. Whatever stopped that one may or may not still apply; the check above is the live answer.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 371,
+      "line": 374,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3381,7 +3381,7 @@
       "surface": "builders-hall",
       "text": "Allow new releases and move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 254,
+      "line": 257,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3390,7 +3390,7 @@
       "surface": "builders-hall",
       "text": "Allow new releases and move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 682,
+      "line": 685,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3426,7 +3426,7 @@
       "surface": "builders-hall",
       "text": "An earlier attempt did not land.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 371,
+      "line": 374,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4200,7 +4200,7 @@
       "surface": "builders-hall",
       "text": "Change to",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 299,
+      "line": 302,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4254,7 +4254,7 @@
       "surface": "builders-hall",
       "text": "Changing the rule…",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 676,
+      "line": 679,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -4308,7 +4308,7 @@
       "surface": "builders-hall",
       "text": "Checked against {…} — nothing blocks this move.{…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 465,
+      "line": 468,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4344,7 +4344,7 @@
       "surface": "builders-hall",
       "text": "Checking what this would do, and what it would bring in. The answer comes from the machine itself, so it can take a couple of minutes.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 454,
+      "line": 457,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5289,7 +5289,7 @@
       "surface": "builders-hall",
       "text": "Could not read this project's deploy state: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 621,
+      "line": 624,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5298,7 +5298,7 @@
       "surface": "builders-hall",
       "text": "Could not read what this would bring in: {…}. The check below still applies.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 539,
+      "line": 542,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5766,7 +5766,7 @@
       "surface": "builders-hall",
       "text": "Database behind.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 584,
+      "line": 587,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7620,7 +7620,7 @@
       "surface": "builders-hall",
       "text": "If you own this project,",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 421,
+      "line": 424,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8682,7 +8682,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 566,
+      "line": 569,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8691,7 +8691,7 @@
       "surface": "builders-hall",
       "text": "Move to {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 728,
+      "line": 731,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -8700,7 +8700,7 @@
       "surface": "builders-hall",
       "text": "Moved {…}, and the box confirmed it. The project’s repository on GitHub still names the old core, so changes pushed there may not reach the live site until the two match.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 387,
+      "line": 390,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8709,7 +8709,7 @@
       "surface": "builders-hall",
       "text": "Moving to core",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 335,
+      "line": 338,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9177,7 +9177,7 @@
       "surface": "builders-hall",
       "text": "No running box to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 705,
+      "line": 708,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9222,7 +9222,7 @@
       "surface": "builders-hall",
       "text": "No shipped work is recorded between core {…} and {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 546,
+      "line": 549,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9447,7 +9447,7 @@
       "surface": "builders-hall",
       "text": "Not checked yet — the runner takes this reading on its own tick.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 460,
+      "line": 463,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9744,7 +9744,7 @@
       "surface": "builders-hall",
       "text": "Nothing newer is published that this box can take. There is nothing to deploy.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 601,
+      "line": 604,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9798,7 +9798,7 @@
       "surface": "builders-hall",
       "text": "Now running core {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 397,
+      "line": 400,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9807,7 +9807,7 @@
       "surface": "builders-hall",
       "text": "Now running core {…} — but GitHub was not updated.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 387,
+      "line": 390,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11670,7 +11670,7 @@
       "surface": "builders-hall",
       "text": "Save rule",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 299,
+      "line": 302,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11886,7 +11886,7 @@
       "surface": "builders-hall",
       "text": "See what would change",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 427,
+      "line": 430,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11985,7 +11985,7 @@
       "surface": "builders-hall",
       "text": "Serving {…} — read from the box itself, {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 604,
+      "line": 607,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12714,7 +12714,7 @@
       "surface": "builders-hall",
       "text": "Still working on core {…}. It keeps going without this page — reload to see where it got to.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 766,
+      "line": 769,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -13065,7 +13065,7 @@
       "surface": "builders-hall",
       "text": "Technical detail — what the upgrade said",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 367,
+      "line": 370,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14037,7 +14037,7 @@
       "surface": "builders-hall",
       "text": "The upgrade checked {…} and refused:{…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 470,
+      "line": 473,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14424,7 +14424,7 @@
       "surface": "builders-hall",
       "text": "This project's code expects {…} database change{…} that its database has not applied yet. Anything that relies on {…} may fail until the migrations run.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 584,
+      "line": 587,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14433,7 +14433,7 @@
       "surface": "builders-hall",
       "text": "This restarts {…} onto core",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 566,
+      "line": 569,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14505,7 +14505,7 @@
       "surface": "builders-hall",
       "text": "This would fail.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 470,
+      "line": 473,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14559,7 +14559,7 @@
       "surface": "builders-hall",
       "text": "Try again",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 270,
+      "line": 273,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14568,7 +14568,7 @@
       "surface": "builders-hall",
       "text": "Try now",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 219,
+      "line": 222,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14775,7 +14775,7 @@
       "surface": "builders-hall",
       "text": "Update rule: {…}",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 299,
+      "line": 302,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14955,7 +14955,7 @@
       "surface": "builders-hall",
       "text": "Waiting to try core {…} again at {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 214,
+      "line": 217,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -14964,7 +14964,7 @@
       "surface": "builders-hall",
       "text": "Waiting to try core {…} again at {…}.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 217,
+      "line": 220,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15243,7 +15243,7 @@
       "surface": "builders-hall",
       "text": "What this brings in",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 555,
+      "line": 558,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15711,7 +15711,7 @@
       "surface": "builders-hall",
       "text": "You can still press Move — the runner will refuse it the same way, and the box is left where it is.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 470,
+      "line": 473,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -16260,7 +16260,7 @@
       "surface": "builders-hall",
       "text": "access: the hub keeps a key of its own for this repository, so this change and every later upgrade are saved to GitHub without asking you again.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 421,
+      "line": 424,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17097,7 +17097,7 @@
       "surface": "builders-hall",
       "text": "is published and this box is not on it yet.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 427,
+      "line": 430,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17673,7 +17673,7 @@
       "surface": "builders-hall",
       "text": "reads the control plane's own observation · ADR 0293 · every move is recorded with who asked",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 709,
+      "line": 712,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17682,7 +17682,7 @@
       "surface": "builders-hall",
       "text": "reconnect GitHub with repository access",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 421,
+      "line": 424,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18213,7 +18213,7 @@
       "surface": "builders-hall",
       "text": "the owner’s blockers",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 231,
+      "line": 234,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -18825,7 +18825,7 @@
       "surface": "builders-hall",
       "text": "{…} Nothing needs doing — this page shows the result when it lands.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 219,
+      "line": 222,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19464,7 +19464,7 @@
       "surface": "builders-hall",
       "text": "— moved {…}, and the box confirmed it.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 397,
+      "line": 400,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19554,7 +19554,7 @@
       "surface": "builders-hall",
       "text": "— {…} {…} of work landed between core {…} and {…}{…}:",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 555,
+      "line": 558,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19572,7 +19572,7 @@
       "surface": "builders-hall",
       "text": "— {…}. The project restarts as part of this, and puts itself back on {…} if the new core does not answer. This page is watching and will say when it lands.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 335,
+      "line": 338,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -19599,7 +19599,7 @@
       "surface": "builders-hall",
       "text": "…and {…} more, not listed.",
       "file": "modules/hall-ui/public/deploy.js",
-      "line": 553,
+      "line": 556,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3071,5 +3071,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.115 with no explicit bump. run 38545604578. (task 1002620)
   1.21.117 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.116 with no explicit bump. run 38548762428. (task 1002620)
+  1.21.118 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.117 with no explicit bump. run 38552002742. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -485,7 +485,7 @@
       "surface": "builders",
       "title": "Deploy",
       "states_read": ["work","out"],
-      "files_hash": "e556930736d4e0b1",
+      "files_hash": "0ee68606fee144a2",
       "reading_hash": "ba271ca64d71e7b3",
       "counts": {"lines":19,"placed":5,"shared":8,"unplaced":6},
       "omitted": {"data":3},

package/docs/recipes/upgrading-the-core.md

@@ -101,6 +101,8 @@ A **major** is never automatic; prereleases are never auto-targeted.
 
 An instance that follows releases and whose `latest` label cannot be read is **skipped**, never upgraded on a guess. Once merges publish as candidates (task 1004298, [ADR 0361](../adr/0361-merges-publish-as-candidates-release-decides-what-others-are-offered.md), switched on by the repo variable `PUBLISH_AS_CANDIDATE=1`), `latest` moves only when the owner presses **Release** on /deploy, and the two follows part. Until that variable is set, `latest` is the newest version and they pick the same target. Set the platform's own entry to `"follow": "candidates"` **before** setting it, or the platform stops taking new versions the moment it is set. The platform's runner for hosted projects needs no roster entry: the `control-plane` row follows candidates and every other project follows releases.
 
+**Hosted projects move on their own** (task [1004729](https://cloudbongos.com/builders#/task/1004729), [ADR 0381](../adr/0381-the-hub-moves-each-hosted-project-by-its-update-rule.md)). Before that task, the hub only *worked out* each hosted project's target every tick; nothing moved until someone pressed the button on /deploy. Now, after each snapshot, the hub runner queues a pre-flight check for the target, then the move once that check passes, for every `cloud-host` project whose rule is not `pinned`. It queues one automatic step per tick across all projects, and never re-queues a version that already failed or was refused for that project. The platform's own hall (`control-plane`) is never moved automatically. To stop every automatic move, set `BONGOS_AUTO_CORE_UPGRADE=off` in the hub runner's environment (unset means on); to stop one project, set its rule to `pinned`. These moves show on /deploy as requested by `runner:auto-upgrade`.
+
 **Crossing a minor from /deploy** (task [1004405](https://cloudbongos.com/builders#/task/1004405)): set the project's update rule to **Fixes and new releases** (`minor`), or press **Allow new releases and move** on the refused move — either is the explicit "this crosses a minor version" choice. That only works once the box runs a core whose runner reads the rule (core 1.20.29 or later, task [1004445](https://cloudbongos.com/builders#/task/1004445)). A box on anything older runs the old runner, which bounds every move to `patch` whatever the rule says, so its **first** crossing is the manual `upgrade.js --to <version>` above; every later one goes through /deploy.
 
 **Where the channel comes from** ([ADR 0357](../adr/0357-the-update-rule-set-on-deploy-is-the-one-the-sweep-follows.md), task [1004468](https://cloudbongos.com/builders#/task/1004468)): the rule set on **/deploy** (`provisioning_instances.update_channel`) wins for any roster entry whose `slug` matches a project row. The roster's `channel` below is only the fallback, used when no row matches or the sweep can't read the database. The sweep reads the control plane's DB from `UPDATE_CHANNEL_DB` (a db name or connection string), else `DATABASE_URL` / `PGDATABASE`. On a control plane, set `UPDATE_CHANNEL_DB`, never `PGDATABASE`: the sweep's env reaches every upgrade it spawns, so a tenant entry with no database of its own would migrate against the control plane's. Every run prints each entry's channel and its source.
@@ -223,7 +225,7 @@ running a go-live.
 
 ## Gotchas
 
-- **The Deploy door fixes three known snags by itself, once** (task 1004448, `scripts/gds/wedge-remedy.js`). When a core move through `/deploy` fails on a **dirty tree** (it commits the tracked changes inside the project), a **full disk** (it prunes that project's own nightly dumps down to the newest 7) or a **database behind its code** (it migrates that database with its own `PGDATABASE` before the code moves), the runner applies the fix, records a `core-upgrade-remedy` event on the project, and tries the move once more on the next tick. If the retry fails for the same reason, or the fix itself fails, the move is retired as `unknown` (`remedy_did_not_hold` / `remedy_failed`) for a person — never a second fix. The manual fixes below still apply to the unattended nightly sweep, which does not go through the door.
+- **The Deploy door fixes four known snags by itself, once** (task 1004448, `scripts/gds/wedge-remedy.js`). When a core move through `/deploy` fails on a **dirty tree** (it commits the tracked changes inside the project), a **full disk** (it prunes that project's own nightly dumps down to the newest 7) a **database behind its code** (it migrates that database with its own `PGDATABASE` before the code moves) or a migration refused with **`must be owner of`** (a project with its own database account whose tables postgres made at provisioning — it hands that project's schema to its account as postgres, task 1004735; projects provisioned since get this at setup), the runner applies the fix, records a `core-upgrade-remedy` event on the project, and tries the move once more on the next tick. If the retry fails for the same reason, or the fix itself fails, the move is retired as `unknown` (`remedy_did_not_hold` / `remedy_failed`) for a person — never a second fix. The manual fixes below still apply to the unattended nightly sweep, which does not go through the door.
 - **A core move uses TWO unix accounts, and which one does what is not interchangeable** (task 1004512, `resolveRunAs` in `scripts/gds/provision-core-upgrade.js`). The move runs as the account that owns the checkout — the app user, on every hosting shape — because everything it writes lives there: the pin, `node_modules`, `.claude/`, the pin commit, and the `git status` it starts with. Only the **database** steps (identity pre-check, migrate, the ledger insert) run as the project's own `bongos-<slug>` account, handed over with `--migrate-as`; that account owns the database and `PUBLIC` has no `CONNECT`, so nothing else can reach it. The flag is emitted only when the two differ, so a control plane and a project older than ADR 0281 run the command they always did. *The symptom when this is wrong:* every move on a project with its own account fails with `fatal: detected dubious ownership in repository`, which the clean-tree pre-flight used to report as a dirty tree — the remedy below then commits a tree nobody touched and the retry fails identically. A `git status` that could not answer is now its own reason (`git_unreadable`, class `unknown`), so it goes to a person instead of to that fix. **Do not "fix" a recurrence with `safe.directory`** — git would then read the tree and the next write step would fail instead.
 - **A Deploy-door move nobody can fix files a blocker and posts to Discord — once** (task 1004449, `scripts/gds/move-escalation.js`). A move retired as `unknown` (including `remedy_did_not_hold`, `remedy_failed` and a failed rollback) files one blocker (`source=provisioning`, `source_ref=core-move:<instance id>:<intent id>`) with the reason and what the move reported, and posts one notice to `#ship-news` that names the project only if it is public. The next core move on that project that lands closes the blocker by itself and posts an all-clear. Refusals the owner can act on (`needs_decision`) are shown on the deploy page instead, not filed.
 - **`--registry` needs no credential at all** (task 1003878). `@bongos/core` is **public** on npm (task 1003872), so `bongos upgrade --registry` resolves it from the default registry like any other dependency — no token, no login, and no instance `.npmrc`. An install failure on this path is therefore a *real* failure (network, registry outage, or a version that was never published), never a missing credential.

package/modules/hall-ui/public/deploy.js

@@ -158,6 +158,8 @@
     migrate: 'updating the project’s database failed',
     // task 1004734: the new core adds a rule some of the project's existing records break
     migrate_check_violation: 'updating the project’s database failed: some records the project already has break a rule the new core adds',
+    // task 1004735: the project's tables were set up under another account, so its own could not change them
+    migrate_not_owner: 'updating the project’s database failed: its tables were set up under a different account than the one updating them',
     restart: 'the project would not restart',
     rollback_failed: 'the new core failed, and putting the old one back failed too',
     no_target: 'the move did not say which version to go to',
@@ -177,6 +179,7 @@
     dirty_tree: 'saved those changes',
     disk_full: 'cleared out old backups',
     schema_pending: 'brought the database up to date',
+    migrate_not_owner: 'handed the project’s tables to the project’s own account',
   };
 
   // A pending move whose next try is in the FUTURE is waiting out a retry, not moving. The

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.117",
+  "version": "1.21.118",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.117",
+      "version": "1.21.118",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.117",
+  "version": "1.21.118",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9680,5 +9680,15 @@
       "id": "1004737",
       "text": "Projects that install Cloud Bongos from npm can run the project health check again: it now says plainly that those checks belong to Cloud Bongos itself and skips them, instead of crashing."
     }
+  ],
+  "1.21.118": [
+    {
+      "id": "1004735",
+      "text": "Projects with their own database account no longer fail updates that change an existing table: new projects are set up correctly, and older ones fix themselves automatically on their next update."
+    },
+    {
+      "id": "1004729",
+      "text": "Hosted projects now take released core updates on their own, one at a time, by each project's update rule (pinned projects never move), with a platform-wide off switch."
+    }
   ]
 }