@bongos/core 1.21.117 → 1.21.119

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.117",
-  "core_contract": "1.21.117",
-  "source_commit": "24f86969a6ea67bd13ceaa3e1a6b4193a717de4e",
+  "core_version": "1.21.119",
+  "core_contract": "1.21.119",
+  "source_commit": "e45da330efcf6e68ae4775165b5025cbb4903372",
   "source_ref": "HEAD",
-  "built_at": "2026-10-14T10:20:16.439Z",
+  "built_at": "2026-10-14T13:43:35.449Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 604,
+    "docs_redacted": 605,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3113,
+    "functional_verbatim": 3116,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3746,
-  "tree_sha256": "a7996793fd481f433e052680171e0844fa40b4f7bd34e9a5533bba236e3979bc",
+  "file_count": 3750,
+  "tree_sha256": "ab4ca3dcbd21d9cc55a93db106532caca2363b955e5c205e9f69d3992547742e",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1927,7 +1927,7 @@
     {
       "path": "docs/adr/0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md",
       "mode": "0000644",
-      "sha256": "fb72a972f472cfea4c214dc73c7c5e811670d4eb2bbbc8d397495c8756daa625"
+      "sha256": "116ff65c499cbf91e5f872b63ef37d9fb1c68a171e3649232e8bd2da28311d51"
     },
     {
       "path": "docs/adr/0294-cli-sessions-do-not-expire.md",
@@ -2364,10 +2364,15 @@
       "mode": "0000644",
       "sha256": "3615157fc3eeeb2dca5136f33fde3a19c2b603cfc26dc25de82a02719346f2f4"
     },
+    {
+      "path": "docs/adr/0381-the-hub-moves-each-hosted-project-by-its-update-rule.md",
+      "mode": "0000644",
+      "sha256": "12602b29d3a701e7ad1e6c411f7cbf6de3c3148b9c08624b6197968de8079c5f"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "b3329d0ba7a95583b785b010e123f4a8ccaf593c645d6802d3ba5a2bf23b70e8"
+      "sha256": "6d2a97e2c7ce557aad5e82dd02c529dc05f0bdf6c014df9a812d3e65c7216763"
     },
     {
       "path": "docs/api-reference.md",
@@ -2402,12 +2407,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "5faccb2629a8dde143bf9ca0e8c517dbb498a77825b2e947c9c01b37b6d0edd9"
+      "sha256": "32112bc332f327d446a1a066fc4036a916ca7e1a021202d4c07f468973910697"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "5d239ce9856df53342344b750e07b4d8d74b634c4d10e05c9aed4f9210825a35"
+      "sha256": "50acc9b093e07c52ee9fc4b31a3e69c5ae6bc73c00530c71fc4a81c6f6aca727"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2917,7 +2922,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d8e108772dbf146ba2c2a7bc345e62c49564629e17f7ff1f155cf9bc8aa1a19b"
+      "sha256": "9273e8ea9033856fb3df24625de22515aa4129046a17c41c65bc5d3f71ec8e24"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3007,7 +3012,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "ed3f0e2bb4fbebc9dad91c09c656620095101b61d4a0693df519281786efefd1"
+      "sha256": "03476cabc2dae58cf07f00b17125cfaca03a5de921359c8a6e14e540cb40d2ce"
     },
     {
       "path": "docs/project-context.template.md",
@@ -3172,7 +3177,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "6a6dde2f442d101c4f84a24d3ec44196c1b5b0dfe71e55e980defc9aec082068"
+      "sha256": "644da54bb231559bff762350dd10a45e1fa91c516853111757e50321de1a061d"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -5752,7 +5757,7 @@
     {
       "path": "modules/hall-ui/public/deploy.js",
       "mode": "0000644",
-      "sha256": "2dd86dbafbaa97bfbca3ab457dc8845b788b36af3657442d28e24cb02fcbcc5b"
+      "sha256": "054270fdc5aac397498b9fb412025347ccb1c985fbb7b0a113bed636a20234ec"
     },
     {
       "path": "modules/hall-ui/public/deploy.states.json",
@@ -10462,12 +10467,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0ace635f24556f8dcafe05047ac751909d9059cecc2a69a0870e4bfa317265df"
+      "sha256": "6469337696b64177fd52f7466f9ac81a7944f2095f16b3d0f7689569038efd02"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "38e0e4baa27d16b52a5e5b5ec1a142ed61c2d096b07df5ef684a33ad81e14143"
+      "sha256": "90f1c32901b1026f763dc05ee48aa2e1a6aa09727fbe360f49fbb4d21e5126a6"
     },
     {
       "path": "public-docs/index.html",
@@ -10487,7 +10492,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "4b3698521da6c1ef14a15c8e3ee3a42f6f7532c4db9f6a9cf40c0e9cd77c4d3e"
+      "sha256": "ef8c6938bb9e62be346bd1a44b2a590a7ff503bbbc0b44fc7ad2a4d112e96910"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11494,6 +11499,11 @@
       "mode": "0000644",
       "sha256": "65bb758becd002ae830a8338ec6ba0bc21ec5ef91ad564c85a2a94b7ab6ffbbc"
     },
+    {
+      "path": "scripts/gds/provision-auto-upgrade.js",
+      "mode": "0000644",
+      "sha256": "73448d6c9ee02f1300e71cc4ed752c32e120a4f08621413164674a962fce8176"
+    },
     {
       "path": "scripts/gds/provision-byo-host.js",
       "mode": "0000644",
@@ -11562,7 +11572,7 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "a52e17d4341c7498d9fc204bfaa7447305a19924e8e05f0fde10583eb1f0a6da"
+      "sha256": "d8c873365cf8f32c9c5eaac6c5cae11126f6e4c786d57eea515714730a31d774"
     },
     {
       "path": "scripts/gds/provision-teardown.js",
@@ -11577,7 +11587,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "772a2586d3601723f096f74f9d8aad82d418c5dce4dc9cb8809525ecd4a005ba"
+      "sha256": "ff2d4e3576942d20056d11236dc13481a8ef560fa9828b691b30ba3758203048"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -11732,7 +11742,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "e9324b2fe5b23acb8b45723ba7d11d708cbdf92b63e70d0387246eb6fd1a5ac9"
+      "sha256": "d6d81c3bb8017122cb6b5a46355b637f7986ec324132bcd583f0c02d2725b6d0"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -12242,7 +12252,7 @@
     {
       "path": "scripts/gds/upgrade-outcome.js",
       "mode": "0000644",
-      "sha256": "199eda583c51bdeb467cc9d84281c9762942e0aa4cb7e76f916fcd18093c06d2"
+      "sha256": "bce74ee06baafe627b418cacd9bbd07eed3760700c98f32630752eed0f358e72"
     },
     {
       "path": "scripts/gds/upgrade.js",
@@ -12277,7 +12287,7 @@
     {
       "path": "scripts/gds/wedge-remedy.js",
       "mode": "0000644",
-      "sha256": "611a04666351d8efc7ac5f32a5fef3e846bb087c3397ffd6e3c15a9d9a8dbacb"
+      "sha256": "f842c89729e74b1b7cb9bf647d4fdb0db9959ed41303077d1790cb28a78ca104"
     },
     {
       "path": "scripts/gds/worktree-claim-guard.js",
@@ -12792,7 +12802,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ad17db745ec1ff7924bd9b01437ae13fa716bd9738b8ac57dceeaa8f591ea2d7"
+      "sha256": "9d6d6c4c7cbec83c8655f8299d3700b0810cb2d6e0cf5b7a06757e33cd756263"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13799,6 +13809,11 @@
       "mode": "0000644",
       "sha256": "72880fa2f4217ee7cab6a5845a0f5c94a5faf22241583b6749c440bb8fc6c6f3"
     },
+    {
+      "path": "tests/core_auto_upgrade.mjs",
+      "mode": "0000644",
+      "sha256": "a3cf352d5dc340b453b22513c28d8c0a439526862535f51f84b7aea2161c734f"
+    },
     {
       "path": "tests/core_update_banner.mjs",
       "mode": "0000644",
@@ -13989,6 +14004,11 @@
       "mode": "0000644",
       "sha256": "4ee5d0ca5117ebc8a50eb5e49d6c4c47987c4c6de4553e59f5e0531a52a7c041"
     },
+    {
+      "path": "tests/db_ownership_handover.mjs",
+      "mode": "0000644",
+      "sha256": "8a758dbdaebf69b5a4ba811a49058fac3e98cae68dbafa674b287ff26c4f3b39"
+    },
     {
       "path": "tests/dead_deps.mjs",
       "mode": "0000644",
@@ -15612,7 +15632,7 @@
     {
       "path": "tests/hub_profile_leak.mjs",
       "mode": "0000644",
-      "sha256": "e9609a8adad0c460c24db69211f02beef3699e3e841d44c1385105c4f5c93385"
+      "sha256": "298afa1c71a485c3c64d90a3976c1a7147f1e888a9362a84502d5a9a94611d56"
     },
     {
       "path": "tests/hub_recent_ships.mjs",
@@ -17037,7 +17057,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "71ea3289a3007e08249cfb309272208c6ec740d7345d8fbf9638e81b6ece5010"
+      "sha256": "2c31c74c71147c5fe96beb8e6a53f8793ea3f42870512a6005f43df7c6fb5382"
     },
     {
       "path": "tests/provision_account_identity.mjs",
@@ -18522,7 +18542,7 @@
     {
       "path": "tests/upgrade_migrate.mjs",
       "mode": "0000644",
-      "sha256": "7f9ca799ee14a5b501ed8446e682d67c43c132738c047ba8752e3f20bda3d030"
+      "sha256": "ceaebfb9bd0a20e4aec695ae8cddcd5a3ddcfe45ebc6772bc0352a257c3d77ab"
     },
     {
       "path": "tests/upgrade_operator.mjs",
@@ -18652,7 +18672,7 @@
     {
       "path": "tests/wedge_remedy.mjs",
       "mode": "0000644",
-      "sha256": "dfb1683e7654269be0c92fce88954aa25146027373581d3b8bfcc6fbdf11f2b0"
+      "sha256": "72540ade635a0328ae188da1d7e18061f665e563d3f3ed8a73ed9165b2e77b77"
     },
     {
       "path": "tests/wizard_born_first_board.mjs",

package/docs/adr/0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md

@@ -121,4 +121,5 @@ reused unchanged; this decision is only about what the *control* believes and di
   guard makes the leg a no-op when the box already serves the target.
 - **What this does not do:** it does not make deploys automatic. ADR 0137's three gates
   stand — land, release, deploy — and this only gives the third gate a handle. An owner who
-  never presses it ships nothing, exactly as today.
+  never presses it ships nothing, exactly as today. *(Amended by [ADR 0381](0381-the-hub-moves-each-hosted-project-by-its-update-rule.md),
+  2026-10-14: the hub now queues released moves for hosted projects by their update rule.)*

package/docs/adr/0381-the-hub-moves-each-hosted-project-by-its-update-rule.md

@@ -0,0 +1,34 @@
+# 0381 — The hub moves each hosted project's core on its own, by that project's update rule
+
+- **Status:** Accepted
+- **Date:** 2026-10-14
+- **Task:** [task 1004729](https://cloudbongos.com/builders#/task/1004729) (goal 1000090)
+- **Decided by:** the owner (2026-10-14): "projects need to be able to upgrade on their own"
+- **Amends:** [ADR 0293](0293-the-owners-deploy-door-is-an-intent-the-control-plane-drains.md) — its "it does not make deploys automatic", for hosted projects only
+- **Related:** 0357 (the update rule set on /deploy), 0360 / 0361 (projects follow releases), 0137 / 0161 (the publish gates)
+
+## Context
+
+Every runner tick, `snapshotAllCoreVersions` works out `recommended` for each active hosted project (`cloud-host`) under its own update rule, then stops. A move happened only when someone pressed the button on /deploy. The other path, `update-sweep.js`, reads a hand-kept roster that provisioning never writes. So toast (rule `patch`) sat on 1.21.20 for 11 days while 1.21.69 was released. The update rule is already the owner's answer to "do you take updates" (`pinned` never moves; `patch` / `minor` move within their bound; tenants take released versions only), so nothing was acting on a decision that had already been made.
+
+## Decision
+
+**D1 — The hub runner queues the move itself, after each snapshot** (`scripts/gds/provision-auto-upgrade.js`, called from `cmdRunIntents` on an `--apply` tick). It uses the same two steps the button uses. For an active `cloud-host` whose `recommended` is newer than what it serves, whose rule is not `pinned`, and with no open intent:
+1. no preflight has passed for that exact target → queue `core-upgrade-preflight` for `recommended`;
+2. the stored preflight PASSED for that target → queue `core-upgrade` to it.
+
+**D2 — Through the existing intent queue.** Every automatic intent goes through `provisioning.enqueueIntent` with `requested_by = 'runner:auto-upgrade'`, as the runner's own reconcile does. The control-plane guard and the single-open-intent slot apply, and /deploy shows these moves like any other. The `control-plane` row is never moved automatically; the platform's own core moves when its owner presses the button.
+
+**D3 — Paced.** At most `AUTO_MOVES_PER_TICK` (1) automatic intents are created per tick across all projects, so a release never restarts every project at once. An intent that lost a race for the slot does not spend the pace.
+
+**D4 — A target that already failed is held.** A passing preflight does not run migrations (toast's 1.21.115 passed its preflight and failed at migrate). So a target is never queued again for an instance that already has, for that target: a `core-upgrade` that ended (error, or done with the box still behind), a preflight intent that errored, or a stored preflight verdict that refused. A newer release is a new target. This reads the existing intent and snapshot rows; there is no new table. Telling the project owner about a hold, and releasing it, is [task 1004730](https://cloudbongos.com/builders#/task/1004730).
+
+**D5 — One platform-wide off switch.** `BONGOS_AUTO_CORE_UPGRADE` (read with `resolveEnv('AUTO_CORE_UPGRADE')`, so `<PREFIX>_AUTO_CORE_UPGRADE` on a re-prefixed hub) in the runner's environment. Unset means **on**. `off` / `0` / `false` / `no` / `disabled` stops every automatic move. Set it in the runner unit's environment (a systemd drop-in) on the hub. The per-project `pinned` rule stays the project-level off switch.
+
+## Consequences
+
+- ADR 0293's "it does not make deploys automatic" no longer holds for hosted projects. The gates before it still stand: a project only moves to a version the owner has **released** (ADR 0361), within its rule.
+- Every existing hosted project benefits on the hub's next tick, whatever core it runs, because the step lives on the hub runner.
+- For hosted projects this replaces the hand-kept roster in `config/update-subscriptions.json`. The roster still matters for installs the hub does not run (task 1004150).
+- The automatic move carries no builder id, so its `core_upgrades` ledger row has no `--requested-by`; the intent row says `runner:auto-upgrade`.
+- Rejected: dry-running every behind project every tick (ADR 0293's reason stands: one preflight per target, cached); moving without a preflight; a new settings table for the switch (an env var is the cheapest hub-side toggle and needs no migration).

package/docs/adr/README.md

@@ -499,3 +499,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0378 | [**A Lead's build-outs are rows on the record, built at once or by a passed vote** ([task 1004711](https://cloudbongos.com/builders#/task/1004711), goal 1000111). **D1:** `government_buildouts` (government_030): one row per committee room, floor, annex or district, never edited. **D2:** `POST /government/buildouts`: only the building's holder; build-rights says at once (written now, with its ground) or a vote (a `build_out` matter through `openMatter`). **D3:** the vote sits under the board unless the building has its own sitting; a district and the Charter always the board. **D4:** a passed vote builds once; the trigger refuses anything else. **D5:** `GET /government/leads` carries each building's `structure`. **D6:** the hall draws the real site, ghost and tally, and the vote picture from the real building.](0378-a-leads-build-outs-are-rows-built-at-once-or-by-a-passed-vote.md) | government / leads / city |
 | 0379 | [**The treasury is pots per goal, a reserve, and borrowing, over real spend** ([task 1004712](https://cloudbongos.com/builders#/task/1004712), goal 1000111). **D1:** spend is cost_log through each task's goal, this month, read every time. **D2:** a pot is a budget the Treasury's holder gives a goal (`government_pots`, government_031). **D3:** the reserve is last month's spend no pot was given, less loans; it may be overdrawn. **D4:** a dry pot files a borrow (poller), its ask stored on `treasury_spending:<id>` and routed to the Treasury. **D5:** answered once (lend, half, no) by its seat. **D6:** the spend cap is a project setting, off by default. **D7:** the docket source and the hall's pots, reserve, beacon and book are real.](0379-the-treasury-is-pots-per-goal-a-reserve-and-borrowing-over-real-spend.md) | government / treasury / city |
 | 0380 | [**A strictness preset is a bundle of laws, switched by one laws vote and read from the laws in force** ([task 1004715](https://cloudbongos.com/builders#/task/1004715), goal 1000111). **D1:** Open workshop, Guild, Factory are catalogues of laws in `presets.js`; every lock names a stored personal setting. **D2:** a switch is ONE laws amendment through `board.proposeLaws` (`POST /government/board/presets`); only its passing writes. **D3:** the preset in force is read from the laws in force, never stored; nothing is seeded. **D4:** `GET /government/presets` says what each would lock; My agents and the Charter are real.](0380-a-strictness-preset-is-a-bundle-of-laws-switched-by-one-laws-vote.md) | government / laws / my agents |
+| 0381 | [**The hub moves each hosted project's core on its own, by that project's update rule** ([task 1004729](https://cloudbongos.com/builders#/task/1004729), goal 1000090). Amends ADR 0293's "not automatic" for hosted projects. **D1:** after each snapshot the runner queues a preflight for `recommended`, then the move once that preflight passed. **D2:** through `enqueueIntent` as `runner:auto-upgrade`; never the control-plane row. **D3:** one automatic intent per tick. **D4:** a target that already failed or was refused is held (read from existing rows; task 1004730 is the richer hold). **D5:** `BONGOS_AUTO_CORE_UPGRADE=off` stops it platform-wide; default on; `pinned` is the per-project switch.](0381-the-hub-moves-each-hosted-project-by-its-update-rule.md) | provisioning / core upgrade / automation |