@bongos/core 1.17.0

package/tests/publish_reconciler.mjs

@@ -0,0 +1,728 @@
+// tests/publish_reconciler.mjs
+//
+// Unit tests for the server-owned publish reconciler (task 1134) — the durable
+// cure for the "strands at confirmed" class. A server-mediated publish (ADR 0055)
+// is async; ship.js stops polling after ~9 min, so the confirmed→shipped flip had
+// no driver once the box exited. This module sweeps confirmed tasks on a timer and
+// runs the EXACT shipTask + postShipBroadcast the publish-status route runs.
+//
+// runSweep is pure w.r.t. injected deps (db / githubPush / emit / loggers)
+// — no DB, no network — so this runs in the DB-free unit gate.
+//
+// Run:  node tests/publish_reconciler.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  Promise.resolve()
+    .then(fn)
+    .then(() => {
+      passed++;
+      console.log(`  ok  ${name}`);
+    })
+    .catch((err) => {
+      failed++;
+      console.log(`  FAIL ${name}`);
+      console.log(`     ${err.message}`);
+    });
+}
+
+// A LANDED status (merged + deploy succeeded). Mirrors getPublishStatus's shape.
+const LANDED = { pr_state: 'closed', merged: true, merge_sha: 'abc1234deadbeef', deploy_status: 'success' };
+const PENDING = { pr_state: 'open', merged: false, merge_sha: null, deploy_status: 'pending' };
+const NONE = { pr_state: 'none', merged: false, merge_sha: null, deploy_status: 'none' };
+
+// task 1547 fixtures: sha-shaped published tips scripted on/off main via ancestryBySha.
+const ON_MAIN = 'a'.repeat(40);
+const NOT_ON_MAIN = 'b'.repeat(40);
+// A LANDED status whose matched PR references task `id` in its server-generated body
+// (the no-published-tip fallback path).
+const landedPrFor = (id) => ({ ...LANDED, pr_number: 700 + id, pr_title: `task ${id}: x`, pr_body: `for task ${id}` });
+
+// Build an injectable deps bundle with sensible defaults + recording stubs.
+function mkDeps({
+  configured = true,
+  rows = [],
+  statusByBranch = {},
+  mergeByBranch = {},
+  ancestryBySha = {},
+  shipImpl,
+  broadcastImpl,
+  conflictResolveImpl,
+  refreshStaleImpl,
+  healAttempts = new Map(),
+} = {}) {
+  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], logs: [], errors: [] };
+  const realLandConfirmed = (s) => !!s && s.merged === true && s.deploy_status === 'success';
+  // isSafeBranch mirrors github-push's pattern enough for the test (rejects
+  // option-like / traversal refs); we use the REAL module so the contract can't drift.
+  const githubPush = require('../modules/lifecycle/github-push.js');
+  return {
+    db: {
+      listConfirmedTasksForReconcile: async () => rows,
+      shipTask: shipImpl || (async ({ taskId, builderId }) => {
+        calls.ship.push({ taskId, builderId });
+        return { id: taskId, value_summary: `task ${taskId}`, security_sensitive: false };
+      }),
+    },
+    githubPush: {
+      isConfigured: () => configured,
+      isSafeBranch: githubPush.isSafeBranch,
+      landConfirmed: realLandConfirmed,
+      // Active merge driver (task 1162). Default: nothing to merge. A branch listed
+      // in mergeByBranch returns its scripted result; an Error value throws (to
+      // prove the sweep swallows a merge-driver failure and continues to land-check).
+      mergeIfGreen: async ({ branch }) => {
+        calls.merge.push(branch);
+        const m = mergeByBranch[branch];
+        if (m instanceof Error) throw m;
+        return m || { merged: false, merged_now: false, reason: 'pending' };
+      },
+      getPublishStatus: async ({ branch }) => {
+        calls.status.push(branch);
+        const s = statusByBranch[branch];
+        if (s instanceof Error) throw s;
+        return s || NONE;
+      },
+      // task 1313 head_sha land-check. Default: not on main. An Error value throws
+      // (to prove a transient compare-API miss is swallowed, leaving it for next sweep).
+      isAncestorOfDefaultBranch: async ({ sha }) => {
+        calls.ancestry.push(sha);
+        const a = ancestryBySha[sha];
+        if (a instanceof Error) throw a;
+        return !!a;
+      },
+      // task 1547 per-task land proof. Mirrors the real github-push.landProvenForTask
+      // shape but routes its ONE network hop (the ancestry compare) through the mock
+      // above so the sweep stays DB/network-free, and reuses the REAL prReferencesTask
+      // so that pure check can't drift. publishedSha (the server-pushed tip) is the
+      // robust proof; the matched-PR-references-this-task fallback covers a legacy /
+      // in-flight row with no recorded tip.
+      landProvenForTask: async ({ taskId, publishedSha, status }) => {
+        if (publishedSha && /^[0-9a-f]{7,64}$/.test(String(publishedSha))) {
+          calls.ancestry.push(publishedSha);
+          const a = ancestryBySha[publishedSha];
+          if (a instanceof Error) throw a;
+          return a
+            ? { proven: true, reason: `published tip ${publishedSha.slice(0, 8)} in main` }
+            : { proven: false, reason: `published tip ${publishedSha.slice(0, 8)} not in main` };
+        }
+        return githubPush.prReferencesTask(status, taskId)
+          ? { proven: true, reason: `matched PR references task ${taskId}` }
+          : { proven: false, reason: `no published tip and matched PR does not reference task ${taskId}` };
+      },
+    },
+    // task.shipped is emitted on the kernel seam now; the discord module's listener
+    // posts the broadcast (BV1.R47). Inject `emit` to observe it — the reconciler
+    // fires it once per shipped task on the confirmed→shipped transition. A custom
+    // broadcastImpl REPLACES the default push (the throwing-broadcast test relies
+    // on that to prove the reconcile stands even when the listener throws).
+    emit: async (event, task) => {
+      if (event !== 'task.shipped') return;
+      if (broadcastImpl) return broadcastImpl(task);
+      calls.broadcast.push(task.id);
+    },
+    // task 1385: server-side conflict resolver. Default stub is a no-op so the
+    // existing tests (no merge_conflict) never invoke the real module.
+    // task 1915: refreshStaleGenerated — the mergeable-but-stale-generated heal.
+    // Default records the call and reports no diff (a real failure), so a test that
+    // doesn't opt in never healed anything.
+    conflictResolve: {
+      resolveBranchConflicts: conflictResolveImpl || (async ({ branch }) => {
+        calls.resolve.push(branch);
+        return { resolved: false, skipped: 'unconfigured' };
+      }),
+      refreshStaleGenerated: refreshStaleImpl || (async ({ branch }) => {
+        calls.refresh.push(branch);
+        return { refreshed: false, skipped: 'no_regen_diff' };
+      }),
+    },
+    // task 1915: per-branch treadmill guard, injected so the cap is deterministic and
+    // never leaks module state across tests.
+    healAttempts,
+    log: (m) => calls.logs.push(m),
+    error: (m) => calls.errors.push(m),
+    _calls: calls,
+    _healAttempts: healAttempts,
+  };
+}
+
+// ---------------------------------------------------------------------------
+
+test('no push credential → no-op (skipped: unconfigured), never touches the DB', async () => {
+  const deps = mkDeps({ configured: false, rows: [{ task_id: 1, builder_id: 9, worktree_name: 'wt' }] });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.skipped, 'unconfigured');
+  assert.equal(r.reconciled, 0);
+  assert.equal(deps._calls.status.length, 0, 'must not call GitHub when unconfigured');
+});
+
+test('a landed branch → shipTask + broadcast fire, reconciled=1, attributed to the claim holder', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 1096, builder_id: 7, worktree_name: 't1096-helpers', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/t1096-helpers': LANDED },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1);
+  assert.deepEqual(deps._calls.ship, [{ taskId: 1096, builderId: 7 }]);
+  assert.deepEqual(deps._calls.broadcast, [1096]);
+});
+
+test('a not-yet-landed branch (open PR / pending deploy) → no ship', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 5, builder_id: 1, worktree_name: 'wt-open' }],
+    statusByBranch: { 'claude/wt-open': PENDING },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0);
+  assert.equal(deps._calls.ship.length, 0);
+  assert.equal(deps._calls.broadcast.length, 0);
+});
+
+test('merged but deploy NOT yet success → no ship (landConfirmed requires both)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 6, builder_id: 1, worktree_name: 'wt-merged-no-deploy' }],
+    statusByBranch: { 'claude/wt-merged-no-deploy': { ...LANDED, deploy_status: 'pending' } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0);
+});
+
+test('getPublishStatus throws (transient) → swallowed, sweep continues to the next task', async () => {
+  const deps = mkDeps({
+    rows: [
+      { task_id: 1, builder_id: 1, worktree_name: 'wt-bad' },
+      { task_id: 2, builder_id: 1, worktree_name: 'wt-good', published_head_sha: ON_MAIN },
+    ],
+    statusByBranch: {
+      'claude/wt-bad': new Error('GitHub 502'),
+      'claude/wt-good': LANDED,
+    },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the good task still reconciles despite the bad one throwing');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 2, builderId: 1 }]);
+});
+
+test('shipTask TASK_NOT_CONFIRMED (route/sweep race) → NOT counted as an error, no broadcast', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 3, builder_id: 1, worktree_name: 'wt-raced', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-raced': LANDED },
+    ancestryBySha: { [ON_MAIN]: true },
+    shipImpl: async () => {
+      const e = new Error('task not in confirmed state');
+      e.code = 'TASK_NOT_CONFIRMED';
+      throw e;
+    },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0);
+  assert.equal(r.errors, 0, 'an idempotent race is expected, not an error');
+  assert.equal(deps._calls.broadcast.length, 0);
+});
+
+test('shipTask throws a real error → counted in errors, sweep does not crash', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 4, builder_id: 1, worktree_name: 'wt-dberr', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-dberr': LANDED },
+    ancestryBySha: { [ON_MAIN]: true },
+    shipImpl: async () => { throw new Error('db exploded'); },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0);
+  assert.equal(r.errors, 1);
+});
+
+test('a broadcast that throws never undoes the reconcile (still counted shipped)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 8, builder_id: 2, worktree_name: 'wt-broadcast-fail', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-broadcast-fail': LANDED },
+    ancestryBySha: { [ON_MAIN]: true },
+    broadcastImpl: async () => { throw new Error('discord down'); },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the ship stands even if the broadcast throws');
+});
+
+test('ambiguous branch (2 confirmed tasks share a worktree_name) → both skipped, no mis-ship', async () => {
+  const deps = mkDeps({
+    rows: [
+      { task_id: 10, builder_id: 1, worktree_name: 'shared-wt' },
+      { task_id: 11, builder_id: 1, worktree_name: 'shared-wt' },
+    ],
+    statusByBranch: { 'claude/shared-wt': LANDED },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'ambiguous branch must not ship either task');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('a row with neither worktree_name nor a sha-shaped head_sha is a no-op', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 12, builder_id: 1, worktree_name: null, head_sha: null }],
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0);
+  assert.equal(deps._calls.status.length, 0, 'no branch → no PR lookup');
+  assert.equal(deps._calls.ancestry.length, 0, 'no sha → no ancestry lookup');
+});
+
+// --- task 1547: per-task land proof keyed on the published tip (the strand cure) ---
+
+test('PR/branch gone (pr_state none) but published tip on main → ship via ancestry, attributed to claim holder', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 1176, builder_id: 3, worktree_name: 'crazy-haslett-6af2af', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/crazy-haslett-6af2af': NONE }, // PR was deleted post-merge
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1);
+  assert.deepEqual(deps._calls.ship, [{ taskId: 1176, builderId: 3 }]);
+  assert.deepEqual(deps._calls.ancestry, [ON_MAIN]);
+});
+
+test('no worktree_name at all but published tip on main → ship via ancestry, no branch lookup', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 1273, builder_id: 1, worktree_name: null, published_head_sha: ON_MAIN }],
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1);
+  assert.equal(deps._calls.status.length, 0, 'no branch to look up');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 1273, builderId: 1 }]);
+});
+
+test('published tip NOT on main → no ship (genuinely in-flight)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 50, builder_id: 1, worktree_name: null, published_head_sha: NOT_ON_MAIN }],
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0);
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('merged PR with deploy still pending → wait, do NOT short-circuit via the tip proof', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 51, builder_id: 1, worktree_name: 'wt-deploying', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-deploying': { pr_state: 'closed', merged: true, merge_sha: 'cafe1234', deploy_status: 'pending' } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'a live PR mid-deploy governs — ship only when deploy succeeds');
+  assert.equal(deps._calls.ancestry.length, 0, 'the tip proof must not be consulted while a PR is mid-land');
+});
+
+test('corrupt published tip ("HEAD") is never sent to the compare API (would false-positive)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 1199, builder_id: 1, worktree_name: null, published_head_sha: 'HEAD' }],
+    ancestryBySha: { HEAD: true }, // even if the API would say yes, we must not ask
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0);
+  assert.equal(deps._calls.ancestry.length, 0, 'a non-sha published tip is rejected before the API call');
+});
+
+test('ambiguous branch but each task has its own on-main published tip → only the on-main one ships', async () => {
+  const deps = mkDeps({
+    rows: [
+      { task_id: 60, builder_id: 1, worktree_name: 'dup-wt', published_head_sha: ON_MAIN },
+      { task_id: 61, builder_id: 2, worktree_name: 'dup-wt', published_head_sha: NOT_ON_MAIN },
+    ],
+    ancestryBySha: { [ON_MAIN]: true, [NOT_ON_MAIN]: false },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'only the task whose own tip is on main ships; the branch ambiguity no longer blocks it');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 60, builderId: 1 }]);
+  assert.equal(deps._calls.status.length, 0, 'ambiguous branch skips the PR path entirely');
+});
+
+// --- task 1547: the branch-name-reuse false-ship this fix closes ---
+
+test('landConfirmed off a REUSED branch but the published tip is NOT in main → NO ship (the BV1.R04/R05 bug)', async () => {
+  // The branch matched an OLDER, already-merged PR (LANDED), but THIS task's own
+  // pushed tip never reached main. Pre-fix this false-shipped; now it must not.
+  const deps = mkDeps({
+    rows: [{ task_id: 1299, builder_id: 95, worktree_name: 'jovial-rosalind-84d6c3', published_head_sha: NOT_ON_MAIN }],
+    statusByBranch: { 'claude/jovial-rosalind-84d6c3': LANDED },
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'a stale merged PR on a reused branch must not ship a task whose tip is not on main');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('landConfirmed, no published tip, matched PR references THIS task → ship (legacy/in-flight fallback)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 999, builder_id: 1, worktree_name: 'wt-legacy' }], // no published_head_sha
+    statusByBranch: { 'claude/wt-legacy': landedPrFor(999) },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'a legacy land whose own PR references this task still ships');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 999, builderId: 1 }]);
+});
+
+test('landConfirmed, no published tip, matched PR references a DIFFERENT task → NO ship (branch reuse)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 1300, builder_id: 95, worktree_name: 'jovial-rosalind-84d6c3' }], // no published_head_sha
+    statusByBranch: { 'claude/jovial-rosalind-84d6c3': landedPrFor(1297) }, // the OLD task's PR
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'a reused branch matching another task\'s PR must not ship this task');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('the tip proof compare-API throws (transient) → swallowed, no ship, next sweep retries', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 70, builder_id: 1, worktree_name: null, published_head_sha: ON_MAIN }],
+    ancestryBySha: { [ON_MAIN]: new Error('GitHub 502 on compare') },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0);
+  assert.equal(r.errors, 0, 'a transient ancestry miss is not an error');
+});
+
+test('listConfirmedTasksForReconcile failure → skipped: list_failed, no crash', async () => {
+  const deps = mkDeps({});
+  deps.db.listConfirmedTasksForReconcile = async () => { throw new Error('pool down'); };
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.skipped, 'list_failed');
+  assert.equal(r.errors, 1);
+});
+
+// --- Active merge driver (task 1162) -------------------------------------
+
+test('stalled-but-green PR → server merges it (merged_now), counted in summary.merged', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 1093, builder_id: 5, worktree_name: 'romantic-austin-2ea51a' }],
+    // not merged yet at land-check (deploy hasn't run) — the merge just fired
+    statusByBranch: { 'claude/romantic-austin-2ea51a': PENDING },
+    mergeByBranch: { 'claude/romantic-austin-2ea51a': { merged: true, merged_now: true, number: 125 } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.merged, 1, 'the stalled green PR was server-merged');
+  assert.equal(r.reconciled, 0, 'no ship this sweep — deploy not yet success');
+  assert.deepEqual(deps._calls.merge, ['claude/romantic-austin-2ea51a']);
+});
+
+test('merge driver runs BEFORE the land-check, so a freshly-merged+deployed PR still ships', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 200, builder_id: 1, worktree_name: 'wt-fast', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-fast': LANDED },          // already merged + deployed
+    ancestryBySha: { [ON_MAIN]: true },
+    mergeByBranch: { 'claude/wt-fast': { merged: true, merged_now: false, number: 7 } }, // already merged → no-op
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.merged, 0, 'already-merged PR is not re-counted');
+  assert.equal(r.reconciled, 1, 'it still ships off the land-check');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 200, builderId: 1 }]);
+});
+
+test('merge driver throws → swallowed, sweep still proceeds to the land-check', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 201, builder_id: 1, worktree_name: 'wt-mergeboom', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-mergeboom': LANDED },
+    ancestryBySha: { [ON_MAIN]: true },
+    mergeByBranch: { 'claude/wt-mergeboom': new Error('GitHub 500 on merge') },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.merged, 0);
+  assert.equal(r.reconciled, 1, 'a merge-driver error never blocks an independent land');
+  assert.equal(r.errors, 0, 'a best-effort merge miss is not an error');
+});
+
+test('not-green PR → no merge, no ship (merge driver reports but does not force)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 202, builder_id: 1, worktree_name: 'wt-blocked' }],
+    statusByBranch: { 'claude/wt-blocked': PENDING },
+    mergeByBranch: { 'claude/wt-blocked': { merged: false, merged_now: false, reason: 'review_required' } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.merged, 0);
+  assert.equal(r.reconciled, 0);
+});
+
+// --- task 1366: session-cost reconcile piggybacked on the same sweep --------
+
+test('1366 runCostSweep calls db.reconcileSessionCosts and passes its counts through', async () => {
+  const calls = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => { calls.push('called'); return { scanned: 9, reconciled: 4, totalUsd: 12.5, unknownModels: [] }; } },
+    log: () => {},
+    error: () => {},
+  };
+  const r = await reconciler.runCostSweep(deps);
+  assert.equal(calls.length, 1, 'reconcileSessionCosts is invoked once');
+  assert.equal(r.reconciled, 4);
+  assert.equal(r.scanned, 9);
+});
+
+test('1366 runCostSweep swallows a reconcile error → skipped:error, never throws', async () => {
+  const errors = [];
+  const deps = {
+    db: { reconcileSessionCosts: async () => { throw new Error('pool down'); } },
+    log: () => {},
+    error: (m) => errors.push(m),
+  };
+  const r = await reconciler.runCostSweep(deps);
+  assert.equal(r.skipped, 'error', 'a reconcile failure is reported, not thrown');
+  assert.equal(errors.length, 1, 'the failure is logged to error');
+});
+
+test('1366 cost sweep is independent of the push credential (runs even when unconfigured)', async () => {
+  // The confirmed→shipped sweep no-ops without a push credential; the cost sweep
+  // is pure DB, so it must NOT inherit that gate. Proven by calling runCostSweep
+  // with a deps bundle that carries no githubPush at all.
+  let called = false;
+  const deps = { db: { reconcileSessionCosts: async () => { called = true; return { scanned: 1, reconciled: 1, totalUsd: 1, unknownModels: [] }; } }, log: () => {}, error: () => {} };
+  const r = await reconciler.runCostSweep(deps);
+  assert.equal(called, true, 'cost reconcile runs without any push-credential check');
+  assert.equal(r.reconciled, 1);
+});
+
+test('1366 runCostSweep on a db without the method → skipped:unsupported (older deps bundle)', async () => {
+  const r = await reconciler.runCostSweep({ db: {}, log: () => {}, error: () => {} });
+  assert.equal(r.skipped, 'unsupported');
+});
+
+// --- task 1385: server-side conflict auto-resolve wiring ---
+
+test('1385 PR conflicts on generated/index files only → server-resolves it (resolvedConflicts=1, not shipped this sweep)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 300, builder_id: 4, worktree_name: 'wt-300' }],
+    mergeByBranch: { 'claude/wt-300': { merged: false, merged_now: false, number: 300, reason: 'merge_conflict' } },
+    conflictResolveImpl: async ({ branch }) => ({ resolved: true, head_sha: 'newsha', branch }),
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.resolvedConflicts, 1, 'the conflict was server-resolved');
+  assert.equal(r.reconciled, 0, 'it does NOT ship this sweep — checks re-run on the new head, lands next sweep');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('1385 hand-written conflict → left for a human (resolvedConflicts=0, no error)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 301, builder_id: 4, worktree_name: 'wt-301' }],
+    mergeByBranch: { 'claude/wt-301': { merged: false, merged_now: false, number: 301, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({ resolved: false, skipped: 'unresolvable_conflict', conflicted: ['src/bongos/db.js'] }),
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.resolvedConflicts, 0);
+  assert.equal(r.errors, 0, 'an unresolvable conflict is a clean no-op, not an error');
+});
+
+test('1385 only merge_conflict triggers the resolver (a failing_check does NOT)', async () => {
+  const seen = [];
+  const deps = mkDeps({
+    rows: [{ task_id: 302, builder_id: 4, worktree_name: 'wt-302' }],
+    mergeByBranch: { 'claude/wt-302': { merged: false, merged_now: false, number: 302, reason: 'failing_check:unit' } },
+    conflictResolveImpl: async ({ branch }) => { seen.push(branch); return { resolved: true }; },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(seen.length, 0, 'the resolver is only called on a true merge conflict');
+  assert.equal(r.resolvedConflicts, 0);
+});
+
+test('1385 a resolver that throws is swallowed (best-effort) → sweep continues, counted as error-logged not crash', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 303, builder_id: 4, worktree_name: 'wt-303' }],
+    mergeByBranch: { 'claude/wt-303': { merged: false, merged_now: false, number: 303, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => { throw new Error('temp clone disk full'); },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.resolvedConflicts, 0);
+  assert.ok(deps._calls.errors.some((m) => /conflict-resolve/.test(m)), 'the failure is logged, not thrown');
+});
+
+// task 1546 / blocker 47 — observability for unprovable strands. A confirmed task
+// the sweep can't prove landed (no branch + no published tip, or land-not-proven)
+// used to be a silent `continue`. The sweep now counts it (unprovable) and, when it
+// is older than STALE_CONFIRMED_MS, WARN-logs it (staleStrands) so a credited-but-
+// unlanded task surfaces in minutes, not the 66h the blocker-47 strands sat.
+test('1546 old confirmed task with no branch + no published tip → counted unprovable + WARN-logged as a strand', async () => {
+  const old = new Date(Date.now() - 66 * 3_600_000).toISOString(); // 66h ago (blocker 47's oldest)
+  const deps = mkDeps({
+    rows: [{ task_id: 263, builder_id: 94, worktree_name: null, head_sha: null, published_head_sha: null, confirmed_at: old }],
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'nothing landed → not shipped');
+  assert.equal(r.unprovable, 1);
+  assert.equal(r.staleStrands, 1);
+  assert.ok(
+    deps._calls.errors.some((m) => /STRAND task 263/.test(m) && /no_branch_no_tip/.test(m)),
+    'a >30min unprovable confirmed task is WARN-logged with its reason'
+  );
+});
+
+test('1546 a FRESH unprovable confirmed task is counted but NOT yet WARN-logged', async () => {
+  const fresh = new Date(Date.now() - 60_000).toISOString(); // 1 min ago
+  const deps = mkDeps({
+    rows: [{ task_id: 999, builder_id: 1, worktree_name: null, head_sha: null, published_head_sha: null, confirmed_at: fresh }],
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.unprovable, 1);
+  assert.equal(r.staleStrands, 0, 'within the grace window → no strand WARN yet');
+  assert.equal(deps._calls.errors.length, 0);
+});
+
+// --- task 1915: speculative regen-heal for the clean-merge-but-stale strand ------
+
+// mergeIfGreen shape for a PR GitHub reports MERGEABLE (no conflict) but with a RED
+// check — the shape whose commonest cause is a stale generated index.
+const mergeableRed = (reason, number = 900) => ({
+  pr_state: 'open', number, merged: false, merged_now: false, mergeable: 'MERGEABLE', reason,
+});
+
+test('1915 couldBeStaleGenerated: MERGEABLE + failing_check / non_required_check_failing → true; other shapes → false', () => {
+  const p = reconciler.couldBeStaleGenerated;
+  assert.equal(p(mergeableRed('failing_check:unit')), true);
+  assert.equal(p(mergeableRed('non_required_check_failing:e2e')), true);
+  // a CONFLICTING PR is the resolveBranchConflicts path, never this one
+  assert.equal(p({ pr_state: 'open', mergeable: 'CONFLICTING', reason: 'merge_conflict' }), false);
+  // pending / computing / review-gated → leave it to settle, not a failure
+  assert.equal(p(mergeableRed('mergeability_computing')), false);
+  assert.equal(p(mergeableRed('branch_behind_base')), false);
+  assert.equal(p(mergeableRed('review_required')), false);
+  assert.equal(p({ ...mergeableRed('failing_check:unit'), merged: true }), false);
+  assert.equal(p({ ...mergeableRed('failing_check:unit'), pr_state: 'closed' }), false);
+  assert.equal(p(null), false);
+});
+
+test('1915 mergeable-but-red PR → regen-heal fires on the right branch; refreshedStale=1, NOT shipped this sweep', async () => {
+  const healedBranches = [];
+  const deps = mkDeps({
+    rows: [{ task_id: 400, builder_id: 5, worktree_name: 'wt-stale' }],
+    statusByBranch: { 'claude/wt-stale': PENDING }, // still open + pending after the push
+    mergeByBranch: { 'claude/wt-stale': mergeableRed('failing_check:unit', 616) },
+    refreshStaleImpl: async ({ branch }) => { healedBranches.push(branch); return { refreshed: true, head_sha: 'healed', branch }; },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.refreshedStale, 1, 'the stale-generated PR was regen-healed');
+  assert.deepEqual(healedBranches, ['claude/wt-stale'], 'the heal is invoked on exactly this task\'s branch');
+  assert.equal(r.reconciled, 0, 'no ship this sweep — checks re-run on the new head, lands next sweep');
+  assert.equal(deps._calls.ship.length, 0, 'the heal never ships (no phantom-ship — land still needs the tip proof)');
+});
+
+test('1915 mergeable-but-red PR where regen yields NO diff → not healed, logged as a real check failure', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 401, builder_id: 5, worktree_name: 'wt-realfail' }],
+    statusByBranch: { 'claude/wt-realfail': PENDING },
+    mergeByBranch: { 'claude/wt-realfail': mergeableRed('failing_check:unit') },
+    refreshStaleImpl: async () => ({ refreshed: false, skipped: 'no_regen_diff' }),
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.refreshedStale, 0);
+  assert.equal(r.reconciled, 0);
+  assert.ok(
+    deps._calls.logs.some((m) => /regeneration produced no diff/.test(m) && /real check failure/.test(m)),
+    'a real (non-staleness) check failure is logged, not silently retried forever'
+  );
+});
+
+test('1915 a merge_conflict PR does NOT trigger the regen-heal (it routes to resolveBranchConflicts)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 402, builder_id: 5, worktree_name: 'wt-conf' }],
+    mergeByBranch: { 'claude/wt-conf': { merged: false, merged_now: false, number: 402, mergeable: 'CONFLICTING', reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({ resolved: true, head_sha: 'x' }),
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.refresh.length, 0, 'refreshStaleGenerated is not called for a true merge conflict');
+  assert.equal(r.resolvedConflicts, 1, 'the conflict path still runs');
+});
+
+test('1915 a regen-heal that throws is swallowed (best-effort) → logged, sweep continues, refreshedStale=0', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 403, builder_id: 5, worktree_name: 'wt-boom' }],
+    statusByBranch: { 'claude/wt-boom': PENDING },
+    mergeByBranch: { 'claude/wt-boom': mergeableRed('non_required_check_failing:e2e') },
+    refreshStaleImpl: async () => { throw new Error('temp clone disk full'); },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.refreshedStale, 0);
+  assert.ok(deps._calls.errors.some((m) => /regen-heal/.test(m)), 'the failure is logged, not thrown');
+});
+
+test('1915 regen-heal is capped per branch (MAX 3 attempts) so a treadmill cannot loop forever', async () => {
+  const healAttempts = new Map();
+  let attempted = 0;
+  const mk = () => mkDeps({
+    rows: [{ task_id: 404, builder_id: 5, worktree_name: 'wt-tread' }],
+    statusByBranch: { 'claude/wt-tread': PENDING },
+    mergeByBranch: { 'claude/wt-tread': mergeableRed('failing_check:unit') },
+    // stays red every sweep → a would-be treadmill; count each real invocation.
+    refreshStaleImpl: async () => { attempted++; return { refreshed: false, skipped: 'no_regen_diff' }; },
+    healAttempts,
+  });
+  for (let i = 0; i < 4; i++) {
+    const deps = mk();
+    await reconciler.runSweep(deps);
+    if (i === 3) {
+      assert.ok(deps._calls.logs.some((m) => /capped/.test(m)), 'the 4th sweep is capped, and logs it for owner visibility');
+    }
+  }
+  assert.equal(attempted, 3, 'exactly MAX_STALE_HEAL_ATTEMPTS (3) heals were attempted before the cap');
+});
+
+test('1915 a TRANSIENT heal skip (clone/fetch/push miss) does NOT burn a cap slot — retried indefinitely', async () => {
+  const healAttempts = new Map();
+  let calls = 0;
+  const mk = () => mkDeps({
+    rows: [{ task_id: 406, builder_id: 5, worktree_name: 'wt-flaky' }],
+    statusByBranch: { 'claude/wt-flaky': PENDING },
+    mergeByBranch: { 'claude/wt-flaky': mergeableRed('failing_check:unit') },
+    // an infra miss every sweep — must NOT count toward the cap (only tree-level
+    // determinations — refreshed / no_regen_diff — do).
+    refreshStaleImpl: async () => { calls++; return { refreshed: false, skipped: 'clone_failed' }; },
+    healAttempts,
+  });
+  for (let i = 0; i < 5; i++) await reconciler.runSweep(mk());
+  assert.equal(calls, 5, 'a transient skip is retried on every sweep, never capped');
+  assert.equal(healAttempts.get('claude/wt-flaky') || 0, 0, 'no cap slot is burned by an environmental miss');
+});
+
+test('1915 the treadmill guard prunes branches that leave the confirmed set (no Map leak)', async () => {
+  const healAttempts = new Map();
+  // Sweep A: branch X is confirmed + red + healed → its attempt is recorded.
+  await reconciler.runSweep(mkDeps({
+    rows: [{ task_id: 407, builder_id: 5, worktree_name: 'gone-soon' }],
+    statusByBranch: { 'claude/gone-soon': PENDING },
+    mergeByBranch: { 'claude/gone-soon': mergeableRed('failing_check:unit') },
+    refreshStaleImpl: async () => ({ refreshed: false, skipped: 'no_regen_diff' }),
+    healAttempts,
+  }));
+  assert.equal(healAttempts.get('claude/gone-soon'), 1, 'the attempt was recorded');
+  // Sweep B: a DIFFERENT branch is confirmed; X has landed/left the set → pruned.
+  await reconciler.runSweep(mkDeps({
+    rows: [{ task_id: 408, builder_id: 5, worktree_name: 'still-here' }],
+    statusByBranch: { 'claude/still-here': PENDING },
+    mergeByBranch: { 'claude/still-here': mergeableRed('failing_check:unit') },
+    refreshStaleImpl: async () => ({ refreshed: false, skipped: 'no_regen_diff' }),
+    healAttempts,
+  }));
+  assert.equal(healAttempts.has('claude/gone-soon'), false, 'a branch no longer confirmed is dropped from the guard');
+  assert.equal(healAttempts.get('claude/still-here'), 1, 'a still-confirmed branch keeps its count');
+});
+
+test('1915 the heal path never runs when the module lacks refreshStaleGenerated (older deps bundle)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 405, builder_id: 5, worktree_name: 'wt-old' }],
+    statusByBranch: { 'claude/wt-old': PENDING },
+    mergeByBranch: { 'claude/wt-old': mergeableRed('failing_check:unit') },
+  });
+  delete deps.conflictResolve.refreshStaleGenerated; // simulate a pre-1915 resolver
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.refreshedStale, 0, 'a missing heal fn is a clean no-op, not a crash');
+});
+
+// Drain the microtask queue, then report + exit with the right code.
+setTimeout(() => {
+  console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);
+  process.exit(failed > 0 ? 1 : 0);
+}, 100);