@bongos/core 1.18.19 → 1.19.2

package/scripts/gds/ship.js

@@ -1103,6 +1103,34 @@ function shouldBailOnFetchFailure(fetchedMain, deployMode, via) {
   return !serverPublish;
 }
 
+// ---------- the land outcome (task 1002541, part 1) ----------
+//
+// The land chain used to answer with a bare boolean. Every bail site already
+// computes a precise reason and logs it, but `false` threw that reason away — so
+// the completion card had only the task's STATUS to go on ('confirmed') and
+// printed "Deploy  landing automatically" even when nothing was landing and the
+// builder was, under ADR 0120, unpaid. The failure announced itself as success.
+//
+// "Not shipped" is not one thing, so this is a three-way, not a boolean:
+//   landed()         — merged + deployed; the task flips to shipped.
+//   landPending()    — published and auto-merge armed: it DOES land on its own
+//                      (CI / the server reconciler), so "landing automatically"
+//                      is honest here. A poll timeout is this, not a failure
+//                      (task 1049) — keep it out of the loud path.
+//   landBailed(r, n) — nothing is landing. `r` is the reason already logged,
+//                      `n` the command that recovers it.
+// Only landBailed makes the card say NOT landed. Purely additive: no bail site
+// changes what it DOES, only what it now reports back.
+function landed() { return { ok: true, pending: false, reason: null, nextStep: null }; }
+function landPending() { return { ok: false, pending: true, reason: null, nextStep: null }; }
+function landBailed(reason, nextStep = null) { return { ok: false, pending: false, reason, nextStep }; }
+
+// The short COMMAND form of strandNextStep (which is prose, sized for the log).
+// The card has room for one command, not a sentence.
+function strandCommand(taskId, via) {
+  return via === 'server' ? `node scripts/gds/ship.js ${taskId}` : '/merge-mode';
+}
+
 // ciLand — dispatch the 'ci' confirmed->shipped land to the local or the
 // server-mediated path. Async because the server path awaits GDS API calls.
 async function ciLand(taskId, branch, valueSummary) {
@@ -1129,7 +1157,7 @@ async function ciLandServer(taskId, branch, valueSummary) {
   try {
     if (!gitArgvOk(['bundle', 'create', bundlePath, `origin/main..${branch}`], { stdio: 'ignore' })) {
       console.log(`  ci-land: could not build the branch bundle (nothing new to push, or a git error); task stays at confirmed. ${strandNextStep(taskId, 'server')}`);
-      return false;
+      return landBailed('could not build the branch bundle', strandCommand(taskId, 'server'));
     }
     const bundleB64 = fs.readFileSync(bundlePath).toString('base64');
     // allowBoxScope: handle the box_scope 403 locally (graceful "stays at
@@ -1142,16 +1170,16 @@ async function ciLandServer(taskId, branch, valueSummary) {
     });
     if (r.status === 403 && r.data && r.data.error === 'box_scope') {
       console.log('  ci-land: this session is BOX-SCOPED — run /builder-reauth (browser, no terminal) to mint a real session, then re-ship. Task stays at confirmed.');
-      return false;
+      return landBailed('this CLI session is box-scoped', '/builder-reauth');
     }
     if (r.status === 503) {
       console.log('  ci-land: server-mediated push is not configured on the server yet (no GitHub App nor GITHUB_PUSH_TOKEN — operator action, ADR 0055). Task stays at confirmed.');
-      return false;
+      return landBailed('server-mediated push is not configured (operator action)', strandCommand(taskId, 'server'));
     }
     if (!r.ok) {
       const e = (r.data && (r.data.message || r.data.error)) || `HTTP ${r.status}`;
       console.log(`  ci-land: server publish failed — ${e}. Task stays at confirmed. ${strandNextStep(taskId, 'server')}`);
-      return false;
+      return landBailed(`server publish failed — ${e}`, strandCommand(taskId, 'server'));
     }
     console.log(`  ci-land: server pushed ${branch} + PR ${r.data.pr_url} (auto-merge ${r.data.auto_merge ? 'enabled' : 'NOT enabled — merge it on GitHub'}).`);
     return pollServerPublish(taskId, branch);
@@ -1230,17 +1258,33 @@ function strandNextStep(taskId, via) {
   return `Run /merge-mode to land it — or re-run \`node scripts/gds/ship.js ${taskId}\`, which resumes from here (task 941).`;
 }
 
-// Print the standard "published — it'll land on its own" success-pending banner
+// The standard "published — it'll land on its own" success-pending banner
 // (task 1049). Shared by both poll paths so the message is identical and never
 // reads as a failure. The task legitimately stays at 'confirmed' until CI lands
 // it; the server reconciles it to 'shipped' (publish-status reconcile-on-read)
 // and a re-run resumes (task 941).
-function printLandPending(taskId, { merged } = {}) {
+//
+// task 1002606 (finding P-3): the banner used to end at "NOT a failure", so when
+// a land DID fail (hand-written conflict, PR closed unmerged, persistent red
+// check) the builder's last signal said everything was fine and the strand sat
+// invisible until they happened to look. The banner now tells the failure story
+// too: the server flags a strand needs_rebase (definitive shapes within a sweep,
+// ambiguous ones at ~30 min), /builder-start warns, and new claims gate on it.
+// Pure + exported so the wording is pinned by tests/ship_ci_deploy.mjs.
+function landPendingLines(taskId, { merged } = {}) {
+  return [
+    `  ci-land: ✓ Published — auto-merge is armed${merged ? ' and the PR has merged' : ''}. This is NOT a failure.`,
+    `  CI is still finishing; GitHub will ${merged ? 'deploy' : 'merge + deploy'} automatically once the required checks pass,`,
+    `  and the task flips to 'shipped' on its own. Re-run \`node scripts/gds/ship.js ${taskId}\` anytime to confirm`,
+    `  it landed — it resumes from here (task 941). The task is at 'confirmed' until the deploy completes.`,
+    `  If it CANNOT land on its own (a hand-written merge conflict, the PR closed without merging, a check`,
+    `  that keeps failing), the server flags the task needs_rebase — /builder-start will warn you and new`,
+    `  claims are gated until you fix + re-land it (re-run the ship after fixing), or release it.`,
+  ];
+}
+function printLandPending(taskId, opts = {}) {
   console.log('');
-  console.log(`  ci-land: ✓ Published — auto-merge is armed${merged ? ' and the PR has merged' : ''}. This is NOT a failure.`);
-  console.log(`  CI is still finishing; GitHub will ${merged ? 'deploy' : 'merge + deploy'} automatically once the required checks pass,`);
-  console.log(`  and the task flips to 'shipped' on its own. Re-run \`node scripts/gds/ship.js ${taskId}\` anytime to confirm`);
-  console.log(`  it landed — it resumes from here (task 941). The task is at 'confirmed' until the deploy completes.`);
+  for (const line of landPendingLines(taskId, opts)) console.log(line);
 }
 
 // One module-scope sleep command shared by both poll loops (task 1093 / C9). A
@@ -1264,17 +1308,17 @@ async function pollServerPublish(taskId, branch) {
       const outcome = classifyLandOutcome(r.data);
       if (outcome === 'shipped') {
         console.log(`  ci-land: merged (${String(r.data.merge_sha || '').slice(0, 8)}) + deploy-prod succeeded. Prod is live.`);
-        return true;
+        return landed();
       }
       if (outcome === 'failed') {
         console.log(`  ci-land: PR was CLOSED without merging (a required check failed, or it was closed manually). Fix it and re-run \`node scripts/gds/ship.js ${taskId}\` to resume. Task stays at 'confirmed'.`);
-        return false;
+        return landBailed('the PR was closed without merging (a check failed, or it was closed manually)', `node scripts/gds/ship.js ${taskId}`);
       }
     }
     shellOk(POLL_SLEEP_CMD);
   }
   printLandPending(taskId);
-  return false;
+  return landPending();
 }
 
 // attestGateTrust — task 1169 (ADR 0058). Ask the SERVER to post the trustless
@@ -1346,7 +1390,7 @@ async function ciLandLocal(taskId, branch, valueSummary) {
   console.log(`  pushing ${branch} to origin...`);
   if (!gitArgvOk(['push', 'origin', branch])) {
     console.log('  ci-land: push failed; task stays at confirmed. Fix the push and re-ship.');
-    return false;
+    return landBailed(`could not push ${branch} to origin`, `node scripts/gds/ship.js ${taskId}`);
   }
 
   // task 1169 (ADR 0058): attest the author's trust tier on the head SHA BEFORE
@@ -1377,7 +1421,7 @@ async function ciLandLocal(taskId, branch, valueSummary) {
     console.log('  ci-land: opening PR -> main...');
     if (!ghArgvOk(buildPrCreateArgv(branch, title, body))) {
       console.log('  ci-land: `gh pr create` failed. Is the GitHub CLI installed + authenticated (`gh auth status`)? Open the PR manually; task stays at confirmed.');
-      return false;
+      return landBailed('`gh pr create` failed (is gh installed + authenticated?)', `node scripts/gds/ship.js ${taskId}`);
     }
   } else {
     console.log(`  ci-land: reusing open PR ${existing.url}`);
@@ -1428,7 +1472,7 @@ function pollCiDeploy(taskId, branch, headSha) {
     }
     if (pr && pr.state === 'CLOSED') {
       console.log(`  ci-land: PR was CLOSED without merging (a required check failed, or it was closed manually). Fix it and re-run \`node scripts/gds/ship.js ${taskId}\` to resume. Task stays at 'confirmed'.`);
-      return false;
+      return landBailed('the PR was closed without merging (a check failed, or it was closed manually)', `node scripts/gds/ship.js ${taskId}`);
     }
     shellOk(POLL_SLEEP_CMD);
   }
@@ -1436,7 +1480,7 @@ function pollCiDeploy(taskId, branch, headSha) {
     // task 1049: PR open + auto-merge armed but not merged in-window = the publish
     // SUCCEEDED and is still in CI — success-pending, not a failure.
     printLandPending(taskId);
-    return false;
+    return landPending();
   }
   console.log(`  ci-land: merged to main (${mergeSha.slice(0, 8)}). Waiting for the prod deploy...`);
 
@@ -1464,14 +1508,14 @@ function pollCiDeploy(taskId, branch, headSha) {
       } else {
         console.log('  ci-land: deploy run succeeded but /version + healthz probes both missed (likely transient). Treating the successful deploy run as authoritative.');
       }
-      return true;
+      return landed();
     }
     shellOk(POLL_SLEEP_CMD);
   }
   // task 1049: merged but the deploy run hasn't confirmed in-window — still
   // success-pending (it deploys on its own), not a failure.
   printLandPending(taskId, { merged: true });
-  return false;
+  return landPending();
 }
 
 // ---------- Step 0: preflight (working tree + branch freshness) ----------
@@ -1997,6 +2041,32 @@ function runSmoke() {
   return { ran: true, clean: okPms };
 }
 
+// task 1002605 (G-18): the pre-resolve smoke gate's two message sets, pure so the
+// wording is pinned by a DB-free unit test (tests/ship_smoke_gate.mjs). A smoke
+// FAIL used to fall silently through into the claim resolve — claim consumed,
+// grading skipped with no message, task parked at 'completed', exit 0 — the
+// choke-point map's likeliest "my task vanished" shape. `abort` is the default
+// (printed BEFORE the resolve; the claim stays active); `parked` is the
+// --allow-smoke-fail continuation (printed where the grader would have run, so
+// the builder knows exactly where the task stopped and how to resume).
+function smokeGateMessages(taskId) {
+  return {
+    abort: [
+      'Ship ABORTED: the production smoke test FAILED — see the FAIL line(s) above.',
+      'No claim resolved, no credits awarded — your claim is still active and nothing changed.',
+      'The smoke suite hits LIVE endpoints (your change is not deployed yet), so this usually means production is briefly degraded — not that your change broke it.',
+      `  - Re-run once it recovers:     node scripts/gds/ship.js ${taskId}`,
+      `  - Ship anyway (deliberate):    node scripts/gds/ship.js ${taskId} --allow-smoke-fail`,
+      `    (parks the task at 'completed' ungraded; resume later with --regrade)`,
+    ],
+    parked: [
+      '--allow-smoke-fail: smoke FAILED and the ship deliberately stops here.',
+      `Task #${taskId} is parked at 'completed' — ungraded, unconfirmed, no credits awarded.`,
+      `Resume when production is healthy:  node scripts/gds/ship.js ${taskId} --regrade`,
+    ],
+  };
+}
+
 // ---------- Step 3: merge + deploy chain ----------
 
 function currentBranch() {
@@ -2263,7 +2333,10 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
   const branch = currentBranch();
   if (!branch || branch === 'main' || branch === 'HEAD') {
     console.log(`  auto-merge: skipped (current branch is ${branch})`);
-    return false;
+    // The merge source IS the current branch, so on main there is nothing to
+    // merge. Half of the single-checkout catch-22 this task documents: the other
+    // half is the "main worktree is on <branch>, not main" bail below.
+    return landBailed(`nothing to merge — this checkout is on ${branch}, not a task branch`, '/merge-mode');
   }
 
   // Refresh the data-driven diagrams before computing commits-ahead, so a
@@ -2299,7 +2372,7 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
   const fetchedMain = shellOk('git fetch origin main');
   if (!fetchedMain && shouldBailOnFetchFailure(fetchedMain, deployMode, pushVia())) {
     console.log('  auto-merge: fetch failed; task stays at confirmed for /merge-mode');
-    return false;
+    return landBailed('could not fetch origin/main', '/merge-mode');
   }
   const commitsAhead = gitOk('git rev-list origin/main..HEAD --count');
   const verdict = zeroCommitVerdict(commitsAhead, dbOnly);
@@ -2318,11 +2391,11 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
     console.error('     DB — nothing to merge or deploy), re-run with --db-only:');
     console.error(`       node scripts/gds/ship.js ${taskId} --db-only`);
     console.error('  The task stays at confirmed; nothing was merged or deployed.');
-    return false;
+    return landBailed('no commits ahead of main, and --db-only was not passed', `node scripts/gds/ship.js ${taskId} --db-only`);
   }
   if (verdict === 'db-only') {
     console.log('  auto-merge: deliberate empty ship (--db-only / --allow-empty) - no commits ahead of main; advancing to shipped without merge/deploy.');
-    return true;
+    return landed();
   }
 
   // #679 / ADR 0042: in 'ci' deploy mode the operator's machine never merges or
@@ -2336,7 +2409,7 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
   console.log(`  pushing ${branch} to origin...`);
   if (!gitArgvOk(['push', 'origin', branch])) {
     console.log('  auto-merge: push failed; task stays at confirmed for /merge-mode');
-    return false;
+    return landBailed(`could not push ${branch} to origin`, '/merge-mode');
   }
 
   // Serialize the shared-main-worktree merge (#462 C4; #269 C6). Concurrent
@@ -2345,7 +2418,7 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
   // than racing its working tree.
   if (!mergeLock.acquire(REPO_ROOT)) {
     console.log('  auto-merge: another active ship or /merge-mode run holds the merge lock; task stays at confirmed for /merge-mode');
-    return false;
+    return landBailed('another ship or /merge-mode run holds the merge lock', '/merge-mode');
   }
   let mergedClean = false;
   try {
@@ -2355,7 +2428,7 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
     const busy = mainWorktreeBusy();
     if (busy) {
       console.log(`  auto-merge: main worktree busy (${busy}); task stays at confirmed for /merge-mode`);
-      return false;
+      return landBailed(`the main worktree is busy (${busy})`, '/merge-mode');
     }
 
     console.log(`  switching to main worktree (${REPO_ROOT}) for merge...`);
@@ -2369,19 +2442,26 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
     }
     if (!shellOk(`git fetch origin`, { cwd: REPO_ROOT })) {
       console.log('  auto-merge: fetch failed; task stays at confirmed for /merge-mode');
-      return false;
+      return landBailed('could not fetch origin in the main worktree', '/merge-mode');
     }
 
     // The main worktree must currently have main checked out.
     const onMain = gitOk('git rev-parse --abbrev-ref HEAD', { cwd: REPO_ROOT });
     if (onMain !== 'main') {
       console.log(`  auto-merge: main worktree is on ${onMain}, not main; task stays at confirmed`);
-      return false;
+      // The other half of the single-checkout catch-22: the merge target tree is
+      // the one holding the feature branch, so there is nowhere to merge INTO.
+      // Name the cure, not just the symptom — this is the bail that used to be
+      // invisible behind "landing automatically".
+      return landBailed(
+        `the main checkout is on ${onMain}, not main — work a task in its own worktree so the main checkout stays on main`,
+        '/merge-mode',
+      );
     }
 
     if (!gitArgvOk(['merge', '--ff-only', 'origin/main'], { cwd: REPO_ROOT })) {
       console.log('  auto-merge: main is ahead of origin somehow; task stays at confirmed');
-      return false;
+      return landBailed('the local main is ahead of origin/main', '/merge-mode');
     }
 
     // #681: build the merge argv and run it WITHOUT a shell. valueSummary is
@@ -2389,13 +2469,13 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
     // `$(...)`/backticks in it can never be interpreted as a command.
     if (!gitArgvOk(buildMergeArgv(branch, valueSummary), { cwd: REPO_ROOT })) {
       console.log('  auto-merge: merge failed (conflicts?); task stays at confirmed for manual /merge-mode');
-      return false;
+      return landBailed(`merging ${branch} into main failed (conflicts?)`, '/merge-mode');
     }
 
     console.log('  smoke against post-merge state...');
     if (!runSmoke().clean) {
       console.log('  auto-merge: post-merge smoke failed; task stays at confirmed; investigate');
-      return false;
+      return landBailed('post-merge smoke tests failed', '/merge-mode');
     }
 
     console.log('  pushing merged main to origin...');
@@ -2406,7 +2486,7 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
     // cross-platform reason as the other node spawns here (#660).
     if (!shellOk(`"${process.execPath}" ${JSON.stringify(path.join(__dirname, 'push-main.js'))}`, { cwd: REPO_ROOT })) {
       console.log('  auto-merge: push failed; task stays at confirmed');
-      return false;
+      return landBailed('could not push the merged main to origin', '/merge-mode');
     }
 
     // Deploy step. The core carries NO deploy target of its own — under the
@@ -2445,11 +2525,11 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
             console.log('  auto-merge: /healthz 200 on re-probe — deploy actually succeeded (deploy.sh raced the restart window). Proceeding.');
           } else {
             console.log('  auto-merge: deploy failed (/healthz never returned 200 after retries); task stays at confirmed');
-            return false;
+            return landBailed('merged to main, but the deploy failed (/healthz never returned 200)', '/merge-mode');
           }
         } else {
           console.log('  auto-merge: ~/deploy.sh returned non-zero and no healthzUrl configured to re-probe; task stays at confirmed');
-          return false;
+          return landBailed('merged to main, but ~/deploy.sh returned non-zero (no healthz to re-probe)', '/merge-mode');
         }
       }
     }
@@ -2470,7 +2550,7 @@ async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
 
     console.log('  flipping task to shipped...');
     mergedClean = true;
-    return true;
+    return landed();
   } finally {
     // Leave REPO_ROOT clean for the NEXT ship/merge no matter how we exited.
     // A failed merge here wedges everyone else: a conflict leaves the tree
@@ -2759,14 +2839,19 @@ async function mergeAndDeploy({ taskId, summary, advanceToMerge, skipMerge, dbOn
   if (advanceToMerge && skipMerge) {
     console.log('');
     console.log('--no-merge: stopping at confirmed. Run /merge-mode later to land it.');
-    return;
+    return landBailed('--no-merge was passed, so the land was skipped', '/merge-mode');
   }
-  if (!advanceToMerge) return;
+  // Grade failed: the card renders the 'failed' stage ('not deployed'), so there
+  // is no land outcome to report.
+  if (!advanceToMerge) return null;
 
   console.log('');
   console.log('Auto-merge chain (confirmed → shipped):');
   const merged = await autoMerge(taskId, summary, { dbOnly });
-  if (!merged) return;
+  // NOTE: `merged` is an OBJECT now — every value is truthy, so this MUST test
+  // .ok. A bare `if (!merged)` would fall through on a bail and POST /ship for a
+  // task that never landed.
+  if (!merged.ok) return merged;
 
   const ship = await (await cliClient()).tasks.postTasksIdShip({ id: taskId, body: {} });
   if (!ship.ok) {
@@ -2777,7 +2862,11 @@ async function mergeAndDeploy({ taskId, summary, advanceToMerge, skipMerge, dbOn
       console.log(`Task #${taskId} is now: shipped (the server reconciled it from the merged PR).`);
     } else {
       console.error(`  /tasks/${taskId}/ship failed:`, ship.data);
-      return;
+      // The merge itself succeeded — only the status flip failed, so a re-run
+      // resumes cleanly (task 941). Report it rather than letting the card claim
+      // the land is in progress.
+      const e = (ship.data && (ship.data.message || ship.data.error)) || `HTTP ${ship.status}`;
+      return landBailed(`merged, but the ship call failed — ${e}`, `node scripts/gds/ship.js ${taskId}`);
     }
   } else {
     console.log(`Task #${taskId} is now: shipped`);
@@ -2815,6 +2904,7 @@ async function mergeAndDeploy({ taskId, summary, advanceToMerge, skipMerge, dbOn
     // server-side in ship-broadcast.postShipBroadcast, so it is preserved.
     console.log('  Discord broadcast: deferred to the server — it posts #ship-feed after the deploy lands.');
   }
+  return merged;
 }
 
 // Memory + session-digest push, gated on a successful land (confirmed/shipped).
@@ -2891,7 +2981,10 @@ function postShipCloseout(taskId) {
 }
 
 async function finishShip({ taskId, summary, advanceToMerge, skipMerge, postGradeStatus, doneLine, card, dbOnly = false }) {
-  await mergeAndDeploy({ taskId, summary, advanceToMerge, skipMerge, dbOnly });
+  // task 1002541: the land outcome carries WHY a land didn't happen. Without it
+  // the card had only the status to go on and printed 'landing automatically'
+  // over a merge that had already bailed.
+  const land = await mergeAndDeploy({ taskId, summary, advanceToMerge, skipMerge, dbOnly });
   // task 1719: mergeAndDeploy may have landed the task to 'shipped' IN-SESSION — the
   // enable-success poll (pollCiDeploy) or, since task 1718, the enable-failure server
   // poll (pollServerPublish). finishShip was handed postGradeStatus from the CONFIRM
@@ -2924,7 +3017,7 @@ async function finishShip({ taskId, summary, advanceToMerge, skipMerge, postGrad
   // always-printed fallback + the headless summary). Strictly best-effort.
   // task 1719: pass the reconciled status so a just-landed ship shows SHIPPED (and
   // writes no breadcrumb), not the stale pre-merge 'confirmed'.
-  await printCompletionCard({ taskId, postGradeStatus: landedStatus, card, usage });
+  await printCompletionCard({ taskId, postGradeStatus: landedStatus, card, usage, land });
   // task 932: reconcile the working tree — ONLY on a successful land. A
   // grade-failed ship stays at 'completed'; leave that tree untouched so the
   // builder can fix findings + re-ship.
@@ -2959,7 +3052,7 @@ function diffstatFor(baseline) {
 // in-feed HTML to a temp file and prints an [otb-card-html] marker the
 // builder-ship skill picks up to render it in the chat feed. Every step is
 // best-effort — a summary card must NEVER fail or undo a completed ship.
-async function printCompletionCard({ taskId, postGradeStatus, card, usage }) {
+async function printCompletionCard({ taskId, postGradeStatus, card, usage, land = null }) {
   if (!card) return;
   try {
     const shipCard = require('../../modules/lifecycle/ship-card');
@@ -3029,6 +3122,10 @@ async function printCompletionCard({ taskId, postGradeStatus, card, usage }) {
       credits: { awarded: card.creditsAwarded, total, perTaskCredit: rewardPolicy(serverReward).perTaskCredit },
       usage: { tokens, costUsd, newTokens, cachedTokens },
       deploy: { commit },
+      // task 1002541: absent (the default) ⇒ the card behaves exactly as before,
+      // which keeps every other caller — resumeMerge, the claim card, and
+      // land-watch replaying breadcrumbs written by older versions — unchanged.
+      land,
     };
     const model = shipCard.buildCardModel(cardInputs);
 
@@ -3179,7 +3276,7 @@ async function resumeMerge(taskId, { summary, skipMerge, force, task, dbOnly = f
   // The first ship stored value_summary; reuse it so the merge commit + broadcast
   // carry meaningful text even when --summary is omitted on the re-run.
   const effSummary = summary || task?.value_summary || '';
-  await mergeAndDeploy({ taskId, summary: effSummary, advanceToMerge: true, skipMerge, dbOnly });
+  const land = await mergeAndDeploy({ taskId, summary: effSummary, advanceToMerge: true, skipMerge, dbOnly });
   const usage = await postShipSync(taskId, 'confirmed');
   console.log('');
   console.log('Done — merge/deploy resume complete.');
@@ -3192,7 +3289,7 @@ async function resumeMerge(taskId, { summary, skipMerge, force, task, dbOnly = f
     const t = await (await cliClient()).tasks.getTasksId({ id: taskId });
     const status = (t.ok && t.data && t.data.task) ? t.data.task.status : 'shipped';
     await printCompletionCard({
-      taskId, postGradeStatus: status, usage,
+      taskId, postGradeStatus: status, usage, land,
       card: { title: task?.title, valueSummary: effSummary, notes: '', creditsAwarded: null },
     });
   } catch (_) { /* the resume already succeeded; the card is a bonus */ }
@@ -3205,7 +3302,7 @@ async function shipMain() {
   const args = process.argv.slice(2);
   const taskId = Number(args[0]);
   if (!Number.isFinite(taskId)) {
-    console.error('usage: node scripts/gds/ship.js <task-id> --notes "..." --summary "..." [--surprise "text" | --surprise none | --no-surprise] [--no-merge] [--db-only] [--verified] [--allow-empty] [--base <ref>]');
+    console.error('usage: node scripts/gds/ship.js <task-id> --notes "..." --summary "..." [--surprise "text" | --surprise none | --no-surprise] [--no-merge] [--db-only] [--verified] [--allow-empty] [--allow-smoke-fail] [--base <ref>]');
     process.exit(2);
   }
   const notes = arg('--notes', args) || '';
@@ -3235,6 +3332,11 @@ async function shipMain() {
   // empty diff is refused (it used to slip through under --skip-grade — the
   // task-1363 phantom ship). Never overrides a dirty working tree.
   const allowEmpty = args.includes('--allow-empty');
+  // task 1002605 (G-18): explicit opt-in to continue past a FAILED production
+  // smoke run. Without it a smoke FAIL now ABORTS before the claim resolves
+  // (claim intact); with it, the resolve proceeds and the task deliberately
+  // parks at 'completed' ungraded — and the ship says so instead of "Done."
+  const allowSmokeFail = args.includes('--allow-smoke-fail');
   // Surprise flag handling — see captureSurpriseLearning(). Resolved below
   // once we know which claim is being shipped (so touches[] can become tags).
   const surpriseRaw = arg('--surprise', args);
@@ -3303,16 +3405,16 @@ async function shipMain() {
   // ---- Hard cap: refuse to ship over the monthly budget (V3.R84 #302, C3) ----
   // Shipping runs the subagent grader, which spends API $. If this builder is at
   // or over their monthly budget, refuse here — BEFORE the grader runs and BEFORE
-  // the claim resolves, so the claim stays active and no cost is incurred. An
-  // Archon lifts the block by raising the builder's budget
-  // (PATCH /builders/:id/budget). Fail-open: a missing/unreadable cost status
-  // (e.g. an older server) never blocks a ship.
+  // the claim resolves, so the claim stays active and no cost is incurred. Any
+  // Metic+ builder lifts the block by raising the builder's budget
+  // (PATCH /builders/:id/budget — builder.budget.set, metic-floored since ADR 0157).
+  // Fail-open: a missing/unreadable cost status (e.g. an older server) never blocks a ship.
   const costStatus = me.data.cost;
   if (costStatus && costStatus.level === 'over') {
     console.error('');
     console.error(`Ship refused: monthly budget exceeded — $${costStatus.spend_mtd_usd} of $${costStatus.budget_mtd_usd} spent this month (${costStatus.pct_used}%).`);
     console.error('Shipping runs the quality grader, which spends API budget. No claim resolved, no credits awarded.');
-    console.error('Ask an Archon to raise your monthly budget (PATCH /builders/:id/budget), then re-ship.');
+    console.error('Ask any Metic or Archon to raise your monthly budget (PATCH /builders/:id/budget), then re-ship.');
     process.exit(1);
   }
 
@@ -3539,6 +3641,19 @@ async function shipMain() {
   console.log(`Verification: smoke=${smoke.clean ? 'clean' : 'FAIL'}, overall=${passed ? 'PASS' : 'FAIL'}`);
   console.log('');
 
+  // task 1002605 (G-18): a smoke FAIL used to fall straight through into the
+  // claim resolve — claim consumed, grading silently skipped, task parked at
+  // 'completed', exit 0, and the builder read "Done." believing they shipped.
+  // Abort BEFORE the resolve instead — the same claim-preserving posture as the
+  // budget cap and the sandbox-review gate above. --allow-smoke-fail is the
+  // deliberate continuation; the parked message where the grader would have run
+  // says exactly where that leaves the task.
+  if (!passed && !allowSmokeFail) {
+    console.error('');
+    for (const line of smokeGateMessages(taskId).abort) console.error(line);
+    process.exit(1);
+  }
+
   // ---- Step 1: resolve the claim (lands at completed) ----
   // V3.R18 (#209): resolveClaim no longer runs the v1 deterministic grader.
   // It now lands the task at `completed` when verification (smoke) passes, and
@@ -3673,6 +3788,12 @@ async function shipMain() {
     ideaBonusInfo = gradePost.data.ideaBonus ?? null;
 
     printGradeOutcome(g, taskId);
+  } else if (!passed && taskStatus === 'completed') {
+    // task 1002605 (G-18): the --allow-smoke-fail continuation. The resolve above
+    // consumed the claim with verification.passed=false, so the grader deliberately
+    // does not run. This used to be a silent fall-through; say where the task is.
+    console.log('');
+    for (const line of smokeGateMessages(taskId).parked) console.log(line);
   }
 
   printCreditsAndAchievements({
@@ -3898,6 +4019,10 @@ module.exports = {
   // #943: pure grade-outcome formatter — exported so the grader-unavailable vs
   // FAIL display branch is unit-tested without capturing stdout.
   formatGradeOutcome,
+  // task 1002605 (G-18): the pre-resolve smoke gate's abort/parked wording —
+  // exported pure so the loudness contract (claim intact on abort; parked +
+  // resume path on --allow-smoke-fail) is pinned without running a ship.
+  smokeGateMessages,
   // task 941 (V4.R03): pure resume-action decision for a claim-less `ship.js <id>`
   // re-run — exported so the truth table (completed→grade, confirmed→merge,
   // ownership, terminal states) is unit-tested with no git/network.
@@ -3926,6 +4051,11 @@ module.exports = {
   // dead-end strand at confirmed), enable-success watches GitHub. Exported so the
   // regression test locks in that a worktree enable-failure still waits for the land.
   landPollAfterAutoMerge,
+  // task 1002541: the land-outcome constructors. Exported so the test can pin the
+  // trap that made this a 3-way instead of a boolean — every outcome is a TRUTHY
+  // object, so a consumer MUST test `.ok`; the old `if (!merged)` would sail past
+  // a bail. Also pins pending (a poll timeout) as distinct from bailed.
+  landed, landPending, landBailed, strandCommand,
   // task 1719: pure post-land status reconciler — a task that reached 'shipped'
   // in-session shows the SHIPPED banner + writes no breadcrumb; otherwise keep the
   // pre-merge status (confirmed → next-turn breadcrumb fallback). Exported for tests.
@@ -3944,6 +4074,9 @@ module.exports = {
   // task 1052 (E): box-aware "what to do next" for a confirmed-strand — a box
   // (via 'server') is pointed at the resume, never at gh-only /merge-mode.
   strandNextStep,
+  // task 1002606: the success-pending banner lines, pure — pinned so the strand
+  // detection story ("NOT a failure" + how you WILL find out if it fails) can't drift.
+  landPendingLines,
   // #857: resolveDeployMode (env + committed config) so doctor.js reports the
   // active deploy mode exactly as ship will use it.
   resolveDeployMode,

package/scripts/hall-preview/server.js

@@ -44,7 +44,7 @@ const EMPTY = process.argv.includes('--empty');
 // --rank: view the hall as a different rank — the /me fixture's builder.rank is
 // overridden in the response, so the Archon-gated pages (watch, harbor, gate)
 // render their real content instead of the sealed notice. Preview-only theatre:
-// the real pages are server-gated (requireArchonPage / ADR 0016).
+// the real pages are server-gated (requireGovernancePage / ADR 0016).
 const RANK_OVERRIDE = arg('--rank');
 const MODULES_OFF = String(arg('--modules-off') || '').split(',').map((s) => s.trim()).filter(Boolean);
 // --modules-on: force-report modules as enabled — a dev box's local config

package/scripts/migrate.sh

@@ -51,7 +51,7 @@ fi
 
 DB="${PGDATABASE:-amazonprimea}"
 
-# Test/ops seam (task 1002611): --print-migrations walks the REAL core-migration loop but reports
+# Test/ops seam (added with the 1.18.19 space-in-path fix): --print-migrations walks the REAL core-migration loop but reports
 # each path instead of applying it, and touches NO DB. tests/migrate_root_resolution.mjs uses it to
 # assert that a checkout whose path contains a space still yields whole, readable paths. Reporting
 # through the real loop (rather than a copy of it in the test) is the point: if the loop ever reverts
@@ -107,7 +107,7 @@ fi
 # key, so moving a file between migrations/ and migrations/game/ does NOT re-run it on prod.
 #
 # The two counters are what the no-op guard below reads: a run that LISTED core migrations but
-# neither applied nor recognized a single one is the space-in-path failure (task 1002611) and must
+# neither applied nor recognized a single one is the space-in-path failure (fixed in 1.18.19) and must
 # be fatal, not silent. Both loops that call this run in the CURRENT shell (herestring / plain glob,
 # never a `... | while` pipeline), so these increments are visible to the caller.
 MIGRATIONS_APPLIED=0
@@ -160,7 +160,7 @@ fi
 # affects whether it re-runs on OTB prod. Today CORE_ROOT == INSTANCE_ROOT (single checkout);
 # once the core installs from node_modules the two roots diverge and this still merges correctly.
 #
-# PATHS WITH SPACES (task 1002611): this list is NEWLINE-separated and must be read a line at a
+# PATHS WITH SPACES (fixed in 1.18.19): this list is NEWLINE-separated and must be read a line at a
 # time. The old `for f in $MIGRATIONS` word-split it on IFS — which includes space — so any checkout
 # whose absolute path contains a space ("/Users/.../Hermeslines Marketing/...") fragmented every
 # path, the `[ -e ]` guard below silently dropped all of them, and ZERO core migrations ran.
@@ -191,7 +191,7 @@ while IFS= read -r f; do
   apply_migration "$f"
 done <<< "$MIGRATIONS"
 
-# --- No-op guard (task 1002611) -------------------------------------------
+# --- No-op guard (added in 1.18.19) -------------------------------------------
 # Silence is what made the space-in-path bug expensive to diagnose: core migrations were skipped
 # without a word, and the first error the operator saw came from an unrelated MODULE migration
 # hitting the empty schema. If the glob LISTED core migrations but we neither applied nor recognized
@@ -289,7 +289,7 @@ if [ "${OTB_POST_DEPLOY_CHECK:-0}" = "1" ]; then
       echo "post-deploy: no prior score ledger — running in baseline-only mode"
     fi
     # `${VAR:+"$VAR"}` expands to NOTHING when empty and to the quoted value otherwise. A bare
-    # $BASELINE_FLAG relied on word-splitting to vanish (the habit that caused task 1002611), and
+    # $BASELINE_FLAG relied on word-splitting to vanish (the habit that caused the space-in-path migration skip), and
     # quoting it outright would instead pass an empty argv entry that argparse rejects. An array
     # would need bash 4 — `set -u` + `"${arr[@]}"` on an empty array aborts under the bash 3.2 that
     # macOS still ships, and this script's shebang takes whatever bash is on PATH.