@bongos/core 1.18.19 → 1.19.2

package/tests/recall_hints.mjs

@@ -10,10 +10,11 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const { taskQuery, pickActiveClaim, formatHints, DEADLINE_MS } =
-  require('../.claude/hooks/recall-hints.js');
+  requireHostModule(require, '../.claude/hooks/recall-hints.js');
 
 let passed = 0;
 let failed = 0;

package/tests/repo_map.mjs

@@ -71,6 +71,10 @@ test('each nested CLAUDE.md carries a delimited generated block with signatures'
     const doc = readFileSync(path.join(ROOT, dir, 'CLAUDE.md'), 'utf8');
     assert.ok(doc.includes(BEGIN), `${dir}/CLAUDE.md should have a generated-block start marker`);
     assert.ok(doc.includes(END), `${dir}/CLAUDE.md should have a generated-block end marker`);
+    // In a PUBLISHED core the nested agent notes are replaced by package-core.js's
+    // CORE_AGENT_DOC_STUB, so there is no hand-written prose to preserve (task 1002470).
+    // Where the real doc is present the prose must survive the generated-block injection.
+    if (doc.includes('@bongos/core — installed platform dependency')) continue;
     // the hand-written prose is preserved alongside the generated block
     assert.match(doc, /Nested CLAUDE\.md — loads on demand/);
   }

package/tests/route_permission_check.mjs

@@ -41,12 +41,16 @@ const rowOf = (src) => rrc.classifyText(src)[0];
 // here ONCE by hand. This is the independent side of every classification assertion
 // below — if someone lowers `backup.manage` to 'xenos', the classifier follows the
 // catalog and this file goes red, which is the whole point.
+// ADR 0157 moved 20 atoms archon→metic. `audit_log.read` and `builder.roster.read` are
+// transcribed at their new floor below; the archon entries that remain are the
+// rank/identity core, which is the point of that ADR.
 const HAND_WRITTEN_FLOORS = {
   'builder.rank.set': 'archon',
-  'audit_log.read': 'archon',
   'auth.session.revoke': 'archon',
-  'builder.roster.read': 'archon',
   'builder.status.set': 'archon',
+  'access_request.review': 'archon',
+  'audit_log.read': 'metic',
+  'builder.roster.read': 'metic',
   'backup.manage': 'metic',
   'idea.triage': 'metic',
   'security.report.file': 'metic',
@@ -132,13 +136,17 @@ test('P1: the label agrees with the REAL threshold function over the whole rank
 });
 
 test('P1: AND semantics — a multi-atom gate takes the STRICTEST floor', () => {
-  const src = "router.post('/x', auth.requireBuilder, auth.requirePermission('idea.file', 'audit_log.read'), h);";
+  // Uses `builder.rank.set` as the archon end of the pair: ADR 0157 lowered
+  // `audit_log.read` (the previous example) to metic, which would no longer exercise the
+  // metic-vs-archon spread this test exists to prove. Rank-setting is the one power that
+  // ADR 0157 guarantees stays archon, so it is the stable choice here.
+  const src = "router.post('/x', auth.requireBuilder, auth.requirePermission('idea.file', 'builder.rank.set'), h);";
   assert.equal(rankOf(src), 'archon',
     'requirePermission ANDs, so the gate is as strict as its strictest atom (archon), not its loosest');
   const src2 = "router.post('/x', auth.requireBuilder, auth.requirePermission('cost.log', 'backup.manage'), h);";
   assert.equal(rankOf(src2), 'metic+archon');
   // order must not matter
-  const src3 = "router.post('/x', auth.requireBuilder, auth.requirePermission('audit_log.read', 'idea.file'), h);";
+  const src3 = "router.post('/x', auth.requireBuilder, auth.requirePermission('builder.rank.set', 'idea.file'), h);";
   assert.equal(rankOf(src3), 'archon');
 });
 
@@ -274,7 +282,8 @@ test('P4: gen-api-docs labels a permission-gated route by its floor, not any-bui
   const trigger = model.find((r) => r.route === '/backup/trigger');
   const audit = model.find((r) => r.route === '/audit-log');
   assert.equal(trigger.rank, 'metic+archon', 'the published rank must be the real floor');
-  assert.equal(audit.rank, 'archon');
+  // ADR 0157: `audit_log.read` floor archon→metic, so the published rank follows.
+  assert.equal(audit.rank, 'metic+archon');
   assert.deepEqual(trigger.perms, ['backup.manage'], 'the docs also name the authority atom');
 
   const spec = genApiDocs.buildOpenapi(model);

package/tests/rubric_fixtures.mjs

@@ -23,6 +23,7 @@
 import { strict as assert } from 'node:assert';
 import { readFileSync, existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { skipUnlessPresent } from './helpers.mjs';
 import { dirname, resolve } from 'node:path';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -30,6 +31,8 @@ const ROOT = resolve(HERE, '..');
 const FIXTURES_DIR = resolve(ROOT, 'modules', 'art-pipeline', 'template', 'rubric_fixtures');
 const MANIFEST = resolve(FIXTURES_DIR, 'fixtures.json');
 const RUBRIC = resolve(ROOT, 'modules', 'art-pipeline', 'template', 'rubric.json');
+skipUnlessPresent('modules/art-pipeline/template/rubric_fixtures',
+  'The art-pipeline module is not installed in this instance.');
 
 let passed = 0;
 function test(name, fn) {

package/tests/run_routine_two_root.mjs

@@ -19,11 +19,13 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { skipUnlessPresent } from './helpers.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.resolve(__dirname, '..'); // the core root (this repo), fixed by resolveCoreRoot()
 const RUN_ROUTINE = path.join(REPO, 'scripts', 'gds', 'run-routine.js');
 const CORE_RESOLVE = path.join(REPO, '.claude', 'hooks', '_core-resolve.js');
+skipUnlessPresent('.claude/hooks/_core-resolve.js');
 
 let passed = 0, failed = 0;
 function test(name, fn) {

package/tests/sandbox_stage.mjs

@@ -240,7 +240,10 @@ function boxDeps(markerFile, overrides = {}) {
       if (cmd === 'git') return execFileSync(cmd, args, opts);
       return '';
     },
-    fetchImpl: async () => ({ status: 200 }),
+    // task 1002607: emulate a real PREVIEW — 200 on the health URL, 404 on the
+    // /api/gds/healthz discriminator (the game-only entry mounts no /api/gds).
+    // A flat always-200 mock would now read as "the MAIN server answered".
+    fetchImpl: async (url) => ({ status: String(url).includes('/api/gds/healthz') ? 404 : 200 }),
     markerPath: markerFile,
     cwd: tmp,
     pollMs: 1,
@@ -346,11 +349,19 @@ await ta('runShipGate: --skip-stage → ok, untouched', async () => {
   assert.equal(fs.existsSync(mp), false);
 });
 
-await ta('runShipGate: staging failure (health never green) warns but does not block', async () => {
+// task 1002607 (§4.4 station 9): a staging failure used to WARN one stderr line
+// and return ok — the review gate silently turned itself off. It now fails
+// CLOSED (like the smoke gate, task 1002605): abort, claim intact, --skip-stage
+// as the explicit bypass, and the reason says plainly the review DID NOT run.
+await ta('1002607 runShipGate: staging failure (health never green) ABORTS — review gate cannot silently turn itself off', async () => {
   const mp = path.join(markerDir, 'm8.json');
   const deps = boxDeps(mp, { fetchImpl: async () => ({ status: 502 }), timeoutMs: 10 });
   const r = await sbx.runShipGate({ taskId: 927, files: ['public/game/a.js'], skipStage: false, tty: true }, deps);
-  assert.equal(r.ok, true, 'a broken preview must not brick shipping');
+  assert.equal(r.ok, false, 'a failed stage must not ship as if the review happened');
+  assert.equal(r.review, undefined, 'a failure to present is NOT a calm review pause');
+  assert.match(r.reason, /DID NOT run/, 'says plainly the review step did not run');
+  assert.match(r.reason, /--skip-stage/, 'names the explicit bypass');
+  assert.match(r.reason, /claim is still active/i, 'claim-preserving');
 });
 
 // ---------- recorded self-approval (#1048), box ----------
@@ -502,12 +513,62 @@ await ta('stage(box): a HARD verify failure → {ok:false,hard:true}, no marker'
   assert.equal(fs.existsSync(mp), false, 'no marker on a hard verify failure');
 });
 
-await ta('runShipGate(box): a SOFT failure (preview never healthy) still warns + continues', async () => {
+await ta('1002607 runShipGate(box): a SOFT failure (preview never healthy) now fails closed — abort, claim intact', async () => {
   const mp = path.join(markerDir, 'soft1.json');
-  // sync ok (injected), but health never green → soft failure → ship continues
+  // sync ok (injected), but health never green → the ship must NOT continue
+  // as if the review ran (that was the silent-disable defect).
   const deps = boxDeps(mp, { fetchImpl: async () => ({ status: 502 }), timeoutMs: 10 });
   const r = await sbx.runShipGate({ taskId: 1068, files: ['public/game/a.js'], skipStage: false, tty: true }, deps);
-  assert.equal(r.ok, true, 'a broken preview must not brick shipping (soft failure)');
+  assert.equal(r.ok, false, 'the soft failure aborts instead of silently skipping the review');
+  assert.match(r.reason, /sandbox staging failed/);
+});
+
+// ---------- task 1002607: waitHealthy truth table ----------
+
+await ta('1002607 waitHealthy: 404 at the health URL is NOT healthy (was: anything < 500 passed)', async () => {
+  const r = await sbx.waitHealthy({ fetchImpl: async () => ({ status: 404 }), timeoutMs: 10, pollMs: 1 });
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /HTTP 404/);
+});
+
+await ta('1002607 waitHealthy: a 200 answered by the MAIN server (api healthz 200) is an impostor, not a healthy preview', async () => {
+  // The full server binds the same 127.0.0.1:3000 — root answers 200, and so does
+  // /api/gds/healthz. The game-only preview (ADR 0052) would 404 the latter.
+  const r = await sbx.waitHealthy({ fetchImpl: async () => ({ status: 200 }), timeoutMs: 1000, pollMs: 1 });
+  assert.equal(r.ok, false, 'a dead preview must not report healthy off the main server');
+  assert.match(r.reason, /MAIN server/);
+  assert.match(r.reason, /preview did not start/);
+});
+
+await ta('1002607 waitHealthy: a real preview (root 200, api healthz 404) is healthy', async () => {
+  const r = await sbx.waitHealthy({
+    fetchImpl: async (url) => ({ status: String(url).includes('/api/gds/healthz') ? 404 : 200 }),
+    timeoutMs: 1000, pollMs: 1,
+  });
+  assert.equal(r.ok, true);
+});
+
+await ta('1002607 waitHealthy: a discriminator probe that ERRORS counts as "not the main server" (preview healthy)', async () => {
+  const r = await sbx.waitHealthy({
+    fetchImpl: async (url) => {
+      if (String(url).includes('/api/gds/healthz')) throw new Error('ECONNREFUSED on a path the preview never mounts');
+      return { status: 200 };
+    },
+    timeoutMs: 1000, pollMs: 1,
+  });
+  assert.equal(r.ok, true, 'only a definite 200 on api healthz marks the impostor');
+});
+
+t('1002607 apiHealthzProbeUrl: same origin as the health URL, api path; null on garbage', () => {
+  assert.equal(sbx.apiHealthzProbeUrl('http://127.0.0.1:3000/'), 'http://127.0.0.1:3000/api/gds/healthz');
+  assert.equal(sbx.apiHealthzProbeUrl('http://127.0.0.1:3100/healthz'), 'http://127.0.0.1:3100/api/gds/healthz');
+  assert.equal(sbx.apiHealthzProbeUrl('not a url'), null);
+});
+
+t('1002607 NO_SANDBOX_MSG: names what is actually missing, not the builder\'s clone', () => {
+  assert.match(sbx.NO_SANDBOX_MSG, /src\/preview-server\.js/, 'names the missing entry file');
+  assert.match(sbx.NO_SANDBOX_MSG, /ADR 0052/, 'points at the contract that defines it');
+  assert.doesNotMatch(sbx.NO_SANDBOX_MSG, /this clone has no game preview entry/, 'the old your-clone-is-at-fault phrasing is gone');
 });
 
 // ---------- runShipGate: LOCAL preview context + recorded approval (task 1056) ----------
@@ -529,7 +590,8 @@ function localDeps(markerFile, overrides = {}) {
       writeFileSync: (p, d) => fs.writeFileSync(p, d),
     },
     execFileSync: (cmd, args, opts) => (cmd === 'git' ? execFileSync(cmd, args, opts) : ''),
-    fetchImpl: async () => ({ status: 200 }),
+    // task 1002607: preview-shaped mock — health 200, API-healthz discriminator 404.
+    fetchImpl: async (url) => ({ status: String(url).includes('/api/gds/healthz') ? 404 : 200 }),
     markerPath: markerFile,
     cwd: tmp,
     pollMs: 1,

package/tests/search_ingest.mjs

@@ -30,6 +30,13 @@ test('metic-tagging: read-sensitive doc surfaces → metic', () => {
   assert.equal(minRankForDoc('docs/audits/2026-06-08-server-security-audit.md'), 'metic');
   assert.equal(minRankForDoc('docs/adr/0016-trust-boundary-server-enforced-permissions.md'), 'metic');
   assert.equal(minRankForDoc('docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md'), 'metic');
+  // task 1002598: docs/governance/ holds the complete gate enumeration (the authority
+  // sweep) and the choke-point map, which catalogue live fail-open paths by file:line.
+  // Served at xenos they were a searchable exploitation index for the population they
+  // describe; the read floor matches security.report.adjudicate, where ADR 0158 §6
+  // sends the same class of detail.
+  assert.equal(minRankForDoc('docs/governance/rank-choke-point-map-2026-08-06.md'), 'metic');
+  assert.equal(minRankForDoc('docs/governance/authority-sweep-2026-07-24.md'), 'metic');
 });
 
 test('metic-tagging: ordinary docs → xenos (read-public)', () => {

package/tests/security_docs.mjs

@@ -18,8 +18,11 @@
 //     - the slug character-class regex rejects non-kebab slugs
 //
 //   Rank wiring (source assertion — mirrors tests/cli_token_reissue.mjs):
-//     - all three /security/docs* routes are auth.requireRank('archon')
-//     - route-rank-check pins them to 'archon' in EXPECTED_RANKS
+//     - all three /security/docs* routes gate on the atom
+//       auth.requirePermission('security.report.adjudicate') (BV1.R104; was
+//       requireRank('archon') and admitted exactly the same builders, ADR 0151)
+//     - that atom's floor moved archon→metic in ADR 0157, so the routes now classify
+//       'metic+archon' and are pinned BY ATOM (`perm:…`) rather than by rank
 //
 // We stub the pool by pre-seeding the require cache for src/db.js so the db
 // module under test never opens a socket — the same monkeypatch seam the repo
@@ -167,18 +170,37 @@ await test('slug character-class regex rejects non-kebab slugs', () => {
 
 console.log('\nsecurity_docs — rank wiring (source + pin):');
 
-await test('all three /security/docs* routes are requireRank(archon)', () => {
+await test('all three /security/docs* routes gate on security.report.adjudicate (metic floor)', () => {
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'routes', 'security.js'), 'utf8');
   const routes = rrc.classifyText(src).filter((r) => r.route.startsWith('/security/docs'));
   assert.equal(routes.length, 3, 'expected GET list, GET :slug, POST');
   for (const r of routes) {
-    assert.equal(r.rank, 'archon', `${r.key} must classify as archon (serves exploit detail)`);
+    // The ATOM is the authority once governance grows custom roles; the rank is what
+    // that atom's catalog floor resolves to today. Assert both, so neither a swapped
+    // atom nor an UNINTENDED floor edit can quietly widen who reads the exploit cookbook.
+    //
+    // ADR 0157 made that widening INTENTIONALLY: `security.report.adjudicate` moved
+    // archon→metic with the rest of the operational block, so the engagement-report
+    // store is now readable by the working rank. That is the one place in the ADR where
+    // delegation carries a genuine CONFIDENTIALITY cost rather than just an
+    // administrative one — every other delegated atom widens who may *act*, this one
+    // widens who may *read attacker-usable detail*. If that trade is unwanted, the fix
+    // is to split the atom the way ADR 0157 §4 split `gate_approval.read` off
+    // `gate_approval.decide`: keep a `security.docs.read` at archon for the cookbook and
+    // let report adjudication delegate. Recorded here so the next reader sees the choice
+    // rather than inferring it from a floor value.
+    assert.deepEqual(r.perms, ['security.report.adjudicate'],
+      `${r.key} must gate on the adjudicate atom (serves exploit detail)`);
+    assert.equal(r.rank, 'metic+archon', `${r.key} must classify as metic+archon (ADR 0157)`);
   }
 });
 
-await test('route-rank-check pins all three /security/docs* routes to archon', () => {
+await test('route-rank-check pins all three /security/docs* routes by atom', () => {
+  // Re-pinned from the rank 'archon' to the ATOM in ADR 0157: the invariant worth
+  // guarding is "these gate on the adjudicate permission", which survives a floor move.
   for (const key of ['GET /security/docs', 'GET /security/docs/:slug', 'POST /security/docs']) {
-    assert.equal(rrc.EXPECTED_RANKS[key], 'archon', `${key} must be pinned archon in EXPECTED_RANKS`);
+    assert.equal(rrc.EXPECTED_RANKS[key], 'perm:security.report.adjudicate',
+      `${key} must be pinned to the adjudicate atom in EXPECTED_RANKS`);
   }
 });
 

package/tests/sequence.mjs

@@ -13,6 +13,7 @@ const {
   topoOrder,
   chainFrom,
   haltReasons,
+  pickNext,
   summarize,
   MIN_SPEC_CHARS,
 } = require('../scripts/gds/sequence.js');
@@ -263,5 +264,68 @@ t('summarize tolerates missing numbers', () => {
     { count: 1, credits: 0, minutes: 0 });
 });
 
+// ------------------------------------------------------- pickNext (--next)
+
+// The live regression this closes (goal 1000030, 2026-08-05): a backlog task
+// sorted to position 0 and --next reported "nothing runnable" while two ready
+// tasks sat behind it.
+const GOAL_1000030 = () => [
+  task({ id: 1002556, status: 'backlog', title: 'perf: fold the resolve' }),
+  task({ id: 1001850, status: 'ready', title: 'R108 — collapse rank-tier maps' }),
+  task({ id: 1001858, status: 'ready', title: 'R110 — governance API routes' }),
+];
+const claimable = (...ids) => ({ rank: 'archon', claimableIds: new Set(ids) });
+
+t('pickNext offers the head when the head is clear', () => {
+  const plan = GOAL_1000030().slice(1);
+  const r = pickNext(plan, claimable(1001850, 1001858));
+  assert.equal(r.next.id, 1001850);
+  assert.deepEqual(r.skipped, []);
+});
+
+t('pickNext skips a blocked head and offers the first runnable task', () => {
+  const r = pickNext(GOAL_1000030(), claimable(1001850, 1001858));
+  assert.equal(r.next.id, 1001850, 'must not dead-end on the backlog task at position 0');
+  assert.equal(r.skipped.length, 1);
+  assert.equal(r.skipped[0].id, 1002556);
+});
+
+t('pickNext reports WHY each skipped task was passed over', () => {
+  const r = pickNext(GOAL_1000030(), claimable(1001850, 1001858));
+  assert.ok(r.skipped[0].reasons.some((x) => x.code === 'deps_unmet'));
+  assert.ok(r.skipped[0].title, 'skipped entries carry a title for the printout');
+});
+
+t('pickNext keeps topological order among the runnable — first clear wins', () => {
+  const r = pickNext(GOAL_1000030(), claimable(1001850, 1001858));
+  assert.equal(r.next.id, 1001850, 'not 1001858, which sorts later');
+});
+
+t('pickNext still halts when NOTHING in the plan clears', () => {
+  const plan = [
+    task({ id: 1, status: 'backlog' }),
+    task({ id: 2, status: 'shipped' }),
+    task({ id: 3, status: 'ready', requires_rank: 'archon' }),
+  ];
+  const r = pickNext(plan, { rank: 'xenos', claimableIds: new Set([3]) });
+  assert.equal(r.next, null);
+  assert.equal(r.skipped.length, 3, 'every task was tried');
+  assert.equal(r.head.id, 1, 'the head is preserved so the halt prints its reasons');
+});
+
+t('pickNext does not weaken a gate — a ready-but-unclaimable task is skipped, not offered', () => {
+  const plan = [task({ id: 9, status: 'ready' })];
+  const r = pickNext(plan, claimable(/* 9 absent from the claimable feed */));
+  assert.equal(r.next, null);
+  assert.ok(r.skipped[0].reasons.some((x) => x.code === 'not_claimable'));
+});
+
+t('pickNext on an empty plan returns no pick and nothing skipped', () => {
+  const r = pickNext([], claimable());
+  assert.equal(r.next, null);
+  assert.deepEqual(r.skipped, []);
+  assert.equal(r.head, null);
+});
+
 console.log(`\nsequence: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/session-cards.mjs

@@ -12,9 +12,10 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const hook = require('../.claude/hooks/session-cards.js');
+const hook = requireHostModule(require, '../.claude/hooks/session-cards.js');
 
 let passed = 0;
 let failed = 0;

package/tests/session_start_freshness.mjs

@@ -16,9 +16,10 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const { decideFreshness } = require('../.claude/hooks/session-start.js');
+const { decideFreshness } = requireHostModule(require, '../.claude/hooks/session-start.js');
 
 let passed = 0;
 let failed = 0;

package/tests/ship_broadcast_server.mjs

@@ -171,5 +171,67 @@ test('laptop deploy mode → never server-handled, even with server push (false)
   });
 });
 
-console.log(`\nship broadcast server (task 1045) tests: ${passed} passed, ${failed} failed`);
+// ---- 3. task 1002606: the strand notice (task.strand-flagged → Discord) ----
+// A strand previously had NO push channel — Discord fired only on task.shipped, so
+// a builder learned of a dead land at their next /builder-start, up to a session
+// later. These pin the poster the reconciler's task.strand-flagged listener fires.
+
+test('1002606 chooseStrandTargets: non-security strand → #ship-feed; line does NOT lead with #<id>', () => {
+  const t = shipBroadcast.chooseStrandTargets({ securitySensitive: false, taskId: 88, reason: 'strand:pr_closed_unmerged' });
+  assert.equal(t.length, 1);
+  assert.equal(t[0].channel, 'ship_feed');
+  assert.match(t[0].line, /task 88/);
+  assert.match(t[0].line, /strand:pr_closed_unmerged/);
+  // A LEADING #<id> is the applause marker (discord-reaction.parseShipMarker) —
+  // a strand must never collect 👍-votes as if it were shipped work.
+  assert.ok(!/^\s*#\d/.test(t[0].line), 'strand line must not start with a #<id> ship marker');
+});
+
+test('1002606 chooseStrandTargets: security strand → ONLY #security-ship-feed (reason can name an unpatched fix)', () => {
+  const t = shipBroadcast.chooseStrandTargets({ securitySensitive: true, taskId: 91, reason: 'strand:unresolvable_conflict:src/gds/auth.js' });
+  assert.equal(t.length, 1);
+  assert.equal(t[0].channel, 'security_ship_feed');
+  for (const { channel } of t) assert.ok(!PUBLIC_CHANNELS.has(channel));
+});
+
+await atest('1002606 postStrandNotice: posts to #ship-feed for a plain strand', async () => {
+  const { fn, calls } = fakePoster();
+  const res = await shipBroadcast.postStrandNotice(
+    { id: 88, builder_id: 7, security_sensitive: false, reason: 'strand:pr_closed_unmerged' },
+    { postWebhook: fn, log: quietLog }
+  );
+  assert.deepEqual(res.posted, ['ship_feed']);
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].line, /task 88/);
+});
+
+await atest('1002606 postStrandNotice: indeterminate security flag → FAIL CLOSED (no post)', async () => {
+  for (const sec of [null, undefined, 'true', 1]) {
+    const { fn, calls } = fakePoster();
+    const res = await shipBroadcast.postStrandNotice(
+      { id: 9, security_sensitive: sec, reason: 'strand:x' },
+      { postWebhook: fn, log: quietLog }
+    );
+    assert.equal(calls.length, 0, `flag=${String(sec)} must suppress`);
+    assert.equal(res.skipped, 'security_flag_indeterminate');
+  }
+});
+
+await atest('1002606 postStrandNotice: best-effort — a throwing webhook never propagates; no task → no_task', async () => {
+  const boom = async () => { throw new Error('webhook down'); };
+  let threw = false;
+  let res;
+  try {
+    res = await shipBroadcast.postStrandNotice(
+      { id: 10, security_sensitive: false, reason: 'strand:y' },
+      { postWebhook: boom, log: quietLog }
+    );
+  } catch (_) { threw = true; }
+  assert.equal(threw, false, 'postStrandNotice must never throw');
+  assert.deepEqual(res.posted, [], 'a failed post is not recorded as posted');
+  const { fn } = fakePoster();
+  assert.equal((await shipBroadcast.postStrandNotice(null, { postWebhook: fn, log: quietLog })).skipped, 'no_task');
+});
+
+console.log(`\nship broadcast server (task 1045 + 1002606) tests: ${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);

package/tests/ship_card.mjs

@@ -105,6 +105,72 @@ test('confirmed: info tone, auto-landing deploy, merge-mode override action', ()
   assert.equal(m.action.cmd, '/merge-mode');               // kept as an optional manual override
 });
 
+// ---- task 1002541: the card must never claim a bailed merge is landing ----
+//
+// The bug: deployText came from the STATUS alone, so a 'confirmed' task printed
+// "landing automatically" even when auto-merge had already given up — no PR, no
+// merge, and (ADR 0120, pay on land) no credits. The failure announced itself as
+// success, which is why these strands survived for days.
+const bailed = {
+  ...shippedInput,
+  postGradeStatus: 'confirmed',
+  land: { ok: false, pending: false, reason: 'the main checkout is on claude/foo, not main', nextStep: '/merge-mode' },
+};
+
+test('confirmed + bailed land: says NOT landed, names the reason, warns', () => {
+  const m = card.buildCardModel(bailed);
+  assert.equal(m.stage, 'confirmed');
+  assert.equal(row(m, 'Deploy'), 'NOT landed — the main checkout is on claude/foo, not main');
+  assert.equal(m.cfg.tone, 'warning');           // not the reassuring 'info'
+  assert.equal(m.cfg.statusWord, 'Not landed');
+  assert.match(m.cfg.headline(1266), /NOT landed/);
+});
+
+test('confirmed + bailed land: the bail reaches the printed monospace card', () => {
+  // The monospace card is the ALWAYS-printed fallback (headless, cron, dev box).
+  // If the reason stops at the model, the builder still never sees it.
+  const out = card.renderMonospaceCard(card.buildCardModel(bailed));
+  assert.match(out, /NOT landed/);
+  assert.ok(!/landing automatically/.test(out), 'the lie must not survive anywhere on the card');
+});
+
+test('confirmed + bailed land: the action is the bail-specific recovery command', () => {
+  const m = card.buildCardModel({
+    ...bailed,
+    land: { ok: false, pending: false, reason: 'no commits ahead of main', nextStep: 'node scripts/gds/ship.js 7 --db-only' },
+  });
+  assert.equal(m.action.cmd, 'node scripts/gds/ship.js 7 --db-only'); // beats the generic /merge-mode
+});
+
+test('confirmed + PENDING land still reads "landing automatically"', () => {
+  // A poll timeout with auto-merge armed is success-PENDING (task 1049): CI or the
+  // server reconciler really does finish it. Crying failure here would be a NEW
+  // lie in the opposite direction, and would train builders to ignore the warning.
+  const m = card.buildCardModel({ ...bailed, land: { ok: false, pending: true, reason: null, nextStep: null } });
+  assert.equal(row(m, 'Deploy'), 'landing automatically');
+  assert.equal(m.cfg.tone, 'info');
+  assert.equal(m.cfg.statusWord, 'Confirmed');
+});
+
+test('confirmed with NO land info is unchanged (back-compat)', () => {
+  // Older land-watch breadcrumbs replay stored cardInputs that have no `land` key,
+  // and other callers (resumeMerge, the claim card) may pass none. Absent ⇒ the
+  // pre-existing behaviour, byte for byte.
+  const m = card.buildCardModel({ ...shippedInput, postGradeStatus: 'confirmed', land: null });
+  assert.equal(row(m, 'Deploy'), 'landing automatically');
+  assert.equal(m.cfg.tone, 'info');
+  assert.equal(m.action.cmd, '/merge-mode');
+});
+
+test('a stale bailed land never overrides a task that DID reach shipped', () => {
+  // land-watch replays the breadcrumb after the server lands it; the status is
+  // then 'shipped' and the old bail is history. The card must show live, not NOT-landed.
+  const m = card.buildCardModel({ ...bailed, postGradeStatus: 'shipped' });
+  assert.equal(m.stage, 'shipped');
+  assert.equal(row(m, 'Deploy'), 'live · 967fb4a');
+  assert.equal(m.cfg.tone, 'success');
+});
+
 test('failed: danger tone, no credits, issue count, regrade action', () => {
   const m = card.buildCardModel({
     ...shippedInput, postGradeStatus: 'completed',

package/tests/ship_ci_deploy.mjs

@@ -44,7 +44,7 @@ function test(name, fn) {
   }
 }
 
-const { parseDeployMode, effectiveDeployMode, buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded, shouldBailOnFetchFailure, classifyLandOutcome, strandNextStep, pickStaleGateReviewRun, landPollAfterAutoMerge, reconciledCardStatus } = ship;
+const { parseDeployMode, effectiveDeployMode, buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded, shouldBailOnFetchFailure, classifyLandOutcome, strandNextStep, pickStaleGateReviewRun, landPollAfterAutoMerge, reconciledCardStatus, landed, landPending, landBailed, strandCommand, landPendingLines } = ship;
 
 // ---- 1. parseDeployMode precedence + safe default ----
 
@@ -266,6 +266,44 @@ test('reconciledCardStatus: status read failed (null) → keep the pre-merge sta
   assert.equal(reconciledCardStatus(undefined, 'confirmed'), 'confirmed');
 });
 
+// ---- 3d. the land outcome: why this is a 3-way object, not a boolean ----
+// task 1002541. The land chain used to answer true/false, so every bail site's
+// precise reason was discarded and the card fell back to the STATUS — printing
+// "landing automatically" over a merge that had already given up.
+
+test('landBailed carries the reason + the recovery command', () => {
+  const o = landBailed('the main checkout is on claude/foo, not main', '/merge-mode');
+  assert.equal(o.ok, false);
+  assert.equal(o.pending, false);
+  assert.equal(o.reason, 'the main checkout is on claude/foo, not main');
+  assert.equal(o.nextStep, '/merge-mode');
+});
+
+test('THE TRAP: every outcome is truthy, so consumers must test .ok', () => {
+  // mergeAndDeploy's guard used to be `if (!merged) return;`. With objects that
+  // check NEVER fires, so a bailed ship would fall through and POST /ship for a
+  // task that never landed. This is the assertion that catches a re-introduction.
+  assert.ok(landBailed('nope', '/merge-mode'), 'a bail object is truthy — !merged cannot detect it');
+  assert.ok(landPending(), 'a pending object is truthy too');
+  assert.equal(landBailed('nope', '/merge-mode').ok, false);
+  assert.equal(landPending().ok, false);
+  assert.equal(landed().ok, true);
+});
+
+test('pending is NOT a bail: no reason, so the card keeps "landing automatically"', () => {
+  // A poll timeout with auto-merge armed is success-pending (task 1049) — it does
+  // land on its own. The card gates its warning on `reason`, so this stays quiet.
+  const o = landPending();
+  assert.equal(o.pending, true);
+  assert.equal(o.reason, null);
+});
+
+test('strandCommand: a box gets the resume, a laptop gets /merge-mode', () => {
+  // /merge-mode needs gh + a main checkout a dev box doesn't have (task 1052).
+  assert.equal(strandCommand(77, 'server'), 'node scripts/gds/ship.js 77');
+  assert.equal(strandCommand(77, 'local'), '/merge-mode');
+});
+
 test('reconciledCardStatus: already shipped stays shipped', () => {
   assert.equal(reconciledCardStatus('shipped', 'shipped'), 'shipped');
 });
@@ -506,6 +544,33 @@ test('effectiveDeployMode: tolerates a missing options object (defaults to no fa
   assert.equal(effectiveDeployMode('laptop'), 'ci'); // canPushLocally undefined ⇒ falsy ⇒ fall back
 });
 
+// ---- task 1002606: the success-pending banner carries the strand-detection story ----
+// Finding P-3: the banner ended at "This is NOT a failure", so when a land DID die
+// (hand-written conflict, dead PR, red check) the builder's last signal said all was
+// well. The banner must keep the reassurance AND say how a real failure reaches them.
+
+test('1002606 landPendingLines: keeps the "NOT a failure" reassurance + the resume command', () => {
+  const lines = landPendingLines(940).join('\n');
+  assert.match(lines, /NOT a failure/);
+  assert.match(lines, /node scripts\/gds\/ship\.js 940/, 'the resume command names THIS task');
+});
+
+test('1002606 landPendingLines: tells the builder how a strand WILL reach them (needs_rebase + /builder-start)', () => {
+  const lines = landPendingLines(940).join('\n');
+  assert.match(lines, /CANNOT land on its own/i, 'the failure story is present');
+  assert.match(lines, /needs_rebase/, 'names the flag the reconciler sets');
+  assert.match(lines, /\/builder-start/, 'names WHERE the warning appears');
+  assert.match(lines, /release/, 'names the release exit too');
+});
+
+test('1002606 landPendingLines: merged variant says deploy-only', () => {
+  const merged = landPendingLines(1, { merged: true }).join('\n');
+  assert.match(merged, /and the PR has merged/);
+  assert.match(merged, /GitHub will deploy automatically/);
+  const unmerged = landPendingLines(1, {}).join('\n');
+  assert.match(unmerged, /GitHub will merge \+ deploy automatically/);
+});
+
 console.log('');
 console.log(`ship_ci_deploy: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);