@bongos/core 1.18.19 → 1.19.3

package/tests/provision.mjs

@@ -588,6 +588,176 @@ await ta('scaffoldStandaloneRepo: no owner token → falls back to the SSH origi
   }
 });
 
+// ── ADOPT vs GREENFIELD onboarding (ADR 0121, task 1002562) ───────────────────────
+// The runner used to run the greenfield scaffold unconditionally: `git init` a fresh tree
+// and push HEAD:main. Against a repo that already has history that is an unrelated-history
+// non-fast-forward, so adopting an existing repo could never succeed.
+
+t('onboardMode: adopt only when the row says so; anything else → greenfield (the SAFE default)', () => {
+  assert.equal(P.onboardMode({ onboard_mode: 'adopt' }), 'adopt');
+  assert.equal(P.onboardMode({ onboard_mode: 'greenfield' }), 'greenfield');
+  // A row written BEFORE provisioning_004 added the column, and any unrecognized value,
+  // must resolve to greenfield — which refuses to push over existing history — never to
+  // adopt, which would start layering onto a repo nobody declared as pre-existing.
+  assert.equal(P.onboardMode({}), 'greenfield');
+  assert.equal(P.onboardMode({ onboard_mode: null }), 'greenfield');
+  assert.equal(P.onboardMode({ onboard_mode: 'ADOPT' }), 'greenfield');
+  assert.equal(P.onboardMode({ onboard_mode: 'something-else' }), 'greenfield');
+  assert.equal(P.onboardMode(null), 'greenfield');
+});
+
+t('alreadyScaffolded: the marker is mode-dependent — package.json alone does NOT mean an adopt is done', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'marker-'));
+  try {
+    assert.equal(P.alreadyScaffolded(dir, 'greenfield'), false, 'no package.json → not scaffolded');
+    assert.equal(P.alreadyScaffolded(dir, 'adopt'), false);
+
+    // An ordinary existing Node project: package.json present, no core dep. Greenfield's
+    // marker would call this "done" — for ADOPT that is the bug this guards, because the
+    // layering would be skipped on the very first run and the instance never become bootable.
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: 'their-app', dependencies: { react: '^18' } }));
+    assert.equal(P.alreadyScaffolded(dir, 'greenfield'), true, 'greenfield: package.json IS the marker (unchanged)');
+    assert.equal(P.alreadyScaffolded(dir, 'adopt'), false, 'adopt: an existing project is NOT already adopted');
+
+    // Once the layer has added the core dep, adopt IS done. Both scope aliases count.
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ dependencies: { react: '^18', '@bongos/core': 'file:vendor/x.tgz' } }));
+    assert.equal(P.alreadyScaffolded(dir, 'adopt'), true);
+    writeFileSync(join(dir, 'package.json'), JSON.stringify({ dependencies: { '@cloudbongos/core': '^1.0.0' } }));
+    assert.equal(P.alreadyScaffolded(dir, 'adopt'), true, 'the @cloudbongos alias counts too');
+
+    // Unparseable → NOT already done, so the adopt layer runs and reports it, rather than
+    // silently skipping on a file it could not read.
+    writeFileSync(join(dir, 'package.json'), '{ not json');
+    assert.equal(P.alreadyScaffolded(dir, 'adopt'), false);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// Drive the scaffold in a given mode against a fresh base and return the joined argv.
+async function scaffoldInMode(mode, { token = null, seedRoot = null } = {}) {
+  const base = mkdtempSync(join(tmpdir(), `mode-${mode}-`));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    if (seedRoot) { mkdirSync(join(base, 'demo'), { recursive: true }); seedRoot(join(base, 'demo')); }
+    const { deps, cmds } = recorder({ apply: true });
+    const writes = [];
+    deps.writeFile = (p, body, opts) => { writes.push({ p, body, opts }); return { ok: true }; };
+    if (token) deps.getGithubToken = async () => ({ token, scope: 'read:user,repo' });
+    await P.scaffoldStandaloneRepo(
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7, onboard_mode: mode },
+      { ...deps, instanceRoot: base },
+    );
+    return { joined: cmds.join('\n'), cmds, writes, root: join(base, 'demo') };
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(base, { recursive: true, force: true });
+  }
+}
+
+await ta('scaffoldStandaloneRepo(adopt): CLONES the existing repo instead of git-init-ing a fresh tree', async () => {
+  const { joined } = await scaffoldInMode('adopt', { token: 'gho_TOK' });
+  assert.match(joined, /clone https:\/\/x-access-token@github\.com\/lars589\/demo\.git/, 'clones over the token URL (covers a PRIVATE repo the shared deploy key cannot read)');
+  assert.ok(!/git -C \S+ init -q/.test(joined), 'never git-inits a fresh tree on the adopt path — that is what produced the unrelated history');
+  assert.ok(!/checkout -B main/.test(joined), 'does not force-create the branch over the cloned one');
+  assert.match(joined, /init\.js --from .* --no-seed --adopt --accept /, 'materializes via init --adopt --accept (layering, accept-gated)');
+  // origin must end up as the SSH remote, like greenfield leaves it: the ongoing deploy
+  // (`git pull --ff-only origin main`, and the box timer's `git reset --hard origin/main`)
+  // reads origin, and the one-shot token URL cannot authenticate once its credential file
+  // is deleted.
+  assert.match(joined, /git -C \S+ remote set-url origin git@github-deploy:lars589\/demo\.git/, 'normalizes origin to the SSH remote after cloning');
+});
+
+// THE SAFETY PROPERTY. Since ADR 0155 this credential can write to EVERY repo the owner
+// owns, so a --force here would be a route to destroying a user's work. A rejected push is
+// the correct, recoverable outcome.
+await ta('scaffoldStandaloneRepo(adopt): NEVER force-pushes and never passes --force to init', async () => {
+  const { joined } = await scaffoldInMode('adopt', { token: 'gho_TOK' });
+  assert.ok(!/--force/.test(joined), 'no --force anywhere in the adopt argv');
+  assert.ok(!/ -f\b/.test(joined.replace(/rm -f /g, '')), 'no -f force shorthand (rm -f of the credential file excepted)');
+  assert.ok(!/\+refs|\+HEAD|:\+/.test(joined), 'no leading-+ refspec (the other way to force a push)');
+  assert.match(joined, /push https:\/\/x-access-token@github\.com\/lars589\/demo\.git HEAD:main/, 'a plain fast-forward push');
+});
+
+await ta('scaffoldStandaloneRepo(greenfield): unchanged — git init + --force, no clone', async () => {
+  const { joined } = await scaffoldInMode('greenfield', { token: 'gho_TOK' });
+  assert.match(joined, /git -C \S+ init -q/, 'still git-inits the empty repo');
+  assert.match(joined, /checkout -B main/);
+  assert.match(joined, /init\.js --from .* --no-seed --force /, 'greenfield keeps --force (safe on an empty repo)');
+  assert.ok(!/--adopt/.test(joined), 'no --adopt on the greenfield path');
+  assert.ok(!/ clone /.test(joined), 'nothing to clone from an empty repo');
+});
+
+await ta('scaffoldStandaloneRepo(adopt): no owner token → clones over the SSH remote (no credential helper)', async () => {
+  const { joined } = await scaffoldInMode('adopt');   // recorder default getGithubToken → null
+  assert.match(joined, /clone git@github-deploy:lars589\/demo\.git/, 'falls back to the SSH remote');
+  assert.ok(!/credential\.helper=/.test(joined), 'no credential helper without a token');
+  assert.match(joined, /push -u origin main/, 'and the SSH origin push');
+});
+
+await ta('scaffoldStandaloneRepo(adopt): does NOT clobber an existing .gitignore — appends only what the deploy needs', async () => {
+  const { writes } = await scaffoldInMode('adopt', {
+    token: 'gho_TOK',
+    seedRoot: (root) => writeFileSync(join(root, '.gitignore'), 'their-secrets/\ncoverage/\n'),
+  });
+  const gi = writes.find((w) => /\.gitignore$/.test(w.p));
+  assert.ok(gi, 'wrote .gitignore');
+  assert.match(String(gi.body), /their-secrets\//, 'the owner’s existing rules survive');
+  assert.match(String(gi.body), /coverage\//);
+  assert.match(String(gi.body), /node_modules\//, 'and the entries `npm ci` + the deploy require are added');
+});
+
+await ta('scaffoldStandaloneRepo(adopt): a default branch that is not `main` fails LOUDLY, not silently', async () => {
+  // The rest of provisioning is main-only (git pull --ff-only origin main; the box deploy
+  // does git reset --hard origin/main), so layering onto another branch would push somewhere
+  // the deploy never reads — a half-working instance with no error.
+  const base = mkdtempSync(join(tmpdir(), 'mode-branch-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    const { deps } = recorder({ apply: true });
+    deps.getGithubToken = async () => ({ token: 'gho_TOK', scope: 'repo' });
+    deps.exec = (cmd) => ({ ok: true, stdout: /rev-parse --abbrev-ref HEAD/.test(cmd) ? 'master\n' : '' });
+    await assert.rejects(
+      () => P.scaffoldStandaloneRepo(
+        { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7, onboard_mode: 'adopt' },
+        { ...deps, instanceRoot: base },
+      ),
+      /default branch is "master", not "main"/,
+    );
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+await ta('scaffoldStandaloneRepo(adopt): the credential file is removed even when a git step THROWS', async () => {
+  const base = mkdtempSync(join(tmpdir(), 'mode-cred-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    const { deps, cmds } = recorder({ apply: true });
+    deps.getGithubToken = async () => ({ token: 'gho_TOK', scope: 'repo' });
+    deps.exec = (cmd) => {
+      cmds.push(cmd);
+      if (/ push /.test(cmd)) throw new Error('remote rejected: non-fast-forward');
+      return { ok: true, stdout: '' };
+    };
+    await assert.rejects(
+      () => P.scaffoldStandaloneRepo(
+        { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7, onboard_mode: 'adopt' },
+        { ...deps, instanceRoot: base },
+      ),
+      /non-fast-forward/,
+    );
+    assert.match(cmds.join('\n'), /rm -f [^\n]*bongos-gitcred-demo/, 'a failed push must not leave the token on disk');
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
 await ta('provisionInstance is idempotent: an already-active instance is a no-op', async () => {
   const { deps, cmds } = recorder();
   const r = await P.provisionInstance({ ...coTenant, status: 'active' }, deps);

package/tests/provisioning_onboard_mode.mjs

@@ -0,0 +1,180 @@
+// tests/provisioning_onboard_mode.mjs
+//
+// The onboard_mode leg of brownfield onboarding (ADR 0121, task 1002562, migration
+// provisioning_004). Before this, greenfield-vs-adopt existed ONLY as a query param on
+// GET /provisioning/onboard-plan that chose which checklist TEXT to render — it was never
+// persisted, so the control-plane runner ran the greenfield scaffold unconditionally and
+// adopting an existing repo always failed as an unrelated-history non-fast-forward.
+//
+// Covers the two layers that carry the mode from the browser to the runner:
+//   • createInstance   — normalization (unknown/absent → greenfield) + what reaches SQL
+//   • POST /instances  — validation + threading, driven over a real mounted router
+//   • publicInstance   — the mode is readable back out (coalesced for pre-004 rows)
+//
+// DB-free: the pool is a recording fake and the data-access fns the route needs are
+// stubbed on the cached module object. No network.
+//
+// Run:  node tests/provisioning_onboard_mode.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const ROOT = new URL('..', import.meta.url).pathname;
+
+const provisioning = require(`${ROOT}/modules/provisioning/provisioning.js`);
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── createInstance: normalization + what actually reaches SQL ─────────────────────
+// A recording pool: capture the INSERT's params so we assert the STORED value, not just
+// the returned row (a normalization bug that only shows up in the column is the one that
+// would silently mislabel a row forever).
+function recordingDb(returnRow = {}) {
+  const calls = [];
+  return {
+    calls,
+    query: async (text, params) => {
+      calls.push({ text, params });
+      return { rows: [{ id: 1, owner_builder_id: 7, slug: 'demo', ...returnRow }] };
+    },
+  };
+}
+
+await ta('createInstance: onboardMode "adopt" is persisted', async () => {
+  const db = recordingDb();
+  await provisioning.createInstance(db, {
+    ownerBuilderId: 7, slug: 'demo', targetRef: 'lars589/demo',
+    hostingShape: 'standalone', onboardMode: 'adopt',
+  });
+  const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
+  assert.ok(insert, 'issued an INSERT');
+  assert.match(insert.text, /onboard_mode/, 'the column is in the INSERT');
+  assert.ok(insert.params.includes('adopt'), `'adopt' reached the INSERT params (got ${JSON.stringify(insert.params)})`);
+});
+
+await ta('createInstance: absent / unknown onboardMode → greenfield, the SAFE default', async () => {
+  // Greenfield refuses to push over existing history (no --force anywhere), so an
+  // unrecognized value must land there. Defaulting to 'adopt' would put the layering path
+  // on a repo nobody declared as pre-existing.
+  for (const mode of [undefined, null, '', 'ADOPT', 'brownfield', 'nonsense']) {
+    const db = recordingDb();
+    await provisioning.createInstance(db, {
+      ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', onboardMode: mode,
+    });
+    const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
+    assert.ok(insert.params.includes('greenfield'), `onboardMode=${JSON.stringify(mode)} → greenfield`);
+    assert.ok(!insert.params.includes('adopt'), `onboardMode=${JSON.stringify(mode)} must NOT become adopt`);
+  }
+});
+
+t('ONBOARD_MODES matches the provisioning_004 CHECK constraint', () => {
+  assert.deepEqual(provisioning.ONBOARD_MODES, ['greenfield', 'adopt']);
+});
+
+t('publicInstance: surfaces onboard_mode, coalescing a pre-004 row to greenfield', () => {
+  assert.equal(provisioning.publicInstance({ id: 1, onboard_mode: 'adopt' }).onboard_mode, 'adopt');
+  // A row read before the column existed (or a NULL) reads as greenfield — which is what
+  // it was, by construction: there was no other scaffold path.
+  assert.equal(provisioning.publicInstance({ id: 1 }).onboard_mode, 'greenfield');
+  assert.equal(provisioning.publicInstance({ id: 1, onboard_mode: null }).onboard_mode, 'greenfield');
+});
+
+// ── POST /provisioning/instances over a real mounted router ───────────────────────
+let lastCreateArgs = null;
+provisioning.createInstance = async (_db, args) => {
+  lastCreateArgs = args;
+  return { instance: { id: 42, owner_builder_id: 7, slug: args.slug, onboard_mode: args.onboardMode }, created: true };
+};
+provisioning.enqueueIntent = async () => ({ intent: { id: 1, state: 'pending' }, created: true });
+provisioning.recordEvent = async () => {};
+provisioning.getInstanceBySlug = async () => null;
+
+const api = require(`${ROOT}/src/module-api.js`);
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+
+const express = require('express');
+const provisioningRoutes = require(`${ROOT}/modules/provisioning/routes/provisioning.js`);
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+await ta('POST /instances: onboard_mode=adopt is threaded through to createInstance', async () => {
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', {
+    slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', onboard_mode: 'adopt',
+  });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'adopt');
+});
+
+await ta('POST /instances: onboard_mode absent → greenfield (unchanged behavior for every existing caller)', async () => {
+  lastCreateArgs = null;
+  const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'standalone' });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs && lastCreateArgs.onboardMode, 'greenfield');
+});
+
+await ta('POST /instances: an unknown onboard_mode is REFUSED (never silently coerced)', async () => {
+  // Coercing here would be worse than refusing: the caller believes it asked for one thing
+  // and the runner does another. The route names the valid set so the client can fix itself.
+  const res = await post('/provisioning/instances', {
+    slug: 'demo', hosting_shape: 'standalone', target_ref: 'a/b', onboard_mode: 'brownfield',
+  });
+  assert.equal(res.status, 400);
+  assert.equal(res.body.error.code, 'bad_onboard_mode');
+  assert.deepEqual(res.body.error.valid, ['greenfield', 'adopt']);
+});
+
+await ta('POST /instances: adopt WITHOUT target_ref is refused — there is no repo to layer onto', async () => {
+  // Without target_ref the runner would fall back to greenfield behavior on a row labelled
+  // adopt. Refuse at the door rather than store a lie.
+  for (const body of [
+    { slug: 'demo', hosting_shape: 'standalone', onboard_mode: 'adopt' },
+    { slug: 'demo', hosting_shape: 'standalone', onboard_mode: 'adopt', target_ref: '   ' },
+  ]) {
+    const res = await post('/provisioning/instances', body);
+    assert.equal(res.status, 400, `expected 400 for ${JSON.stringify(body)}`);
+    assert.equal(res.body.error.code, 'target_ref_required_for_adopt');
+  }
+});
+
+server.close();
+console.log(`\nprovisioning_onboard_mode: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/publish_manifest.mjs

@@ -211,6 +211,9 @@ t('no publishable test statically imports an excluded module (R89 boundary)', ()
   const offenders = [];  // …and are still publishable (the actual failure)
   for (const name of fs.readdirSync(testsDir)) {
     if (!/\.(mjs|js|cjs)$/.test(name)) continue;
+    // Skip self: the regex specimens below are deliberate full import forms;
+    // this file's real imports pull scripts/gds code only, never modules/.
+    if (name === 'publish_manifest.mjs') continue;
     const rel = `tests/${name}`;
     const bad = new Set();
     let m; IMPORT_RE.lastIndex = 0;
@@ -225,9 +228,19 @@ t('no publishable test statically imports an excluded module (R89 boundary)', ()
       offenders.push(`${rel} imports excluded module(s) [${[...bad].sort().join(', ')}] but is still PUBLISHABLE — add it to CONTENT_EXCLUDE (task 2147)`);
     }
   }
-  // non-vacuous: the scan must actually SEE the known host tests (a broken regex that
-  // matched nothing would otherwise pass silently). The 7 game/art tests are the floor.
-  assert.ok(detected.length >= 7, `expected ≥7 host-module tests detected, saw ${detected.length} — the import scan may be broken`);
+  // non-vacuous: prove the regex itself extracts a module key from every import
+  // form it claims to cover. A repo-state floor ("must see ≥7 host tests") went
+  // stale the moment the host-module tests moved to modules/<key>/tests/ under
+  // ADR 0107 — tests/ can legitimately contain zero live specimens (task 1002611).
+  for (const [specimen, key] of [
+    [`const x = require('../modules/game/db.js')`, 'game'],
+    [`import x from '../../modules/art-pipeline/pipeline/palette.js'`, 'art-pipeline'],
+    [`const y = await import('./modules/some-key/loader.js')`, 'some-key'],
+  ]) {
+    IMPORT_RE.lastIndex = 0;
+    const m = IMPORT_RE.exec(specimen);
+    assert.ok(m && (m[2] || m[4]) === key, `import scan no longer matches: ${specimen}`);
+  }
   assert.equal(offenders.length, 0, '\n        ' + offenders.join('\n        '));
 });
 

package/tests/publish_reconciler.mjs

@@ -58,7 +58,7 @@ function mkDeps({
   refreshStaleImpl,
   healAttempts = new Map(),
 } = {}) {
-  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], flag: [], logs: [], errors: [] };
+  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], flag: [], events: [], logs: [], errors: [] };
   // isSafeBranch mirrors github-push's pattern enough for the test (rejects
   // option-like / traversal refs); we use the REAL module so the contract can't drift.
   const githubPush = require('../modules/lifecycle/github-push.js');
@@ -108,23 +108,33 @@ function mkDeps({
         return !!a;
       },
       // task 1547 per-task land proof. Mirrors the real github-push.landProvenForTask
-      // shape but routes its ONE network hop (the ancestry compare) through the mock
+      // shape but routes its network hops (the ancestry compares) through the mock
       // above so the sweep stays DB/network-free, and reuses the REAL prReferencesTask
       // so that pure check can't drift. publishedSha (the server-pushed tip) is the
-      // robust proof; the matched-PR-references-this-task fallback covers a legacy /
-      // in-flight row with no recorded tip.
+      // robust proof; task 1002615 adds the merged-PR merge-commit proof (out-of-band /
+      // squash land) and gates the no-tip reference fallback on merged:true, because
+      // the sweep now consults this proof even while a PR is still in flight.
       landProvenForTask: async ({ taskId, publishedSha, status }) => {
-        if (publishedSha && /^[0-9a-f]{7,64}$/.test(String(publishedSha))) {
+        const hasTip = !!(publishedSha && /^[0-9a-f]{7,64}$/.test(String(publishedSha)));
+        if (hasTip) {
           calls.ancestry.push(publishedSha);
           const a = ancestryBySha[publishedSha];
           if (a instanceof Error) throw a;
-          return a
-            ? { proven: true, reason: `published tip ${publishedSha.slice(0, 8)} in main` }
-            : { proven: false, reason: `published tip ${publishedSha.slice(0, 8)} not in main` };
+          if (a) return { proven: true, reason: `published tip ${publishedSha.slice(0, 8)} in main` };
         }
-        return githubPush.prReferencesTask(status, taskId)
+        if (status && status.merged === true && githubPush.prReferencesTask(status, taskId)
+            && status.merge_sha && /^[0-9a-f]{7,64}$/.test(String(status.merge_sha))) {
+          calls.ancestry.push(status.merge_sha);
+          const m = ancestryBySha[status.merge_sha];
+          if (m instanceof Error) throw m;
+          if (m) return { proven: true, reason: `merged PR for task ${taskId} — merge in main (out-of-band/squash land)` };
+        }
+        if (hasTip) {
+          return { proven: false, reason: `published tip ${publishedSha.slice(0, 8)} not in main` };
+        }
+        return (status && status.merged === true && githubPush.prReferencesTask(status, taskId))
           ? { proven: true, reason: `matched PR references task ${taskId}` }
-          : { proven: false, reason: `no published tip and matched PR does not reference task ${taskId}` };
+          : { proven: false, reason: `no published tip and no merged PR references task ${taskId}` };
       },
     },
     // task.shipped is emitted on the kernel seam now; the discord module's listener
@@ -133,6 +143,9 @@ function mkDeps({
     // broadcastImpl REPLACES the default push (the throwing-broadcast test relies
     // on that to prove the reconcile stands even when the listener throws).
     emit: async (event, task) => {
+      // task 1002606: record EVERY seam event so the strand push channel
+      // (task.strand-flagged) is observable alongside task.shipped.
+      calls.events.push({ event, payload: task });
       if (event !== 'task.shipped') return;
       if (broadcastImpl) return broadcastImpl(task);
       calls.broadcast.push(task.id);
@@ -307,6 +320,50 @@ test('1002472 merged + deploy unconfigured but tip NOT in main → NO ship (1547
   assert.equal(deps._calls.ship.length, 0);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002615 (idea 1000613) — a land made OUT-OF-BAND must still ship.
+// The 2026-07-29 reproduction: ship → confirmed → PR merged by the owner through
+// the web UI → the work verified on main → the task sat at 'confirmed' for 9+ min
+// (forever), builder unpaid, until a manual POST /ship.
+// ---------------------------------------------------------------------------
+const MERGE_SHA = 'c'.repeat(40);
+
+test('1002615 web-UI squash merge (tip rewritten, PR merged) → ships via the merge-commit proof', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 80, builder_id: 3, worktree_name: 'wt-squash', published_head_sha: NOT_ON_MAIN }],
+    statusByBranch: { 'claude/wt-squash': { ...landedPrFor(80), deploy_status: 'unconfigured', merge_sha: MERGE_SHA } },
+    ancestryBySha: { [NOT_ON_MAIN]: false, [MERGE_SHA]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'a squash-rewritten land must not strand unpaid');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 80, builderId: 3 }]);
+  assert.deepEqual(deps._calls.broadcast, [80]);
+});
+
+test('1002615 manual git merge to main, PR closed un-merged → tip ancestry ships it (prNotLanded no longer suppresses the proof)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 81, builder_id: 3, worktree_name: 'wt-oob', published_head_sha: ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-oob': { pr_state: 'closed', merged: false, merge_sha: null, deploy_status: 'pending' } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'work on main behind a dead PR must still land');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 81, builderId: 3 }]);
+});
+
+test('1002615 the reuse guard holds: merged PR for a DIFFERENT task + tip not in main → NO ship', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 82, builder_id: 3, worktree_name: 'wt-reused', published_head_sha: NOT_ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-reused': { ...landedPrFor(999), deploy_status: 'unconfigured', merge_sha: MERGE_SHA } },
+    ancestryBySha: { [NOT_ON_MAIN]: false, [MERGE_SHA]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'the merge-commit proof must bind to THIS task');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
 test('getPublishStatus throws (transient) → swallowed, sweep continues to the next task', async () => {
   const deps = mkDeps({
     rows: [
@@ -906,6 +963,120 @@ test('1002461 the WARN re-arms once a credential appears and then disappears aga
   assert.equal(badAgain._calls.errors.length, 1, 'a credential LOSS after a healthy period must warn again');
 });
 
+// ---------------------------------------------------------------------------
+// task 1002606 (finding P-3, the DETECTION half) — a strand reaches its builder
+// when it is DETECTED, not at the 30-minute stale WARN. Definitive shapes flag
+// needs_rebase on the sweep that sees them AND emit task.strand-flagged (the
+// push channel Discord listens on); ambiguous shapes keep the 30-min grace.
+// ---------------------------------------------------------------------------
+
+test('1002606 a hand-written conflict flags needs_rebase IMMEDIATELY (not at the 30-min WARN), with the file list', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 500, builder_id: 6, worktree_name: 'wt-hand', title: 'x', security_sensitive: false,
+             confirmed_at: new Date().toISOString() }], // FRESH — no stale grace involved
+    mergeByBranch: { 'claude/wt-hand': { merged: false, merged_now: false, number: 500, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({ resolved: false, skipped: 'unresolvable_conflict', conflicted: ['src/bongos/db.js'] }),
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 1, 'flagged on THIS sweep, minutes after the conflict — not 30 later');
+  assert.equal(deps._calls.flag[0].taskId, 500);
+  assert.match(deps._calls.flag[0].reason, /^strand:unresolvable_conflict:src\/bongos\/db\.js/, 'the reason names the conflicted file so /builder-start says WHERE');
+  assert.ok(deps._calls.errors.some((m) => /STRAND task 500/.test(m) && /hand-written conflict/.test(m)), 'WARN\'d with the concrete cause');
+  assert.equal(r.strandsFlagged, 1);
+  assert.equal(r.reconciled, 0, 'a conflicted PR still never ships');
+});
+
+test('1002606 every NEW needs_rebase flag emits task.strand-flagged (the push channel)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 501, builder_id: 6, worktree_name: 'wt-hand2', title: 'the title', security_sensitive: true,
+             confirmed_at: new Date().toISOString() }],
+    mergeByBranch: { 'claude/wt-hand2': { merged: false, merged_now: false, number: 501, reason: 'merge_conflict' } },
+    conflictResolveImpl: async () => ({ resolved: false, skipped: 'unresolvable_conflict', conflicted: ['a.js'] }),
+  });
+  await reconciler.runSweep(deps);
+  const strandEvents = deps._calls.events.filter((e) => e.event === 'task.strand-flagged');
+  assert.equal(strandEvents.length, 1, 'exactly one push event per new flag');
+  assert.equal(strandEvents[0].payload.id, 501);
+  assert.equal(strandEvents[0].payload.builder_id, 6);
+  assert.equal(strandEvents[0].payload.security_sensitive, true, 'the security flag rides along so the listener can route safely');
+  assert.match(strandEvents[0].payload.reason, /^strand:unresolvable_conflict/);
+});
+
+test('1002606 an ALREADY-flagged strand does not re-emit (flagTaskNeedsRebase idempotence gates the event)', async () => {
+  const old = new Date(Date.now() - 50 * 3_600_000).toISOString();
+  const deps = mkDeps({
+    rows: [{ task_id: 502, builder_id: 6, worktree_name: null, published_head_sha: null, confirmed_at: old }],
+  });
+  deps.db.flagTaskNeedsRebase = async () => false; // already flagged on a prior sweep
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.events.filter((e) => e.event === 'task.strand-flagged').length, 0,
+    'a re-sweep of a flagged strand must not spam the channel');
+  assert.ok(deps._calls.errors.some((m) => /STRAND task 502/.test(m) && /needs_rebase already set/.test(m)),
+    'the WARN line still fires for journal visibility');
+});
+
+test('1002606 a PR CLOSED without merging is DEFINITIVE — flagged fresh, no 30-min grace', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 503, builder_id: 8, worktree_name: 'wt-deadpr', published_head_sha: NOT_ON_MAIN,
+             confirmed_at: new Date().toISOString() }], // FRESH
+    statusByBranch: { 'claude/wt-deadpr': { pr_state: 'closed', merged: false, merge_sha: null, deploy_status: 'none' } },
+    ancestryBySha: { [NOT_ON_MAIN]: false }, // and the work is NOT on main out-of-band
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.deepEqual(deps._calls.flag, [{ taskId: 503, reason: 'strand:pr_closed_unmerged' }],
+    'a dead PR will never land on its own — the builder is told now');
+  assert.ok(deps._calls.errors.some((m) => /STRAND task 503/.test(m) && /closed without merging/.test(m)));
+  assert.equal(r.strandsFlagged, 1);
+  assert.equal(r.staleStrands, 0, 'not an AGED strand — this is the immediate path');
+});
+
+test('1002606 the 1002615 out-of-band land still wins over the dead-PR flag (proof runs first)', async () => {
+  // Same closed-unmerged PR shape, but the work IS on main — it must ship, not flag.
+  const deps = mkDeps({
+    rows: [{ task_id: 504, builder_id: 8, worktree_name: 'wt-oob2', published_head_sha: ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-oob2': { pr_state: 'closed', merged: false, merge_sha: null, deploy_status: 'none' } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'landed work behind a dead PR ships (1002615)');
+  assert.equal(deps._calls.flag.length, 0, 'a landed task is never flagged');
+});
+
+test('1002606 an OPEN PR still gets the grace — fresh, not flagged (CI may be legitimately running)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 505, builder_id: 8, worktree_name: 'wt-open2', confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-open2': PENDING },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 0, 'an in-flight open PR is not a definitive strand');
+  assert.equal(r.strandsFlagged, 0);
+});
+
+test('1002606 a MERGED PR mid-deploy keeps the grace (merged=true never hits the dead-PR path)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 506, builder_id: 8, worktree_name: 'wt-middeploy', published_head_sha: ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-middeploy': { pr_state: 'closed', merged: true, merge_sha: 'cafe1234', deploy_status: 'pending' } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.flag.length, 0, 'a merge whose deploy is finishing is the NORMAL landing window');
+  assert.equal(r.reconciled, 0, 'the deploy gate still governs (1002615 exception intact)');
+});
+
+test('1002606 the aged stale strand now ALSO emits task.strand-flagged', async () => {
+  const old = new Date(Date.now() - 50 * 3_600_000).toISOString();
+  const deps = mkDeps({
+    rows: [{ task_id: 507, builder_id: 9, worktree_name: null, published_head_sha: null, confirmed_at: old }],
+  });
+  await reconciler.runSweep(deps);
+  const strandEvents = deps._calls.events.filter((e) => e.event === 'task.strand-flagged');
+  assert.equal(strandEvents.length, 1);
+  assert.equal(strandEvents[0].payload.id, 507);
+  assert.match(strandEvents[0].payload.reason, /^strand:no_branch_no_tip/);
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);