@bongos/core 1.19.1032 → 1.19.1034

package/scripts/gds/ship-flow.js

@@ -18,7 +18,7 @@ const { captureSurpriseLearning, promptSurprise } = require('./ship-surprise.js'
 // task 1003109: the optional `--visual` leg of a ship (goal 1000072).
 const shipVisual = require('./ship-visual.js');
 const { gitOk } = require('./ship-git.js');
-const { autoLinkifyChangedDocs, mergeMainIntoBranch, preflight } = require('./ship-preflight-steps.js');
+const { autoLinkifyChangedDocs, mergeMainIntoBranch, preflight, shipInputPaths } = require('./ship-preflight-steps.js');
 const { applyBaseOverride, computeChangedFiles, computeGraderBaseline, runSmokeAsync } = require('./ship-grade.js');
 const { buildPriorRoundContext, computeGradeResult, gradeAndRecord, printCreditsAndAchievements, printGradeOutcome } = require('./ship-grade-steps.js');
 const { apiErrorLine, normalizeApiError, isUnknownFieldRejection } = require('./ship-io.js');
@@ -196,7 +196,9 @@ async function shipMain() {
   // ---- Step 0: preflight (working tree + branch freshness) ----
   console.log(`Verifying claim #${ac.claim_id} on task #${ac.task_id}: ${ac.title}`);
   console.log('Preflight (working tree + branch freshness)...');
-  const pre = preflight(ac, { force });
+  // task 1001436: inputFiles keeps --notes-file/--summary-file/--visual out of the
+  // preflight's untracked-file warning — they are this ship's input, not its artifact.
+  const pre = preflight(ac, { force, inputFiles: shipInputPaths(args) });
   if (!pre.ok) {
     console.error('');
     console.error(`Ship aborted: ${pre.reason}. No claim resolved, no credits awarded.`);
@@ -929,7 +931,7 @@ async function regradeMain() {
   // if the local ship/grade tooling is behind main (a stale grader silently
   // fails the same way — the #662 lesson). --force overrides the freshness leg.
   console.log('Preflight (working tree + branch freshness)...');
-  const pre = preflight(claimLike, { force });
+  const pre = preflight(claimLike, { force, inputFiles: shipInputPaths(args) });
   if (!pre.ok) {
     console.error('');
     console.error(`Re-grade aborted: ${pre.reason}. Task stays at completed.`);

package/scripts/gds/ship-grade-steps.js

@@ -20,6 +20,8 @@ const { plainCardLines } = require('./plain-cards.js');
 // gives, and the two can never drift.
 const { preflightChecks } = require('./preflight.js');
 const { computeRawDiffHash, reconstructPanelIssues, runNoArtifactGrader, runSubagentGrader, shouldReuseGrade } = require('./ship-grade.js');
+// task 1002903: the severity gate's own reading of which low scores had no finding.
+const { unbackedLowScores } = require('../../modules/grading/grader-workers/worker-verdict.js');
 
 // ---------- Shared grade-step helpers (used by shipMain AND regradeMain) ----------
 //
@@ -396,6 +398,37 @@ function formatGradeOutcome(g, taskId, cliFinding = null) {
     return out.join('\n');
   }
 
+  // task 1002903: a reviewer scored below threshold and named NO major/blocker
+  // finding, so the severity gate (task 1002663) downgraded it — the ship parks for
+  // a human rather than hard-failing. The ordinary block below would print "FAIL"
+  // and "Fix the issues above" over an empty list, which is how task 1002721's
+  // builder read a real grade as a broken one. Sits below the outage and
+  // authorization shapes, and steps aside when any finding IS substantive or a
+  // gating worker hard-failed (then the ordinary block and its findings apply).
+  // The record's own list wins; the workers are the fallback for a grade written
+  // before signals.unbacked_scores existed.
+  const gradeThreshold = Number(g.threshold);
+  const unbacked = Array.isArray(g.signals?.unbacked_scores)
+    ? g.signals.unbacked_scores
+    : Number.isFinite(gradeThreshold) ? unbackedLowScores(g.signals?.workers, { threshold: gradeThreshold }) : [];
+  const hasSubstantive = (g.issues || []).some((i) => i && (i.severity === 'blocker' || i.severity === 'major'));
+  if (!g.passed && unbacked.length > 0 && !hasSubstantive && g.signals?.panel_outcome !== 'fail') {
+    out.push('');
+    out.push(`Subagent grade: NOT PASSED — UNBACKED LOW SCORE  ·  a reviewer scored below ${g.threshold ?? '?'} without naming a finding — NOT a findings-backed rejection`);
+    for (const u of unbacked) {
+      out.push(`  ${u.kind}: ${u.axis} ${u.score}/10 — no major or blocker finding stands behind it`);
+    }
+    if (g.notes_md) out.push(g.notes_md.split('\n').map((l) => '  ' + l).join('\n'));
+    out.push('');
+    out.push('There is nothing listed to fix. The severity gate does not let an unbacked score hard-fail a ship, so the task stays at completed for a human instead.');
+    out.push('Re-grade once — an unbacked score often does not repeat:');
+    out.push(`  node scripts/gds/ship.js ${taskId} --regrade`);
+    out.push('If it repeats on work you can defend, file an override-request with your evidence (recorded; an Archon decides):');
+    out.push(`  node scripts/gds/api.js POST /api/bongos/tasks/${taskId}/override-request --body-file rationale.json   # {"rationale":"<why the grade is wrong, specifically>"}`);
+    out.push(...plainCardLines('grade_unbacked_score'));
+    return out.join('\n');
+  }
+
   const verdict = g.passed ? 'PASS' : 'FAIL';
   out.push('');
   out.push(`Subagent grade: ${verdict}  ·  blended ${g.score}/10  ·  threshold ${g.threshold} (both axes)`);

package/scripts/gds/ship-land.js

@@ -16,6 +16,9 @@ const { gitArgvOk, gitOk, sanitizeGitHubRefs, shellOk } = require('./ship-git.js
 const { buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded, deployedCommitStatus, fetchDeployedVersion, ghArgvOk, ghJson, pushVia, resolveInstanceBase } = require('./ship-deploy-target.js');
 const { normalizeApiError } = require('./ship-io.js');
 const { plainCardLines } = require('./plain-cards.js');
+// The server's own reader of a PR's check rollup (task 1003988), reused so the laptop
+// poll names a red PR exactly the way publish-status does (task 1003764). Dependency-free.
+const { readCheckRollup, UNIT_REPORT_CONTEXT } = require('../../modules/lifecycle/check-rollup.js');
 
 // ---------- the land outcome (task 1002541, part 1) ----------
 //
@@ -284,7 +287,19 @@ function strandNextStep(taskId, via) {
 // too: the server flags a strand needs_rebase (definitive shapes within a sweep,
 // ambiguous ones at ~30 min), /builder-start warns, and new claims gate on it.
 // Pure + exported so the wording is pinned by tests/ship_ci_deploy.mjs.
-function landPendingLines(taskId, { merged } = {}) {
+//
+// task 1003764: `red` — the PR was RED on the poll's last read. "NOT a failure" is then
+// false: a required check that failed does not pass by waiting, so the banner says the
+// land is stuck on it and defers to the red lines above for the remedy.
+function landPendingLines(taskId, { merged, red } = {}) {
+  if (red) {
+    return [
+      '  ci-land: Published, but the PR is RED (the check named above), so it has NOT merged and will not',
+      '  until that check passes. The task stays at \'confirmed\'. Do what the lines above say, then re-run',
+      `  \`node scripts/gds/ship.js ${taskId}\` — it resumes from here (task 941). If it stays red, the server flags`,
+      '  the task needs_rebase — /builder-start will warn you and new claims are gated until it lands or is released.',
+    ];
+  }
   return [
     `  ci-land: ✓ Published — auto-merge is armed${merged ? ' and the PR has merged' : ''}. This is NOT a failure.`,
     `  CI is still finishing; GitHub will ${merged ? 'deploy' : 'merge + deploy'} automatically once the required checks pass,`,
@@ -298,7 +313,9 @@ function landPendingLines(taskId, { merged } = {}) {
 function printLandPending(taskId, opts = {}) {
   console.log('');
   for (const line of landPendingLines(taskId, opts)) console.log(line);
-  for (const line of plainCardLines('land_pending')) console.log(line);
+  // The land_pending card says there is nothing to do, which a red PR makes untrue; the
+  // red line already printed the failing_check card (task 1003764).
+  if (!opts.red) for (const line of plainCardLines('land_pending')) console.log(line);
 }
 
 // task 1002645 — the honest close-out when the PR MERGED but the server refused the
@@ -349,9 +366,150 @@ function redPrLine(md) {
 // redPrLines — the red line followed by the same reason in plain words (task 1003989).
 // The card is keyed on the merge reason; when the failing tests were readable that
 // reason is `failing_check:<name>`, which resolves to the failing_check card.
-function redPrLines(md) {
+// task 1003764: the merge trap sits between them. `opts` = { taskId, via } for its wording.
+function redPrLines(md, opts = {}) {
   const red = redPrLine(md);
-  return red ? [red, ...plainCardLines((md && md.reason) || 'failing_check')] : [];
+  return red ? [red, ...mergeTrapLines(md, opts), ...plainCardLines((md && md.reason) || 'failing_check')] : [];
+}
+
+// The unit tests that gate GENERATED files — each compares a committed artifact with a
+// fresh build of it. `fitness` holds the combined gate (fitness.js "generated artifacts
+// fresh": copy registry, API docs, file map, nested CLAUDE.md blocks, the §13 snippet).
+// tests/ship_land_red_pr.mjs fails if one of these names stops being a real test file.
+const FRESHNESS_TESTS = new Set(['fitness', 'api_docs', 'api_client', 'file_map', 'repo_map', 'session_index', 'interaction_posture']);
+
+// failingTestNames — "2 failed: a, b" (the unit-report line, run-unit-tests.js
+// describeFailures) → ['a', 'b']. A line cut at the status limit ends in '…'; the cut
+// name is dropped rather than guessed at. Pure.
+function failingTestNames(text) {
+  const m = /^\s*\d+\s+failed:\s*(.*)$/.exec(String(text || ''));
+  if (!m) return [];
+  const names = m[1].split(',').map((s) => s.trim()).filter(Boolean);
+  if (names.length && names[names.length - 1].endsWith('…')) names.pop();
+  return names;
+}
+
+// mergeTrapLines — task 1003764. CI tests the MERGE, not the branch: a pull_request run
+// checks out the PR merged into the CURRENT main, so a branch that was green when pushed
+// goes red when main moves under it, and re-running the test on the branch shows nothing
+// wrong. Task 1003747's land sat "waiting" for ~20 minutes of git archaeology on exactly
+// that — main moved six commits, the copy registry went stale in the merged tree only.
+// Every red PR gets the trap named; a failing freshness gate also gets its healing command,
+// which differs by push path (a credential-less machine cannot merge main locally, and the
+// server heals it for them — publish-reconciler refreshStaleGenerated). Pure + exported.
+function mergeTrapLines(md, { taskId = '<id>', via = 'local' } = {}) {
+  const lines = [
+    '  ci-land: CI tests your branch MERGED with the current main, not the branch alone — if the failure',
+    via === 'server'
+      ? '  does not reproduce on your branch, main moved under the PR after it was pushed.'
+      : '  does not reproduce on your branch, main moved under it: `git fetch origin && git merge origin/main`, then re-run it.',
+  ];
+  const gates = failingTestNames(md && md.failing_tests).filter((n) => FRESHNESS_TESTS.has(n));
+  if (!gates.length) return lines;
+  const named = gates.map((g) => `\`${g}\``).join(', ');
+  lines.push(`  ci-land: ${named} ${gates.length > 1 ? 'are freshness gates' : 'is a freshness gate'}, so "fix it" here means regenerate: a generated file (copy`);
+  lines.push('  registry, API docs, repo map…) is stale in the MERGED tree even though your branch was fresh.');
+  if (via === 'server') {
+    lines.push('  The server regenerates stale generated files on the merged tree itself (every ~5 min, up to 3 tries),');
+    lines.push('  so this usually clears without you; if it stays red the server flags the task needs_rebase.');
+  } else {
+    lines.push(`  Heal it: \`git fetch origin && git merge origin/main\`, then re-run \`node scripts/gds/ship.js ${taskId}\` — the ship`);
+    lines.push('  regenerates every generated file on the merged tree before it pushes (`node scripts/gds/ship-check.js` shows which).');
+  }
+  lines.push('  A busy main can re-stale it while CI re-runs; a repeat is that race, not a new fault.');
+  return lines;
+}
+
+// redBlocksMerge — is this red the kind that stops the merge? A failing REQUIRED check
+// (`failing_check…`) does; a failing optional one does not (GitHub still merges an UNSTABLE
+// PR), so only the first may turn the closing banner red (task 1003764). Pure + exported.
+function redBlocksMerge(md) {
+  return /^failing_check/.test(String((md && md.reason) || ''));
+}
+
+// A check conclusion (CheckRun) or state (status context) that means FAILED. Pending and
+// expected are waiting, not red — reporting them as failures would be the mirror image of
+// the bug this names (a failure dressed as waiting).
+const RED_CONCLUSIONS = new Set(['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', 'ACTION_REQUIRED', 'STARTUP_FAILURE']);
+
+// localMergeDriver — task 1003764. The laptop path watches its PR with the builder's own
+// gh, and read only state + mergeCommit, so a red required check was invisible for the
+// whole wait. This reads `gh pr view --json statusCheckRollup,mergeStateStatus,headRefOid`
+// through the server's parser and answers in publish-status's merge_driver shape, so both
+// poll paths hand redPrLines the same thing. `failingTestsFor(sha)` reads the unit-report
+// status (gh pr view omits a status's description) and is asked only once that status is
+// itself red, i.e. posted. Null when nothing is red. Pure + exported.
+function localMergeDriver(pr, failingTestsFor = () => null) {
+  if (!pr || pr.state !== 'OPEN' || !Array.isArray(pr.statusCheckRollup)) return null;
+  const { checks } = readCheckRollup({ contexts: { nodes: pr.statusCheckRollup } });
+  const red = checks.filter((c) => RED_CONCLUSIONS.has(String(c.conclusion || '').toUpperCase()));
+  if (!red.length) return null;
+  const kind = pr.mergeStateStatus === 'UNSTABLE' ? 'non_required_check_failing' : 'failing_check';
+  const reported = red.some((c) => c.name === UNIT_REPORT_CONTEXT);
+  return { reason: `${kind}:${red[0].name}`, failing_tests: (reported && failingTestsFor(pr.headRefOid)) || null };
+}
+
+// unitReportFor — the failing-test line the `unit` workflow posted on `sha`, read with this
+// machine's gh through the same parser the server uses. Null when unreadable; the red line
+// then names the check instead, as it did before the report existed. `gh` is injectable.
+function unitReportFor(sha, gh = ghJson) {
+  if (!/^[0-9a-f]{7,64}$/i.test(String(sha || ''))) return null;
+  const combined = gh(['api', `repos/{owner}/{repo}/commits/${sha}/status`]);
+  const nodes = ((combined && combined.statuses) || []).map((s) => ({ ...s, __typename: 'StatusContext' }));
+  return readCheckRollup({ contexts: { nodes } }).failing_tests;
+}
+
+// task 1003499 — a CONFLICTING PR is a land that cannot happen, however green it is.
+// GitHub's auto-merge waits for a clean merge as well as for green checks, so a PR
+// whose branch conflicts with main sits open under a fully green rollup and never
+// merges. PR #497 sat like that for ~25 minutes while both polls below said nothing
+// and then printed "auto-merge is armed ... NOT a failure", the banner a land that IS
+// on its way gets. The server already knew (mergeBlockReason -> 'merge_conflict'); the
+// ship never asked. Pure + exported. Takes both shapes it is handed: `gh pr view`'s
+// camelCase (mergeable, mergeStateStatus) and publish-status's snake_case merge_driver
+// (mergeable, merge_state, reason). A read that failed (null) is not a conflict.
+function prConflicting(pr) {
+  if (!pr) return false;
+  const state = pr.mergeStateStatus ?? pr.merge_state;
+  return pr.mergeable === 'CONFLICTING' || state === 'DIRTY' || pr.reason === 'merge_conflict';
+}
+
+// What the poll says the moment it sees the conflict. Pure + exported so the wording
+// is pinned by tests/ship_land_conflict.mjs. The poll keeps waiting afterwards on
+// purpose: a conflict only in generated files is healed by the server's own resolver
+// on its next sweep (ADR 0082), and the PR then merges inside this same window.
+function conflictPrLines(taskId) {
+  return [
+    '  ci-land: the PR CONFLICTS with main, so auto-merge cannot fire until that is resolved, however green its checks are.',
+    '  ci-land: a conflict only in generated files is healed by the server on its next sweep (~5 min), so this keeps waiting.',
+    '  ci-land: anything hand-written waits for you. From this worktree:',
+    '    git fetch -q origin && git merge origin/main   # resolve the conflicts, commit',
+    `    node scripts/gds/ship.js ${taskId}               # resumes the land; it does not re-grade`,
+    ...plainCardLines('merge_conflict'),
+  ];
+}
+
+// noteConflict — one poll's worth of conflict tracking, shared by both loops. Prints
+// the lines above when the PR BECOMES conflicting (not on every 10s poll, and once
+// more if main moves on and undoes a heal), and returns whether it conflicts now.
+// A failed read keeps the last answer rather than inventing a new one.
+function noteConflict(taskId, pr, wasConflicting) {
+  if (!pr) return wasConflicting;
+  const now = prConflicting(pr);
+  if (now && !wasConflicting) for (const line of conflictPrLines(taskId)) console.log(line);
+  return now;
+}
+
+// landConflicted — the verdict when the wait ends with the PR STILL conflicting. It is
+// not landing on its own, so it must not print the "landing automatically" banner or
+// the land_pending card ("Nothing to do. This is normal, not a failure."): task
+// 1002541's rule that a land which is not happening must not announce itself as
+// success. No bailId, so ship-merge never reroutes it: the PR already exists and is
+// the problem. /strand-fix walks the cure (its case C: merge main in, resolve, re-ship).
+function landConflicted(taskId) {
+  console.log('');
+  console.log(`  ci-land: still CONFLICTING when the wait ended, so this will NOT land on its own. The task stays at 'confirmed' until the conflict is resolved (/strand-fix ${taskId} walks it).`);
+  return landBailed('the PR conflicts with main, so it cannot merge until the conflict is resolved', `/strand-fix ${taskId}`);
 }
 
 // One module-scope sleep command shared by both poll loops (task 1093 / C9). A
@@ -366,8 +524,12 @@ const POLL_SLEEP_CMD = 'node -e "setTimeout(()=>{}, 10000)"';
 // reconciles the task to shipped when it observes merge+deploy — task 1049) until
 // the PR merges + deploy-prod succeeds. Returns true when prod is confirmed live;
 // a timeout with an armed PR is success-PENDING (the publish worked), not failure.
-async function pollServerPublish(taskId, branch) {
+// A timeout with a CONFLICTING PR is not (task 1003499): see landConflicted.
+// `deps` exists for tests/ship_land_conflict.mjs; a real ship passes none.
+async function pollServerPublish(taskId, branch, deps = {}) {
   const TRIES = 54; // ~9 min at 10s — checks + auto-merge + Actions deploy
+  const readStatus = deps.readStatus || (async (q) => (await cliClient()).tasks.getTasksIdPublishStatus(q));
+  const pause = deps.pause || (() => shellOk(POLL_SLEEP_CMD));
   console.log('  ci-land: waiting for auto-merge + prod deploy (polling the server)...');
   // task 1002645: GitHub can report merged+deployed while the SERVER refused the
   // confirmed→shipped flip (reconcile_blocked — the task-1547 land proof missed).
@@ -376,14 +538,29 @@ async function pollServerPublish(taskId, branch) {
   // pushed tip, so the proof usually heals within the window.
   let blockedReason = null;
   let redLine = null;
+  let conflicting = false;
+  let stuckRed = false; // task 1003764: a failing required check on the LAST read turns the closing banner red
+  let readFailure = null;
   for (let i = 0; i < TRIES; i++) {
-    const r = await (await cliClient()).tasks.getTasksIdPublishStatus({ id: taskId, query: { branch } });
+    const r = await readStatus({ id: taskId, query: { branch } });
+    if (!r.ok) {
+      // task 1003764: a failed status read used to be skipped in silence, so a broken
+      // diagnostic looked exactly like slow CI. Say so once per distinct failure.
+      const { code } = normalizeApiError(r.data);
+      const why = `HTTP ${r.status}${code ? ` ${code}` : ''}`;
+      if (why !== readFailure) {
+        readFailure = why;
+        console.log(`  ci-land: could not read the land status from the server (${why}) — still polling.`);
+      }
+    }
     if (r.ok && r.data) {
       const red = redPrLine(r.data.merge_driver);
       if (red && red !== redLine) {
         redLine = red;
-        for (const line of redPrLines(r.data.merge_driver)) console.log(line);
+        for (const line of redPrLines(r.data.merge_driver, { taskId, via: 'server' })) console.log(line);
       }
+      stuckRed = !!red && redBlocksMerge(r.data.merge_driver);
+      conflicting = noteConflict(taskId, r.data.merge_driver, conflicting);
       const outcome = classifyLandOutcome(r.data);
       if (outcome === 'shipped') {
         if (r.data.reconcile_blocked) {
@@ -401,7 +578,7 @@ async function pollServerPublish(taskId, branch) {
         return landBailed('the PR was closed without merging (a check failed, or it was closed manually)', `node scripts/gds/ship.js ${taskId}`);
       }
     }
-    shellOk(POLL_SLEEP_CMD);
+    pause();
   }
   if (blockedReason) {
     console.log('');
@@ -409,7 +586,8 @@ async function pollServerPublish(taskId, branch) {
     for (const line of plainCardLines('reconcile_blocked')) console.log(line);
     return landBailed(`the PR merged but the server could not prove the land is this task's: ${blockedReason}`, `node scripts/gds/ship.js ${taskId}`);
   }
-  printLandPending(taskId);
+  if (conflicting) return landConflicted(taskId);
+  printLandPending(taskId, { red: stuckRed });
   return landPending();
 }
 
@@ -723,14 +901,33 @@ async function ciLandLocal(taskId, branch, valueSummary) {
 //   3. public edge healthz -> 200 (belt-and-braces, a different vantage).
 // Times out conservatively; on any timeout the task stays at confirmed with a
 // precise next step rather than a false "shipped".
-function pollCiDeploy(taskId, branch, headSha) {
+// `deps` exists for tests/ship_land_conflict.mjs; a real ship passes none.
+function pollCiDeploy(taskId, branch, headSha, deps = {}) {
   const MERGE_TRIES = 30; // ~5 min at 10s — checks + auto-merge
   const DEPLOY_TRIES = 24; // ~4 min at 10s — Actions deploy
+  const readJson = deps.ghJson || ghJson;
+  const pause = deps.pause || (() => shellOk(POLL_SLEEP_CMD));
 
   console.log('  ci-land: waiting for auto-merge (checks + branch protection)...');
   let mergeSha = null;
+  let conflicting = false;
+  // task 1003764: say WHY it has not merged. This loop read only state + mergeCommit,
+  // so a red required check — the likeliest reason — went unnamed for the whole wait.
+  // The unit-report line (which failing tests) is fetched once per head sha.
+  let redLine = null;
+  let stuckRed = false;
+  let report = { sha: undefined, text: null };
+  const failingTestsFor = (sha) => {
+    if (sha !== report.sha) report = { sha, text: unitReportFor(sha, readJson) };
+    return report.text;
+  };
   for (let i = 0; i < MERGE_TRIES; i++) {
-    const pr = ghJson(['pr', 'view', branch, '--json', 'state,mergeCommit']);
+    // task 1003499: mergeable + mergeStateStatus ride the same read, so a conflict is
+    // named on the poll it appears; the two-field read is the fallback for a gh that
+    // predates those fields, which keeps this no worse than before on any machine.
+    // task 1003764: so do headRefOid + statusCheckRollup, so a red check is named too.
+    const pr = readJson(['pr', 'view', branch, '--json', 'state,mergeCommit,mergeable,mergeStateStatus,headRefOid,statusCheckRollup'])
+      || readJson(['pr', 'view', branch, '--json', 'state,mergeCommit']);
     if (pr && pr.state === 'MERGED') {
       mergeSha = pr.mergeCommit && pr.mergeCommit.oid;
       break;
@@ -739,18 +936,31 @@ function pollCiDeploy(taskId, branch, headSha) {
       console.log(`  ci-land: PR was CLOSED without merging (a required check failed, or it was closed manually). Fix it and re-run \`node scripts/gds/ship.js ${taskId}\` to resume. Task stays at 'confirmed'.`);
       return landBailed('the PR was closed without merging (a check failed, or it was closed manually)', `node scripts/gds/ship.js ${taskId}`);
     }
-    shellOk(POLL_SLEEP_CMD);
+    if (pr) {
+      const md = localMergeDriver(pr, failingTestsFor);
+      const red = redPrLine(md);
+      if (red && red !== redLine) {
+        redLine = red;
+        for (const line of redPrLines(md, { taskId, via: 'local' })) console.log(line);
+      }
+      stuckRed = !!red && redBlocksMerge(md);
+    }
+    conflicting = noteConflict(taskId, pr, conflicting);
+    pause();
   }
   if (!mergeSha) {
     // task 1049: PR open + auto-merge armed but not merged in-window = the publish
-    // SUCCEEDED and is still in CI — success-pending, not a failure.
-    printLandPending(taskId);
+    // SUCCEEDED and is still in CI — success-pending, not a failure. Unless it is
+    // CONFLICTING (task 1003499): then nothing is still in CI, and it never merges.
+    // Or RED (task 1003764): then the banner says the land is stuck on that check.
+    if (conflicting) return landConflicted(taskId);
+    printLandPending(taskId, { red: stuckRed });
     return landPending();
   }
   console.log(`  ci-land: merged to main (${mergeSha.slice(0, 8)}). Waiting for the prod deploy...`);
 
   for (let i = 0; i < DEPLOY_TRIES; i++) {
-    const runs = ghJson([
+    const runs = readJson([
       'run', 'list', '--workflow', 'deploy-prod.yml', '--branch', 'main',
       '--json', 'headSha,status,conclusion', '--limit', '15',
     ]);
@@ -775,7 +985,7 @@ function pollCiDeploy(taskId, branch, headSha) {
       }
       return landed();
     }
-    shellOk(POLL_SLEEP_CMD);
+    pause();
   }
   // task 1049: merged but the deploy run hasn't confirmed in-window — still
   // success-pending (it deploys on its own), not a failure.
@@ -811,6 +1021,21 @@ module.exports = {
   prAssigneeLine,
   redPrLine,
   redPrLines,
+  // task 1003499: a CONFLICTING PR is named while the land waits, and a wait that
+  // ends conflicting is a bail, not "landing automatically". The polls are exported
+  // with their optional `deps` so the test drives the real loops.
+  prConflicting,
+  conflictPrLines,
+  landConflicted,
+  pollCiDeploy,
+  pollServerPublish,
+  // task 1003764: name WHY a published PR has not merged when a check is red.
+  FRESHNESS_TESTS,
+  failingTestNames,
+  mergeTrapLines,
+  redBlocksMerge,
+  localMergeDriver,
+  unitReportFor,
   reconciledCardStatus,
   strandCommand,
   strandNextStep,

package/scripts/gds/ship-merge.js

@@ -32,6 +32,7 @@ const { gateMergeResult } = require('./ship-merge-gate.js');
 const { dbOnlyIgnoredNotice } = require('./ship-honesty.js');
 const { currentBranch, mainWorktreeBusy, regenerateApiClient, regenerateApiDocs, regenerateCopyInventory, regenerateDiagrams, regenerateFileMap, regenerateRepoMap, regenerateSessionIndex } = require('./ship-regen.js');
 const { REPO_ROOT } = require('./ship-state.js');
+const { envPrefix } = require('../../src/instance-config');
 
 // zeroCommitVerdict — dbOnly is deliberately consulted ONLY at zero commits
 // ahead: a branch carrying real commits must be merged, whatever flag was typed.
@@ -287,7 +288,7 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
 
     console.log('  pushing merged main to origin...');
     // SEC #863: route through push-main.js, which carries the
-    // OTB_ALLOW_MAIN_PUSH override so the pre-push permission gate lets THIS
+    // <PREFIX>_ALLOW_MAIN_PUSH override so the pre-push permission gate lets THIS
     // graded+confirmed pipeline push through while still blocking ad-hoc
     // `git push origin main`. process.execPath (quoted) for the same
     // cross-platform reason as the other node spawns here (#660).
@@ -298,7 +299,7 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
       // the ci PR path before this point; reaching this with protection on
       // means an env-forced 'laptop' or a failed protection probe.
       if (mainIsProtected() === true) {
-        return landBailed('main is branch-protected — the direct push can never land; unset OTB_DEPLOY_MODE (the ci PR path lands it)', `node scripts/gds/ship.js ${taskId}`);
+        return landBailed(`main is branch-protected — the direct push can never land; unset the DEPLOY_MODE env override (${envPrefix()}_DEPLOY_MODE, or the legacy OTB_DEPLOY_MODE) — the ci PR path lands it`, `node scripts/gds/ship.js ${taskId}`);
       }
       return landBailed('could not push the merged main to origin', '/merge-mode');
     }

package/scripts/gds/ship-preflight-steps.js

@@ -11,7 +11,8 @@
 const { execFileSync } = require('node:child_process');
 const fs = require('node:fs');
 const path = require('node:path');
-const { trackedDirty, cleanupMacFinderDupRefs } = require('../../modules/lifecycle/ship-preflight');
+const { trackedDirty, cleanupMacFinderDupRefs, untrackedLeftBehind, untrackedWarningLines } = require('../../modules/lifecycle/ship-preflight');
+const { arg } = require('./cli-lib');
 const mergeRegen = require('./git-merge-regen');
 const { argvOut, gitArgvOk, gitOk } = require('./ship-git.js');
 const { pushVia } = require('./ship-deploy-target.js');
@@ -40,6 +41,63 @@ function parseDeletedUpstreamPaths(rawLogOutput) {
   return [...new Set(rawLogOutput.split('\n').map((s) => s.trim()).filter(Boolean))];
 }
 
+// shipInputPaths — the repo-relative paths of the files a ship was HANDED as input
+// (task 1001436), so preflight's untracked-file warning never lists them. The
+// builder-ship skill writes notes.md + summary.txt into the worktree and passes them
+// here; left in, they would put the warning on nearly every ship and teach everyone
+// to skip it. `-` (stdin), a missing value and a path outside the checkout add
+// nothing — a file outside the tree cannot be an untracked file in it. Both sides go
+// through realpath, so a /var vs /private/var spelling of one file still matches.
+// `cwd`, `repoRoot` and `realpath` are injectable for the unit test.
+const SHIP_INPUT_FLAGS = ['--notes-file', '--summary-file', '--response-file', '--visual'];
+
+function safeRealpath(p) {
+  try { return fs.realpathSync.native(p); } catch (_) { return path.resolve(p); }
+}
+
+function shipInputPaths(args, { cwd = process.cwd(), repoRoot = null, realpath = safeRealpath } = {}) {
+  const root = realpath(repoRoot || gitOk('git rev-parse --show-toplevel') || cwd);
+  const out = [];
+  for (const flag of SHIP_INPUT_FLAGS) {
+    const value = arg(flag, args || []);
+    if (typeof value !== 'string' || value === '' || value === '-' || value.startsWith('--')) continue;
+    const rel = path.relative(root, realpath(path.resolve(cwd, value)));
+    if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) continue;
+    out.push(rel.split(path.sep).join('/'));
+  }
+  return out;
+}
+
+// The code that RUNS the ship and the grade on this machine — what step (c) of
+// preflight() refuses to run from a stale copy. PATHSPECS, not a file list (task
+// 1004273): the list used to name ship.js and grader.js alone, and two carves moved
+// the logic out from under it (task 1003205 split ship.js into ~20 ship-*.js files;
+// grader.js now delegates to grader-*.js, grader-workers/ and grade-engine.js), so a
+// branch behind main on ship-land.js or grader-score.js sailed through. A prefix
+// covers the next carve too. They reach git as argv, never through a shell, so a
+// file that exists ONLY on origin/main (a new carve file) still matches — a shell
+// would have expanded the glob against this checkout and missed exactly that one.
+// tests/ship_preflight.mjs fails if a ship*.js / grader* / grade-engine file is not covered.
+const TOOLING_PATHSPECS = Object.freeze([
+  'scripts/gds/ship*.js',           // ship.js + every ship-*.js carved out of it
+  'scripts/gds/smoke-gds.js',
+  'scripts/gds/cli-lib.js',
+  'modules/grading/grader*',        // grader.js, grader-*.js, grader-rubric.json, grader-workers/
+  'modules/grading/grade-engine.js', // grader.js requires it (task 1002839)
+]);
+
+// staleToolingFiles — the tooling files origin/main has changed since this branch's
+// merge-base. Three-dot (HEAD...origin/main) scopes to the origin/main side, so the
+// builder's OWN edits to these files (shipping a ship fix) do not count. A failed git
+// call reads as nothing stale, as it always has. `cwd` is injectable for the test.
+function staleToolingFiles({ cwd } = {}) {
+  const out = argvOut('git', ['diff', '--name-only', 'HEAD...origin/main', '--', ...TOOLING_PATHSPECS], cwd ? { cwd } : {});
+  return out ? out.split('\n').map((s) => s.trim()).filter(Boolean) : [];
+}
+
+// opts: { force, inputFiles } — inputFiles is shipInputPaths(args) from the caller;
+// omitted (the resume path has no prose flags), nothing is excluded from the
+// untracked-file warning.
 function preflight(claim, opts = {}) {
   // (a) Working-tree check — refuse if any TRACKED file carries an uncommitted
   // modification or staged change. This fires post-commit, so a clean tree
@@ -92,14 +150,7 @@ function preflight(claim, opts = {}) {
   // (HEAD...origin/main) scopes to changes on the origin/main side since the
   // merge-base, so the builder's OWN edits to these files (e.g. shipping a
   // ship.js fix) do not trip it.
-  const TOOLING_PATHS = [
-    'scripts/gds/ship.js',
-    'scripts/gds/smoke-gds.js',
-    'scripts/gds/cli-lib.js',
-    'modules/grading/grader.js', // BV1.R73: grading carved to modules/grading/
-  ];
-  const staleToolingStr = gitOk(`git diff --name-only HEAD...origin/main -- ${TOOLING_PATHS.join(' ')}`);
-  const staleTooling = staleToolingStr ? staleToolingStr.trim().split('\n').filter(Boolean) : [];
+  const staleTooling = staleToolingFiles();
   if (staleTooling.length > 0) {
     if (opts.force) {
       console.log(`  preflight: ship tooling is behind origin/main (${staleTooling.join(', ')}) — proceeding due to --force`);
@@ -145,8 +196,29 @@ function preflight(claim, opts = {}) {
     }
   }
 
-  console.log(`  preflight: working tree clean, branch ${behind} commits behind main, ship tooling current — OK`);
-  return { ok: true };
+  // (e) Untracked-file warning (task 1001436) — WARN-ONLY, never blocks, never
+  // changes the exit code. Step (a) ignores untracked files so scratch cannot
+  // false-refuse a ship, which also meant a NEW deliverable left un-added beside
+  // committed work shipped without it, in silence (the residual of the task-1363
+  // phantom ship). This names those files while stopping is still free. It needs
+  // committed work to warn about — upstreamDelTouched is this branch's committed
+  // diff from step (d); with none, the empty-diff guard already refuses and lists
+  // them. Its own `git status`, on purpose: --untracked-files=all names each file
+  // rather than a collapsed `dir/`, so the ship's input files can be excluded
+  // exactly; and a failed or oversized read here stays a skipped warning, never a
+  // blank porcelain for the refusal in step (a).
+  const untrackedPorcelain = gitOk('git status --porcelain --untracked-files=all', { maxBuffer: 64 * 1024 * 1024 });
+  const leftBehind = untrackedLeftBehind(untrackedPorcelain, {
+    committedFileCount: upstreamDelTouched.length,
+    inputs: opts.inputFiles || [],
+  });
+  for (const line of untrackedWarningLines(leftBehind, { taskId: claim && claim.task_id })) console.error(line);
+
+  const treeState = leftBehind.length > 0
+    ? `tracked files clean (${leftBehind.length} untracked file(s) will not ship — see the warning)`
+    : 'working tree clean';
+  console.log(`  preflight: ${treeState}, branch ${behind} commits behind main, ship tooling current — OK`);
+  return { ok: true, untrackedLeftBehind: leftBehind };
 }
 
 // mergeMainIntoBranch — pull origin/main INTO the current feature branch BEFORE
@@ -320,4 +392,7 @@ module.exports = {
   mergeMainIntoBranch,
   parseDeletedUpstreamPaths,
   preflight,
+  shipInputPaths,
+  staleToolingFiles,
+  TOOLING_PATHSPECS,
 };

package/scripts/gds/ship.js

@@ -354,7 +354,7 @@ module.exports = {
   // task 1045: the gate that defers the broadcast to the server on the server-
   // mediated publish path — exported so the truth table (ci+server → true, laptop
   // / non-ci → false) is unit-tested with no gh/network (env-driven via
-  // OTB_DEPLOY_MODE + OTB_PUSH_VIA_SERVER).
+  // <PREFIX>_DEPLOY_MODE + <PREFIX>_PUSH_VIA_SERVER).
   broadcastHandledByServer,
   fatalRecoveryLines, // G04 re-export (definition in ship-honesty.js)
 };

package/scripts/gds/stray-unit-sweep.sh

@@ -31,7 +31,9 @@ ETC=/etc/systemd/system
 CORE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 case "$CORE_DIR" in */node_modules/@bongos/core) INSTANCE_DIR="${INSTANCE_DIR:-${CORE_DIR%/node_modules/@bongos/core}}" ;; esac
 [ -n "${PROVISION_APP_USER:-}${INSTANCE_DIR:-}" ] || { echo "set INSTANCE_DIR to the control plane's instance checkout (or PROVISION_APP_USER) — this sweep is not running from one"; exit 1; }
-APP_USER="${PROVISION_APP_USER:-$(stat -c %U "$INSTANCE_DIR" 2>/dev/null)}"
+# Owner by name: GNU stat `-c %U`, else BSD/macOS stat `-f %Su` — each refuses the other's
+# flag (task 1004170), the same lookup address-park-sweep.sh makes.
+APP_USER="${PROVISION_APP_USER:-$(stat -c %U "$INSTANCE_DIR" 2>/dev/null || stat -f %Su "$INSTANCE_DIR" 2>/dev/null)}"
 if [ "$APP_USER" = root ] || ! [[ "$APP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
   echo "cannot use '$APP_USER' as the app account — set PROVISION_APP_USER to the unprivileged account that owns ${INSTANCE_DIR:-the instance checkout}"; exit 1
 fi