@bongos/core 1.19.1033 → 1.19.1035

package/tests/ship_assurance.mjs

@@ -194,14 +194,15 @@ await t('the CLI carries the declaration through its deliberate-empty path', ()
 const { deriveShipAssurance } = require(path.join(ROOT, 'modules/lifecycle/ship-assurance.js'));
 const TIP = 'a'.repeat(40);
 console.log('\nthe tip proof does not depend on the branch/PR probe');
-await t('tip in main + getPublishStatus throwing (no branch on the claim) → proof', async () => {
+await t('tip in main + getPublishStatus throwing → proof (the status probe is only a witness)', async () => {
   const seen = [];
   const r = await deriveShipAssurance({
     taskId: 1003285,
     body: {},
     db: { getClaimPublishedSha: async () => TIP },
     githubPush: {
-      getPublishStatus: async () => { const e = new Error('BAD_BRANCH'); e.code = 'BAD_BRANCH'; throw e; },
+      findTaskPullRequest: async () => ({ branch: 'task-1003285', pr_number: 7, merged: true }),
+      getPublishStatus: async () => { const e = new Error('STATUS_FETCH_FAILED'); e.code = 'STATUS_FETCH_FAILED'; throw e; },
       landProvenForTask: async ({ publishedSha, status }) => {
         seen.push({ publishedSha, status });
         return publishedSha === TIP ? { proven: true, reason: 'published tip in main' } : { proven: false };
@@ -210,9 +211,28 @@ await t('tip in main + getPublishStatus throwing (no branch on the claim) → pr
     onProbeError: (e) => seen.push({ probeError: e.code }),
   });
   assert.equal(seen.some((s) => s.publishedSha === TIP && s.status === null), true, 'the proof ran with status=null');
-  assert.equal(seen.some((s) => s.probeError === 'BAD_BRANCH'), true, 'the probe failure was still reported');
+  assert.equal(seen.some((s) => s.probeError === 'STATUS_FETCH_FAILED'), true, 'the probe failure was still reported');
   assert.equal(r.assurance && r.assurance.kind, 'proof');
 });
+await t('tip in main + the PR search throwing → proof, and the status probe is never asked', async () => {
+  let statusCalls = 0;
+  const errs = [];
+  const r = await deriveShipAssurance({
+    taskId: 1003286,
+    body: {},
+    db: { getClaimPublishedSha: async () => TIP },
+    githubPush: {
+      findTaskPullRequest: async () => { const e = new Error('PUSH_UNCONFIGURED'); e.code = 'PUSH_UNCONFIGURED'; throw e; },
+      getPublishStatus: async () => { statusCalls++; return null; },
+      landProvenForTask: async ({ publishedSha, status }) => (publishedSha === TIP && status === null
+        ? { proven: true, reason: 'published tip in main' } : { proven: false }),
+    },
+    onProbeError: (e) => errs.push(e.code),
+  });
+  assert.equal(r.assurance && r.assurance.kind, 'proof');
+  assert.deepEqual(errs, ['PUSH_UNCONFIGURED'], 'the search failure is reported on its own');
+  assert.equal(statusCalls, 0, 'no branch was found, so there is nothing to ask the status probe about');
+});
 await t('no tip + getPublishStatus throwing → still the 409 refusal (nothing to prove)', async () => {
   const r = await deriveShipAssurance({
     taskId: 1003253,
@@ -238,5 +258,68 @@ await t('a proof failure (compare API down) still falls through to the refusal,
   assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
 });
 
+// task 1004275 — the status probe was called with { taskId, publishedSha }, which
+// getPublishStatus does not read: it wants { branch }, so it threw BAD_BRANCH on EVERY
+// manual ship and both PR-witness proofs could never fire here. A squash-landed or
+// no-tip task was refused ship_land_not_proven while the reconciler (which resolves a
+// branch) shipped it minutes later. The branch now comes from the task's own PR, found
+// by title — the lookup GET /publish-status has used since task 1003764.
+console.log('\nthe PR witnesses reach the proof (task 1004275)');
+const realPush = require(path.join(ROOT, 'modules/lifecycle/github-push.js'));
+// The REAL getPublishStatus contract, minus the network: anything but a safe branch is
+// refused exactly as the real one refuses it, so the pre-fix call shape goes red here.
+const statusFor = (merged) => async (args) => {
+  if (!args || !realPush.isSafeBranch(args.branch)) { const e = new Error('BAD_BRANCH'); e.code = 'BAD_BRANCH'; throw e; }
+  return { branch: args.branch, pr_state: merged ? 'closed' : 'open', merged, pr_number: 1214,
+    pr_title: 'task 1004275: fix the land proof', pr_body: '', merge_sha: null };
+};
+await t('no tip + a merged PR titled for the task → proof (the no-tip fallback now fires)', async () => {
+  const asked = [];
+  const errs = [];
+  const r = await deriveShipAssurance({
+    taskId: 1004275,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      findTaskPullRequest: async (a) => { asked.push(a); return { branch: '1004275-assurance-branch-w4q8', pr_number: 1214, merged: true }; },
+      getPublishStatus: statusFor(true),
+      landProvenForTask: realPush.landProvenForTask, // no tip + merged PR → decided with no network call
+    },
+    onProbeError: (e) => errs.push(e.code),
+  });
+  assert.deepEqual(errs, [], 'no probe failed');
+  assert.deepEqual(asked, [{ taskId: 1004275 }], 'the PR is found by the task id');
+  assert.equal(r.assurance && r.assurance.kind, 'proof');
+  assert.match(r.assurance.reason, /matched PR references task 1004275/);
+});
+await t('no tip + the task\'s PR still OPEN → the 409 refusal (a PR is a witness, not a land)', async () => {
+  const r = await deriveShipAssurance({
+    taskId: 1004275,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      findTaskPullRequest: async () => ({ branch: '1004275-assurance-branch-w4q8', pr_number: 1214, merged: false }),
+      getPublishStatus: statusFor(false),
+      landProvenForTask: realPush.landProvenForTask,
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+});
+await t('no tip + no PR for the task → the 409 refusal, and getPublishStatus is not called with nothing', async () => {
+  let statusCalls = 0;
+  const r = await deriveShipAssurance({
+    taskId: 1004276,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      findTaskPullRequest: async () => null,
+      getPublishStatus: async () => { statusCalls++; throw new Error('BAD_BRANCH'); },
+      landProvenForTask: realPush.landProvenForTask,
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+  assert.equal(statusCalls, 0);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/ship_land_red_pr.mjs

@@ -0,0 +1,236 @@
+// tests/ship_land_red_pr.mjs — a stalled land names its red check (task 1003764, gap 2).
+//
+// WHY. Task 1003747's ship sat at "waiting for auto-merge + prod deploy" while a
+// required check was red, and ended on "This is NOT a failure". The cause — CI tests
+// the branch MERGED with main, and main had moved six commits, staling the copy
+// registry in the merged tree only — took ~20 minutes of git archaeology to find,
+// though it was one API call away. The laptop poll (pollCiDeploy) never looked at
+// checks at all; the server poll named them but not the merge trap, and not how a
+// freshness gate heals. These drive both polls with fake gh / server reads (no
+// network, no sleeping) and pin the pure pieces they are built from.
+//
+// Run:  node tests/ship_land_red_pr.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import { createRequire } from 'node:module';
+import {
+  FRESHNESS_TESTS, failingTestNames, landPendingLines, localMergeDriver, mergeTrapLines,
+  pollCiDeploy, pollServerPublish, redBlocksMerge, redPrLines, unitReportFor,
+} from '../scripts/gds/ship-land.js';
+
+const require = createRequire(import.meta.url);
+const githubPush = require('../modules/lifecycle/github-push.js');
+const { CARDS } = require('../scripts/gds/plain-cards.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+// Run fn with console.log captured; returns { result, out }.
+async function capture(fn) {
+  const lines = [];
+  const orig = console.log;
+  console.log = (...a) => { lines.push(a.join(' ')); };
+  try { return { result: await fn(), out: lines.join('\n'), lines }; }
+  finally { console.log = orig; }
+}
+
+const SHA = 'a'.repeat(40);
+// What `gh pr view --json state,mergeCommit,mergeStateStatus,headRefOid,statusCheckRollup`
+// really returns (shape taken from a live PR on this repo): check runs, then statuses.
+const run = (name, conclusion, status = 'COMPLETED') => ({ __typename: 'CheckRun', name, conclusion, status, workflowName: 'unit' });
+const ctx = (context, state) => ({ __typename: 'StatusContext', context, state, targetUrl: '' });
+const openPr = (rollup, mergeStateStatus = 'BLOCKED') => ({ state: 'OPEN', mergeCommit: null, mergeStateStatus, headRefOid: SHA, statusCheckRollup: rollup });
+const RED_ROLLUP = [run('unit', 'FAILURE'), run('report', 'SUCCESS'), ctx('gate-author-trust', 'SUCCESS'), ctx('unit-report', 'FAILURE')];
+const COMBINED_STATUS = { state: 'failure', statuses: [
+  { context: 'gate-author-trust', state: 'success', description: 'Metic+ author' },
+  { context: 'unit-report', state: 'failure', description: '1 failed: fitness' },
+] };
+
+// ---- localMergeDriver: the laptop's view of a red PR, in publish-status's shape ----
+
+await test('localMergeDriver names the failing required check and asks for the tests once the report is posted', async () => {
+  const asked = [];
+  const md = localMergeDriver(openPr(RED_ROLLUP), (sha) => { asked.push(sha); return '1 failed: fitness'; });
+  assert.deepEqual(md, { reason: 'failing_check:unit', failing_tests: '1 failed: fitness' });
+  assert.deepEqual(asked, [SHA], 'the unit-report is read for the PR head sha');
+});
+
+await test('localMergeDriver does not ask for tests before the unit-report status exists', async () => {
+  let asked = 0;
+  const md = localMergeDriver(openPr([run('unit', 'FAILURE')]), () => { asked++; return 'x'; });
+  assert.deepEqual(md, { reason: 'failing_check:unit', failing_tests: null });
+  assert.equal(asked, 0);
+});
+
+await test('localMergeDriver: pending, expected and in-progress are waiting, not red', async () => {
+  for (const rollup of [
+    [run('unit', '', 'IN_PROGRESS')],
+    [ctx('unit-report', 'PENDING')],
+    [ctx('some-required-status', 'EXPECTED')],
+    [run('unit', 'SUCCESS'), run('lint', 'NEUTRAL'), run('docs', 'SKIPPED'), ctx('unit-report', 'SUCCESS')],
+  ]) assert.equal(localMergeDriver(openPr(rollup)), null, JSON.stringify(rollup));
+});
+
+await test('localMergeDriver: an UNSTABLE PR means the failing check is optional', async () => {
+  assert.equal(localMergeDriver(openPr([run('lint', 'FAILURE')], 'UNSTABLE')).reason, 'non_required_check_failing:lint');
+});
+
+await test('localMergeDriver: nothing to say for a merged/closed PR, or a gh that returned no rollup', async () => {
+  assert.equal(localMergeDriver(null), null);
+  assert.equal(localMergeDriver({ ...openPr(RED_ROLLUP), state: 'MERGED' }), null);
+  assert.equal(localMergeDriver({ state: 'OPEN', mergeCommit: null }), null, 'the legacy two-field read has no rollup');
+});
+
+await test('localMergeDriver agrees with the server\'s mergeBlockReason on a red required check', async () => {
+  const server = githubPush.mergeBlockReason({
+    merged: false, pr_state: 'open', mergeable: 'MERGEABLE', merge_state: 'BLOCKED', review_decision: null,
+    rollup_state: 'FAILURE', checks: [{ name: 'unit', conclusion: 'FAILURE', status: 'COMPLETED' }], checks_unreadable: false,
+  });
+  assert.equal(localMergeDriver(openPr([run('unit', 'FAILURE')])).reason, server);
+});
+
+// ---- unitReportFor: the failing-test line, via the same parser the server uses ----
+
+await test('unitReportFor reads the unit-report status for the sha', async () => {
+  const calls = [];
+  const text = unitReportFor(SHA, (args) => { calls.push(args); return COMBINED_STATUS; });
+  assert.equal(text, '1 failed: fitness');
+  assert.deepEqual(calls, [['api', `repos/{owner}/{repo}/commits/${SHA}/status`]]);
+});
+
+await test('unitReportFor: a green report, an unreadable one, or a bad sha → null (and a bad sha never reaches gh)', async () => {
+  assert.equal(unitReportFor(SHA, () => ({ statuses: [{ context: 'unit-report', state: 'success', description: 'all unit tests passed' }] })), null);
+  assert.equal(unitReportFor(SHA, () => null), null);
+  assert.equal(unitReportFor('HEAD; rm -rf /', () => { throw new Error('must not call gh'); }), null);
+});
+
+// ---- the merge trap + the freshness heal ----
+
+await test('failingTestNames parses the unit-report line and drops a name the status limit cut', async () => {
+  assert.deepEqual(failingTestNames('1 failed: fitness'), ['fitness']);
+  assert.deepEqual(failingTestNames('3 failed: api_docs, fitness, security'), ['api_docs', 'fitness', 'security']);
+  assert.deepEqual(failingTestNames('40 failed: a_test, b_test, some_lo…'), ['a_test', 'b_test']);
+  assert.deepEqual(failingTestNames(null), []);
+  assert.deepEqual(failingTestNames('all unit tests passed'), []);
+});
+
+await test('every name in FRESHNESS_TESTS is a real test file', async () => {
+  for (const name of FRESHNESS_TESTS) {
+    assert.ok(fs.existsSync(new URL(`./${name}.mjs`, import.meta.url)), `tests/${name}.mjs does not exist`);
+  }
+});
+
+await test('every red PR names the trap: CI tests the MERGE, not the branch', async () => {
+  const local = mergeTrapLines({ reason: 'failing_check:unit' }, { taskId: 42, via: 'local' }).join('\n');
+  assert.match(local, /MERGED with the current main, not the branch alone/);
+  assert.match(local, /git fetch origin && git merge origin\/main/, 'the laptop can reproduce on the merge');
+  const server = mergeTrapLines({ reason: 'failing_check:unit' }, { taskId: 42, via: 'server' }).join('\n');
+  assert.match(server, /MERGED with the current main/);
+  assert.ok(!/git merge origin\/main/.test(server), 'a credential-less machine cannot merge main locally — never tell it to');
+});
+
+await test('a failing freshness gate gets its healing command, per push path', async () => {
+  const md = { reason: 'failing_check:unit-report', failing_tests: '1 failed: fitness' };
+  const local = mergeTrapLines(md, { taskId: 42, via: 'local' }).join('\n');
+  assert.match(local, /`fitness` is a freshness gate/);
+  assert.match(local, /stale in the MERGED tree/);
+  assert.match(local, /node scripts\/gds\/ship\.js 42/, 'names the re-ship for THIS task');
+  assert.match(local, /ship-check\.js/);
+  const server = mergeTrapLines(md, { taskId: 42, via: 'server' }).join('\n');
+  assert.match(server, /The server regenerates stale generated files/);
+  const plain = mergeTrapLines({ reason: 'failing_check:unit-report', failing_tests: '1 failed: security' }, { taskId: 42 }).join('\n');
+  assert.ok(!/freshness gate/.test(plain), 'an ordinary failing test gets no regenerate advice');
+});
+
+await test('redPrLines: the red line first, then the trap, then the plain-words card', async () => {
+  const lines = redPrLines({ reason: 'failing_check:unit-report', failing_tests: '1 failed: fitness' }, { taskId: 42, via: 'local' });
+  assert.match(lines[0], /the PR is RED — 1 failed: fitness/);
+  assert.match(lines[1], /MERGED with the current main/);
+  const at = lines.findIndex((l) => l.includes('[otb-plain]'));
+  assert.ok(at > 2, 'the card still follows');
+  assert.ok(lines.slice(at).join('\n').includes(CARDS.failing_check.happened));
+  assert.deepEqual(redPrLines({ reason: 'review_required' }), [], 'nothing red → nothing printed');
+});
+
+await test('redBlocksMerge: only a failing REQUIRED check stops the merge', async () => {
+  assert.equal(redBlocksMerge({ reason: 'failing_check:unit' }), true);
+  assert.equal(redBlocksMerge({ reason: 'failing_check_unreadable' }), true);
+  assert.equal(redBlocksMerge({ reason: 'non_required_check_failing:lint' }), false, 'GitHub still merges an UNSTABLE PR');
+  assert.equal(redBlocksMerge(null), false);
+});
+
+await test('landPendingLines: a RED PR never gets "NOT a failure"; a green-but-slow one keeps it', async () => {
+  const red = landPendingLines(42, { red: true }).join('\n');
+  assert.ok(!/NOT a failure/.test(red), 'a failing required check does not pass by waiting');
+  assert.match(red, /RED/);
+  assert.match(red, /node scripts\/gds\/ship\.js 42/);
+  assert.match(landPendingLines(42).join('\n'), /This is NOT a failure/);
+});
+
+// ---- the two poll loops, end to end with fakes ----
+
+await test('pollCiDeploy (laptop): a red PR is named once, the trap and heal are printed, and the banner is red', async () => {
+  const seen = { prView: 0, status: 0 };
+  const gh = (args) => {
+    if (args[0] === 'pr' && args[1] === 'view') { seen.prView++; return openPr(RED_ROLLUP); }
+    if (args[0] === 'api') { seen.status++; return COMBINED_STATUS; }
+    throw new Error(`unexpected gh call: ${args.join(' ')}`);
+  };
+  const { result, out } = await capture(() => pollCiDeploy(42, 'task-42', SHA, { ghJson: gh, pause: () => {} }));
+  assert.equal(result.pending, true, 'still a pending land — the check can yet pass');
+  assert.equal(seen.prView, 30, 'polled the whole window');
+  assert.equal(seen.status, 1, 'the unit-report is read once per head sha, not once per poll');
+  assert.equal(out.split('the PR is RED — 1 failed: fitness').length - 1, 1, 'named once, not thirty times');
+  assert.match(out, /MERGED with the current main/);
+  assert.match(out, /`fitness` is a freshness gate/);
+  assert.match(out, /node scripts\/gds\/ship\.js 42/);
+  assert.ok(!/This is NOT a failure/.test(out), 'the closing banner must not contradict the red line');
+  assert.ok(!out.includes(CARDS.land_pending.happened), 'nor the "nothing to do" card');
+});
+
+await test('pollCiDeploy: a gh that rejects the new fields falls back to the old read and still sees the merge', async () => {
+  const gh = (args) => {
+    if (args[0] === 'pr' && args.includes('state,mergeCommit')) return { state: 'MERGED', mergeCommit: { oid: 'b'.repeat(40) } };
+    if (args[0] === 'pr') return null; // unknown JSON field → gh exits non-zero → ghJson null
+    if (args[0] === 'run') return [];
+    throw new Error(`unexpected gh call: ${args.join(' ')}`);
+  };
+  const { result, out } = await capture(() => pollCiDeploy(42, 'task-42', SHA, { ghJson: gh, pause: () => {} }));
+  assert.match(out, /merged to main \(bbbbbbbb\)/);
+  assert.equal(result.pending, true);
+});
+
+await test('pollCiDeploy: a green PR that is merely slow keeps the reassuring banner', async () => {
+  const gh = (args) => (args[0] === 'pr' ? openPr([run('unit', '', 'IN_PROGRESS')]) : null);
+  const { out } = await capture(() => pollCiDeploy(42, 'task-42', SHA, { ghJson: gh, pause: () => {} }));
+  assert.ok(!/RED/.test(out));
+  assert.match(out, /This is NOT a failure/);
+});
+
+await test('pollServerPublish (credential-less): a failing status read is said once; a red PR gets the server-path heal', async () => {
+  let n = 0;
+  const readStatus = async () => {
+    n++;
+    if (n <= 3) return { ok: false, status: 502, data: { error: { code: 'status_failed', message: 'x' } } };
+    return { ok: true, status: 200, data: {
+      pr_state: 'open', merged: false, deploy_status: 'pending', reconcile_blocked: null,
+      merge_driver: { reason: 'failing_check:unit-report', failing_tests: '1 failed: fitness' },
+    } };
+  };
+  const { result, out } = await capture(() => pollServerPublish(42, 'task-42', { readStatus, pause: () => {} }));
+  assert.equal(result.pending, true);
+  assert.equal(out.split('could not read the land status from the server (HTTP 502 status_failed)').length - 1, 1,
+    'three identical failures are reported once');
+  assert.equal(out.split('the PR is RED — 1 failed: fitness').length - 1, 1);
+  assert.match(out, /The server regenerates stale generated files/);
+  assert.ok(!/git merge origin\/main/.test(out), 'never tells a credential-less machine to merge main');
+  assert.ok(!/This is NOT a failure/.test(out));
+});
+
+console.log(`\nship-land red PR (task 1003764) tests: ${passed} passed, ${failed} failed`);
+process.exitCode = failed > 0 ? 1 : 0;

package/tests/ship_preflight.mjs

@@ -17,7 +17,7 @@ const {
   untrackedPaths, untrackedLeftBehind, untrackedWarningLines,
 } = require('../modules/lifecycle/ship-preflight.js');
 // task 1001436: the preflight step itself + the ship-input resolver it is handed.
-const { preflight, shipInputPaths } = require('../scripts/gds/ship-preflight-steps.js');
+const { preflight, shipInputPaths, staleToolingFiles, TOOLING_PATHSPECS } = require('../scripts/gds/ship-preflight-steps.js');
 
 const tests = [];
 const test = (name, fn) => tests.push({ name, fn });
@@ -509,6 +509,72 @@ test('preflight (real git): nothing committed on the branch → no untracked war
   });
 });
 
+// ---- stale ship-tooling guard (task 1004273) ----
+// The guard named ship.js + grader.js only; two carves moved the logic into ship-*.js
+// and grader-*.js / grader-workers/ / grade-engine.js, so a branch behind main on any
+// of those shipped with a stale copy — the #662 shape the guard exists for.
+
+test('stale-tooling guard: every tracked ship*.js and grader file is covered by TOOLING_PATHSPECS', () => {
+  const root = path.resolve(import.meta.dirname, '..');
+  const ls = (...spec) => execSync(`git ls-files -z -- ${spec.map((s) => `'${s}'`).join(' ')}`, { cwd: root, encoding: 'utf8' })
+    .split('\0').filter(Boolean);
+  // Chosen by an independent rule (the filename), then asked of git's own pathspec matcher.
+  const shipTooling = ls('scripts/gds', 'modules/grading').filter((f) =>
+    /^scripts\/gds\/ship[^/]*\.js$/.test(f) || /^modules\/grading\/(?:grader|grade-engine)/.test(f));
+  assert.ok(shipTooling.length >= 25, `only ${shipTooling.length} ship/grader file(s) found — the scan is reading the wrong tree`);
+  assert.ok(shipTooling.includes('scripts/gds/ship-land.js') && shipTooling.includes('modules/grading/grader-score.js'));
+  const covered = new Set(ls(...TOOLING_PATHSPECS));
+  const missed = shipTooling.filter((f) => !covered.has(f));
+  assert.deepEqual(missed, [], `ship/grade tooling the stale-tooling guard would not refuse: ${missed.join(', ')}`);
+});
+
+// Publish the throwaway repo's main to its local bare "origin".
+const publishMain = (run) => run(['git', 'push', '-q', 'origin', 'main'].join(' '));
+
+test('preflight (real git): main moved a carved ship-*.js and added a new grader file → refused stale-tooling', () => {
+  withPreflightRepo(({ work, run }) => {
+    fs.mkdirSync(path.join(work, 'scripts', 'gds'), { recursive: true });
+    fs.mkdirSync(path.join(work, 'modules', 'grading'), { recursive: true });
+    fs.writeFileSync(path.join(work, 'scripts', 'gds', 'ship-land.js'), '// v1\n');
+    fs.writeFileSync(path.join(work, 'modules', 'grading', 'grader-score.js'), '// v1\n');
+    run('git add -A && git commit -q -m tooling');
+    publishMain(run);
+    run('git checkout -q -b feature');
+    fs.writeFileSync(path.join(work, 'src.txt'), 'the branch\'s own work\n');
+    run('git add -A && git commit -q -m work');
+    // main moves: one carved file changes, one file appears that this checkout never had.
+    run('git checkout -q main');
+    fs.writeFileSync(path.join(work, 'scripts', 'gds', 'ship-land.js'), '// v2\n');
+    fs.writeFileSync(path.join(work, 'modules', 'grading', 'grader-new.js'), '// new carve\n');
+    run('git add -A && git commit -q -m "main moves the tooling"');
+    publishMain(run);
+    run('git checkout -q feature');
+    assert.ok(!fs.existsSync(path.join(work, 'modules', 'grading', 'grader-new.js')), 'the new file is on main only');
+
+    const { result, out } = capturePreflight({ task_id: 4244, head_sha: null }, {});
+    assert.equal(result.ok, false);
+    assert.equal(result.reason, 'stale-tooling');
+    assert.match(out, /- scripts\/gds\/ship-land\.js/, 'a carved ship-*.js is tooling');
+    assert.match(out, /- modules\/grading\/grader-new\.js/, 'a file only main has is still matched');
+    assert.deepEqual(staleToolingFiles({ cwd: work }).sort(), ['modules/grading/grader-new.js', 'scripts/gds/ship-land.js']);
+  });
+});
+
+test('preflight (real git): the branch\'s OWN edit to a ship-*.js is not stale tooling', () => {
+  withPreflightRepo(({ work, run }) => {
+    fs.mkdirSync(path.join(work, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(work, 'scripts', 'gds', 'ship-land.js'), '// v1\n');
+    run('git add -A && git commit -q -m tooling');
+    publishMain(run);
+    run('git checkout -q -b feature');
+    fs.writeFileSync(path.join(work, 'scripts', 'gds', 'ship-land.js'), '// the fix this task ships\n');
+    run('git add -A && git commit -q -m "fix the land"');
+    const { result } = capturePreflight({ task_id: 4245, head_sha: null }, {});
+    assert.equal(result.ok, true);
+    assert.deepEqual(staleToolingFiles({ cwd: work }), []);
+  });
+});
+
 // ---- runner ----
 
 let pass = 0;

package/tests/start_env_guard.mjs

@@ -118,6 +118,22 @@ t('a hosted origin says the core installs with no token, and never re-offers the
   assert.doesNotMatch(card, /\bprivate\b/i, 'must not call the package private');
 });
 
+// task 1004288: the card above was corrected when the core went public, but the SKILL that
+// routes the same fresh-clone wall kept teaching the old posture — "a PRIVATE package", "404s
+// on any machine with no NPM_TOKEN", "the expected tokenless outcome". An agent that believes
+// that reads a real 404 (a version never published, a mistyped name) as normal and moves on.
+t('the builder-start skill agrees with the card: the core is public, and a 404 is not normal', () => {
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const skill = readFileSync(path.join(import.meta.dirname, '..', '.claude', 'skills', 'builder-start', 'SKILL.md'), 'utf8');
+  assert.doesNotMatch(skill, /PRIVATE package|private package/i, 'must not call @bongos/core a private package (ADR 0283)');
+  assert.doesNotMatch(skill, /expected tokenless outcome/i, 'must not present a tokenless 404 as expected');
+  assert.doesNotMatch(skill, /404s on any machine with no `?NPM_TOKEN/i, 'must not tell the agent a tokenless install 404s');
+  assert.match(skill, /PUBLIC npm package/, 'names the core as public');
+  assert.match(skill, /ADR 0283/, 'cites the decision that made it public');
+  assert.match(skill, /404 on `@bongos\/core` is therefore \*\*not\*\* a normal outcome/, 'says a 404 now means something is wrong');
+});
+
 t('isLocalOrigin: loopback is local, everything else is remote', () => {
   for (const o of ['http://localhost:3000', 'http://app.localhost:3000', 'http://127.0.0.1:3000', 'http://[::1]:3000']) {
     assert.equal(isLocalOrigin(o), true, `${o} should be local`);

package/tests/upgrade.mjs

@@ -1543,7 +1543,7 @@ t('persistPin: a refused origin push on a WIRED private instance is loud — nam
   assert.equal(r.refused, 'read-only-deploy-key');
   // The tokenless refusal is a plain sentence, not the bare status line.
   assert.match(r.error, /read-only deploy key at \/srv\/bongos\/acme\/\.git\/cloudbongos-deploy-key/, 'names the key');
-  assert.match(r.error, /no owner GitHub token is stored/, 'and why nothing else was tried');
+  assert.match(r.error, /no owner GitHub token was available/, 'and why nothing else was tried');
   assert.notEqual(r.error, 'git push failed');
   const text = warnings.join('\n');
   assert.match(text, /PIN NOT PUSHED/, 'shouts');
@@ -1655,6 +1655,25 @@ t('resolvePinPushAuth: the owner token is spent only when one is stored AND the
   assert.equal(await u.resolvePinPushAuth(dir, { log: hush, instance: inst, getGithubToken: async () => { throw new Error('secret-box off'); } }, at('git@github.com:acme/widgets.git')), null);
 });
 
+t('resolvePinPushAuth: on a hosted project\u2019s own box a missing row SAYS WHY, instead of falling back silently (task 1004065)', async () => {
+  // The project's own database has no provisioning table (ADR 0281), so the lookup
+  // answers null there — and on a checkout wired with the read-only deploy key that is
+  // not "the origin path", it is a push that cannot succeed.
+  const dir = { instanceDir: '/srv/bongos/acme' };
+  const wired = { config: { status: 0, stdout: 'ssh -F /dev/null -i /srv/bongos/acme/.git/cloudbongos-deploy-key -o IdentitiesOnly=yes\n' }, remote: { status: 0, stdout: 'git@github.com:acme/widgets.git\n' } };
+  const said = [];
+  const r = await u.resolvePinPushAuth(dir, { log: (m) => said.push(m), getInstanceBySlug: async () => null }, pinRun(wired));
+  assert.equal(r, null, 'still the remote path — there is no token to use');
+  const line = said.join('\n');
+  assert.match(line, /no provisioning row is readable from this database/, 'names what is missing');
+  assert.match(line, /read-only deploy key at \/srv\/bongos\/acme\/\.git\/cloudbongos-deploy-key/, 'and why the fallback cannot work');
+  assert.match(line, /pushes the pin from the hub/, 'and where the push actually happens');
+  // An UNWIRED checkout with no row (a laptop, a public instance) is the real origin path: quiet.
+  const quiet = [];
+  await u.resolvePinPushAuth(dir, { log: (m) => quiet.push(m), getInstanceBySlug: async () => null }, pinRun({ remote: wired.remote }));
+  assert.deepEqual(quiet, [], 'no noise where the fallback is correct');
+});
+
 t('runUpgrade --commit-pin: on a wired private instance the pin lands via the owner token, end to end', async () => {
   const dir = scratchConsumer({ pinned: '1.14.1', installed: '1.14.1' });
   const src = mkdtempSync(join(tmpdir(), 'otb-upgrade-src-'));