@bongos/core 1.19.1034 → 1.19.1035

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1034",
-  "core_contract": "1.19.1034",
-  "source_commit": "a2446fb2d3a1cb50cc5c61e6aaae4344615e02aa",
+  "core_version": "1.19.1035",
+  "core_contract": "1.19.1035",
+  "source_commit": "984bf7acda7d778bdbac5cb358d4817b17b18d88",
   "source_ref": "HEAD",
-  "built_at": "2026-09-26T03:45:37.837Z",
+  "built_at": "2026-09-26T07:18:36.442Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 541,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2488,
+    "functional_verbatim": 2489,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3056,
-  "tree_sha256": "6d0641af25600fb820e657fe9a5b366956049e9ba1f13d1b052cae54e6847ce4",
+  "file_count": 3057,
+  "tree_sha256": "625127767ece3a0c054244383e2f3971ffcd5a2fb986f2ea192d4d837c89b237",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -352,12 +352,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "217dec95a590eee3d3b3e7e7670882ff4851d596b9a3329215d563ab9509f5f7"
+      "sha256": "e5aa86f924b3c8f3b216daa93f707a583a74e82ad3cb6162288ec987ac70bc24"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "f96abe3e0fad14745f5aa2f578e28316cf1c24cffa32aa389db2671ec0daa4b7"
+      "sha256": "bafe28d4273b7c1959fe9737bdd17a02cea669fea51495393863570030b605f9"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -367,17 +367,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "c4a5ecc76df6099d9e1bd3e76ed0164b460e61aaf34de46fa023e22c8781a122"
+      "sha256": "2a53db773795e45a22fad49b6483613219ca7a6d230965ae8974ece117b7ea78"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "5f6b4bc9bb1f216cdedc6a74679d2e38f72ad9a1c561411e39a571d632dccf3d"
+      "sha256": "1b3e0d29bec82e3637396c31bb42af2c8a72e6a897a7b83f02dd2e546e4817ce"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "de19e3ed58c7ba6792de3c1781e3b7fa8342643c35daf713a9cf4290ae61fbbd"
+      "sha256": "4eb0b66ce4a75e30a6013a2f03fcc65775d2fa6e0b9caed2d630f1b89418f0da"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2197,12 +2197,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d6cad3e0d4212d9e595905f44b506e6d656526288b93e00631438c81a829f9bf"
+      "sha256": "39a0682dabb9b1d64c1b8641963e04e1a22ead6bdb29a51ed4d516609f287e4d"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "f6dbe34c5bf7142fb6ce672c11227ea441620c5e0a6acb7da425b0b4e7be7ef8"
+      "sha256": "d81fad692604b0240f2237d2d33eb0ff503fdfa992f2376d9aa565b8c8c59de9"
     },
     {
       "path": "docs/architecture.md",
@@ -2762,7 +2762,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a453af9a4655748e0c20e59569a290edf687fb7445e7bcf5fb003ae3a05fe013"
+      "sha256": "831d4d60af672d57ba41368d631ed8d63dbdccb6da2ac3c5c67f7c08055f6630"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3987,7 +3987,7 @@
     {
       "path": "modules/autonomy/db.js",
       "mode": "0000644",
-      "sha256": "722b9f3ddbd59fda3e92ae6c6fb0400eb3eadc343f0a3f84369d69bea72b7d65"
+      "sha256": "445db52d066ca1e26bc1d33d547aa9cb76ebbbd26f518cd2f451c912752cc2de"
     },
     {
       "path": "modules/autonomy/digest.js",
@@ -4027,7 +4027,7 @@
     {
       "path": "modules/autonomy/routes/autonomy.js",
       "mode": "0000644",
-      "sha256": "e119e149565972008d42e986f82b4fcbff22d74301222e8772d63de16e936abf"
+      "sha256": "26ed62b15d9d35d02a9b59667538d77d4224967532e8455804f9f254cdcf93b7"
     },
     {
       "path": "modules/autonomy/runner-health.js",
@@ -4432,7 +4432,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "6d1895c276755d7a3cbec780f35e20ee9cc6cfee5557a48142bc5dcffb9d3f19"
+      "sha256": "594be00f46a3086fe804d04444061017a21b24aa22d490e82c01e1059fd17a0f"
     },
     {
       "path": "modules/government/config.js",
@@ -6337,7 +6337,7 @@
     {
       "path": "modules/lifecycle/ship-assurance.js",
       "mode": "0000644",
-      "sha256": "9bbbabd157420ffc7ed8c323436a27045da0d7bc7c8bfd7f4c44f300855556b1"
+      "sha256": "690171d9e4e7d82537cf1d030d98aa37ee0ac72bbcdce6a04429d3d49ecbe46a"
     },
     {
       "path": "modules/lifecycle/ship-card.js",
@@ -8432,12 +8432,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6015018149591834ddba172ad282a9e261f08bb7c1422df2dbe2798b3200d2e8"
+      "sha256": "badec3b8c68b18938b3759d753d7d28e594367c32103cb46a3842e5f0968648f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b6ab2ffb9d197a30331f1b963b7543b8858952a45dd5cd6679b73f220bbf05ba"
+      "sha256": "605847b031c0ec07aef44c3b574bf3eafbb320c75280d9af2c8cc1d80c725385"
     },
     {
       "path": "public-docs/index.html",
@@ -8457,7 +8457,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "5c43a6c1797e7c25442659efef80fcf952bebf22669e8889e9351803423ee81b"
+      "sha256": "368eba38c61e4ecb3613174255b865e9c9fc595ffc04930e35a90a0a5696c38e"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10247,7 +10247,7 @@
     {
       "path": "src/bongos/core-update.js",
       "mode": "0000644",
-      "sha256": "b2759f016671a00e6b875ff5faf399b922f64c54bce472e64f813d39070aaf49"
+      "sha256": "27630af327d56e6eea77eb7e402086ec695f9fd02f419e48af463ed1adbfab8c"
     },
     {
       "path": "src/bongos/db-kernel.js",
@@ -10417,7 +10417,7 @@
     {
       "path": "src/bongos/routes/core-update.js",
       "mode": "0000644",
-      "sha256": "c58709402311486c0d4acdd408caba45cb4d8bd1de2bc8b345b63747fcf42bbf"
+      "sha256": "5cfcc4d5a48eb6e0c2370adf6c990d86a4af605d664c56b64687920150b16463"
     },
     {
       "path": "src/bongos/routes/github.js",
@@ -10517,7 +10517,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7a87904f92dece324a000b33f1500b825775cd6d4126e6da7f683da17a8b6ccb"
+      "sha256": "896f882c5f8e0e2050bab3d8b44aecfb3967be01cc9328003477016ae7f7fa4a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14249,6 +14249,11 @@
       "mode": "0000644",
       "sha256": "0d45c19886939b8a068df438d2e03e749efb3a84258764ed0a345ce96128827d"
     },
+    {
+      "path": "tests/routine_observability_api.mjs",
+      "mode": "0000644",
+      "sha256": "5769b95af91e3b0ddf7a8c41ffb83a0cc3231dc912c396dc98ac9ae15918c820"
+    },
     {
       "path": "tests/routine_schedule.mjs",
       "mode": "0000644",
@@ -14532,7 +14537,7 @@
     {
       "path": "tests/ship_assurance.mjs",
       "mode": "0000644",
-      "sha256": "63f7b9e24126449b55d8c4fd0c5d8ff4dc11fea2e4eeb7b60d87d66722d5f518"
+      "sha256": "ca6e0100049ad284c8467fe4775ed9db4578f11c0704091043dda5e2c25654cf"
     },
     {
       "path": "tests/ship_autolinkify.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 437 operations across 65 resource groups
+- 439 operations across 66 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -189,6 +189,8 @@ function createClient(opts = {}) {
       getAutonomyPrecheck: (args) => request("GET", "/autonomy/precheck", { hasBody: false }, args),
       // GET /autonomy/runners — rank: any-builder — GET /autonomy/runners
       getAutonomyRunners: (args) => request("GET", "/autonomy/runners", { hasBody: false }, args),
+      // GET /autonomy/runs — rank: metic+archon — GET /autonomy/runs
+      getAutonomyRuns: (args) => request("GET", "/autonomy/runs", { hasBody: false }, args),
     },
     "backup": {
       // GET /backup/status — rank: metic+archon — GET /backup/status
@@ -350,6 +352,10 @@ function createClient(opts = {}) {
       // GET /core-update — rank: archon — GET /core-update
       getCoreUpdate: (args) => request("GET", "/core-update", { hasBody: false }, args),
     },
+    "coreUpgrades": {
+      // GET /core-upgrades — rank: archon — GET /core-upgrades
+      getCoreUpgrades: (args) => request("GET", "/core-upgrades", { hasBody: false }, args),
+    },
     "cost": {
       // POST /cost — rank: any-builder — POST /cost
       postCost: (args) => request("POST", "/cost", { hasBody: true }, args),

package/clients/bongos-client/index.cjs

@@ -188,6 +188,8 @@ function createClient(opts = {}) {
       getAutonomyPrecheck: (args) => request("GET", "/autonomy/precheck", { hasBody: false }, args),
       // GET /autonomy/runners — rank: any-builder — GET /autonomy/runners
       getAutonomyRunners: (args) => request("GET", "/autonomy/runners", { hasBody: false }, args),
+      // GET /autonomy/runs — rank: metic+archon — GET /autonomy/runs
+      getAutonomyRuns: (args) => request("GET", "/autonomy/runs", { hasBody: false }, args),
     },
     "backup": {
       // GET /backup/status — rank: metic+archon — GET /backup/status
@@ -349,6 +351,10 @@ function createClient(opts = {}) {
       // GET /core-update — rank: archon — GET /core-update
       getCoreUpdate: (args) => request("GET", "/core-update", { hasBody: false }, args),
     },
+    "coreUpgrades": {
+      // GET /core-upgrades — rank: archon — GET /core-upgrades
+      getCoreUpgrades: (args) => request("GET", "/core-upgrades", { hasBody: false }, args),
+    },
     "cost": {
       // POST /cost — rank: any-builder — POST /cost
       postCost: (args) => request("POST", "/cost", { hasBody: true }, args),

package/clients/bongos-client/index.d.ts

@@ -35,6 +35,7 @@ export interface GetAuditLogResponse { rows: unknown; page: unknown }
 export interface GetAuthAppPairInfoResponse { pair_code: unknown; device_name: unknown; platform: unknown; status: unknown }
 export interface GetAuthWebAdmissionStatusResponse { admitted: boolean }
 export interface GetAutonomyRunnersResponse { runners: unknown; none: unknown }
+export interface GetAutonomyRunsResponse { routine: unknown; limit: unknown; runs: unknown }
 export interface GetBackupStatusResponse { backup_dir: unknown; db_name: unknown; latest_dump: unknown; stale: unknown; age_hours: unknown; trigger_running: unknown }
 export interface GetBlockersIdResponse { blocker: unknown }
 export interface GetBlockersResponse { blockers: unknown; page: unknown }
@@ -61,6 +62,7 @@ export interface GetConnectionsRequestsResponse { incoming: unknown; outgoing: u
 export interface GetConnectionsResponse { connections: unknown; count: unknown }
 export interface GetConnectionsSuggestionsResponse { suggestions: unknown; count: unknown }
 export interface GetCoreUpdateResponse { ok: boolean; update: unknown }
+export interface GetCoreUpgradesResponse { ok: boolean; running: unknown; limit: unknown; upgrades: unknown }
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }
 export interface GetDiscordChannelsSnapshotResponse { ok: boolean; guild_id: unknown; config: unknown; warnings: unknown }
 export interface GetDoneWhenPendingReviewResponse { criteria: unknown; count: unknown }
@@ -601,6 +603,8 @@ export interface BongosClient {
     getAutonomyPrecheck(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /autonomy/runners — rank: any-builder */
     getAutonomyRunners(args?: RequestArgs): Promise<GetAutonomyRunnersResponse>;
+    /** GET /autonomy/runs — rank: metic+archon */
+    getAutonomyRuns(args?: RequestArgs): Promise<GetAutonomyRunsResponse>;
   };
   "backup": {
     /** GET /backup/status — rank: metic+archon */
@@ -762,6 +766,10 @@ export interface BongosClient {
     /** GET /core-update — rank: archon */
     getCoreUpdate(args?: RequestArgs): Promise<GetCoreUpdateResponse>;
   };
+  "coreUpgrades": {
+    /** GET /core-upgrades — rank: archon */
+    getCoreUpgrades(args?: RequestArgs): Promise<GetCoreUpgradesResponse>;
+  };
   "cost": {
     /** POST /cost — rank: any-builder */
     postCost(args: RequestArgs & { body: PostCostRequest }): Promise<PostCostResponse>;

package/clients/bongos-client/index.mjs

@@ -185,6 +185,8 @@ export function createClient(opts = {}) {
       getAutonomyPrecheck: (args) => request("GET", "/autonomy/precheck", { hasBody: false }, args),
       // GET /autonomy/runners — rank: any-builder — GET /autonomy/runners
       getAutonomyRunners: (args) => request("GET", "/autonomy/runners", { hasBody: false }, args),
+      // GET /autonomy/runs — rank: metic+archon — GET /autonomy/runs
+      getAutonomyRuns: (args) => request("GET", "/autonomy/runs", { hasBody: false }, args),
     },
     "backup": {
       // GET /backup/status — rank: metic+archon — GET /backup/status
@@ -346,6 +348,10 @@ export function createClient(opts = {}) {
       // GET /core-update — rank: archon — GET /core-update
       getCoreUpdate: (args) => request("GET", "/core-update", { hasBody: false }, args),
     },
+    "coreUpgrades": {
+      // GET /core-upgrades — rank: archon — GET /core-upgrades
+      getCoreUpgrades: (args) => request("GET", "/core-upgrades", { hasBody: false }, args),
+    },
     "cost": {
       // POST /cost — rank: any-builder — POST /cost
       postCost: (args) => request("POST", "/cost", { hasBody: true }, args),

package/docs/api/openapi.json

@@ -105,6 +105,10 @@
       "name": "core-update",
       "description": "Endpoints under `/api/bongos/core-update`."
     },
+    {
+      "name": "core-upgrades",
+      "description": "Endpoints under `/api/bongos/core-upgrades`."
+    },
     {
       "name": "cost",
       "description": "Endpoints under `/api/bongos/cost`."
@@ -2128,6 +2132,47 @@
         ]
       }
     },
+    "/autonomy/runs": {
+      "get": {
+        "operationId": "get_autonomy_runs",
+        "tags": [
+          "autonomy"
+        ],
+        "summary": "GET /autonomy/runs",
+        "description": "The gate's past decisions — did a routine fire, and what did it decide, and why (task 1002669). READ-ONLY and behind the SAME atom as the precheck above (`autonomy.precheck`, Metic+): whoever may ask the gate the question may read its past answers, and a new atom would need a migration for no change in audience. Adds no gate anywhere — pure observability over rows the precheck already writes. ?routine=<name> narrows to one routine; ?limit=1..100 (default 20), newest first.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `autonomy.precheck` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/autonomy/routes/autonomy.js",
+        "x-permissions": [
+          "autonomy.precheck"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetAutonomyRunsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/backup/status": {
       "get": {
         "operationId": "get_backup_status",
@@ -5126,6 +5171,47 @@
         ]
       }
     },
+    "/core-upgrades": {
+      "get": {
+        "operationId": "get_core_upgrades",
+        "tags": [
+          "core-upgrades"
+        ],
+        "summary": "GET /core-upgrades",
+        "description": "GET /core-upgrades — the instance's own core-upgrade ledger, newest first: when the pin last moved, from and to which version, and whether a person or the unattended sweep moved it (task 1002669). READ-ONLY. Gated on the SAME atom as /core-update above and the deploy door, for the same first reason: it names the exact core this box has run and when, which is a vulnerability-window disclosure (ADR 0043). No new atom, so no migration. ?limit=1..100 (default 20).\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `core.pin.move` (all required).",
+        "x-rank": "archon",
+        "x-source": "src/bongos/routes/core-update.js",
+        "x-permissions": [
+          "core.pin.move"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetCoreUpgradesResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/cost": {
       "post": {
         "operationId": "post_cost",
@@ -20636,6 +20722,19 @@
           "none"
         ]
       },
+      "GetAutonomyRunsResponse": {
+        "type": "object",
+        "properties": {
+          "routine": {},
+          "limit": {},
+          "runs": {}
+        },
+        "required": [
+          "routine",
+          "limit",
+          "runs"
+        ]
+      },
       "GetBackupStatusResponse": {
         "type": "object",
         "properties": {
@@ -20999,6 +21098,23 @@
           "update"
         ]
       },
+      "GetCoreUpgradesResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "running": {},
+          "limit": {},
+          "upgrades": {}
+        },
+        "required": [
+          "ok",
+          "running",
+          "limit",
+          "upgrades"
+        ]
+      },
       "GetDiscordChannelsPlanResponse": {
         "type": "object",
         "properties": {
@@ -27782,9 +27898,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 437,
-  "x-schema-count": 479,
+  "x-endpoint-count": 439,
+  "x-schema-count": 481,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 327,
+  "x-response-schemas": 329,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 437 endpoints across 74 route files.
+> **Generated from the live route files** — the route file is authoritative. 439 endpoints across 74 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -84,7 +84,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/auth/web/callback` | `public` | — | OAuth callback; the state cookie + code are the bearer. |
 | GET | `/api/bongos/auth/web/start` | `public` | — | /auth/web — browser flow (used by the /builders page). |
 
-## `autonomy` (7)
+## `autonomy` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -95,6 +95,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/autonomy/heartbeat` | `any-builder` | `host`, `pid`, `started_at`, `mode`, `consecutive_failures`, `last_event`, `working_task_id` | The runner's check-in, once per loop. |
 | GET | `/api/bongos/autonomy/precheck` | `metic+archon` | — |  |
 | GET | `/api/bongos/autonomy/runners` | `any-builder` | — | What the hall renders: the CALLER'S OWN runners, with the pure verdict attached so the page and any future alert cannot disagree about wh… |
+| GET | `/api/bongos/autonomy/runs` | `metic+archon` | — | The gate's past decisions — did a routine fire, and what did it decide, and why (task 1002669). |
 
 ## `backup` (2)
 
@@ -224,6 +225,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/core-update` | `archon` | — |  |
 
+## `core-upgrades` (1)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/core-upgrades` | `archon` | — | GET /core-upgrades — the instance's own core-upgrade ledger, newest first: when the pin last moved, from and to which version, and whethe… |
+
 ## `cost` (1)
 
 | Method | Path | Rank | Body | Description |

package/docs/module-api-changelog.md

@@ -2547,5 +2547,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1032 with no explicit bump. run 36214617025. (task 1002620)
   1.19.1034 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1033 with no explicit bump. run 36215757254. (task 1002620)
+  1.19.1035 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1034 with no explicit bump. run 36226356336. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/autonomy/db.js

@@ -44,6 +44,24 @@ async function lastAutonomyHead(routine) {
   return rows[0]?.head_sha || null;
 }
 
+// The recent autonomy-gate decisions, newest first — the off-box answer to "did the
+// routine fire, and what did it decide" (task 1002669). Every precheck writes a row
+// here, every SKIP included, so the table is the whole record; before this read
+// existed, finding out needed an SSH session on the host (blocker 1000106). `routine`
+// null means every routine. The (routine, created_at DESC) index serves both shapes.
+async function readAutonomyRuns({ routine = null, limit = 20 } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, routine, decision, reason, head_sha, claimable_count, enabled, created_at
+       FROM autonomy_runs
+      WHERE ($1::text IS NULL OR routine = $1)
+      ORDER BY created_at DESC, id DESC
+      LIMIT $2`,
+    [routine, limit]
+  );
+  // bigserial ids arrive as strings from node-postgres; keep them strings on purpose.
+  return rows.map((r) => ({ ...r, id: String(r.id) }));
+}
+
 // ── the Autobongos fence (task 1003908, ADR 0307 §6) ─────────────────────────
 //
 // These back the one control surface the runner host cannot write to. Everything
@@ -162,6 +180,7 @@ async function readRunnerHeartbeats(builderId) {
 module.exports = {
   recordAutonomyRun,
   lastAutonomyHead,
+  readAutonomyRuns,
   recordRunnerHeartbeat,
   readRunnerHeartbeats,
   readFence,

package/modules/autonomy/routes/autonomy.js

@@ -42,6 +42,16 @@ const { validateOrRespond } = api;
 //
 // rank: archon — autonomy is an ops control surface, and a precheck records an
 // autonomy_runs row + git-fetches. Keep it archon-scoped (ADR 0016).
+// ?limit for GET /autonomy/runs: an integer 1..100, else the default 20. Clamped rather
+// than refused — a read an operator types by hand should answer, not argue.
+const RUNS_DEFAULT_LIMIT = 20;
+const RUNS_MAX_LIMIT = 100;
+function runsLimit(raw) {
+  const n = Number.parseInt(String(raw ?? ''), 10);
+  if (!Number.isFinite(n)) return RUNS_DEFAULT_LIMIT;
+  return Math.min(RUNS_MAX_LIMIT, Math.max(1, n));
+}
+
 module.exports = function buildAutonomyRouter() {
   const router = express.Router();
 
@@ -58,6 +68,24 @@ module.exports = function buildAutonomyRouter() {
     }
   });
 
+  // The gate's past decisions — did a routine fire, and what did it decide, and why
+  // (task 1002669). READ-ONLY and behind the SAME atom as the precheck above
+  // (`autonomy.precheck`, Metic+): whoever may ask the gate the question may read its
+  // past answers, and a new atom would need a migration for no change in audience.
+  // Adds no gate anywhere — pure observability over rows the precheck already writes.
+  // ?routine=<name> narrows to one routine; ?limit=1..100 (default 20), newest first.
+  router.get('/autonomy/runs', auth.requireBuilder, auth.requirePermission('autonomy.precheck'), async (req, res) => {
+    const routine = typeof req.query.routine === 'string' && req.query.routine ? req.query.routine.slice(0, 64) : null;
+    const limit = runsLimit(req.query.limit);
+    try {
+      const runs = await db.readAutonomyRuns({ routine, limit });
+      res.json({ routine, limit, runs });
+    } catch (err) {
+      log.error('[gds] GET /autonomy/runs', err);
+      res.fail('autonomy_runs_unreadable', { status: 503, message: 'could not read the autonomy decisions' });
+    }
+  });
+
   // ── the Autobongos fence (task 1003908, ADR 0307 §6) ───────────────────────
   //
   // These four routes ARE the fence. Everything the unattended runner is allowed

package/modules/government/catalog.js

@@ -108,7 +108,7 @@ const PERMISSIONS = [
   // owner holds: the catalog's own invariant forbids granting a system key to metic,
   // so this cannot be delegated downward by a custom rank. The web tier still gains
   // no shell - the route only QUEUES an intent the control-plane runner drains.
-  { key: 'core.pin.move', system: true, floor: 'archon', guards: 'POST /provisioning/instances/:id/core-upgrade — gate 3 of the release pipeline (ADR 0293)' },
+  { key: 'core.pin.move', system: true, floor: 'archon', guards: 'POST /provisioning/instances/:id/core-upgrade — gate 3 of the release pipeline (ADR 0293); also the reads GET /core-update (the upgrade banner) and GET /core-upgrades (the upgrade ledger, task 1002669)' },
   // autonomy.fence.manage (task 1003908, ADR 0307 §6) — THE AUTOBONGOS KILL
   // SWITCH and the allowlist of goals an unattended runner may work. system:true
   // + archon for core.pin.move's reason, in a slightly sharper form: this decides
@@ -253,7 +253,7 @@ const PERMISSIONS = [
   { key: 'security.report.adjudicate', system: false, floor: 'metic', guards: 'GET /security/reports, POST /security/reports/:id/{confirm,dispute,fix,link-fix}, /security/docs CRUD (ADR 0157, was archon)' },
   { key: 'provisioning.fleet.manage', system: false, floor: 'metic', guards: 'GET /provisioning/fleet[/cost-ledger], POST .../force-teardown (ADR 0157, was archon)' },
   { key: 'box.fleet.manage', system: false, floor: 'metic', scope: 'any', resource: 'box', verb: 'manage', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block (ADR 0157, was archon)' },
-  { key: 'autonomy.precheck', system: false, floor: 'metic', guards: 'GET /autonomy/precheck — unsupervised-runner gate (ADR 0157, was archon)' },
+  { key: 'autonomy.precheck', system: false, floor: 'metic', guards: 'GET /autonomy/precheck — unsupervised-runner gate (ADR 0157, was archon); also GET /autonomy/runs, the gate\'s past decisions (task 1002669)' },
   { key: 'discord.channels.manage', system: false, floor: 'metic', guards: 'GET /discord/channels/plan, POST .../reconcile (ADR 0157, was archon)' },
   // Metic by the discord.channels.manage analogue — configuring a project-wide
   // social surface — rather than archon. The blast radius is bounded by the OTHER

package/modules/lifecycle/ship-assurance.js

@@ -74,10 +74,26 @@ async function deriveShipAssurance({ taskId, body = {}, db, githubPush, onProbeE
   // before landProvenForTask ever saw a recorded tip, so a commit provably on main
   // was refused as "not proven" (strands 1003285/1003286, task 1003434). Each step
   // now fails on its own: a status miss degrades to status=null, never to no-proof.
+  //
+  // The status probe needs a BRANCH (task 1004275). It used to be called with
+  // { taskId, publishedSha }, which getPublishStatus does not read, so it threw
+  // BAD_BRANCH every time and both PR-witness proofs in landProvenForTask (the
+  // squash/out-of-band land, and the no-tip fallback) could never fire on this path,
+  // while the reconciler proved the same land ~5 min later. So find the task's own PR
+  // first, by the "task <id>: …" title both publish paths give it (the same lookup
+  // GET /publish-status does since task 1003764), and ask about that branch. No PR,
+  // or a failed search, leaves status=null: the tip proof still runs.
   let publishedSha = null;
   try { publishedSha = await db.getClaimPublishedSha(taskId); } catch (e) { report(e); }
+  let branch = null;
+  try {
+    const found = await githubPush.findTaskPullRequest({ taskId });
+    branch = (found && found.branch) || null;
+  } catch (e) { report(e); }
   let status = null;
-  try { status = await githubPush.getPublishStatus({ taskId, publishedSha }); } catch (e) { report(e); }
+  if (branch) {
+    try { status = await githubPush.getPublishStatus({ branch }); } catch (e) { report(e); }
+  }
   try {
     const proof = await githubPush.landProvenForTask({ taskId, publishedSha, status });
     if (proof && proof.proven) return { assurance: { kind: 'proof', reason: proof.reason } };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1034",
+  "version": "1.19.1035",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1034",
+      "version": "1.19.1035",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1034",
+  "version": "1.19.1035",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7477,5 +7477,15 @@
       "id": "1004288",
       "text": "The setup instructions an AI assistant follows on a fresh copy of a project no longer claim the core package is private, so a real download failure is no longer mistaken for normal."
     }
+  ],
+  "1.19.1035": [
+    {
+      "id": "1004275",
+      "text": "Marking a task shipped by hand now recognises work that already reached the project through its own merged request, instead of refusing it and making the builder wait for the automatic check minutes later."
+    },
+    {
+      "id": "1002669",
+      "text": "The owner can now check from their own laptop what the automatic background jobs decided and when the project's core software was last upgraded, instead of logging into the server to find out."
+    }
   ]
 }

package/src/bongos/core-update.js

@@ -144,4 +144,26 @@ async function readCoreUpdate({ running, channel, get, ...deps } = {}) {
   return coreUpdateVerdict({ running, available: r.ok ? r.versions : [], channel });
 }
 
-module.exports = { readCoreUpdate };
+// readCoreUpgrades — the instance's own core-upgrade ledger, newest first: when the
+// core pin last moved, from which version to which, and who or what moved it (task
+// 1002669). `core_upgrades` is written by `bongos upgrade` on every successful move and
+// rollback (scripts/gds/upgrade.js), including the unattended patch sweep's, and no
+// route read it — so "when did the pin last move" needed an SSH session. The pool is
+// injectable so the test runs with no database; the default is the instance's own.
+async function readCoreUpgrades({ limit = 20, pool = null } = {}) {
+  const db = pool || require('./pool').pool;
+  const { rows } = await db.query(
+    `SELECT id, from_version, to_version, source_commit, note, applied_at, source, requested_by_builder_id
+       FROM core_upgrades
+      ORDER BY applied_at DESC, id DESC
+      LIMIT $1`,
+    [limit]
+  );
+  return rows.map((r) => ({
+    ...r,
+    id: String(r.id),
+    requested_by_builder_id: r.requested_by_builder_id == null ? null : String(r.requested_by_builder_id),
+  }));
+}
+
+module.exports = { readCoreUpdate, readCoreUpgrades };

package/src/bongos/routes/core-update.js

@@ -21,9 +21,16 @@
 const express = require('express');
 const { asyncHandler } = require('./_helpers');
 const auth = require('../auth');
-const { readCoreUpdate } = require('../core-update');
+const { readCoreUpdate, readCoreUpgrades } = require('../core-update');
 
-module.exports = function buildCoreUpdateRouter() {
+// ?limit for GET /core-upgrades: an integer 1..100, else 20.
+function upgradesLimit(raw) {
+  const n = Number.parseInt(String(raw ?? ''), 10);
+  if (!Number.isFinite(n)) return 20;
+  return Math.min(100, Math.max(1, n));
+}
+
+module.exports = function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
   const router = express.Router();
 
   router.get(
@@ -45,5 +52,23 @@ module.exports = function buildCoreUpdateRouter() {
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
+  // GET /core-upgrades — the instance's own core-upgrade ledger, newest first: when
+  // the pin last moved, from and to which version, and whether a person or the
+  // unattended sweep moved it (task 1002669). READ-ONLY. Gated on the SAME atom as
+  // /core-update above and the deploy door, for the same first reason: it names the
+  // exact core this box has run and when, which is a vulnerability-window disclosure
+  // (ADR 0043). No new atom, so no migration. ?limit=1..100 (default 20).
+  router.get(
+    '/core-upgrades',
+    auth.requireBuilder,
+    auth.requirePermission('core.pin.move'),
+    asyncHandler('GET /core-upgrades', async (req, res) => {
+      let running = null;
+      try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
+      const limit = upgradesLimit(req.query.limit);
+      res.json({ ok: true, running, limit, upgrades: await upgrades({ limit }) });
+    }, { errorCode: 'core_upgrades_unreadable', message: false }),
+  );
+
   return router;
 };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1034'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1035'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/routine_observability_api.mjs

@@ -0,0 +1,195 @@
+// tests/routine_observability_api.mjs — the unattended routines are diagnosable from off
+// the box (task 1002669).
+//
+// Every autonomy-gate decision already lands in `autonomy_runs` and every core upgrade in
+// `core_upgrades`, but no route read either, so "did the routine fire, what did it
+// decide, and when did the pin last move" needed an SSH session (blocker 1000106). Two
+// read-only routes answer it now:
+//   GET /api/bongos/autonomy/runs    — behind `autonomy.precheck` (Metic+), the atom the
+//                                      precheck itself uses
+//   GET /api/bongos/core-upgrades    — behind `core.pin.move` (Archon), the atom the
+//                                      upgrade banner and the deploy door use
+// No new atom, so no migration. These tests drive REAL requests through the assembled
+// routers with only the two auth gates stubbed (the core_update_banner precedent: an
+// arity-mangled handler 500s, and only a real request sees that), read the atom each
+// gate was built with off the router stack, and pin the SQL against a stubbed pool.
+//
+// DB-free, no network. Run:  node --test tests/routine_observability_api.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const req = createRequire(import.meta.url);
+const express = req('express');
+const { attachFail } = req(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+// A permission stub that remembers which atom it was built with, so the test can read
+// the gate's authority off the router instead of grepping the source for it.
+const permStub = (key) => {
+  const mw = (_req, _res, next) => next();
+  mw.permKey = key;
+  return mw;
+};
+const passBuilder = (reqq, _res, next) => { reqq.builder = { id: 3, rank: 'archon' }; next(); };
+
+async function serve(router) {
+  const app = express();
+  app.use(attachFail);
+  app.use(router);
+  const server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  return { base, close: () => server.close() };
+}
+
+function layerFor(router, p) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p);
+  assert.ok(layer, `${p} is registered`);
+  return layer;
+}
+
+// ── GET /autonomy/runs ──────────────────────────────────────────────────────────────
+
+function autonomyRouter() {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const saved = { b: api.requireBuilder, p: api.requirePermission };
+  api.requireBuilder = passBuilder;
+  api.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'modules/autonomy/routes/autonomy.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)();
+  } finally {
+    api.requireBuilder = saved.b;
+    api.requirePermission = saved.p;
+  }
+}
+
+test('GET /autonomy/runs is gated by requireBuilder + the precheck\'s own atom', () => {
+  const layer = layerFor(autonomyRouter(), '/autonomy/runs');
+  assert.equal(layer.route.methods.get, true);
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack[1].handle.permKey, 'autonomy.precheck');
+});
+
+test('GET /autonomy/runs returns the decisions, narrowed by routine and a clamped limit', async () => {
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = db.readAutonomyRuns;
+  const seen = [];
+  const rows = [{ id: '7', routine: 'overnight-builder', decision: 'no-go', reason: 'no claimable work', head_sha: 'abc', claimable_count: 0, enabled: true, created_at: '2026-09-25T02:00:00.000Z' }];
+  db.readAutonomyRuns = async (args) => { seen.push(args); return rows; };
+  const s = await serve(autonomyRouter());
+  try {
+    let r = await fetch(`${s.base}/autonomy/runs?routine=overnight-builder&limit=500`);
+    assert.equal(r.status, 200);
+    assert.deepEqual(await r.json(), { routine: 'overnight-builder', limit: 100, runs: rows });
+    assert.deepEqual(seen.pop(), { routine: 'overnight-builder', limit: 100 }, 'a limit above 100 is clamped, not refused');
+
+    r = await fetch(`${s.base}/autonomy/runs`);
+    assert.equal(r.status, 200);
+    assert.deepEqual(seen.pop(), { routine: null, limit: 20 }, 'no routine = every routine; the default limit is 20');
+
+    await fetch(`${s.base}/autonomy/runs?limit=banana`);
+    assert.equal(seen.pop().limit, 20, 'a non-number falls back to the default');
+    await fetch(`${s.base}/autonomy/runs?limit=0`);
+    assert.equal(seen.pop().limit, 1);
+
+    db.readAutonomyRuns = async () => { throw new Error('relation "autonomy_runs" does not exist'); };
+    r = await fetch(`${s.base}/autonomy/runs`);
+    assert.equal(r.status, 503, 'an unreadable table is a 503 that says so, never an empty list');
+    const body = await r.json();
+    assert.equal(body.error.code, 'autonomy_runs_unreadable');
+    assert.ok(!JSON.stringify(body).includes('does not exist'), 'the database error text stays in the log');
+  } finally {
+    s.close();
+    db.readAutonomyRuns = saved;
+  }
+});
+
+test('readAutonomyRuns: newest first, one routine or all, ids as strings', async () => {
+  const api = req(path.join(ROOT, 'src/module-api.js'));
+  const db = req(path.join(ROOT, 'modules/autonomy/db.js'));
+  const saved = api.pool.query;
+  const calls = [];
+  api.pool.query = async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 42, routine: 'bfg', decision: 'go' }] }; };
+  try {
+    const out = await db.readAutonomyRuns({ routine: 'bfg', limit: 5 });
+    assert.deepEqual(out, [{ id: '42', routine: 'bfg', decision: 'go' }]);
+    assert.match(calls[0].sql, /FROM autonomy_runs/);
+    assert.match(calls[0].sql, /\$1::text IS NULL OR routine = \$1/);
+    assert.match(calls[0].sql, /ORDER BY created_at DESC/);
+    assert.deepEqual(calls[0].params, ['bfg', 5]);
+    await db.readAutonomyRuns();
+    assert.deepEqual(calls[1].params, [null, 20]);
+    assert.doesNotMatch(calls[0].sql, /\b(INSERT|UPDATE|DELETE)\b/i, 'read-only');
+  } finally {
+    api.pool.query = saved;
+  }
+});
+
+// ── GET /core-upgrades ──────────────────────────────────────────────────────────────
+
+function coreUpdateRouter(deps) {
+  const auth = req(path.join(ROOT, 'src/bongos/auth.js'));
+  const saved = { b: auth.requireBuilder, p: auth.requirePermission };
+  auth.requireBuilder = passBuilder;
+  auth.requirePermission = permStub;
+  const routePath = req.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  delete req.cache[routePath];
+  try {
+    return req(routePath)(deps);
+  } finally {
+    auth.requireBuilder = saved.b;
+    auth.requirePermission = saved.p;
+    delete req.cache[routePath];
+  }
+}
+
+test('GET /core-upgrades is gated by requireBuilder + core.pin.move, like the banner beside it', () => {
+  const router = coreUpdateRouter();
+  const layer = layerFor(router, '/core-upgrades');
+  assert.equal(layer.route.stack.length, 3, 'requireBuilder + requirePermission + handler');
+  assert.equal(layer.route.stack[1].handle.permKey, 'core.pin.move');
+  assert.equal(layerFor(router, '/core-update').route.stack[1].handle.permKey, 'core.pin.move', 'the existing route is untouched');
+});
+
+test('GET /core-upgrades answers "when did the pin last move", newest first', async () => {
+  const seen = [];
+  const ledger = [
+    { id: '12', from_version: '1.19.1022', to_version: '1.19.1023', source_commit: 'b50d32f1', note: null, applied_at: '2026-09-24T10:00:00.000Z', source: 'door', requested_by_builder_id: '3' },
+    { id: '11', from_version: '1.19.1010', to_version: '1.19.1022', source_commit: null, note: 'auto-subscription (patch)', applied_at: '2026-09-23T10:00:00.000Z', source: 'cli', requested_by_builder_id: null },
+  ];
+  const s = await serve(coreUpdateRouter({ upgrades: async (args) => { seen.push(args); return ledger; } }));
+  try {
+    const r = await fetch(`${s.base}/core-upgrades?limit=2`);
+    assert.equal(r.status, 200, 'the handler runs — a 500 here is the asyncHandler arity bug');
+    const body = await r.json();
+    assert.equal(body.ok, true);
+    assert.equal(body.limit, 2);
+    assert.deepEqual(body.upgrades, ledger);
+    assert.equal(body.upgrades[0].applied_at, '2026-09-24T10:00:00.000Z', 'the first row is the last pin move');
+    assert.ok('running' in body, 'the running core version rides along, so behind-or-not is one read');
+    assert.deepEqual(seen, [{ limit: 2 }]);
+  } finally {
+    s.close();
+  }
+});
+
+test('readCoreUpgrades: the ledger, newest first, read-only, ids as strings', async () => {
+  const { readCoreUpgrades } = req(path.join(ROOT, 'src/bongos/core-update.js'));
+  const calls = [];
+  const pool = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 5, to_version: '1.19.1023', requested_by_builder_id: 3 }, { id: 4, to_version: '1.19.1022', requested_by_builder_id: null }] }; } };
+  const out = await readCoreUpgrades({ limit: 7, pool });
+  assert.deepEqual(out, [
+    { id: '5', to_version: '1.19.1023', requested_by_builder_id: '3' },
+    { id: '4', to_version: '1.19.1022', requested_by_builder_id: null },
+  ]);
+  assert.match(calls[0].sql, /FROM core_upgrades/);
+  assert.match(calls[0].sql, /ORDER BY applied_at DESC/);
+  assert.deepEqual(calls[0].params, [7]);
+  assert.doesNotMatch(calls[0].sql, /\b(INSERT|UPDATE|DELETE)\b/i, 'read-only');
+});

package/tests/ship_assurance.mjs

@@ -194,14 +194,15 @@ await t('the CLI carries the declaration through its deliberate-empty path', ()
 const { deriveShipAssurance } = require(path.join(ROOT, 'modules/lifecycle/ship-assurance.js'));
 const TIP = 'a'.repeat(40);
 console.log('\nthe tip proof does not depend on the branch/PR probe');
-await t('tip in main + getPublishStatus throwing (no branch on the claim) → proof', async () => {
+await t('tip in main + getPublishStatus throwing → proof (the status probe is only a witness)', async () => {
   const seen = [];
   const r = await deriveShipAssurance({
     taskId: 1003285,
     body: {},
     db: { getClaimPublishedSha: async () => TIP },
     githubPush: {
-      getPublishStatus: async () => { const e = new Error('BAD_BRANCH'); e.code = 'BAD_BRANCH'; throw e; },
+      findTaskPullRequest: async () => ({ branch: 'task-1003285', pr_number: 7, merged: true }),
+      getPublishStatus: async () => { const e = new Error('STATUS_FETCH_FAILED'); e.code = 'STATUS_FETCH_FAILED'; throw e; },
       landProvenForTask: async ({ publishedSha, status }) => {
         seen.push({ publishedSha, status });
         return publishedSha === TIP ? { proven: true, reason: 'published tip in main' } : { proven: false };
@@ -210,9 +211,28 @@ await t('tip in main + getPublishStatus throwing (no branch on the claim) → pr
     onProbeError: (e) => seen.push({ probeError: e.code }),
   });
   assert.equal(seen.some((s) => s.publishedSha === TIP && s.status === null), true, 'the proof ran with status=null');
-  assert.equal(seen.some((s) => s.probeError === 'BAD_BRANCH'), true, 'the probe failure was still reported');
+  assert.equal(seen.some((s) => s.probeError === 'STATUS_FETCH_FAILED'), true, 'the probe failure was still reported');
   assert.equal(r.assurance && r.assurance.kind, 'proof');
 });
+await t('tip in main + the PR search throwing → proof, and the status probe is never asked', async () => {
+  let statusCalls = 0;
+  const errs = [];
+  const r = await deriveShipAssurance({
+    taskId: 1003286,
+    body: {},
+    db: { getClaimPublishedSha: async () => TIP },
+    githubPush: {
+      findTaskPullRequest: async () => { const e = new Error('PUSH_UNCONFIGURED'); e.code = 'PUSH_UNCONFIGURED'; throw e; },
+      getPublishStatus: async () => { statusCalls++; return null; },
+      landProvenForTask: async ({ publishedSha, status }) => (publishedSha === TIP && status === null
+        ? { proven: true, reason: 'published tip in main' } : { proven: false }),
+    },
+    onProbeError: (e) => errs.push(e.code),
+  });
+  assert.equal(r.assurance && r.assurance.kind, 'proof');
+  assert.deepEqual(errs, ['PUSH_UNCONFIGURED'], 'the search failure is reported on its own');
+  assert.equal(statusCalls, 0, 'no branch was found, so there is nothing to ask the status probe about');
+});
 await t('no tip + getPublishStatus throwing → still the 409 refusal (nothing to prove)', async () => {
   const r = await deriveShipAssurance({
     taskId: 1003253,
@@ -238,5 +258,68 @@ await t('a proof failure (compare API down) still falls through to the refusal,
   assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
 });
 
+// task 1004275 — the status probe was called with { taskId, publishedSha }, which
+// getPublishStatus does not read: it wants { branch }, so it threw BAD_BRANCH on EVERY
+// manual ship and both PR-witness proofs could never fire here. A squash-landed or
+// no-tip task was refused ship_land_not_proven while the reconciler (which resolves a
+// branch) shipped it minutes later. The branch now comes from the task's own PR, found
+// by title — the lookup GET /publish-status has used since task 1003764.
+console.log('\nthe PR witnesses reach the proof (task 1004275)');
+const realPush = require(path.join(ROOT, 'modules/lifecycle/github-push.js'));
+// The REAL getPublishStatus contract, minus the network: anything but a safe branch is
+// refused exactly as the real one refuses it, so the pre-fix call shape goes red here.
+const statusFor = (merged) => async (args) => {
+  if (!args || !realPush.isSafeBranch(args.branch)) { const e = new Error('BAD_BRANCH'); e.code = 'BAD_BRANCH'; throw e; }
+  return { branch: args.branch, pr_state: merged ? 'closed' : 'open', merged, pr_number: 1214,
+    pr_title: 'task 1004275: fix the land proof', pr_body: '', merge_sha: null };
+};
+await t('no tip + a merged PR titled for the task → proof (the no-tip fallback now fires)', async () => {
+  const asked = [];
+  const errs = [];
+  const r = await deriveShipAssurance({
+    taskId: 1004275,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      findTaskPullRequest: async (a) => { asked.push(a); return { branch: '1004275-assurance-branch-w4q8', pr_number: 1214, merged: true }; },
+      getPublishStatus: statusFor(true),
+      landProvenForTask: realPush.landProvenForTask, // no tip + merged PR → decided with no network call
+    },
+    onProbeError: (e) => errs.push(e.code),
+  });
+  assert.deepEqual(errs, [], 'no probe failed');
+  assert.deepEqual(asked, [{ taskId: 1004275 }], 'the PR is found by the task id');
+  assert.equal(r.assurance && r.assurance.kind, 'proof');
+  assert.match(r.assurance.reason, /matched PR references task 1004275/);
+});
+await t('no tip + the task\'s PR still OPEN → the 409 refusal (a PR is a witness, not a land)', async () => {
+  const r = await deriveShipAssurance({
+    taskId: 1004275,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      findTaskPullRequest: async () => ({ branch: '1004275-assurance-branch-w4q8', pr_number: 1214, merged: false }),
+      getPublishStatus: statusFor(false),
+      landProvenForTask: realPush.landProvenForTask,
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+});
+await t('no tip + no PR for the task → the 409 refusal, and getPublishStatus is not called with nothing', async () => {
+  let statusCalls = 0;
+  const r = await deriveShipAssurance({
+    taskId: 1004276,
+    body: {},
+    db: { getClaimPublishedSha: async () => null },
+    githubPush: {
+      findTaskPullRequest: async () => null,
+      getPublishStatus: async () => { statusCalls++; throw new Error('BAD_BRANCH'); },
+      landProvenForTask: realPush.landProvenForTask,
+    },
+  });
+  assert.equal(r.refusal && r.refusal.code, 'ship_land_not_proven');
+  assert.equal(statusCalls, 0);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);