@bongos/core 1.19.1038 → 1.19.1039

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1038",
-  "core_contract": "1.19.1038",
-  "source_commit": "da6abbe0d3be205fbf1468053e22d062f0f88c53",
+  "core_version": "1.19.1039",
+  "core_contract": "1.19.1039",
+  "source_commit": "dc9e168d73f9ec605af32419b0b638cca7539418",
   "source_ref": "HEAD",
-  "built_at": "2026-09-26T08:02:16.753Z",
+  "built_at": "2026-09-26T08:16:22.165Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 542,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2493,
+    "functional_verbatim": 2496,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3062,
-  "tree_sha256": "809d2cff15d7aea1e31dcb2a5d161eae233d7b7b4edaae142688cd13b33ef9a4",
+  "file_count": 3065,
+  "tree_sha256": "e4228541e27d69f8e2578edadb43181228ced5f21cc7b6dbe0102de50c3917be",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2767,7 +2767,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f4e772d2b38f923f36c45a1e2fc9254a2843370b4703d291ab82b0e5b126e998"
+      "sha256": "3d636e0870231f27697b67900e7feedff8e82b751cdd9771509cfe792d7157d6"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2887,7 +2887,7 @@
     {
       "path": "docs/recipes/core-release-pipeline.md",
       "mode": "0000644",
-      "sha256": "12e2fdc72d1bed7d524b50960dea3a67791b098b7dbafaff9c6f95cd356b185a"
+      "sha256": "4f006e07e58a861399d8d04ab0b52a1752f4ff605475288d60b60bffb7e123e7"
     },
     {
       "path": "docs/recipes/failed-ship-recovery-proof.md",
@@ -2967,7 +2967,7 @@
     {
       "path": "docs/recipes/private-npm-distribution.md",
       "mode": "0000644",
-      "sha256": "5e4213d19d7f13ff0a378f996c7e909e00cf262516e72f96e44d4ddf0d4cc861"
+      "sha256": "0125fca7ef4c910f87a03e20ccfb06ae8a81cf5ebc8f9821e4bc3e8a8d0a7ea1"
     },
     {
       "path": "docs/recipes/redteam-patrol.md",
@@ -8452,12 +8452,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b884a2821059a8a69b9757b7eb9cb8432983a1563b5a5461044aed5129119a69"
+      "sha256": "3a6d785e2391594909ba62c1e5dcf1c250096d802da67b1033353c8ced7bfac8"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "735b76d59c3bbe7444b3354e6bba1a1e72bcf639236fb4dd7925561290c71e96"
+      "sha256": "9ef9e201b3c2d1326f37ecd30eb7ed0ebbb56f8360608128e4b04974798cf4d0"
     },
     {
       "path": "public-docs/index.html",
@@ -8477,7 +8477,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "bd9f61be14683fe846ffb42627b8cd3b24e1a4a732c793248d4eb4d845dae5cd"
+      "sha256": "d39efdd82af8f39bf10ff6b145838d57dd6ab9eea277836ff1b7bd67a06f61ca"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9382,7 +9382,7 @@
     {
       "path": "scripts/gds/plain-cards.js",
       "mode": "0000644",
-      "sha256": "59735337e798c66feedeabfde750a9639a0def9c64ded40faa4c8b35b40adc5f"
+      "sha256": "b253a6c0e34cac3d18fb031b9a445d4db0589484da016309ecd7481a1ec1f311"
     },
     {
       "path": "scripts/gds/portability-smoke-art.sh",
@@ -9479,6 +9479,11 @@
       "mode": "0000644",
       "sha256": "3fbf7c20f83e3de8b47f834414c2bec9ba35f528cfb93995db73d627c8d46e73"
     },
+    {
+      "path": "scripts/gds/publish-integration-gate.js",
+      "mode": "0000644",
+      "sha256": "f797bfe1b72d0bb50587093ab93f32fd86b916f644dbf782cedf0b0e177b2b25"
+    },
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
@@ -9872,7 +9877,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "92fcb61d2f0a1ee08912972fa153295e15684535d34e115574ff58e72d0d3615"
+      "sha256": "699e58b44e1be60c9e17acf108f7cd895a75d43a2854dac494583df35f522dbc"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -10532,7 +10537,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b1619ae083207e98797c5198861f067a405ee89c80ccc5a0b83d1fc1d381a465"
+      "sha256": "ef1f931d2bcea8854e341858cc0b0d7d347ede63bcc77377c71695f6600852fa"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14064,6 +14069,11 @@
       "mode": "0000644",
       "sha256": "3e3b97d2c7e4e67a412eaa04bbf3d8fd4ad649ae46f9e194c8e07eedfc2349bb"
     },
+    {
+      "path": "tests/publish_integration_gate.mjs",
+      "mode": "0000644",
+      "sha256": "f220032a0e9d58bfc07316f4192744294d2eef023677e602c23fc2c775e87390"
+    },
     {
       "path": "tests/publish_manifest.mjs",
       "mode": "0000644",
@@ -14619,6 +14629,11 @@
       "mode": "0000644",
       "sha256": "a3b7858c255f1c7ea692866dbadd7321f77bd88c8380c429b7cb5f6b1b65496b"
     },
+    {
+      "path": "tests/ship_land_ci_not_started.mjs",
+      "mode": "0000644",
+      "sha256": "9d7902dfb2183713a06ecc845c4f466d3dc04fcf7d34a0f79cb2c6b6f89587af"
+    },
     {
       "path": "tests/ship_land_conflict.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2554,6 +2554,8 @@ is load-bearing: the script throws rather than guess if it is missing, and
   1.19.1037 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1036 with no explicit bump. run 36227523642. (task 1002620)
   1.19.1038 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.19.1037 with no explicit bump. run 36228544921. (task 1002620)
+        landed since 1.19.1037 with no explicit bump. run 36228854271. (task 1002620)
+  1.19.1039 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1038 with no explicit bump. run 36229255566. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/core-release-pipeline.md

@@ -99,7 +99,7 @@ node scripts/gds/package-core.js --ref main --self-verify
 
 ### 2c. Publish — automatic on merge
 
-**Every merge to `main` publishes** ([ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137's manual gate): once the required `unit` check succeeds on a main push, the `publish` workflow auto-bumps a **patch** if nobody bumped (via `scripts/gds/bump-version.js`, which writes the literal AND appends the ledger entry to [`docs/module-api-changelog.md`](../module-api-changelog.md) — ADR 0203; the carrier commit stages both), builds through the fail-closed no-leak gate with `--self-verify`, publishes, and tags `core-v<version>`. A **minor/major is still a human in-task bump** — CI never makes that call, because it decides what patch-channel subscribers receive unattended.
+**Every merge to `main` publishes** ([ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137's manual gate): once the required `unit` check succeeds on a main push — and the `integration` lane is green on the commit being released, which carries the packaged-core empty-database proof (task 1002863; the wait is task 1004290) — the `publish` workflow auto-bumps a **patch** if nobody bumped (via `scripts/gds/bump-version.js`, which writes the literal AND appends the ledger entry to [`docs/module-api-changelog.md`](../module-api-changelog.md) — ADR 0203; the carrier commit stages both), builds through the fail-closed no-leak gate with `--self-verify`, publishes, and tags `core-v<version>`. A **minor/major is still a human in-task bump** — CI never makes that call, because it decides what patch-channel subscribers receive unattended.
 
 The lane is armed by the owner via the `PUBLISH_ON_MERGE=1` repo variable + two secrets (`NPM_TOKEN`, `RELEASE_PUSH_TOKEN`); while disarmed it no-ops loudly. Manual fallback, same command CI runs:
 

package/docs/recipes/private-npm-distribution.md

@@ -55,7 +55,7 @@ npm publish ./clients/bongos-client               # real (publishConfig makes it
 
 ## Cutting a core release (the policy — [ADR 0161](../adr/0161-publish-on-merge.md), superseding ADR 0137)
 
-**Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check, auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it: repo variable `PUBLISH_ON_MERGE=1`, a **trusted publisher** registered on npmjs.com for `@bongos/core` naming this repo + `publish.yml`, and the secret `RELEASE_PUSH_TOKEN` (contents:write, for the bump commit). There is deliberately **no** `NPM_TOKEN` — the lane authenticates by OIDC, and the workflow sets neither `NPM_TOKEN` nor `NODE_AUTH_TOKEN` because either one would send npm down the legacy token path and skip the OIDC exchange entirely. A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
+**Publishing is automatic on merge** as of 2026-08-08: the `publish` workflow rides behind the required `unit` check and waits for the `integration` lane's verdict on the commit it releases (task 1004290), auto-bumps a patch when nobody bumped, builds through the fail-closed no-leak gate, publishes, and tags — see the workflow header (`.github/workflows/publish.yml`) and ADR 0161. It ships inert until the owner arms it: repo variable `PUBLISH_ON_MERGE=1`, a **trusted publisher** registered on npmjs.com for `@bongos/core` naming this repo + `publish.yml`, and the secret `RELEASE_PUSH_TOKEN` (contents:write, for the bump commit). There is deliberately **no** `NPM_TOKEN` — the lane authenticates by OIDC, and the workflow sets neither `NPM_TOKEN` nor `NODE_AUTH_TOKEN` because either one would send npm down the legacy token path and skip the OIDC exchange entirely. A **minor/major bump stays a human in-task edit**. The update subscription ([ADR 0136](../adr/0136-update-channel-subscription-policy.md)) consumes whatever is published, on its next sweep.
 
 The steps below remain as the **manual fallback** (lane disarmed, npm outage, or a deliberate out-of-band release):
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1038",
+  "version": "1.19.1039",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1038",
+      "version": "1.19.1039",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1038",
+  "version": "1.19.1039",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7509,9 +7509,19 @@
     }
   ],
   "1.19.1038": [
+    {
+      "id": "1004289",
+      "text": "When the code host refuses to run the automatic tests at all, for example because the account's allowance ran out, the shipping tool now says so plainly and names the owner's fix, instead of telling the builder to fix code tha"
+    },
     {
       "id": "1002840",
       "text": "The grader can now call AI models from other companies through one plug-in point, ready for a second-opinion reviewer; nothing changes today — it still uses only Claude and spends nothing new."
     }
+  ],
+  "1.19.1039": [
+    {
+      "id": "1004290",
+      "text": "A new release of the core is now published only after the check that it can set up a brand-new empty database has passed, so a release that cannot install cleanly can no longer reach projects."
+    }
   ]
 }

package/scripts/gds/plain-cards.js

@@ -169,6 +169,11 @@ const CARDS = Object.freeze({
     'An automatic test failed on your work, so it has not been added to the project.',
     'I will run that test here, fix what it found, and send the work again. Sending the same work again would fail the same way.',
     null, FAULT),
+  // task 1004289: the tests never ran at all (the account cannot run them right now).
+  ci_not_started: card(
+    'The automatic tests never ran on your work: the code host did not start them, because the account has run out of test time or has a payment problem. Nothing was tested, so nothing needs fixing.',
+    'I will not change the work. Once the owner restores the test time, I will start the tests again on the same work and it will be added on its own.',
+    'The project owner, to restore the account\'s test time on the code host.', FAULT),
   non_required_check_failing: card(
     'An optional automatic test failed on your work.',
     'I will look at what it found. It does not stop the work being added, but it is usually worth fixing.',

package/scripts/gds/publish-integration-gate.js

@@ -0,0 +1,142 @@
+#!/usr/bin/env node
+// scripts/gds/publish-integration-gate.js — the publish lane waits for the integration
+// lane's verdict on the exact commit it is about to release (task 1004290).
+//
+// WHY. publish.yml fires on the `unit` workflow's success, and `unit` is DB-free by
+// design. The proof that the packaged core can set up an EMPTY database and serve a
+// DB-backed route — tests/consumer_layout_boot.mjs, task 1002863 — runs in the
+// `integration` workflow, on the same main push. Without this gate that result arrived
+// after the publish and gated nothing: a core that installs and boots but cannot migrate
+// its own database still reached npm, and from there the nightly tenant upgrade sweep.
+//
+// WHAT IT COSTS, MEASURED 2026-09-26 (not assumed). Both lanes start on the same push, and
+// integration is the SHORTER one: on the two commits right after task 1002863 landed,
+// integration took 247s and 245s against unit's 351s and 335s. So when unit's success fires
+// the publish, integration has usually already answered and this gate is a single API
+// read. It runs inside the existing publish job — no new job — and it polls only in the
+// rare case integration is still going. Over 299 main pushes (2026-09-20 → 26) integration
+// was green 254 times, cancelled 41 times (a newer merge superseded it) and red 3 times,
+// all three the Actions-budget outage of 2026-09-25 — so it is not a flaky lane that would
+// stall every release.
+//
+// THE VERDICTS (decideIntegrationGate, pure):
+//   go          the newest push-event run on this commit succeeded → publish
+//   wait        no run yet, or it is still going → poll
+//   superseded  it was cancelled — almost always a newer merge's run replacing it under
+//               integration.yml's cancel-in-progress group. Nothing is published; that
+//               newer merge fires its own publish, which asks about its own commit.
+//   red         anything else (failure, timed_out, startup_failure …) → refuse, loudly
+// Only PUSH-event runs count: the weekly scheduled run on main carries HEAD's sha but runs
+// only the parked-set ratchet, so its conclusion says nothing about this commit.
+//
+// OUTPUT: `go=true|false` to $GITHUB_OUTPUT. Exit 0 for go and superseded, 1 for red,
+// timeout or an unreadable API (a refusal that must be seen), 2 for bad arguments.
+//
+//   node scripts/gds/publish-integration-gate.js --sha <40-hex> --repo <owner/name>
+//        [--timeout-min 12] [--interval-s 20]      token: GH_TOKEN or GITHUB_TOKEN
+
+'use strict';
+
+const fs = require('node:fs');
+
+const WORKFLOW_FILE = 'integration.yml';
+const DEFAULT_TIMEOUT_MIN = 12; // inside publish.yml's 20-minute job, leaving room to pack + publish
+const DEFAULT_INTERVAL_S = 20;
+const SHA_RE = /^[0-9a-f]{40}$/;
+const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+
+// decideIntegrationGate — PURE. `runs` is list-workflow-runs' `workflow_runs` for one
+// head sha and the push event. The newest run decides (a re-push of the same sha, or a
+// re-run, supersedes an older verdict).
+function decideIntegrationGate(runs) {
+  const list = Array.isArray(runs) ? runs.filter((r) => r && typeof r === 'object') : [];
+  if (!list.length) return { verdict: 'wait', run: null };
+  const newest = list.slice().sort((a, b) =>
+    (Number(b.run_number) || 0) - (Number(a.run_number) || 0)
+    || String(b.created_at || '').localeCompare(String(a.created_at || '')))[0];
+  if (newest.status !== 'completed') return { verdict: 'wait', run: newest };
+  if (newest.conclusion === 'success') return { verdict: 'go', run: newest };
+  if (newest.conclusion === 'cancelled') return { verdict: 'superseded', run: newest };
+  return { verdict: 'red', run: newest };
+}
+
+function runsUrl(repo, sha) {
+  return `https://api.github.com/repos/${repo}/actions/workflows/${WORKFLOW_FILE}/runs?head_sha=${sha}&event=push&per_page=20`;
+}
+
+// waitForIntegration — poll until the gate has a verdict or the time is up. A 401/403/404
+// is not something waiting fixes (a missing `actions: read`, a renamed workflow), so it
+// ends the wait at once as 'unreadable'. Any other failed read is retried. Everything that
+// touches the world is injectable for tests/publish_integration_gate.mjs.
+async function waitForIntegration({
+  sha, repo, token, timeoutMs, intervalMs,
+  fetchImpl = globalThis.fetch, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), now = Date.now,
+}) {
+  const deadline = now() + timeoutMs;
+  let last = { verdict: 'wait', run: null, why: 'no read yet' };
+  for (;;) {
+    try {
+      const res = await fetchImpl(runsUrl(repo, sha), {
+        headers: { Authorization: `Bearer ${token}`, Accept: 'application/vnd.github+json', 'X-GitHub-Api-Version': '2022-11-28' },
+      });
+      if ([401, 403, 404].includes(res.status)) return { verdict: 'unreadable', run: null, why: `HTTP ${res.status}` };
+      if (res.ok) {
+        const body = await res.json();
+        last = { ...decideIntegrationGate(body && body.workflow_runs), why: null };
+        if (last.verdict !== 'wait') return last;
+      } else {
+        last = { ...last, why: `HTTP ${res.status}` };
+      }
+    } catch (e) {
+      last = { ...last, why: (e && e.message) || String(e) };
+    }
+    if (now() + intervalMs > deadline) return { verdict: 'timeout', run: last.run, why: last.why };
+    await sleep(intervalMs);
+  }
+}
+
+// The one line per outcome the Actions log shows, and what the rest of the lane reads.
+function reportLines(verdict, { sha, run, why, timeoutMin }) {
+  const short = String(sha).slice(0, 8);
+  const url = run && run.html_url ? ` ${run.html_url}` : '';
+  switch (verdict) {
+    case 'go':
+      return { go: true, code: 0, line: `integration is green on ${short}${url} — publishing.` };
+    case 'superseded':
+      return { go: false, code: 0, line: `::notice title=not published — integration was cancelled on ${short}::Usually a newer merge's run replaced it; that merge fires its own publish, which checks its own commit.${url}` };
+    case 'red':
+      return { go: false, code: 1, line: `::error title=not published — integration is red on ${short}::The integration lane (${run && run.conclusion}) runs the proof that the packaged core can migrate an empty database (task 1002863). A core that fails it must not reach npm. Fix main; the next merge publishes everything.${url}` };
+    case 'unreadable':
+      return { go: false, code: 1, line: `::error title=not published — cannot read the integration lane::${why}. publish.yml needs 'permissions: actions: read', and the workflow file must still be ${WORKFLOW_FILE}.` };
+    default:
+      return { go: false, code: 1, line: `::error title=not published — integration had no verdict on ${short} after ${timeoutMin} min::${why ? `Last read: ${why}. ` : ''}Re-run this workflow once integration finishes, or let the next merge publish.${url}` };
+  }
+}
+
+function argValue(argv, flag) {
+  const i = argv.indexOf(flag);
+  return i >= 0 && i + 1 < argv.length ? argv[i + 1] : null;
+}
+
+async function main(argv = process.argv.slice(2), env = process.env) {
+  const sha = String(argValue(argv, '--sha') || '').toLowerCase();
+  const repo = String(argValue(argv, '--repo') || env.GITHUB_REPOSITORY || '');
+  const token = env.GH_TOKEN || env.GITHUB_TOKEN || '';
+  const timeoutMin = Number(argValue(argv, '--timeout-min') || DEFAULT_TIMEOUT_MIN);
+  const intervalS = Number(argValue(argv, '--interval-s') || DEFAULT_INTERVAL_S);
+  if (!SHA_RE.test(sha) || !REPO_RE.test(repo) || !token || !(timeoutMin > 0) || !(intervalS > 0)) {
+    console.error('usage: publish-integration-gate.js --sha <40-hex> --repo <owner/name> [--timeout-min N] [--interval-s N]  (token: GH_TOKEN or GITHUB_TOKEN)');
+    return 2;
+  }
+  const result = await waitForIntegration({ sha, repo, token, timeoutMs: timeoutMin * 60000, intervalMs: intervalS * 1000 });
+  const out = reportLines(result.verdict, { sha, run: result.run, why: result.why, timeoutMin });
+  console.log(out.line);
+  if (env.GITHUB_OUTPUT) fs.appendFileSync(env.GITHUB_OUTPUT, `go=${out.go}\n`);
+  return out.code;
+}
+
+if (require.main === module) {
+  main().then((code) => { process.exitCode = code; }, (e) => { console.error(e); process.exitCode = 1; });
+}
+
+module.exports = { decideIntegrationGate, waitForIntegration, reportLines, main, WORKFLOW_FILE, runsUrl };

package/scripts/gds/ship-land.js

@@ -291,7 +291,17 @@ function strandNextStep(taskId, via) {
 // task 1003764: `red` — the PR was RED on the poll's last read. "NOT a failure" is then
 // false: a required check that failed does not pass by waiting, so the banner says the
 // land is stuck on it and defers to the red lines above for the remedy.
-function landPendingLines(taskId, { merged, red } = {}) {
+function landPendingLines(taskId, { merged, red, notStarted } = {}) {
+  // task 1004289: CI never RAN (the account cannot run Actions). Not a failure of the
+  // work, and not something waiting fixes either: the checks have to be started again.
+  if (notStarted) {
+    return [
+      '  ci-land: Published, but CI never started on the PR (GitHub ran none of its checks), so it has NOT merged',
+      '  and cannot until they run. The task stays at \'confirmed\'. Nothing in the work needs to change: once the',
+      `  owner restores GitHub Actions, re-run the failed jobs (lines above), then re-run \`node scripts/gds/ship.js ${taskId}\``,
+      '  to watch the land — it resumes from here (task 941).',
+    ];
+  }
   if (red) {
     return [
       '  ci-land: Published, but the PR is RED (the check named above), so it has NOT merged and will not',
@@ -314,8 +324,9 @@ function printLandPending(taskId, opts = {}) {
   console.log('');
   for (const line of landPendingLines(taskId, opts)) console.log(line);
   // The land_pending card says there is nothing to do, which a red PR makes untrue; the
-  // red line already printed the failing_check card (task 1003764).
-  if (!opts.red) for (const line of plainCardLines('land_pending')) console.log(line);
+  // red line already printed the failing_check card (task 1003764), or the
+  // ci_not_started one (task 1004289).
+  if (!opts.red && !opts.notStarted) for (const line of plainCardLines('land_pending')) console.log(line);
 }
 
 // task 1002645 — the honest close-out when the PR MERGED but the server refused the
@@ -351,6 +362,11 @@ function prAssigneeLine(login) {
 // exported so the wording is pinned by tests/unit_report_status.mjs.
 function redPrLine(md) {
   const reason = (md && md.reason) || '';
+  if (md && md.not_started) {
+    const job = (/^ci_not_started:(.+)$/.exec(reason) || [])[1];
+    return `  ci-land: CI NEVER RAN on this PR — GitHub did not start ${job ? `the \`${job}\` job` : 'its checks'} ("The job was not started because …", `
+      + 'an Actions budget or billing stop on the account). Nothing in the work was tested, so there is nothing in it to fix.';
+  }
   const fix = 'fix it, commit, and re-run the ship — re-pushing unchanged work cannot turn it green.';
   if (md && md.failing_tests) {
     return `  ci-land: the PR is RED — ${md.failing_tests}. Reproduce with \`node tests/<name>.mjs\`, ${fix}`;
@@ -369,9 +385,21 @@ function redPrLine(md) {
 // task 1003764: the merge trap sits between them. `opts` = { taskId, via } for its wording.
 function redPrLines(md, opts = {}) {
   const red = redPrLine(md);
+  if (red && md.not_started) return [red, ...notStartedLines(md), ...plainCardLines('ci_not_started')];
   return red ? [red, ...mergeTrapLines(md, opts), ...plainCardLines((md && md.reason) || 'failing_check')] : [];
 }
 
+// notStartedLines — task 1004289. What to do when CI never ran, instead of the merge trap
+// (there is no failure to reproduce). Re-running is the remedy, not re-pushing: the same
+// commit is fine, it simply was never tested. Pure + exported.
+function notStartedLines(md) {
+  const rerun = md && /^\d+$/.test(String(md.run_id || '')) ? `\`gh run rerun ${md.run_id} --failed\`` : '"Re-run failed jobs" on the PR';
+  return [
+    '  ci-land: this is the repo OWNER\'s to fix, on GitHub: the account\'s Actions budget / spending limit or payment method.',
+    `  ci-land: once Actions can run again, ${rerun} starts the checks on the SAME commit — do not re-push or edit the work.`,
+  ];
+}
+
 // The unit tests that gate GENERATED files — each compares a committed artifact with a
 // fresh build of it. `fitness` holds the combined gate (fitness.js "generated artifacts
 // fresh": copy registry, API docs, file map, nested CLAUDE.md blocks, the §13 snippet).
@@ -439,16 +467,42 @@ const RED_CONCLUSIONS = new Set(['FAILURE', 'ERROR', 'TIMED_OUT', 'CANCELLED', '
 // poll paths hand redPrLines the same thing. `failingTestsFor(sha)` reads the unit-report
 // status (gh pr view omits a status's description) and is asked only once that status is
 // itself red, i.e. posted. Null when nothing is red. Pure + exported.
-function localMergeDriver(pr, failingTestsFor = () => null) {
+// task 1004289 — `neverStarted(rawCheck)` answers "did this red job never run at all?"
+// (jobNeverStarted below). When EVERY red check is one, nothing was tested, and the
+// answer is { reason: 'ci_not_started:<name>', not_started: true, run_id } rather than
+// a failing check the builder is told to fix.
+function localMergeDriver(pr, failingTestsFor = () => null, neverStarted = () => false) {
   if (!pr || pr.state !== 'OPEN' || !Array.isArray(pr.statusCheckRollup)) return null;
   const { checks } = readCheckRollup({ contexts: { nodes: pr.statusCheckRollup } });
   const red = checks.filter((c) => RED_CONCLUSIONS.has(String(c.conclusion || '').toUpperCase()));
   if (!red.length) return null;
+  const redRaw = pr.statusCheckRollup.filter((c) => c && RED_CONCLUSIONS.has(String(c.conclusion || c.state || '').toUpperCase()));
+  if (redRaw.length && redRaw.every((c) => neverStarted(c))) {
+    const run = /\/runs\/(\d+)\//.exec(String(redRaw[0].detailsUrl || ''));
+    return { reason: `ci_not_started:${red[0].name}`, not_started: true, failing_tests: null, run_id: run ? run[1] : null };
+  }
   const kind = pr.mergeStateStatus === 'UNSTABLE' ? 'non_required_check_failing' : 'failing_check';
   const reported = red.some((c) => c.name === UNIT_REPORT_CONTEXT);
   return { reason: `${kind}:${red[0].name}`, failing_tests: (reported && failingTestsFor(pr.headRefOid)) || null };
 }
 
+// jobNeverStarted — task 1004289. When the account cannot run Actions (its budget is
+// spent, or a payment failed), GitHub still marks every job FAILED seconds after it was
+// queued, with no steps and no runner, and one annotation saying why: "The job was not
+// started because an Actions budget is preventing further use." (PR 1211, 2026-09-25).
+// Read as an ordinary red check, that told the builder to fix their code — advice that
+// cannot help, where each retry is another failed run. An Actions job's id (the tail of
+// its detailsUrl) is its check-run id, so its annotations are one read away. FAIL-OPEN:
+// anything unreadable is "no", which keeps the ordinary red wording. `gh` is injectable.
+const NOT_STARTED_RE = /^\s*The job was not started because\b/i;
+function jobNeverStarted(check, gh = ghJson) {
+  if (!check || (check.__typename && check.__typename !== 'CheckRun')) return false;
+  const m = /\/job\/(\d+)(?:[/?#]|$)/.exec(String(check.detailsUrl || ''));
+  if (!m) return false;
+  const notes = gh(['api', `repos/{owner}/{repo}/check-runs/${m[1]}/annotations`]);
+  return Array.isArray(notes) && notes.some((a) => a && NOT_STARTED_RE.test(String(a.message || '')));
+}
+
 // unitReportFor — the failing-test line the `unit` workflow posted on `sha`, read with this
 // machine's gh through the same parser the server uses. Null when unreadable; the red line
 // then names the check instead, as it did before the report existed. `gh` is injectable.
@@ -921,6 +975,14 @@ function pollCiDeploy(taskId, branch, headSha, deps = {}) {
     if (sha !== report.sha) report = { sha, text: unitReportFor(sha, readJson) };
     return report.text;
   };
+  // task 1004289: a finished job's annotations never change, so each is read once.
+  let notStarted = false;
+  const startMemo = new Map();
+  const neverStarted = (c) => {
+    const key = String((c && c.detailsUrl) || '');
+    if (!startMemo.has(key)) startMemo.set(key, jobNeverStarted(c, readJson));
+    return startMemo.get(key);
+  };
   for (let i = 0; i < MERGE_TRIES; i++) {
     // task 1003499: mergeable + mergeStateStatus ride the same read, so a conflict is
     // named on the poll it appears; the two-field read is the fallback for a gh that
@@ -937,13 +999,14 @@ function pollCiDeploy(taskId, branch, headSha, deps = {}) {
       return landBailed('the PR was closed without merging (a check failed, or it was closed manually)', `node scripts/gds/ship.js ${taskId}`);
     }
     if (pr) {
-      const md = localMergeDriver(pr, failingTestsFor);
+      const md = localMergeDriver(pr, failingTestsFor, neverStarted);
       const red = redPrLine(md);
       if (red && red !== redLine) {
         redLine = red;
         for (const line of redPrLines(md, { taskId, via: 'local' })) console.log(line);
       }
       stuckRed = !!red && redBlocksMerge(md);
+      notStarted = !!(md && md.not_started);
     }
     conflicting = noteConflict(taskId, pr, conflicting);
     pause();
@@ -954,7 +1017,7 @@ function pollCiDeploy(taskId, branch, headSha, deps = {}) {
     // CONFLICTING (task 1003499): then nothing is still in CI, and it never merges.
     // Or RED (task 1003764): then the banner says the land is stuck on that check.
     if (conflicting) return landConflicted(taskId);
-    printLandPending(taskId, { red: stuckRed });
+    printLandPending(taskId, { red: stuckRed, notStarted });
     return landPending();
   }
   console.log(`  ci-land: merged to main (${mergeSha.slice(0, 8)}). Waiting for the prod deploy...`);
@@ -1036,6 +1099,9 @@ module.exports = {
   redBlocksMerge,
   localMergeDriver,
   unitReportFor,
+  // task 1004289: CI that never ran is said as such, not as a failure to fix.
+  jobNeverStarted,
+  notStartedLines,
   reconciledCardStatus,
   strandCommand,
   strandNextStep,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1038'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1039'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_integration_gate.mjs

@@ -0,0 +1,198 @@
+// tests/publish_integration_gate.mjs — npm publishing waits for the integration lane's
+// verdict on the commit it releases (task 1004290).
+//
+// WHY. publish.yml fires on `unit`, which is DB-free by design. The proof that the
+// PACKAGED core can migrate an empty database (tests/consumer_layout_boot.mjs, task
+// 1002863) runs in integration.yml, and until this gate its verdict arrived after the
+// publish and gated nothing. What is pinned here:
+//   1. the verdicts, from the real list-workflow-runs payload shape
+//   2. the wait: polls while running, stops at once on an unreadable API, times out loudly
+//   3. the lane is WIRED: actions:read, the step sits before any install/pack/publish, and
+//      every later armed step carries the integration go — so a new step cannot slip past
+//
+// Network-free: fetch, sleep and the clock are injected.
+//
+// Run:  node tests/publish_integration_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const gate = require('../scripts/gds/publish-integration-gate.js');
+const { decideIntegrationGate, waitForIntegration, reportLines, main, runsUrl } = gate;
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+const SHA = '078e8b7b'.padEnd(40, '0');
+// The fields GitHub's list-workflow-runs answers with that the gate reads (from a real
+// integration run on main, 2026-09-26: run 36210...; trimmed to what matters).
+const ghRun = (run_number, status, conclusion) => ({
+  id: 36210000000 + run_number, run_number, event: 'push', head_sha: SHA, status, conclusion,
+  created_at: `2026-09-26T03:${String(run_number % 60).padStart(2, '0')}:00Z`,
+  html_url: `https://github.com/example-org/example-repo/actions/runs/${36210000000 + run_number}`,
+});
+const okJson = (body) => ({ ok: true, status: 200, json: async () => body });
+
+// ---- 1. the verdicts ----
+
+await test('decideIntegrationGate: success → go, running or absent → wait, cancelled → superseded, anything else → red', async () => {
+  assert.equal(decideIntegrationGate([ghRun(1, 'completed', 'success')]).verdict, 'go');
+  assert.equal(decideIntegrationGate([]).verdict, 'wait', 'the run has not been created yet');
+  assert.equal(decideIntegrationGate(undefined).verdict, 'wait');
+  for (const status of ['queued', 'in_progress', 'waiting', 'pending']) {
+    assert.equal(decideIntegrationGate([ghRun(1, status, null)]).verdict, 'wait', status);
+  }
+  assert.equal(decideIntegrationGate([ghRun(1, 'completed', 'cancelled')]).verdict, 'superseded');
+  for (const c of ['failure', 'timed_out', 'startup_failure', 'action_required', 'skipped', 'neutral', 'stale', null]) {
+    assert.equal(decideIntegrationGate([ghRun(1, 'completed', c)]).verdict, 'red', `fail-closed on ${c}`);
+  }
+});
+
+await test('decideIntegrationGate: the NEWEST run on the sha decides, whatever order the API lists them in', async () => {
+  assert.equal(decideIntegrationGate([ghRun(5, 'completed', 'failure'), ghRun(7, 'completed', 'success')]).verdict, 'go');
+  assert.equal(decideIntegrationGate([ghRun(7, 'completed', 'failure'), ghRun(5, 'completed', 'success')]).verdict, 'red');
+  assert.equal(decideIntegrationGate([ghRun(8, 'in_progress', null), ghRun(7, 'completed', 'success')]).verdict, 'wait');
+});
+
+await test('only PUSH runs are asked for: the weekly scheduled run carries HEAD\'s sha but tests only the parked set', async () => {
+  const u = runsUrl('example-org/example-repo', SHA);
+  assert.match(u, /\/actions\/workflows\/integration\.yml\/runs\?/);
+  assert.match(u, new RegExp(`head_sha=${SHA}`));
+  assert.match(u, /event=push/);
+  assert.ok(fs.existsSync(new URL('../.github/workflows/integration.yml', import.meta.url)), 'the workflow the gate names exists');
+});
+
+// ---- 2. the wait ----
+
+function clock() {
+  let t = 0;
+  return { now: () => t, sleep: async (ms) => { t += ms; } };
+}
+
+await test('waitForIntegration: polls while integration runs, then publishes on green', async () => {
+  const c = clock();
+  const replies = [okJson({ workflow_runs: [] }), okJson({ workflow_runs: [ghRun(3, 'in_progress', null)] }),
+    okJson({ workflow_runs: [ghRun(3, 'completed', 'success')] })];
+  const asked = [];
+  const r = await waitForIntegration({
+    sha: SHA, repo: 'example-org/example-repo', token: 't', timeoutMs: 600000, intervalMs: 20000,
+    fetchImpl: async (url, init) => { asked.push({ url, auth: init.headers.Authorization }); return replies.shift(); },
+    ...c,
+  });
+  assert.equal(r.verdict, 'go');
+  assert.equal(asked.length, 3);
+  assert.equal(asked[0].auth, 'Bearer t');
+  assert.equal(c.now(), 40000, 'slept between reads, not after the verdict');
+});
+
+await test('waitForIntegration: a 403/404 ends the wait at once (waiting cannot grant a permission)', async () => {
+  for (const status of [401, 403, 404]) {
+    const c = clock();
+    let calls = 0;
+    const r = await waitForIntegration({
+      sha: SHA, repo: 'o/r', token: 't', timeoutMs: 600000, intervalMs: 20000,
+      fetchImpl: async () => { calls++; return { ok: false, status, json: async () => ({}) }; }, ...c,
+    });
+    assert.equal(r.verdict, 'unreadable', String(status));
+    assert.equal(calls, 1);
+  }
+});
+
+await test('waitForIntegration: flaky reads are retried, and a lane with no verdict times out rather than publishing', async () => {
+  const c = clock();
+  let calls = 0;
+  const r = await waitForIntegration({
+    sha: SHA, repo: 'o/r', token: 't', timeoutMs: 60000, intervalMs: 20000,
+    fetchImpl: async () => {
+      calls++;
+      if (calls === 1) throw new Error('ECONNRESET');
+      if (calls === 2) return { ok: false, status: 502, json: async () => ({}) };
+      return okJson({ workflow_runs: [ghRun(3, 'in_progress', null)] });
+    },
+    ...c,
+  });
+  assert.equal(r.verdict, 'timeout');
+  assert.ok(calls >= 3, 'kept reading through the transient failures');
+});
+
+await test('reportLines: only a green lane says go; red, unreadable and timeout exit non-zero', async () => {
+  const base = { sha: SHA, run: ghRun(3, 'completed', 'failure'), why: 'HTTP 403', timeoutMin: 12 };
+  assert.deepEqual([reportLines('go', base).go, reportLines('go', base).code], [true, 0]);
+  assert.deepEqual([reportLines('superseded', base).go, reportLines('superseded', base).code], [false, 0]);
+  for (const v of ['red', 'unreadable', 'timeout']) {
+    const o = reportLines(v, base);
+    assert.equal(o.go, false, v);
+    assert.equal(o.code, 1, v);
+    assert.match(o.line, /^::error title=not published/, v);
+    assert.doesNotMatch(o.line.split('::')[1], /,/, `${v}: a comma in the title would split the annotation's properties`);
+  }
+  assert.match(reportLines('red', base).line, /task 1002863/, 'says what the red lane was proving');
+  assert.match(reportLines('unreadable', base).line, /actions: read/);
+});
+
+await test('main: writes go=… to GITHUB_OUTPUT and refuses bad arguments with exit 2', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'integ-gate-'));
+  try {
+    const out = path.join(dir, 'out');
+    const log = console.log;
+    const err = console.error;
+    console.log = () => {};
+    console.error = () => {};
+    try {
+      assert.equal(await main(['--sha', 'nope', '--repo', 'o/r'], { GH_TOKEN: 't', GITHUB_OUTPUT: out }), 2);
+      assert.equal(await main(['--sha', SHA, '--repo', 'o/r'], { GITHUB_OUTPUT: out }), 2, 'no token');
+      const realFetch = globalThis.fetch;
+      globalThis.fetch = async () => okJson({ workflow_runs: [ghRun(3, 'completed', 'success')] });
+      try {
+        assert.equal(await main(['--sha', SHA, '--repo', 'o/r'], { GH_TOKEN: 't', GITHUB_OUTPUT: out }), 0);
+      } finally { globalThis.fetch = realFetch; }
+    } finally { console.log = log; console.error = err; }
+    assert.equal(fs.readFileSync(out, 'utf8'), 'go=true\n');
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+// ---- 3. the wiring ----
+
+const YML = fs.readFileSync(new URL('../.github/workflows/publish.yml', import.meta.url), 'utf8');
+// Split the job into steps at each `      - ` list item (the job's step indentation).
+const steps = YML.split(/\n(?=      - (?:name|uses):)/).slice(1);
+const stepIndex = (re) => steps.findIndex((s) => re.test(s));
+
+await test('publish.yml can read the integration runs, and asks about the commit it packages', async () => {
+  assert.match(YML, /^permissions:[\s\S]*?^\s+actions: read$/m, 'the job token needs actions:read to list runs');
+  assert.doesNotMatch(YML, /actions: write/, 'read only');
+  const g = steps[stepIndex(/id: integ\n/)];
+  assert.ok(g, 'the integration gate step exists');
+  assert.match(g, /node scripts\/gds\/publish-integration-gate\.js --sha "\$\(git rev-parse HEAD\)"/, 'HEAD — the checkout is ref: main, not the trigger sha');
+  assert.match(g, /GH_TOKEN: \$\{\{ github\.token \}\}/);
+});
+
+await test('publish.yml: the gate runs before anything is installed, bumped, packed, published, recorded or tagged', async () => {
+  const at = stepIndex(/id: integ\n/);
+  assert.ok(at > stepIndex(/id: relhead\n/), 'after the cascade terminator (a carrier HEAD needs no gate)');
+  for (const re of [/actions\/setup-node@/, /run: npm ci\b/, /id: ver\n/, /id: bump\n/, /id: pack\n/, /id: pub\n/, /git push origin HEAD:main/, /git tag "core-v/]) {
+    const i = stepIndex(re);
+    assert.ok(i > at, `${re} must come after the integration gate (at ${i}, gate at ${at})`);
+  }
+});
+
+await test('publish.yml: every armed step after the gate also requires its go — no step can slip past it', async () => {
+  const at = stepIndex(/id: integ\n/);
+  const later = steps.slice(at + 1).filter((s) => /steps\.armed\.outputs\.armed == 'true'/.test(s));
+  assert.ok(later.length >= 9, `expected the install..tag chain after the gate, found ${later.length}`);
+  for (const s of later) {
+    const name = (/- (?:name: (.*)|uses: (.*))/.exec(s) || [])[1] || s.slice(0, 60);
+    assert.match(s, /steps\.integ\.outputs\.go == 'true'/, `"${name}" runs without the integration gate`);
+  }
+});
+
+console.log(`\npublish integration gate (task 1004290) tests: ${passed} passed, ${failed} failed`);
+process.exitCode = failed > 0 ? 1 : 0;

package/tests/ship_land_ci_not_started.mjs

@@ -0,0 +1,168 @@
+// tests/ship_land_ci_not_started.mjs — a land wait that says "CI never ran" when it did
+// not, instead of "fix your code" (task 1004289).
+//
+// WHY. During the 2026-09-25 GitHub Actions budget outage (blocker 1000173) every job on
+// every PR "failed" in about two seconds without running: conclusion FAILURE, no steps, no
+// runner, and one annotation — "The job was not started because an Actions budget is
+// preventing further use." Task 1003764's red-check reader saw an ordinary red `unit`
+// check and told the builder on PR 1211 to fix it, commit and re-run, plus the "CI tests
+// your branch MERGED with main" trap. None of that can help: nothing was tested, and the
+// fix is the owner's, on the GitHub account. These drive the laptop poll with a fake gh
+// carrying the REAL payloads from PR 1211 (run 36210373664, attempt 1).
+//
+// Run:  node tests/ship_land_ci_not_started.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import {
+  jobNeverStarted, landPendingLines, localMergeDriver, notStartedLines, pollCiDeploy, redBlocksMerge, redPrLine, redPrLines,
+} from '../scripts/gds/ship-land.js';
+
+const require = createRequire(import.meta.url);
+const { CARDS, cardFor } = require('../scripts/gds/plain-cards.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+async function capture(fn) {
+  const lines = [];
+  const orig = console.log;
+  console.log = (...a) => { lines.push(a.join(' ')); };
+  try { return { result: await fn(), out: lines.join('\n') }; }
+  finally { console.log = orig; }
+}
+
+const SHA = 'b9b03b03687ce823c016a29b0141736a3595c547';
+const RUN = '36210373664';
+const JOB_UNIT = '108315429264';
+const JOB_REPORT = '108315436139';
+const jobUrl = (job) => `https://github.com/example-org/example-repo/actions/runs/${RUN}/job/${job}`;
+const checkRun = (name, job, conclusion = 'FAILURE') => ({
+  __typename: 'CheckRun', name, conclusion, status: 'COMPLETED', workflowName: 'unit', detailsUrl: jobUrl(job),
+  startedAt: '2026-09-26T02:01:46Z', completedAt: '2026-09-26T02:01:48Z',
+});
+const ctx = (context, state) => ({ __typename: 'StatusContext', context, state, targetUrl: '' });
+const openPr = (rollup) => ({ state: 'OPEN', mergeCommit: null, mergeStateStatus: 'BLOCKED', headRefOid: SHA, statusCheckRollup: rollup });
+// PR 1211's rollup during the outage: both unit-workflow jobs "failed", the trust status green.
+const OUTAGE_ROLLUP = [checkRun('unit', JOB_UNIT), checkRun('report', JOB_REPORT), ctx('gate-author-trust', 'SUCCESS')];
+
+// The two annotations GitHub returned for job 108315429264, verbatim (paths trimmed).
+const BUDGET_NOTES = [
+  { path: '.github', annotation_level: 'failure', title: '', message: 'The job was not started because an Actions budget is preventing further use.' },
+  { path: '.github', annotation_level: 'notice', title: '', message: '"The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026."' },
+];
+const NOTICE_ONLY = [BUDGET_NOTES[1]];
+const annotationsPath = (job) => `repos/{owner}/{repo}/check-runs/${job}/annotations`;
+
+// ---- the detector ----
+
+await test('jobNeverStarted: the budget annotation on the job reads as never started', async () => {
+  const asked = [];
+  const gh = (args) => { asked.push(args); return BUDGET_NOTES; };
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), gh), true);
+  assert.deepEqual(asked, [['api', annotationsPath(JOB_UNIT)]], 'reads the check run named by the job id in its detailsUrl');
+});
+
+await test('jobNeverStarted: the payment-failed wording is the same shape and is caught too', async () => {
+  const gh = () => [{ annotation_level: 'failure', message: 'The job was not started because recent account payments have failed or your spending limit needs to be increased.' }];
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), gh), true);
+});
+
+await test('jobNeverStarted is FAIL-OPEN: a real failure, an unreadable read, or no job id is "no"', async () => {
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), () => NOTICE_ONLY), false, 'a job that ran and failed');
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), () => null), false, 'gh could not read the annotations');
+  assert.equal(jobNeverStarted(checkRun('unit', JOB_UNIT), () => ({ message: 'Not Found' })), false, 'an error object, not a list');
+  let calls = 0;
+  const gh = () => { calls++; return BUDGET_NOTES; };
+  assert.equal(jobNeverStarted({ __typename: 'CheckRun', name: 'x', detailsUrl: 'https://example.com/checks' }, gh), false);
+  assert.equal(jobNeverStarted(ctx('unit-report', 'FAILURE'), gh), false, 'a commit status is not a job');
+  assert.equal(calls, 0, 'nothing to look up, so nothing is asked');
+});
+
+// ---- the merge-driver answer and the lines it prints ----
+
+await test('localMergeDriver: every red check never started → ci_not_started, not a failing check', async () => {
+  const md = localMergeDriver(openPr(OUTAGE_ROLLUP), () => 'must not be asked', () => true);
+  assert.deepEqual(md, { reason: 'ci_not_started:unit', not_started: true, failing_tests: null, run_id: RUN });
+});
+
+await test('localMergeDriver: one real failure beside a never-started job is still a failing check', async () => {
+  const rollup = [checkRun('unit', JOB_UNIT), checkRun('lint', '999', 'FAILURE')];
+  const md = localMergeDriver(openPr(rollup), () => null, (c) => c.name === 'unit');
+  assert.equal(md.reason, 'failing_check:unit');
+  assert.equal(md.not_started, undefined);
+});
+
+await test('localMergeDriver: without a never-started answer (the default) nothing changes', async () => {
+  assert.deepEqual(localMergeDriver(openPr(OUTAGE_ROLLUP), () => null), { reason: 'failing_check:unit', failing_tests: null });
+});
+
+await test('the red line says CI never ran and the work needs nothing; no fix-your-code, no merge trap', async () => {
+  const md = { reason: 'ci_not_started:unit', not_started: true, failing_tests: null, run_id: RUN };
+  const out = redPrLines(md, { taskId: 42, via: 'local' }).join('\n');
+  assert.match(redPrLine(md), /CI NEVER RAN/);
+  assert.match(out, /the `unit` job/);
+  assert.match(out, /nothing in it to fix/);
+  assert.match(out, /repo OWNER's to fix/);
+  assert.match(out, new RegExp(`gh run rerun ${RUN} --failed`), 'names the re-run for the exact run');
+  assert.match(out, /do not re-push or edit the work/);
+  assert.doesNotMatch(out, /fix it, commit/, 'the advice that cannot help is gone');
+  assert.doesNotMatch(out, /MERGED with the current main/, 'and so is the merge trap');
+  assert.ok(out.includes(CARDS.ci_not_started.happened), 'the plain card rides along');
+  assert.ok(!out.includes(CARDS.failing_check.happened), 'not the "a test failed" card');
+  assert.equal(cardFor('ci_not_started:unit'), CARDS.ci_not_started, 'the named reason resolves to its card');
+  assert.equal(redBlocksMerge(md), false, 'it is not the failing-check kind of red');
+});
+
+await test('notStartedLines without a run id points at the PR button instead of inventing a command', async () => {
+  const out = notStartedLines({ reason: 'ci_not_started:unit', not_started: true, run_id: null }).join('\n');
+  assert.match(out, /"Re-run failed jobs" on the PR/);
+  assert.doesNotMatch(out, /gh run rerun/);
+});
+
+await test('the closing banner for a never-started CI is neither "NOT a failure" nor "fix the check"', async () => {
+  const out = landPendingLines(42, { notStarted: true }).join('\n');
+  assert.match(out, /CI never started/);
+  assert.match(out, /Nothing in the work needs to change/);
+  assert.match(out, /node scripts\/gds\/ship\.js 42/);
+  assert.doesNotMatch(out, /NOT a failure/);
+  assert.doesNotMatch(out, /Do what the lines above say/);
+});
+
+// ---- the laptop poll, end to end ----
+
+await test('pollCiDeploy (laptop): an Actions-budget outage is named as CI never running, once, with no code advice', async () => {
+  const seen = { prView: 0, annotations: 0, status: 0 };
+  const gh = (args) => {
+    if (args[0] === 'pr' && args[1] === 'view') { seen.prView++; return openPr(OUTAGE_ROLLUP); }
+    if (args[0] === 'api' && /check-runs\/\d+\/annotations$/.test(args[1])) { seen.annotations++; return BUDGET_NOTES; }
+    if (args[0] === 'api') { seen.status++; return { statuses: [] }; }
+    throw new Error(`unexpected gh call: ${args.join(' ')}`);
+  };
+  const { result, out } = await capture(() => pollCiDeploy(42, 'task-42', SHA, { ghJson: gh, pause: () => {} }));
+  assert.equal(result.pending, true, 'the land is still pending — the checks can yet run');
+  assert.equal(seen.prView, 30, 'polled the whole window');
+  assert.equal(seen.annotations, 2, 'each job\'s annotations are read once, not once per poll');
+  assert.equal(out.split('CI NEVER RAN on this PR').length - 1, 1, 'named once');
+  assert.match(out, /CI never started on the PR/, 'the closing banner says the same');
+  assert.doesNotMatch(out, /fix it, commit/);
+  assert.doesNotMatch(out, /MERGED with the current main/);
+  assert.doesNotMatch(out, /This is NOT a failure/);
+  assert.ok(!out.includes(CARDS.land_pending.happened), 'nor the "nothing to do" card');
+});
+
+await test('pollCiDeploy: when the annotations cannot be read, it falls back to the ordinary red wording', async () => {
+  const gh = (args) => {
+    if (args[0] === 'pr' && args[1] === 'view') return openPr(OUTAGE_ROLLUP);
+    return null; // no Checks read on this gh, or the API is down
+  };
+  const { out } = await capture(() => pollCiDeploy(42, 'task-42', SHA, { ghJson: gh, pause: () => {} }));
+  assert.match(out, /the PR is RED — the `unit` check failed/);
+  assert.doesNotMatch(out, /CI NEVER RAN/);
+});
+
+console.log(`\nship-land CI never started (task 1004289) tests: ${passed} passed, ${failed} failed`);
+process.exitCode = failed > 0 ? 1 : 0;