@bongos/core 1.19.23 → 1.19.25

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.23",
-  "core_contract": "1.19.23",
-  "source_commit": "fcdc2c0100a2b96183b34980f7c33572b67c7d1f",
+  "core_version": "1.19.25",
+  "core_contract": "1.19.25",
+  "source_commit": "5946896ddb840e6d7a52eadf92a5e42d47d716fa",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T01:44:34.493Z",
+  "built_at": "2026-08-11T13:18:22.297Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1510,
-  "tree_sha256": "80499ca716f5acc869706f3832aba22ffa0facdf31abd6eca71baec9b273d628",
+  "tree_sha256": "159afabb8c0c958bde0c962fb152ab372f6c6e34333f2d6718a4b2f2e40dd47b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3362,7 +3362,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "200de3b5be6b1f3b0612dea91409f44aa3d5b76f8f90fb71e4e5ced43a0890fb"
+      "sha256": "c8f356746096a6fe39e456b12367d29b6bbf4e39df1515c09144c95e239f1b49"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3417,7 +3417,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "7f42dfe5b16dff0e3833b0a586c5b04592aeaee1aa1f4f41c0255a16db1a14fc"
+      "sha256": "964af2331007a4cfb9142e7245d7625cf21c973e4f885e0171855b9e188b9e95"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -3457,7 +3457,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "add6acd00adc842e90348ca789da0a473aa2dc68d949cf2b5586c68ef5eaa1be"
+      "sha256": "f5041a43ea0a74bc6b16f8ceb6490c70090e7959e66f137c92040ee842db1ec0"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "969211290cee8ccee357109c325ff4741c8cce3319d520b22506126099beea7e"
+      "sha256": "61a5251f8c5ae2be0e5d3cce0dbff87afc4ec3b5327d128a04ad67b6283b23ba"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b00d5423d5019e305bb488af793202ccb4d3089da6c129851e32f85ea4219904"
+      "sha256": "11341042a94fdb5a03fd8d318a6471763f0b97d46efb13b00743f4abee686839"
     },
     {
       "path": "public-docs/index.html",
@@ -5197,7 +5197,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "085a7feeff06fa7d2b833c483795161e2c4a6ee79630e2f09d7ae2f06eeb253c"
+      "sha256": "1a00cb0c8ab216bab06b60b4ad1eaa18dc521eafd62ebe34f8fd35c7ff12e486"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5522,7 +5522,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "2cacde2aa0984457904c0a29cc0dd0d41e32be89b7b6e401d885662805c3de5e"
+      "sha256": "b1389bf7cb4d53a27d332106ddbcd9327d76521c2330b4763d4ed0919c52f2a5"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0e4203ec0098beb9a54a4ea56b3c5701cfca5bb02b6676114a9257f5b353aff5"
+      "sha256": "3b6cabeb91e7181b5d83689bb3e81b4113e0c1a357e6b040fc0caecbf405802b"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5797,7 +5797,7 @@
     {
       "path": "tests/auth_error_brand.mjs",
       "mode": "0000644",
-      "sha256": "e28bdcf3149d3baa15fdd4d5a44276953abfa3633ff37923f75355be746fc840"
+      "sha256": "e94cdcd827f8e981b62c4f9f403678d5dda0af6e5fb5cbf1cb667b94eb1bfc49"
     },
     {
       "path": "tests/auth_flow_slice1.mjs",
@@ -6387,7 +6387,7 @@
     {
       "path": "tests/github_push_land_proof.mjs",
       "mode": "0000644",
-      "sha256": "080a19cae0faf168b4b7fa31d1a68d0fe84b3d5b41c9bbfda1f5ecee34ad8ca4"
+      "sha256": "c55433099e4681a8dd091873e9f8687f35e629b4a4ad3a3c3dd462860070fc59"
     },
     {
       "path": "tests/github_push_merge_driver.mjs",
@@ -7097,7 +7097,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "5f9a083a4fc9c54683a277afcd14aff10db0dda1082e65cb5032445b25026139"
+      "sha256": "99572892490e209835aae6479370e97b49585bfaa719c788a4d06d92407a9a7d"
     },
     {
       "path": "tests/publish_manifest.mjs",
@@ -7107,7 +7107,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "fa54fe19a54153ce65f8a98ccce22c9aad7e2c928a648fb2fc621067168eb703"
+      "sha256": "240337de03354de198d6baaaca9f33b267aceb40a8ba43d31303eb21fad9226c"
     },
     {
       "path": "tests/rank_gate.mjs",
@@ -7377,7 +7377,7 @@
     {
       "path": "tests/ship_ci_deploy.mjs",
       "mode": "0000644",
-      "sha256": "de59e8ed0d1a0e30b52994fe1bf3e1864706613a1329d967f74eeae277c1948e"
+      "sha256": "e236bc3d6882bc6ddf5d389371a92a96aec62769f14c37bbca31810bcbea0d61"
     },
     {
       "path": "tests/ship_preflight.mjs",

package/modules/lifecycle/github-push.js

@@ -465,6 +465,54 @@ function prReferencesTask(status, taskId) {
   return new RegExp(`\\btask\\s+#?${Number(taskId)}\\b`, 'i').test(hay);
 }
 
+// task 1002645 — locate a task's PR by the "task <id>: …" TITLE convention, for when
+// the reconciler cannot derive the branch. The sweep derives claude/<worktree_name>
+// (the dev-box convention), but a laptop/wave ship pushes its own branch name
+// (worktree-<worktree_name>), so the derived branch finds no PR and the sweep's whole
+// PR path — the mergeIfGreen nudge (the ONLY green-PR merger where native auto-merge
+// is repo-disallowed), conflict heal, land proof — never engages; the task strands at
+// 'confirmed' (wave PRs 34/35/36). Both publish paths title their PR "task <id>: …"
+// (openOrFindPullRequest above; ship.js buildPrCreateArgv), so a TITLE-PREFIX match
+// positively binds a PR to its task. Deliberately TIGHTER than prReferencesTask
+// (title+body word match): the search widens the candidate set from "this branch's
+// own PR" to "recent PRs", and a body MENTION of a task must not bind it.
+//
+// Uses the REST pulls list (real-time — the search API lags on fresh PRs), newest
+// first, and returns the first title match whose head is a same-repo, safe-named
+// branch (a fork's head is invisible to the owner:branch lookups downstream):
+// { branch, pr_number, pr_state, merged }. Null when nothing matches. Pure w.r.t.
+// injected token/repoInfo/fetchImpl for tests.
+async function findTaskPullRequest({ taskId }, deps = {}) {
+  if (!Number.isInteger(Number(taskId))) return null;
+  const token = await resolveToken(deps);
+  if (!token) throw err('PUSH_UNCONFIGURED');
+  const repoInfo = deps.repoInfo || loadRepoInfo();
+  if (!repoInfo || repoInfo.error) throw err('NO_REPO_INFO');
+  const { owner, repo } = repoInfo;
+  const doFetch = deps.fetchImpl || fetch;
+  const res = await doFetch(
+    `https://api.github.com/repos/${owner}/${repo}/pulls?state=all&sort=created&direction=desc&per_page=100`,
+    { headers: ghHeaders(token) }
+  );
+  if (!res.ok) throw err('STATUS_FETCH_FAILED', { status: res.status });
+  const prs = await res.json();
+  if (!Array.isArray(prs)) return null;
+  const titleRe = new RegExp(`^task\\s+#?${Number(taskId)}\\b`, 'i');
+  for (const pr of prs) {
+    if (!pr || !titleRe.test(String(pr.title || ''))) continue;
+    const head = pr.head || {};
+    if (!head.repo || head.repo.full_name !== `${owner}/${repo}`) continue;
+    if (!isSafeBranch(head.ref)) continue;
+    return {
+      branch: head.ref,
+      pr_number: pr.number || null,
+      pr_state: pr.state || null,
+      merged: !!pr.merged_at,
+    };
+  }
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // Active merge driver (task 1162) — land a green PR the moment it's mergeable
 // instead of waiting on GitHub's auto-merge daemon.
@@ -1000,6 +1048,7 @@ module.exports = {
   landConfirmed,
   landProvenForTask,
   prReferencesTask,
+  findTaskPullRequest,
   scrubCredential,
   isAncestorOfDefaultBranch,
   resolveToken,

package/modules/lifecycle/publish-reconciler.js

@@ -240,20 +240,14 @@ async function runSweep(deps = {}) {
     }
     return flagged;
   };
-  for (const r of rows) {
-    const branch = r.worktree_name ? `claude/${r.worktree_name}` : null;
-    if (branch) branchesSeen.add(branch);
-    const branchUsable = !!branch && push.isSafeBranch(branch) && branchCount.get(branch) === 1;
-    if (branch && branchCount.get(branch) > 1) {
-      // A reused worktree_name maps a branch to >1 confirmed task, so a merged PR is
-      // ambiguous — but each task's OWN head_sha is not, so we skip only the branch/PR
-      // path and let the head_sha ancestry land-check below resolve it unambiguously.
-      logFn(`[publish-reconciler] task ${r.task_id}: branch ${branch} maps to >1 confirmed task — using head_sha land-check only`);
-    }
 
-    let landed = false;
-    let landNote = '';
-    let branchStatus = null;
+  // task 1002645 — the per-branch PR path (merge nudge → conflict/stale heal →
+  // publish-status), extracted so it can run TWICE for one task: first on the
+  // derived claude/<worktree_name> branch (the dev-box convention), then — when
+  // that finds no PR — on the REAL branch adopted from the task's own PR
+  // (findTaskPullRequest). Mutates the sweep counters via closure; returns
+  // { status, prNotLanded }.
+  const sweepBranchPath = async (r, branch) => {
     // task 1002472 — set when a PR exists but has not fully landed. Classifies the
     // unprovable reason for the observability below (which the old bare `continue`
     // skipped). task 1002615: it no longer suppresses the land proof — the proof
@@ -261,8 +255,7 @@ async function runSweep(deps = {}) {
     // so an open PR still can't ship by reference, while a task whose WORK is
     // already on main (out-of-band merge) can now prove it by ancestry.
     let prNotLanded = false;
-
-    if (branchUsable) {
+    {
       // Active merge driver (task 1162): GitHub's auto-merge fires on check-completion
       // EVENTS, so a PR whose auto-merge was re-armed AFTER its checks already went
       // green can sit open forever (the PR #125 stall). Before checking for a land,
@@ -399,7 +392,53 @@ async function runSweep(deps = {}) {
         // short-circuit that window.
         prNotLanded = true;
       }
-      branchStatus = status;
+      return { status, prNotLanded };
+    }
+  };
+
+  for (const r of rows) {
+    let branch = r.worktree_name ? `claude/${r.worktree_name}` : null;
+    if (branch) branchesSeen.add(branch);
+    const branchUsable = !!branch && push.isSafeBranch(branch) && branchCount.get(branch) === 1;
+    if (branch && branchCount.get(branch) > 1) {
+      // A reused worktree_name maps a branch to >1 confirmed task, so a merged PR is
+      // ambiguous — but each task's OWN head_sha is not, so we skip only the branch/PR
+      // path and let the head_sha ancestry land-check below resolve it unambiguously.
+      logFn(`[publish-reconciler] task ${r.task_id}: branch ${branch} maps to >1 confirmed task — using head_sha land-check only`);
+    }
+
+    let landed = false;
+    let landNote = '';
+    let branchStatus = null;
+    let prNotLanded = false;
+
+    if (branchUsable) {
+      ({ status: branchStatus, prNotLanded } = await sweepBranchPath(r, branch));
+    }
+
+    // task 1002645 — the claude/<worktree_name> derivation is the DEV-BOX convention;
+    // a laptop/wave ship pushes its own branch name (worktree-<worktree_name>), so the
+    // derived branch finds no PR and the merge nudge / conflict heal / land proof all
+    // sat idle while the task stranded at 'confirmed' (wave PRs 34/35/36 — native
+    // auto-merge is repo-disallowed, so the sweep's mergeIfGreen is the only green-PR
+    // merger). When the derived branch yields no PR, find the task's PR by the
+    // "task <id>: …" TITLE convention and re-run the branch path on its real head
+    // branch. Best-effort: a search miss just waits for the next sweep.
+    if ((!branchStatus || branchStatus.pr_state === 'none')
+        && typeof push.findTaskPullRequest === 'function') {
+      try {
+        const found = await push.findTaskPullRequest({ taskId: r.task_id });
+        if (found && found.branch && found.branch !== branch && push.isSafeBranch(found.branch)) {
+          logFn(
+            `[publish-reconciler] task ${r.task_id}: no PR on ${branch || '(no derived branch)'} — adopted ${found.branch} from PR #${found.pr_number} by title convention`
+          );
+          branch = found.branch;
+          branchesSeen.add(branch);
+          ({ status: branchStatus, prNotLanded } = await sweepBranchPath(r, branch));
+        }
+      } catch (_) {
+        /* best-effort: a PR-search miss waits for the next sweep */
+      }
     }
 
     // task 1547 — prove the land belongs to THIS task before shipping. landConfirmed

package/modules/lifecycle/routes/tasks.js

@@ -1718,6 +1718,19 @@ module.exports = function buildTasksRouter() {
     if (!(await gateTaskOwnership(req, res, id))) return;
     const { head_sha: headSha } = req.body;
     if (!/^[0-9a-f]{7,64}$/.test(headSha)) return res.fail('bad_head_sha', 400);
+    // task 1002645: the laptop ci-land pushes with the BUILDER's own credential, so
+    // the server-mediated path that records claims.published_head_sha (task 1547)
+    // never runs — landProvenForTask then has neither tip nor PR and the reconciler
+    // strands the task at 'confirmed' forever (wave PRs 34/35/36). ship.js calls
+    // this endpoint with the exact pushed tip at the moment of the push, so record
+    // it here too. Sits BEFORE the credential 503 on purpose: the tip is true
+    // regardless, and a later-provisioned credential lets the sweep heal
+    // retroactively. Best-effort, mirroring publish-branch.
+    try {
+      await db.setClaimPublishedSha({ taskId: id, builderId: req.builder.id, sha: headSha });
+    } catch (e) {
+      console.error('[gds] setClaimPublishedSha via attest-gate (non-blocking)', id, e && e.message);
+    }
     if (!githubPush.isConfigured()) {
       return res.fail('push_unconfigured', { status: 503, message: 'No server push credential (GitHub App / GITHUB_PUSH_TOKEN) to post the gate attestation. ' +
           'A gate-surface PR will need an owner review until the operator provisions it.' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.23",
+  "version": "1.19.25",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.23",
+      "version": "1.19.25",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.23",
+  "version": "1.19.25",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship.js

@@ -1326,6 +1326,23 @@ function printLandPending(taskId, opts = {}) {
   for (const line of landPendingLines(taskId, opts)) console.log(line);
 }
 
+// task 1002645 — the honest close-out when the PR MERGED but the server refused the
+// confirmed→shipped flip (reconcile_blocked: the task-1547 land proof missed — a
+// wrong/missing published tip, or the matched PR doesn't reference this task). The
+// optimistic "NOT a failure" banner was a lie here: without proof the auto-land can
+// NEVER finish, and the wave-5 ships sat at 'confirmed' with their last signal
+// saying everything was fine. Name the refusal and the remedy instead. Pure +
+// exported so the wording is pinned by tests/ship_ci_deploy.mjs.
+function reconcileBlockedLines(taskId, reason) {
+  return [
+    `  ci-land: the PR MERGED, but the task did NOT flip to 'shipped' — the server could not prove the land is`,
+    `  THIS task's: ${reason}.`,
+    `  The server reconciler retries the proof every ~5 min, so a late-recorded tip or PR reference still lands`,
+    `  on its own. Re-run \`node scripts/gds/ship.js ${taskId}\` to re-drive it; if it stays blocked the server`,
+    `  flags the task needs_rebase and /builder-start will show the remedy.`,
+  ];
+}
+
 // One module-scope sleep command shared by both poll loops (task 1093 / C9). A
 // child `node -e setTimeout` is used (not `await new Promise`) so it blocks
 // identically in the SYNCHRONOUS pollCiDeploy and the async pollServerPublish —
@@ -1341,13 +1358,26 @@ const POLL_SLEEP_CMD = 'node -e "setTimeout(()=>{}, 10000)"';
 async function pollServerPublish(taskId, branch) {
   const TRIES = 54; // ~9 min at 10s — checks + auto-merge + Actions deploy
   console.log('  ci-land: waiting for auto-merge + prod deploy (polling the server)...');
+  // task 1002645: GitHub can report merged+deployed while the SERVER refused the
+  // confirmed→shipped flip (reconcile_blocked — the task-1547 land proof missed).
+  // "Prod is live" + exit here was a lie that left the task stranded with no
+  // signal. Say the real reason and keep polling — attest-gate now records the
+  // pushed tip, so the proof usually heals within the window.
+  let blockedReason = null;
   for (let i = 0; i < TRIES; i++) {
     const r = await (await cliClient()).tasks.getTasksIdPublishStatus({ id: taskId, query: { branch } });
     if (r.ok && r.data) {
       const outcome = classifyLandOutcome(r.data);
       if (outcome === 'shipped') {
-        console.log(`  ci-land: merged (${String(r.data.merge_sha || '').slice(0, 8)}) + deploy-prod succeeded. Prod is live.`);
-        return landed();
+        if (r.data.reconcile_blocked) {
+          if (r.data.reconcile_blocked !== blockedReason) {
+            blockedReason = r.data.reconcile_blocked;
+            console.log(`  ci-land: merged, but the server did NOT flip the task to shipped: ${blockedReason}. Still polling (the reconciler retries every sweep)...`);
+          }
+        } else {
+          console.log(`  ci-land: merged (${String(r.data.merge_sha || '').slice(0, 8)}) + deploy-prod succeeded. Prod is live.`);
+          return landed();
+        }
       }
       if (outcome === 'failed') {
         console.log(`  ci-land: PR was CLOSED without merging (a required check failed, or it was closed manually). Fix it and re-run \`node scripts/gds/ship.js ${taskId}\` to resume. Task stays at 'confirmed'.`);
@@ -1356,6 +1386,11 @@ async function pollServerPublish(taskId, branch) {
     }
     shellOk(POLL_SLEEP_CMD);
   }
+  if (blockedReason) {
+    console.log('');
+    for (const line of reconcileBlockedLines(taskId, blockedReason)) console.log(line);
+    return landBailed(`the PR merged but the server could not prove the land is this task's: ${blockedReason}`, `node scripts/gds/ship.js ${taskId}`);
+  }
   printLandPending(taskId);
   return landPending();
 }
@@ -4176,6 +4211,9 @@ module.exports = {
   // task 1002606: the success-pending banner lines, pure — pinned so the strand
   // detection story ("NOT a failure" + how you WILL find out if it fails) can't drift.
   landPendingLines,
+  // task 1002645: the merged-but-proof-refused close-out lines (reconcile_blocked) —
+  // pinned so this shape can never regress to the optimistic "NOT a failure" banner.
+  reconcileBlockedLines,
   // #857: resolveDeployMode (env + committed config) so doctor.js reports the
   // active deploy mode exactly as ship will use it.
   resolveDeployMode,

package/src/bongos/routes/auth.js

@@ -21,6 +21,14 @@ function escapeHtml(s) {
 //   subtitle — replaces the default header sub-line
 //   cta      — { href, label } for the primary button (default: retry sign-in)
 //   note     — replaces the default troubleshooting footnote
+// The instance's own word for the admitting rank, for per-branch error strings
+// (task 1002616, the 1439 follow-up): core error surfaces never hardcode
+// "Archon" — a non-OTB instance names its own role (branding rankLabels.archon;
+// ADR 0062 §3). Used as "the ${admitterLabel()}", so labels stay grammatical.
+function admitterLabel() {
+  try { return branding().rankLabels?.archon || 'owner'; } catch { return 'owner'; }
+}
+
 function renderAuthErrorPage(heading, detail, opts = {}) {
   // Every fixed string on this page — the tab-title suffix, epigraph, page
   // heading, sub-line, and retry button — is owned by the instance branding
@@ -500,7 +508,7 @@ module.exports = function buildAuthRouter() {
     if (!code || !state || state !== expectedState) {
       return res.status(400).type('text/html').send(renderAuthErrorPage(
         'State mismatch',
-        'The handshake-cookie did not match the state GitHub returned. This usually means the sign-in took too long (cookie expired after 10 minutes) or the request crossed an origin boundary. Start over and the gate will open.',
+        'The handshake-cookie did not match the state GitHub returned. This usually means the sign-in took too long (cookie expired after 10 minutes) or the request crossed an origin boundary. Start over and sign in again.',
       ));
     }
     try {
@@ -584,18 +592,18 @@ module.exports = function buildAuthRouter() {
         }
         return res.status(403).type('text/html').send(renderAuthErrorPage(
           'This account is not approved yet',
-          'Signing in with GitHub is only for builders an Archon has already approved. If you are new, request access at the builders’ hall — an Archon will approve you, then this sign-in will let you in. If you were just approved, the Archon may still need to mark you invited; give it a moment and try again.',
+          `Signing in with GitHub is only for builders the ${admitterLabel()} has already approved. If you are new, request access at the builders’ hall — once the ${admitterLabel()} approves you, this sign-in will let you in. If you were just approved, it may take a moment to be marked invited; try again shortly.`,
           {
             subtitle: 'Sign-in is for approved builders. New here? Request access first.',
             cta: { href: '/builders', label: 'Go to the hall & request access' },
-            note: 'Already approved and still blocked? Ask the Archon to confirm your request was marked “invited.”',
+            note: `Already approved and still blocked? Ask the ${admitterLabel()} to confirm your request was marked “invited.”`,
           },
         ));
       }
       console.error('[gds] web/callback', err);
       res.status(500).type('text/html').send(renderAuthErrorPage(
         'The handshake threw an error',
-        `The server tried to exchange the auth code for a session and something went wrong: ${err.message}. Try again; if it persists, the Archon must investigate the server logs.`,
+        `The server tried to exchange the auth code for a session and something went wrong: ${err.message}. Try again; if it persists, ask the ${admitterLabel()} to investigate the server logs.`,
       ));
     }
   });
@@ -727,7 +735,7 @@ module.exports = function buildAuthRouter() {
       console.error('[gds] discord/callback', err);
       res.status(500).type('text/html').send(renderAuthErrorPage(
         'The Discord link threw an error',
-        'Linking failed unexpectedly. Try again; if it persists, the Archon must check the server logs.',
+        `Linking failed unexpectedly. Try again; if it persists, ask the ${admitterLabel()} to check the server logs.`,
         { cta: { href: '/builders', label: 'Back to the hall' } },
       ));
     }
@@ -1061,3 +1069,6 @@ module.exports.reqHost = reqHost;
 // The auth-error page renderer (task 1439): pure over the branding pack, so a
 // test can prove every visible string is brand-owned (no OTB lore baked in).
 module.exports.renderAuthErrorPage = renderAuthErrorPage;
+// The admitting-rank label for per-branch strings (task 1002616) — exported for
+// the same reason: the test proves the label is pack-owned, never "Archon".
+module.exports.admitterLabel = admitterLabel;

package/src/module-api.js

@@ -473,8 +473,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.21 with no explicit bump. run 31449168428. (task 1002620)
 //   1.19.23 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.22 with no explicit bump. run 31450197816. (task 1002620)
+//   1.19.24 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.23 with no explicit bump. run 31450459825. (task 1002620)
+//   1.19.25 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.24 with no explicit bump. run 31495418623. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.23'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.25'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_error_brand.mjs

@@ -67,6 +67,33 @@ const escapeHtml = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({
   '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
 }[c]));
 
+// ---- task 1002616: the per-branch CALL-SITE strings are lore-free too ----
+// Task 1439 made the TEMPLATE brand-aware but deliberately scoped out the
+// heading/detail arguments each callback error branch passes in. Those still
+// said "an Archon has already approved", "the Archon must investigate", and
+// "the gate will open" — instance lore rendered on every instance.
+
+test('call-site strings: no hardcoded Archon/gate lore in the auth error branches (task 1002616)', async () => {
+  const { readFileSync } = await import('node:fs');
+  const src = readFileSync(new URL('../src/bongos/routes/auth.js', import.meta.url), 'utf8');
+  // The four exact leaks, pinned so they cannot return verbatim…
+  assert.doesNotMatch(src, /gate will open/, 'state-mismatch branch must not carry gate lore');
+  assert.doesNotMatch(src, /an Archon has already approved|an Archon will approve/, 'NOT_APPROVED branch must not hardcode Archon');
+  assert.doesNotMatch(src, /Ask the Archon\b/, 'the NOT_APPROVED note must not hardcode Archon');
+  assert.doesNotMatch(src, /the Archon must (investigate|check)/, 'the 500 branches must not hardcode Archon');
+  // …and the label helper is actually what the branches interpolate.
+  assert.match(src, /admitterLabel\(\)/, 'branches resolve the instance label at render time');
+});
+
+test('admitterLabel: pack-owned with a neutral fallback (task 1002616)', () => {
+  const { admitterLabel } = authMod;
+  const label = admitterLabel();
+  const pack = loadBranding({ env: {} });
+  const expected = pack.rankLabels?.archon || 'owner';
+  assert.equal(label, expected, 'the label is the ambient pack’s rankLabels.archon');
+  assert.notEqual(label.trim(), '', 'never empty');
+});
+
 test('renderAuthErrorPage interpolates the branding pack, not hardcoded lore', () => {
   // Whatever pack is ambient in this checkout, the rendered page must carry ITS
   // authError values and ITS worldName — that is the pack-driven property.

package/tests/github_push_land_proof.mjs

@@ -152,6 +152,95 @@ test('landProvenForTask: a non-sha published tip ("HEAD") falls back to the PR c
   assert.equal(compareCalled, false, 'a non-sha tip must never reach the compare API (would false-positive)');
 });
 
+// --- task 1002645: findTaskPullRequest — the PR-title fallback locator --------
+//
+// The reconciler derives claude/<worktree_name> (dev-box convention); a laptop/wave
+// ship pushes worktree-<worktree_name>, so the derived branch finds no PR and the
+// sweep never engaged (wave PRs 34/35/36 stranded at 'confirmed'). This locates the
+// task's PR by the "task <id>: …" TITLE-PREFIX convention — deliberately TIGHTER
+// than prReferencesTask (title+body word match) because the search widens the
+// candidate set from "this branch's own PR" to "recent PRs".
+
+// A REST /pulls list response the locator pages through (newest first).
+function depsWithPulls(pulls, { ok = true, status = 200 } = {}) {
+  return {
+    token: 'x',
+    repoInfo: { owner: 'o', repo: 'r' },
+    fetchImpl: async () => ({ ok, status, json: async () => pulls }),
+  };
+}
+const pull = (title, ref, { merged = false, state = 'closed', repo = 'o/r', number = 36 } = {}) => ({
+  number, title, state, merged_at: merged ? '2026-08-11T00:00:00Z' : null,
+  head: { ref, repo: { full_name: repo } },
+});
+
+test('findTaskPullRequest: "task <id>: …" title → returns the REAL head branch + PR meta', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 1002616 },
+    depsWithPulls([
+      pull('task 1002620: unrelated newer', 'worktree-task-1002620'),
+      pull('task 1002616: denial speech', 'worktree-task-1002616', { merged: true }),
+    ])
+  );
+  assert.equal(r.branch, 'worktree-task-1002616');
+  assert.equal(r.merged, true);
+  assert.equal(r.pr_number, 36);
+});
+
+test('findTaskPullRequest: a body-only mention must NOT bind (tighter than prReferencesTask)', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 55 },
+    depsWithPulls([{ ...pull('fix regression', 'other-branch'), body: 'this also touches task 55' }])
+  );
+  assert.equal(r, null, 'a PR that merely MENTIONS the task is not its PR');
+});
+
+test('findTaskPullRequest: word boundary — task 100 does not match "task 1002: …"', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 100 },
+    depsWithPulls([pull('task 1002: other work', 'worktree-task-1002')])
+  );
+  assert.equal(r, null);
+});
+
+test('findTaskPullRequest: a FORK head is skipped (owner:branch lookups downstream cannot see it)', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 7 },
+    depsWithPulls([pull('task 7: from a fork', 'their-branch', { repo: 'someone/else' })])
+  );
+  assert.equal(r, null);
+});
+
+test('findTaskPullRequest: an unsafe head ref is skipped (injection guard)', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 8 },
+    depsWithPulls([pull('task 8: bad head', '-rf')])
+  );
+  assert.equal(r, null);
+});
+
+test('findTaskPullRequest: no match → null; bad task id → null before any fetch', async () => {
+  assert.equal(await gh.findTaskPullRequest({ taskId: 9 }, depsWithPulls([])), null);
+  assert.equal(
+    await gh.findTaskPullRequest(
+      { taskId: 'nope' },
+      { token: 'x', repoInfo: { owner: 'o', repo: 'r' }, fetchImpl: async () => { throw new Error('must not fetch'); } }
+    ),
+    null
+  );
+});
+
+test('findTaskPullRequest: API failure → STATUS_FETCH_FAILED; no credential → PUSH_UNCONFIGURED', async () => {
+  await assert.rejects(
+    () => gh.findTaskPullRequest({ taskId: 1 }, depsWithPulls([], { ok: false, status: 502 })),
+    (e) => e.code === 'STATUS_FETCH_FAILED'
+  );
+  await assert.rejects(
+    () => gh.findTaskPullRequest({ taskId: 1 }, { token: null, repoInfo: { owner: 'o', repo: 'r' } }),
+    (e) => e.code === 'PUSH_UNCONFIGURED'
+  );
+});
+
 // --- scrubCredential ---------------------------------------------------------
 
 test('scrubCredential: strips the x-access-token push credential from captured output', () => {

package/tests/publish_branch_route.mjs

@@ -311,6 +311,44 @@ await t('POST /tasks/:id/attest-gate: requireBuilder present, allowBoxScope ABSE
   assert.ok(!handles.includes(auth.allowBoxScope), 'must NOT carry allowBoxScope — a box session must reauth, never self-attest (#919)');
 });
 
+// task 1002645: the attest call is the ONE moment the laptop ci-land tells the
+// server its true pushed tip, so the route must record it on the claim
+// (claims.published_head_sha) — without it landProvenForTask has neither tip nor
+// PR and the reconciler strands the ship at 'confirmed' forever (wave PRs
+// 34/35/36). Recorded BEFORE the push-credential 503 on purpose: an unconfigured
+// server still captures the tip, so a later-provisioned credential heals the
+// strand retroactively — which is exactly the shape this test drives.
+await t('POST /tasks/:id/attest-gate records the pushed tip on the claim, even when push is unconfigured', async () => {
+  const dbMod = require('../modules/lifecycle/db.js');
+  const savedSet = dbMod.setClaimPublishedSha;
+  const recorded = [];
+  dbMod.setClaimPublishedSha = async (args) => { recorded.push(args); return 1; };
+  try {
+    await withEnv({
+      GITHUB_PUSH_TOKEN: undefined, GITHUB_APP_ID: undefined,
+      GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined,
+    }, async () => {
+      const router = buildTasksRouter();
+      const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
+      const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+      const out = { failCode: null, jsonBody: null };
+      const res = {
+        status() { return this; },
+        json(b) { out.jsonBody = b; return this; },
+        fail(code) { out.failCode = code; return this; },
+      };
+      // rank archon → gateTaskOwnership passes with no DB lookup, keeping the test hermetic.
+      const req = { params: { id: '77' }, body: { head_sha: 'a'.repeat(40) }, builder: { id: 95, rank: 'archon' } };
+      await handler(req, res);
+      assert.equal(out.failCode, 'push_unconfigured', 'no credential → still the usual 503 to the caller');
+      assert.deepEqual(recorded, [{ taskId: 77, builderId: 95, sha: 'a'.repeat(40) }],
+        'the tip is recorded BEFORE the credential check — the wave-strand cure');
+    });
+  } finally {
+    dbMod.setClaimPublishedSha = savedSet;
+  }
+});
+
 // ===========================================================================
 // GitHub App credential (task 1028 / ADR 0055 hardening): the server mints a
 // short-lived installation token from the App private key instead of holding a

package/tests/publish_reconciler.mjs

@@ -52,13 +52,14 @@ function mkDeps({
   statusByBranch = {},
   mergeByBranch = {},
   ancestryBySha = {},
+  taskPrByTask = {},
   shipImpl,
   broadcastImpl,
   conflictResolveImpl,
   refreshStaleImpl,
   healAttempts = new Map(),
 } = {}) {
-  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], flag: [], events: [], logs: [], errors: [] };
+  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], search: [], resolve: [], refresh: [], flag: [], events: [], logs: [], errors: [] };
   // isSafeBranch mirrors github-push's pattern enough for the test (rejects
   // option-like / traversal refs); we use the REAL module so the contract can't drift.
   const githubPush = require('../modules/lifecycle/github-push.js');
@@ -99,6 +100,16 @@ function mkDeps({
         if (s instanceof Error) throw s;
         return s || NONE;
       },
+      // task 1002645: the PR-title fallback locator. Default: nothing found (null),
+      // so pre-1002645 tests keep their exact behavior. Script per task id via
+      // taskPrByTask; an Error value throws (to prove the sweep swallows a search
+      // miss and continues).
+      findTaskPullRequest: async ({ taskId }) => {
+        calls.search.push(taskId);
+        const f = taskPrByTask[taskId];
+        if (f instanceof Error) throw f;
+        return f || null;
+      },
       // task 1313 head_sha land-check. Default: not on main. An Error value throws
       // (to prove a transient compare-API miss is swallowed, leaving it for next sweep).
       isAncestorOfDefaultBranch: async ({ sha }) => {
@@ -1077,6 +1088,106 @@ test('1002606 the aged stale strand now ALSO emits task.strand-flagged', async (
   assert.match(strandEvents[0].payload.reason, /^strand:no_branch_no_tip/);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002645 — the reconciler was blind to laptop/wave ships. The sweep derives
+// claude/<worktree_name> (dev-box convention); a wave ship pushes
+// worktree-<worktree_name>, so getPublishStatus saw pr_state:'none' and the whole
+// PR path (mergeIfGreen nudge — the ONLY merger where native auto-merge is
+// repo-disallowed — conflict heal, land proof) never engaged. PRs 34/35/36 all
+// stranded at 'confirmed' until a manual flip. The fallback finds the task's PR by
+// the "task <id>: …" TITLE convention and re-runs the branch path on its REAL head.
+// ---------------------------------------------------------------------------
+
+test('1002645 THE PIN: a worktree-named branch (laptop wave ship) lands UNATTENDED via the PR-title fallback', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 2645, builder_id: 95, worktree_name: 'task-2645', published_head_sha: ON_MAIN }],
+    statusByBranch: {
+      'claude/task-2645': NONE,                 // the derived dev-box branch has no PR
+      'worktree-task-2645': LANDED_NO_WORKFLOW, // the REAL branch: merged, pin-bump repo
+    },
+    taskPrByTask: { 2645: { branch: 'worktree-task-2645', pr_number: 36, pr_state: 'closed', merged: true } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the wave-5 strand shape must land with NO human step (ADR 0162)');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 2645, builderId: 95 }]);
+  assert.deepEqual(deps._calls.search, [2645], 'the fallback ran exactly once');
+  assert.ok(deps._calls.merge.includes('worktree-task-2645'),
+    'the merge nudge engages on the REAL branch — the only merger when native auto-merge is disallowed');
+});
+
+test('1002645 a green-but-unmerged PR on the real branch is server-merged via the fallback (no client poll needed)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 2646, builder_id: 95, worktree_name: 'task-2646' }],
+    statusByBranch: { 'claude/task-2646': NONE, 'worktree-task-2646': PENDING },
+    taskPrByTask: { 2646: { branch: 'worktree-task-2646', pr_number: 37, pr_state: 'open', merged: false } },
+    mergeByBranch: { 'worktree-task-2646': { merged: true, merged_now: true, number: 37 } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.merged, 1, 'the sweep merges the wave PR itself — the land no longer depends on a live ship.js poll');
+  assert.equal(r.reconciled, 0, 'ships on a later sweep once deploy + proof confirm');
+});
+
+test('1002645 a legacy laptop strand (no recorded tip) heals retroactively via the adopted PR reference', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 2616, builder_id: 95, worktree_name: 'task-2616' }], // no published_head_sha
+    statusByBranch: { 'claude/task-2616': NONE, 'worktree-task-2616': landedPrFor(2616) },
+    taskPrByTask: { 2616: { branch: 'worktree-task-2616', pr_number: 36, pr_state: 'closed', merged: true } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the PRs-34/35/36 shape heals with no manual POST /ship');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 2616, builderId: 95 }]);
+});
+
+test('1002645 the fallback does NOT fire when the derived branch already has a PR (dev-box path unchanged)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 900, builder_id: 1, worktree_name: 'wt-box' }],
+    statusByBranch: { 'claude/wt-box': PENDING },
+    taskPrByTask: { 900: new Error('search must not run') },
+  });
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.search.length, 0, 'a dev-box ship keeps the derived-branch path — no extra API call');
+});
+
+test('1002645 a PR-search failure is swallowed — the sweep continues to the next task and retries next sweep', async () => {
+  const deps = mkDeps({
+    rows: [
+      { task_id: 901, builder_id: 1, worktree_name: 'task-901' },
+      { task_id: 902, builder_id: 1, worktree_name: 'wt-ok', published_head_sha: ON_MAIN },
+    ],
+    statusByBranch: { 'claude/task-901': NONE, 'claude/wt-ok': LANDED },
+    taskPrByTask: { 901: new Error('GitHub 502') },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the healthy task still ships');
+  assert.equal(r.errors, 0, 'a transient search miss is not an error');
+});
+
+test('1002645 an unsafe adopted branch name is refused (the injection guard holds on the fallback)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 903, builder_id: 1, worktree_name: null, published_head_sha: null,
+             confirmed_at: new Date().toISOString() }],
+    taskPrByTask: { 903: { branch: '-rf', pr_number: 1, pr_state: 'open', merged: false } },
+  });
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.status.length, 0, 'a branch that fails isSafeBranch is never queried');
+  assert.equal(deps._calls.merge.length, 0, 'nor merge-nudged');
+});
+
+test('1002645 the reuse guard still holds through the fallback: adopted PR merged but tip NOT in main → NO ship', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 904, builder_id: 1, worktree_name: 'task-904', published_head_sha: NOT_ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/task-904': NONE, 'worktree-task-904': LANDED_NO_WORKFLOW },
+    taskPrByTask: { 904: { branch: 'worktree-task-904', pr_number: 40, pr_state: 'closed', merged: true } },
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'adopting the real branch must not weaken the task-1547 per-task proof');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);

package/tests/ship_ci_deploy.mjs

@@ -607,6 +607,27 @@ test('1002606 landPendingLines: merged variant says deploy-only', () => {
   assert.match(unmerged, /GitHub will merge \+ deploy automatically/);
 });
 
+// ---- task 1002645: the merged-but-proof-refused close-out (reconcile_blocked) ----
+// GitHub can report merged+deployed while the SERVER refused the confirmed→shipped
+// flip (the task-1547 land proof missed). pollServerPublish used to print "Prod is
+// live" / the optimistic P-3 banner for that shape — a lie: without proof the
+// auto-land can NEVER finish. The close-out must name the refusal and the remedy,
+// and must never claim success or "NOT a failure".
+
+test('1002645 reconcileBlockedLines: names the refusal reason + the re-drive command', () => {
+  const lines = ship.reconcileBlockedLines(2645, 'published tip abcd1234 not in main (branch-reuse/stale PR)').join('\n');
+  assert.match(lines, /did NOT flip|could not prove/i, 'says the flip was refused');
+  assert.match(lines, /published tip abcd1234 not in main/, 'carries the server\'s exact reason');
+  assert.match(lines, /node scripts\/gds\/ship\.js 2645/, 'the re-drive command names THIS task');
+  assert.match(lines, /needs_rebase/, 'names the flag that gates a stuck strand');
+});
+
+test('1002645 reconcileBlockedLines: never reads as success (no "NOT a failure", no "Prod is live")', () => {
+  const lines = ship.reconcileBlockedLines(1, 'x').join('\n');
+  assert.ok(!/NOT a failure/.test(lines), 'the optimistic reassurance must not appear on a blocked land');
+  assert.ok(!/Prod is live/.test(lines), 'nor the success line');
+});
+
 console.log('');
 console.log(`ship_ci_deploy: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);