@bongos/core 1.19.24 → 1.19.26

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.24",
-  "core_contract": "1.19.24",
-  "source_commit": "e17b55346ce6c5a5b0e7c17be12fd87f49805bfa",
+  "core_version": "1.19.26",
+  "core_contract": "1.19.26",
+  "source_commit": "522fdcf67202b1961ce21cc5bb1e9e21f3455105",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T01:49:44.456Z",
+  "built_at": "2026-08-11T13:25:13.567Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 285,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1204,
+    "functional_verbatim": 1205,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1510,
-  "tree_sha256": "238b6875fb5bfeb460a7d827d8b671f23f910870fdfffaa09977138b1537865c",
+  "file_count": 1511,
+  "tree_sha256": "ecaa7b2c50ea700a1da02925b30bc638ccef3e362d27f47a50c59957afc232be",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2822,7 +2822,7 @@
     {
       "path": "modules/grading/db.js",
       "mode": "0000644",
-      "sha256": "ed7df5654cead0c89945a53c2de65bbdb7549aeeb7b73845143bced5a451d77b"
+      "sha256": "b651b73c65b0da33284430b430638dbc39b34db43846a05ab431deaabcc44b3b"
     },
     {
       "path": "modules/grading/grader-rubric.json",
@@ -2932,7 +2932,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "dcb19e4ec7a5df5299f84d70dc80fcc09d0ecf3110d89dda9ec40d1444df376d"
+      "sha256": "5bdd907f10ae15f8efdb55adce3ce23991a376122eb79c549e025f8f4845fae5"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -3352,7 +3352,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "7dc50e4e88a204583c753555c76f4103df405a143c4266dbff53793c292803f9"
+      "sha256": "85c856016e548399538734098d2f08d3920fb52814759ffa314ed26d98bf32eb"
     },
     {
       "path": "modules/lifecycle/done-when.js",
@@ -3362,7 +3362,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "200de3b5be6b1f3b0612dea91409f44aa3d5b76f8f90fb71e4e5ced43a0890fb"
+      "sha256": "c8f356746096a6fe39e456b12367d29b6bbf4e39df1515c09144c95e239f1b49"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3417,7 +3417,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "7f42dfe5b16dff0e3833b0a586c5b04592aeaee1aa1f4f41c0255a16db1a14fc"
+      "sha256": "964af2331007a4cfb9142e7245d7625cf21c973e4f885e0171855b9e188b9e95"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -3457,7 +3457,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "add6acd00adc842e90348ca789da0a473aa2dc68d949cf2b5586c68ef5eaa1be"
+      "sha256": "f5041a43ea0a74bc6b16f8ceb6490c70090e7959e66f137c92040ee842db1ec0"
     },
     {
       "path": "modules/lifecycle/routes/versions.js",
@@ -4002,12 +4002,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "642ec17a7c466b31700ea4759e0f3f3f1622f016bd5ce39122ac50ae1b393449"
+      "sha256": "08c0827545637895b730387d92d4a0ce7fef7b055a966cb88ab70e6be901880c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "00411692affd964ada475f325a9e810cd2d351d5b168500d32759a70ef2af627"
+      "sha256": "1ac1c894e7f11d5502855775e3f2ca37031927a68ec7e8dca447661b872467e5"
     },
     {
       "path": "public-docs/index.html",
@@ -5197,7 +5197,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "085a7feeff06fa7d2b833c483795161e2c4a6ee79630e2f09d7ae2f06eeb253c"
+      "sha256": "1a00cb0c8ab216bab06b60b4ad1eaa18dc521eafd62ebe34f8fd35c7ff12e486"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5627,7 +5627,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "08c66b410a4563d54fa8e8f6c0cf0ab077bf95b902923eb785419e8f261ebe99"
+      "sha256": "39b05d86d4fbb1035769ff0c30a97b21c75eea8ee145a25784789d17fb20aa38"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6387,7 +6387,7 @@
     {
       "path": "tests/github_push_land_proof.mjs",
       "mode": "0000644",
-      "sha256": "080a19cae0faf168b4b7fa31d1a68d0fe84b3d5b41c9bbfda1f5ecee34ad8ca4"
+      "sha256": "c55433099e4681a8dd091873e9f8687f35e629b4a4ad3a3c3dd462860070fc59"
     },
     {
       "path": "tests/github_push_merge_driver.mjs",
@@ -6564,6 +6564,11 @@
       "mode": "0000644",
       "sha256": "a2d76ca391999e54b0767c3cba8eba34e84d5c704c3ac98370195ef9889bd152"
     },
+    {
+      "path": "tests/grade_aggregates_unavailable.mjs",
+      "mode": "0000644",
+      "sha256": "a55ae09e94648035479ff214ac26c2c84f2fc3c166237f06d296a6fd6608ec48"
+    },
     {
       "path": "tests/grade_attempts.mjs",
       "mode": "0000644",
@@ -7097,7 +7102,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "5f9a083a4fc9c54683a277afcd14aff10db0dda1082e65cb5032445b25026139"
+      "sha256": "99572892490e209835aae6479370e97b49585bfaa719c788a4d06d92407a9a7d"
     },
     {
       "path": "tests/publish_manifest.mjs",
@@ -7107,7 +7112,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "fa54fe19a54153ce65f8a98ccce22c9aad7e2c928a648fb2fc621067168eb703"
+      "sha256": "240337de03354de198d6baaaca9f33b267aceb40a8ba43d31303eb21fad9226c"
     },
     {
       "path": "tests/rank_gate.mjs",
@@ -7377,7 +7382,7 @@
     {
       "path": "tests/ship_ci_deploy.mjs",
       "mode": "0000644",
-      "sha256": "de59e8ed0d1a0e30b52994fe1bf3e1864706613a1329d967f74eeae277c1948e"
+      "sha256": "e236bc3d6882bc6ddf5d389371a92a96aec62769f14c37bbca31810bcbea0d61"
     },
     {
       "path": "tests/ship_preflight.mjs",

package/modules/grading/db.js

@@ -18,22 +18,33 @@
 const api = require('../../src/module-api');
 const { pool } = api;
 
-// Rolling grade stats for a builder over the last `days`: { n, avg_score, n_passed }.
-// Windows by graded_at; `shipped_by` attributes the grade to the builder who did
-// the work. Returns a zero row when the builder has no grades in the window.
+// Rolling grade stats for a builder over the last `days`: { n, avg_score,
+// n_passed, n_unavailable }. Windows by graded_at; `shipped_by` attributes the
+// grade to the builder who did the work. Returns a zero row when the builder
+// has no grades in the window.
+//
+// Quality stats count ONLY quality-graded rows (task 1002652): a grader outage
+// (#943 — signals.panel_outcome='unavailable') or a json-null gating axis
+// (functional_fidelity / code_quality) is bucketed as n_unavailable, never a
+// 0-score fail. The predicate is a documented twin of lifecycle/db.js
+// `gradeQualityWhere` (module boundary — keep the two in sync).
 async function builderRollingAvgGrade(builderId, days = 14) {
+  const q = `(COALESCE(g.signals->>'panel_outcome','') <> 'unavailable'
+           AND COALESCE(jsonb_typeof(g.rubric_scores->'functional_fidelity'),'') <> 'null'
+           AND COALESCE(jsonb_typeof(g.rubric_scores->'code_quality'),'') <> 'null')`;
   const { rows } = await pool.query(
     `SELECT
-       COUNT(*)::int                                            AS n,
-       COALESCE(AVG(g.score), 0)::numeric(3,1)                  AS avg_score,
-       COALESCE(SUM(CASE WHEN g.passed THEN 1 ELSE 0 END), 0)::int AS n_passed
+       COUNT(*) FILTER (WHERE ${q})::int                         AS n,
+       COALESCE(AVG(g.score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS avg_score,
+       COALESCE(SUM(CASE WHEN g.passed THEN 1 ELSE 0 END) FILTER (WHERE ${q}), 0)::int AS n_passed,
+       COUNT(*) FILTER (WHERE NOT ${q})::int                     AS n_unavailable
        FROM task_grades g
        JOIN tasks t ON t.id = g.task_id
       WHERE t.shipped_by = $1
         AND g.graded_at >= now() - ($2 || ' days')::interval`,
     [builderId, String(days)]
   );
-  return rows[0] || { n: 0, avg_score: 0, n_passed: 0 };
+  return rows[0] || { n: 0, avg_score: 0, n_passed: 0, n_unavailable: 0 };
 }
 
 module.exports = { builderRollingAvgGrade };

package/modules/hall-ui/public/builders.js

@@ -1457,15 +1457,20 @@
       return;
     }
     tbody.innerHTML = grades.map((g) => {
-      const score = Number(g.score).toFixed(1);
-      const verdict = g.passed
-        ? `<span style="color:var(--olive,#5b7a4d);font-weight:600">passed</span>`
-        : `<span style="color:#a04040;font-weight:600">fell short</span>`;
+      // A grader OUTAGE row (panel_outcome 'unavailable') carries a placeholder
+      // score of 0 — label it, never render it as a 0.0 fail (task 1002652).
+      const isOutage = g.panel_outcome === 'unavailable';
+      const score = isOutage ? '—' : Number(g.score).toFixed(1);
+      const verdict = isOutage
+        ? `<span style="color:var(--ink-soft,#8a8577)">not graded (grader outage)</span>`
+        : g.passed
+          ? `<span style="color:var(--olive,#5b7a4d);font-weight:600">passed</span>`
+          : `<span style="color:#a04040;font-weight:600">fell short</span>`;
       return `
         <tr>
           <td class="ledger__num">#${g.task_id}</td>
           <td>${escapeHtml(g.title || '')}</td>
-          <td class="ledger__drachmae">${score} / 10</td>
+          <td class="ledger__drachmae">${isOutage ? '—' : `${score} / 10`}</td>
           <td>${verdict}</td>
           <td class="ledger__date">${fmtDate(g.graded_at)}</td>
         </tr>
@@ -1603,7 +1608,9 @@
     if (!isEco) {
       charts.push(chartCard('Cost / work ($)', (data.cost_trend || []).map((r) => r.per_work), 'var(--terracotta)',
         `total ${usd(h.total_cost_usd)}`));
-      charts.push(chartCard('Grade pass rate', (data.grade_trend || []).map((r) => (r.n ? r.n_passed / r.n : 0)), 'var(--accent)',
+      // n counts quality-graded rows only (task 1002652); a day whose grades
+      // were all outages has n=0 and must not plot as a 0% dip.
+      charts.push(chartCard('Grade pass rate', (data.grade_trend || []).filter((r) => Number(r.n) > 0).map((r) => r.n_passed / r.n), 'var(--accent)',
         'share of work passing review'));
     }
     gridEl.innerHTML = charts.join('');

package/modules/lifecycle/db.js

@@ -83,15 +83,34 @@ const staleClaimHourPredicate = (param) =>
                     AND c.claimed_at    < now() - (${param}::int * interval '1 hour'))`;
 
 // grade pass-count fragment: SUM of passed-as-1. `col` is the (possibly
-// alias-qualified) boolean column ('passed' or 'g.passed'); pass
-// { coalesce: false } for the two sites that omit the COALESCE(...,0) wrap
-// (audit §2B db-tx — alias × coalesce are the two preserved drift dimensions).
-
-const gradePassCount = (col, { coalesce = true } = {}) => {
-  const inner = `SUM(CASE WHEN ${col} THEN 1 ELSE 0 END)`;
+// alias-qualified) boolean column ('passed' or 'g.passed'); { where } restricts
+// the sum to quality-graded rows via FILTER (task 1002652 — every aggregate
+// site passes gradeQualityWhere, and keeps coalesce on because FILTER can zero
+// out a group). { coalesce: false } preserved for callers that want a raw SUM.
+
+const gradePassCount = (col, { coalesce = true, where = null } = {}) => {
+  const filter = where ? ` FILTER (WHERE ${where})` : '';
+  const inner = `SUM(CASE WHEN ${col} THEN 1 ELSE 0 END)${filter}`;
   return coalesce ? `COALESCE(${inner}, 0)::int` : `${inner}::int`;
 };
 
+// Quality-graded row predicate (task 1002652). Two task_grades shapes carry
+// score 0 / passed=false that are NOT quality verdicts and must never enter an
+// aggregate: a grader OUTAGE (#943 — signals.panel_outcome='unavailable',
+// rubric axes json-null) and a panel row whose gating axis
+// (functional_fidelity / code_quality) is json-null (an errored worker, not a
+// judged 0). jsonb_typeof + COALESCE keep legacy rows counted (missing keys /
+// SQL-NULL rubric_scores → typeof NULL → '' ≠ 'null') and keep the predicate
+// NULL-safe under NOT (a bare NULL operand would drop rows from the
+// n_unavailable bucket).
+
+const gradeQualityWhere = (alias = '') => {
+  const a = alias ? `${alias}.` : '';
+  return `(COALESCE(${a}signals->>'panel_outcome','') <> 'unavailable'
+           AND COALESCE(jsonb_typeof(${a}rubric_scores->'functional_fidelity'),'') <> 'null'
+           AND COALESCE(jsonb_typeof(${a}rubric_scores->'code_quality'),'') <> 'null')`;
+};
+
 // The shared `bounds`/`days` DAY_SERIES_CTE for the costSummary day-series
 // queries moved with costSummary into modules/economy/cost.js (BV1.R77 / ADR
 // 0093 §§1-2) — its only two callers left the monolith.
@@ -4856,9 +4875,13 @@ async function recentShippedTasksByBuilder(builderId, limit = 10) {
 // this is safe to call freely.
 
 async function recentGradesForBuilder(builderId, limit = 5) {
+  // panel_outcome rides along so consumers can LABEL an outage row ("not
+  // graded") instead of rendering its placeholder 0.0 as a fail (task 1002652).
+  // A list read stays unfiltered — honesty here means labeling, not hiding.
   const { rows } = await pool.query(
     `SELECT g.task_id, g.score, g.passed, g.threshold, g.graded_at,
             g.grader_kind, g.grader_version, g.rubric_scores,
+            g.signals->>'panel_outcome' AS panel_outcome,
             COALESCE(g.signals->'issues', '[]'::jsonb) AS issues,
             COALESCE((g.signals->>'confidence')::numeric, NULL) AS confidence,
             t.title, t.kind, t.discipline
@@ -4876,33 +4899,43 @@ async function recentGradesForBuilder(builderId, limit = 5) {
 // public status tile + leaderboard hover.
 
 async function rollingAvgGrade(days = 7) {
+  // Quality stats aggregate ONLY quality-graded rows; outage / null-axis rows
+  // are counted apart as n_unavailable (task 1002652 — 21 outage rows once
+  // read as a month of pass_rate 0.000).
+  const q = gradeQualityWhere();
   const { rows } = await pool.query(
     `SELECT
-       COUNT(*)::int                                            AS n,
-       COALESCE(AVG(score), 0)::numeric(3,1)                    AS avg_score,
-       ${gradePassCount('passed')} AS n_passed,
-       COALESCE(MIN(score), 0)::numeric(3,1)                    AS min_score,
-       COALESCE(MAX(score), 0)::numeric(3,1)                    AS max_score
+       COUNT(*) FILTER (WHERE ${q})::int                         AS n,
+       COALESCE(AVG(score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS avg_score,
+       ${gradePassCount('passed', { where: q })} AS n_passed,
+       COALESCE(MIN(score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS min_score,
+       COALESCE(MAX(score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS max_score,
+       COUNT(*) FILTER (WHERE NOT ${q})::int                     AS n_unavailable
        FROM task_grades
       WHERE graded_at >= now() - ($1 || ' days')::interval`,
     [String(days)]
   );
-  return rows[0] || { n: 0, avg_score: 0, n_passed: 0, min_score: 0, max_score: 0 };
+  return rows[0] || { n: 0, avg_score: 0, n_passed: 0, min_score: 0, max_score: 0, n_unavailable: 0 };
 }
 
 // Per-builder rolling avg, last `days` days. Powers the /builders profile.
 
 async function gradeByBuilder(days = 30) {
+  // pass_rate is NULL (not 0.000) for a builder whose window holds only
+  // outage / null-axis rows — "no graded work", never a fabricated fail-streak
+  // (task 1002652). fmtPct-style consumers already render null as '—'.
+  const q = gradeQualityWhere('g');
   const { rows } = await pool.query(
     `SELECT
        t.shipped_by                                             AS builder_id,
        b.github_login,
        b.display_name,
        b.avatar_url,
-       COUNT(*)::int                                            AS n,
-       COALESCE(AVG(g.score), 0)::numeric(3,1)                  AS avg_score,
-       ${gradePassCount('g.passed')} AS n_passed,
-       ROUND(COALESCE(AVG(CASE WHEN g.passed THEN 1 ELSE 0 END), 0), 3) AS pass_rate,
+       COUNT(*) FILTER (WHERE ${q})::int                        AS n,
+       COALESCE(AVG(g.score) FILTER (WHERE ${q}), 0)::numeric(3,1) AS avg_score,
+       ${gradePassCount('g.passed', { where: q })} AS n_passed,
+       ROUND(AVG(CASE WHEN g.passed THEN 1 ELSE 0 END) FILTER (WHERE ${q}), 3) AS pass_rate,
+       COUNT(*) FILTER (WHERE NOT ${q})::int                    AS n_unavailable,
        MAX(g.graded_at)                                         AS last_graded_at
        FROM task_grades g
        JOIN tasks t    ON t.id = g.task_id
@@ -4920,12 +4953,17 @@ async function gradeByBuilder(days = 30) {
 // chart on status.amazonprimea.com.
 
 async function gradeTrendByDay(days = 30) {
+  // A day whose rows are all outages keeps its row (n=0, avg_score NULL,
+  // n_unavailable>0) so a chart can show "grader down", never a 0.0-score day
+  // (task 1002652 — the 2026-07-12..19 zero-score week was five outage days).
+  const q = gradeQualityWhere();
   const { rows } = await pool.query(
     `SELECT
        to_char(date_trunc('day', graded_at), 'YYYY-MM-DD') AS day,
-       COUNT(*)::int AS n,
-       AVG(score)::numeric(3,1) AS avg_score,
-       ${gradePassCount('passed', { coalesce: false })} AS n_passed
+       COUNT(*) FILTER (WHERE ${q})::int AS n,
+       AVG(score) FILTER (WHERE ${q})::numeric(3,1) AS avg_score,
+       ${gradePassCount('passed', { where: q })} AS n_passed,
+       COUNT(*) FILTER (WHERE NOT ${q})::int AS n_unavailable
        FROM task_grades
       WHERE graded_at >= now() - ($1 || ' days')::interval
       GROUP BY date_trunc('day', graded_at)
@@ -4989,11 +5027,14 @@ async function builderAnalytics(builderId, days = 90) {
         [builderId, d]
       ),
       // Grade pass-rate per day (quality holding up as throughput rises?).
+      // Quality-graded rows only — outage / null-axis rows would read as
+      // fail-days (task 1002652); headline.grade_pass_rate derives from these
+      // rows so it inherits the same honesty.
       pool.query(
         `SELECT to_char(date_trunc('day', g.graded_at), 'YYYY-MM-DD') AS day,
-                COUNT(*)::int AS n,
-                ${gradePassCount('g.passed', { coalesce: false })} AS n_passed,
-                AVG(g.score)::numeric(3,1) AS avg_score
+                COUNT(*) FILTER (WHERE ${gradeQualityWhere('g')})::int AS n,
+                ${gradePassCount('g.passed', { where: gradeQualityWhere('g') })} AS n_passed,
+                AVG(g.score) FILTER (WHERE ${gradeQualityWhere('g')})::numeric(3,1) AS avg_score
            FROM task_grades g
            JOIN tasks t ON t.id = g.task_id
           WHERE t.shipped_by = $1
@@ -5457,6 +5498,7 @@ module.exports = {
   rollingAvgGrade,
   gradeByBuilder,
   gradeTrendByDay,
+  gradeQualityWhere, // exported for tests/grade_aggregates_unavailable.mjs (task 1002652)
   builderAnalytics,
   ecosystemAnalytics,
   createOverrideRequest,

package/modules/lifecycle/github-push.js

@@ -465,6 +465,54 @@ function prReferencesTask(status, taskId) {
   return new RegExp(`\\btask\\s+#?${Number(taskId)}\\b`, 'i').test(hay);
 }
 
+// task 1002645 — locate a task's PR by the "task <id>: …" TITLE convention, for when
+// the reconciler cannot derive the branch. The sweep derives claude/<worktree_name>
+// (the dev-box convention), but a laptop/wave ship pushes its own branch name
+// (worktree-<worktree_name>), so the derived branch finds no PR and the sweep's whole
+// PR path — the mergeIfGreen nudge (the ONLY green-PR merger where native auto-merge
+// is repo-disallowed), conflict heal, land proof — never engages; the task strands at
+// 'confirmed' (wave PRs 34/35/36). Both publish paths title their PR "task <id>: …"
+// (openOrFindPullRequest above; ship.js buildPrCreateArgv), so a TITLE-PREFIX match
+// positively binds a PR to its task. Deliberately TIGHTER than prReferencesTask
+// (title+body word match): the search widens the candidate set from "this branch's
+// own PR" to "recent PRs", and a body MENTION of a task must not bind it.
+//
+// Uses the REST pulls list (real-time — the search API lags on fresh PRs), newest
+// first, and returns the first title match whose head is a same-repo, safe-named
+// branch (a fork's head is invisible to the owner:branch lookups downstream):
+// { branch, pr_number, pr_state, merged }. Null when nothing matches. Pure w.r.t.
+// injected token/repoInfo/fetchImpl for tests.
+async function findTaskPullRequest({ taskId }, deps = {}) {
+  if (!Number.isInteger(Number(taskId))) return null;
+  const token = await resolveToken(deps);
+  if (!token) throw err('PUSH_UNCONFIGURED');
+  const repoInfo = deps.repoInfo || loadRepoInfo();
+  if (!repoInfo || repoInfo.error) throw err('NO_REPO_INFO');
+  const { owner, repo } = repoInfo;
+  const doFetch = deps.fetchImpl || fetch;
+  const res = await doFetch(
+    `https://api.github.com/repos/${owner}/${repo}/pulls?state=all&sort=created&direction=desc&per_page=100`,
+    { headers: ghHeaders(token) }
+  );
+  if (!res.ok) throw err('STATUS_FETCH_FAILED', { status: res.status });
+  const prs = await res.json();
+  if (!Array.isArray(prs)) return null;
+  const titleRe = new RegExp(`^task\\s+#?${Number(taskId)}\\b`, 'i');
+  for (const pr of prs) {
+    if (!pr || !titleRe.test(String(pr.title || ''))) continue;
+    const head = pr.head || {};
+    if (!head.repo || head.repo.full_name !== `${owner}/${repo}`) continue;
+    if (!isSafeBranch(head.ref)) continue;
+    return {
+      branch: head.ref,
+      pr_number: pr.number || null,
+      pr_state: pr.state || null,
+      merged: !!pr.merged_at,
+    };
+  }
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // Active merge driver (task 1162) — land a green PR the moment it's mergeable
 // instead of waiting on GitHub's auto-merge daemon.
@@ -1000,6 +1048,7 @@ module.exports = {
   landConfirmed,
   landProvenForTask,
   prReferencesTask,
+  findTaskPullRequest,
   scrubCredential,
   isAncestorOfDefaultBranch,
   resolveToken,

package/modules/lifecycle/publish-reconciler.js

@@ -240,20 +240,14 @@ async function runSweep(deps = {}) {
     }
     return flagged;
   };
-  for (const r of rows) {
-    const branch = r.worktree_name ? `claude/${r.worktree_name}` : null;
-    if (branch) branchesSeen.add(branch);
-    const branchUsable = !!branch && push.isSafeBranch(branch) && branchCount.get(branch) === 1;
-    if (branch && branchCount.get(branch) > 1) {
-      // A reused worktree_name maps a branch to >1 confirmed task, so a merged PR is
-      // ambiguous — but each task's OWN head_sha is not, so we skip only the branch/PR
-      // path and let the head_sha ancestry land-check below resolve it unambiguously.
-      logFn(`[publish-reconciler] task ${r.task_id}: branch ${branch} maps to >1 confirmed task — using head_sha land-check only`);
-    }
 
-    let landed = false;
-    let landNote = '';
-    let branchStatus = null;
+  // task 1002645 — the per-branch PR path (merge nudge → conflict/stale heal →
+  // publish-status), extracted so it can run TWICE for one task: first on the
+  // derived claude/<worktree_name> branch (the dev-box convention), then — when
+  // that finds no PR — on the REAL branch adopted from the task's own PR
+  // (findTaskPullRequest). Mutates the sweep counters via closure; returns
+  // { status, prNotLanded }.
+  const sweepBranchPath = async (r, branch) => {
     // task 1002472 — set when a PR exists but has not fully landed. Classifies the
     // unprovable reason for the observability below (which the old bare `continue`
     // skipped). task 1002615: it no longer suppresses the land proof — the proof
@@ -261,8 +255,7 @@ async function runSweep(deps = {}) {
     // so an open PR still can't ship by reference, while a task whose WORK is
     // already on main (out-of-band merge) can now prove it by ancestry.
     let prNotLanded = false;
-
-    if (branchUsable) {
+    {
       // Active merge driver (task 1162): GitHub's auto-merge fires on check-completion
       // EVENTS, so a PR whose auto-merge was re-armed AFTER its checks already went
       // green can sit open forever (the PR #125 stall). Before checking for a land,
@@ -399,7 +392,53 @@ async function runSweep(deps = {}) {
         // short-circuit that window.
         prNotLanded = true;
       }
-      branchStatus = status;
+      return { status, prNotLanded };
+    }
+  };
+
+  for (const r of rows) {
+    let branch = r.worktree_name ? `claude/${r.worktree_name}` : null;
+    if (branch) branchesSeen.add(branch);
+    const branchUsable = !!branch && push.isSafeBranch(branch) && branchCount.get(branch) === 1;
+    if (branch && branchCount.get(branch) > 1) {
+      // A reused worktree_name maps a branch to >1 confirmed task, so a merged PR is
+      // ambiguous — but each task's OWN head_sha is not, so we skip only the branch/PR
+      // path and let the head_sha ancestry land-check below resolve it unambiguously.
+      logFn(`[publish-reconciler] task ${r.task_id}: branch ${branch} maps to >1 confirmed task — using head_sha land-check only`);
+    }
+
+    let landed = false;
+    let landNote = '';
+    let branchStatus = null;
+    let prNotLanded = false;
+
+    if (branchUsable) {
+      ({ status: branchStatus, prNotLanded } = await sweepBranchPath(r, branch));
+    }
+
+    // task 1002645 — the claude/<worktree_name> derivation is the DEV-BOX convention;
+    // a laptop/wave ship pushes its own branch name (worktree-<worktree_name>), so the
+    // derived branch finds no PR and the merge nudge / conflict heal / land proof all
+    // sat idle while the task stranded at 'confirmed' (wave PRs 34/35/36 — native
+    // auto-merge is repo-disallowed, so the sweep's mergeIfGreen is the only green-PR
+    // merger). When the derived branch yields no PR, find the task's PR by the
+    // "task <id>: …" TITLE convention and re-run the branch path on its real head
+    // branch. Best-effort: a search miss just waits for the next sweep.
+    if ((!branchStatus || branchStatus.pr_state === 'none')
+        && typeof push.findTaskPullRequest === 'function') {
+      try {
+        const found = await push.findTaskPullRequest({ taskId: r.task_id });
+        if (found && found.branch && found.branch !== branch && push.isSafeBranch(found.branch)) {
+          logFn(
+            `[publish-reconciler] task ${r.task_id}: no PR on ${branch || '(no derived branch)'} — adopted ${found.branch} from PR #${found.pr_number} by title convention`
+          );
+          branch = found.branch;
+          branchesSeen.add(branch);
+          ({ status: branchStatus, prNotLanded } = await sweepBranchPath(r, branch));
+        }
+      } catch (_) {
+        /* best-effort: a PR-search miss waits for the next sweep */
+      }
     }
 
     // task 1547 — prove the land belongs to THIS task before shipping. landConfirmed

package/modules/lifecycle/routes/tasks.js

@@ -1718,6 +1718,19 @@ module.exports = function buildTasksRouter() {
     if (!(await gateTaskOwnership(req, res, id))) return;
     const { head_sha: headSha } = req.body;
     if (!/^[0-9a-f]{7,64}$/.test(headSha)) return res.fail('bad_head_sha', 400);
+    // task 1002645: the laptop ci-land pushes with the BUILDER's own credential, so
+    // the server-mediated path that records claims.published_head_sha (task 1547)
+    // never runs — landProvenForTask then has neither tip nor PR and the reconciler
+    // strands the task at 'confirmed' forever (wave PRs 34/35/36). ship.js calls
+    // this endpoint with the exact pushed tip at the moment of the push, so record
+    // it here too. Sits BEFORE the credential 503 on purpose: the tip is true
+    // regardless, and a later-provisioned credential lets the sweep heal
+    // retroactively. Best-effort, mirroring publish-branch.
+    try {
+      await db.setClaimPublishedSha({ taskId: id, builderId: req.builder.id, sha: headSha });
+    } catch (e) {
+      console.error('[gds] setClaimPublishedSha via attest-gate (non-blocking)', id, e && e.message);
+    }
     if (!githubPush.isConfigured()) {
       return res.fail('push_unconfigured', { status: 503, message: 'No server push credential (GitHub App / GITHUB_PUSH_TOKEN) to post the gate attestation. ' +
           'A gate-surface PR will need an owner review until the operator provisions it.' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.24",
+  "version": "1.19.26",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.24",
+      "version": "1.19.26",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.24",
+  "version": "1.19.26",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship.js

@@ -1326,6 +1326,23 @@ function printLandPending(taskId, opts = {}) {
   for (const line of landPendingLines(taskId, opts)) console.log(line);
 }
 
+// task 1002645 — the honest close-out when the PR MERGED but the server refused the
+// confirmed→shipped flip (reconcile_blocked: the task-1547 land proof missed — a
+// wrong/missing published tip, or the matched PR doesn't reference this task). The
+// optimistic "NOT a failure" banner was a lie here: without proof the auto-land can
+// NEVER finish, and the wave-5 ships sat at 'confirmed' with their last signal
+// saying everything was fine. Name the refusal and the remedy instead. Pure +
+// exported so the wording is pinned by tests/ship_ci_deploy.mjs.
+function reconcileBlockedLines(taskId, reason) {
+  return [
+    `  ci-land: the PR MERGED, but the task did NOT flip to 'shipped' — the server could not prove the land is`,
+    `  THIS task's: ${reason}.`,
+    `  The server reconciler retries the proof every ~5 min, so a late-recorded tip or PR reference still lands`,
+    `  on its own. Re-run \`node scripts/gds/ship.js ${taskId}\` to re-drive it; if it stays blocked the server`,
+    `  flags the task needs_rebase and /builder-start will show the remedy.`,
+  ];
+}
+
 // One module-scope sleep command shared by both poll loops (task 1093 / C9). A
 // child `node -e setTimeout` is used (not `await new Promise`) so it blocks
 // identically in the SYNCHRONOUS pollCiDeploy and the async pollServerPublish —
@@ -1341,13 +1358,26 @@ const POLL_SLEEP_CMD = 'node -e "setTimeout(()=>{}, 10000)"';
 async function pollServerPublish(taskId, branch) {
   const TRIES = 54; // ~9 min at 10s — checks + auto-merge + Actions deploy
   console.log('  ci-land: waiting for auto-merge + prod deploy (polling the server)...');
+  // task 1002645: GitHub can report merged+deployed while the SERVER refused the
+  // confirmed→shipped flip (reconcile_blocked — the task-1547 land proof missed).
+  // "Prod is live" + exit here was a lie that left the task stranded with no
+  // signal. Say the real reason and keep polling — attest-gate now records the
+  // pushed tip, so the proof usually heals within the window.
+  let blockedReason = null;
   for (let i = 0; i < TRIES; i++) {
     const r = await (await cliClient()).tasks.getTasksIdPublishStatus({ id: taskId, query: { branch } });
     if (r.ok && r.data) {
       const outcome = classifyLandOutcome(r.data);
       if (outcome === 'shipped') {
-        console.log(`  ci-land: merged (${String(r.data.merge_sha || '').slice(0, 8)}) + deploy-prod succeeded. Prod is live.`);
-        return landed();
+        if (r.data.reconcile_blocked) {
+          if (r.data.reconcile_blocked !== blockedReason) {
+            blockedReason = r.data.reconcile_blocked;
+            console.log(`  ci-land: merged, but the server did NOT flip the task to shipped: ${blockedReason}. Still polling (the reconciler retries every sweep)...`);
+          }
+        } else {
+          console.log(`  ci-land: merged (${String(r.data.merge_sha || '').slice(0, 8)}) + deploy-prod succeeded. Prod is live.`);
+          return landed();
+        }
       }
       if (outcome === 'failed') {
         console.log(`  ci-land: PR was CLOSED without merging (a required check failed, or it was closed manually). Fix it and re-run \`node scripts/gds/ship.js ${taskId}\` to resume. Task stays at 'confirmed'.`);
@@ -1356,6 +1386,11 @@ async function pollServerPublish(taskId, branch) {
     }
     shellOk(POLL_SLEEP_CMD);
   }
+  if (blockedReason) {
+    console.log('');
+    for (const line of reconcileBlockedLines(taskId, blockedReason)) console.log(line);
+    return landBailed(`the PR merged but the server could not prove the land is this task's: ${blockedReason}`, `node scripts/gds/ship.js ${taskId}`);
+  }
   printLandPending(taskId);
   return landPending();
 }
@@ -4176,6 +4211,9 @@ module.exports = {
   // task 1002606: the success-pending banner lines, pure — pinned so the strand
   // detection story ("NOT a failure" + how you WILL find out if it fails) can't drift.
   landPendingLines,
+  // task 1002645: the merged-but-proof-refused close-out lines (reconcile_blocked) —
+  // pinned so this shape can never regress to the optimistic "NOT a failure" banner.
+  reconcileBlockedLines,
   // #857: resolveDeployMode (env + committed config) so doctor.js reports the
   // active deploy mode exactly as ship will use it.
   resolveDeployMode,

package/src/module-api.js

@@ -475,8 +475,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.22 with no explicit bump. run 31450197816. (task 1002620)
 //   1.19.24 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.23 with no explicit bump. run 31450459825. (task 1002620)
+//   1.19.25 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.24 with no explicit bump. run 31495418623. (task 1002620)
+//   1.19.26 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.25 with no explicit bump. run 31495996665. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.24'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.26'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/github_push_land_proof.mjs

@@ -152,6 +152,95 @@ test('landProvenForTask: a non-sha published tip ("HEAD") falls back to the PR c
   assert.equal(compareCalled, false, 'a non-sha tip must never reach the compare API (would false-positive)');
 });
 
+// --- task 1002645: findTaskPullRequest — the PR-title fallback locator --------
+//
+// The reconciler derives claude/<worktree_name> (dev-box convention); a laptop/wave
+// ship pushes worktree-<worktree_name>, so the derived branch finds no PR and the
+// sweep never engaged (wave PRs 34/35/36 stranded at 'confirmed'). This locates the
+// task's PR by the "task <id>: …" TITLE-PREFIX convention — deliberately TIGHTER
+// than prReferencesTask (title+body word match) because the search widens the
+// candidate set from "this branch's own PR" to "recent PRs".
+
+// A REST /pulls list response the locator pages through (newest first).
+function depsWithPulls(pulls, { ok = true, status = 200 } = {}) {
+  return {
+    token: 'x',
+    repoInfo: { owner: 'o', repo: 'r' },
+    fetchImpl: async () => ({ ok, status, json: async () => pulls }),
+  };
+}
+const pull = (title, ref, { merged = false, state = 'closed', repo = 'o/r', number = 36 } = {}) => ({
+  number, title, state, merged_at: merged ? '2026-08-11T00:00:00Z' : null,
+  head: { ref, repo: { full_name: repo } },
+});
+
+test('findTaskPullRequest: "task <id>: …" title → returns the REAL head branch + PR meta', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 1002616 },
+    depsWithPulls([
+      pull('task 1002620: unrelated newer', 'worktree-task-1002620'),
+      pull('task 1002616: denial speech', 'worktree-task-1002616', { merged: true }),
+    ])
+  );
+  assert.equal(r.branch, 'worktree-task-1002616');
+  assert.equal(r.merged, true);
+  assert.equal(r.pr_number, 36);
+});
+
+test('findTaskPullRequest: a body-only mention must NOT bind (tighter than prReferencesTask)', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 55 },
+    depsWithPulls([{ ...pull('fix regression', 'other-branch'), body: 'this also touches task 55' }])
+  );
+  assert.equal(r, null, 'a PR that merely MENTIONS the task is not its PR');
+});
+
+test('findTaskPullRequest: word boundary — task 100 does not match "task 1002: …"', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 100 },
+    depsWithPulls([pull('task 1002: other work', 'worktree-task-1002')])
+  );
+  assert.equal(r, null);
+});
+
+test('findTaskPullRequest: a FORK head is skipped (owner:branch lookups downstream cannot see it)', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 7 },
+    depsWithPulls([pull('task 7: from a fork', 'their-branch', { repo: 'someone/else' })])
+  );
+  assert.equal(r, null);
+});
+
+test('findTaskPullRequest: an unsafe head ref is skipped (injection guard)', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 8 },
+    depsWithPulls([pull('task 8: bad head', '-rf')])
+  );
+  assert.equal(r, null);
+});
+
+test('findTaskPullRequest: no match → null; bad task id → null before any fetch', async () => {
+  assert.equal(await gh.findTaskPullRequest({ taskId: 9 }, depsWithPulls([])), null);
+  assert.equal(
+    await gh.findTaskPullRequest(
+      { taskId: 'nope' },
+      { token: 'x', repoInfo: { owner: 'o', repo: 'r' }, fetchImpl: async () => { throw new Error('must not fetch'); } }
+    ),
+    null
+  );
+});
+
+test('findTaskPullRequest: API failure → STATUS_FETCH_FAILED; no credential → PUSH_UNCONFIGURED', async () => {
+  await assert.rejects(
+    () => gh.findTaskPullRequest({ taskId: 1 }, depsWithPulls([], { ok: false, status: 502 })),
+    (e) => e.code === 'STATUS_FETCH_FAILED'
+  );
+  await assert.rejects(
+    () => gh.findTaskPullRequest({ taskId: 1 }, { token: null, repoInfo: { owner: 'o', repo: 'r' } }),
+    (e) => e.code === 'PUSH_UNCONFIGURED'
+  );
+});
+
 // --- scrubCredential ---------------------------------------------------------
 
 test('scrubCredential: strips the x-access-token push credential from captured output', () => {

package/tests/grade_aggregates_unavailable.mjs

@@ -0,0 +1,114 @@
+// tests/grade_aggregates_unavailable.mjs
+//
+// Unit tests for task 1002652 — a grader OUTAGE row (#943: score 0, passed
+// false, signals.panel_outcome='unavailable', rubric axes json-null) and a
+// null-gating-axis panel row must never enter a quality aggregate. 21 outage
+// rows once read as a month of pass_rate 0.000 on /public/grades and the hall.
+//
+// The SQL itself runs against live Postgres in production; here we pin the
+// QUERY CONTRACT the same way the other pool.query readers are pinned (see
+// versions_route.mjs note): pool.query is stubbed to capture SQL, and each
+// aggregate's captured text must carry the quality predicate + the
+// n_unavailable bucket. gradeQualityWhere's NULL-safety (COALESCE around every
+// operand) is what keeps legacy rows counted AND the NOT-bucket total — a bare
+// NULL operand under NOT would silently drop rows from both buckets.
+//
+// Run:  node tests/grade_aggregates_unavailable.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { pool } = require('../src/bongos/pool.js');
+const db = require('../modules/lifecycle/db.js');
+const gradingDb = require('../modules/grading/db.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// Capture every SQL text pool.query sees while `fn` runs; always restore.
+async function captureSql(fn) {
+  const captured = [];
+  const orig = pool.query;
+  pool.query = async (sql) => { captured.push(String(sql)); return { rows: [] }; };
+  try { await fn(); } finally { pool.query = orig; }
+  return captured;
+}
+
+const PREDICATE_MARKS = [
+  "panel_outcome", "'unavailable'",
+  "jsonb_typeof", "functional_fidelity", "code_quality",
+];
+
+function assertQualityFiltered(sql, label) {
+  for (const mark of PREDICATE_MARKS) {
+    assert.ok(sql.includes(mark), `${label}: SQL must carry quality-predicate mark "${mark}"`);
+  }
+  assert.ok(sql.includes('FILTER (WHERE'), `${label}: aggregates must FILTER on the predicate`);
+  assert.ok(sql.includes('n_unavailable'), `${label}: must bucket excluded rows as n_unavailable`);
+  // NULL-safety: every jsonb_typeof operand must be COALESCE-wrapped, or NOT
+  // (predicate) goes NULL on legacy rows and drops them from n_unavailable.
+  const typeofCount = (sql.match(/jsonb_typeof/g) || []).length;
+  const guardedCount = (sql.match(/COALESCE\(jsonb_typeof/g) || []).length;
+  assert.equal(guardedCount, typeofCount, `${label}: every jsonb_typeof must be COALESCE-guarded`);
+}
+
+await test('gradeQualityWhere: parenthesized, alias-qualified, NULL-safe on all three operands', () => {
+  const bare = db.gradeQualityWhere();
+  const aliased = db.gradeQualityWhere('g');
+  assert.ok(bare.startsWith('(') && bare.trimEnd().endsWith(')'), 'must parenthesize (composes under NOT/AND)');
+  assert.ok(aliased.includes('g.signals') && aliased.includes('g.rubric_scores'), 'alias must qualify both columns');
+  assert.ok(!bare.includes('g.'), 'bare form must not smuggle an alias');
+  assert.ok(bare.includes("COALESCE(") && bare.includes("panel_outcome"), 'panel_outcome operand must be COALESCE-guarded');
+  assert.equal((bare.match(/COALESCE\(jsonb_typeof/g) || []).length, 2, 'both rubric axes COALESCE-guarded');
+});
+
+await test('rollingAvgGrade excludes outage/null-axis rows and buckets n_unavailable', async () => {
+  const sql = (await captureSql(() => db.rollingAvgGrade(7)))[0];
+  assertQualityFiltered(sql, 'rollingAvgGrade');
+});
+
+await test('gradeByBuilder: quality-filtered, and pass_rate is NULL (not 0.000) with no quality rows', async () => {
+  const sql = (await captureSql(() => db.gradeByBuilder(30)))[0];
+  assertQualityFiltered(sql, 'gradeByBuilder');
+  // The old shape ROUND(COALESCE(AVG(...),0),3) fabricated a 0.000 fail-streak
+  // for an all-outage window — the lars589 symptom. COALESCE must be gone from
+  // the pass_rate expression so it reads NULL ("no graded work") instead.
+  assert.ok(!sql.includes('ROUND(COALESCE(AVG'), 'pass_rate must not coalesce an empty window to 0');
+  assert.ok(/AVG\(CASE WHEN g\.passed THEN 1 ELSE 0 END\) FILTER/.test(sql), 'pass_rate must average quality rows only');
+});
+
+await test('gradeTrendByDay keeps outage-only days as n=0 + n_unavailable, never a 0.0-score day', async () => {
+  const sql = (await captureSql(() => db.gradeTrendByDay(30)))[0];
+  assertQualityFiltered(sql, 'gradeTrendByDay');
+  assert.ok(!/WHERE[^G]*unavailable[^G]*GROUP BY/s.test(sql.replace(/FILTER \(WHERE[^)]+\)+/g, '')),
+    'exclusion must be FILTER-based (top-level WHERE would drop outage-only days from the series)');
+});
+
+await test('recentGradesForBuilder labels rather than hides: selects panel_outcome, no FILTER', async () => {
+  const sql = (await captureSql(() => db.recentGradesForBuilder(1, 5)))[0];
+  assert.ok(sql.includes("signals->>'panel_outcome'"), 'must select panel_outcome for display labeling');
+  assert.ok(!sql.includes('FILTER (WHERE'), 'the list read stays unfiltered — labeling, not hiding');
+});
+
+await test('builderAnalytics grade-trend query is quality-filtered (feeds headline.grade_pass_rate)', async () => {
+  const sqls = await captureSql(() => db.builderAnalytics(1, 90));
+  const gradeSql = sqls.find((s) => s.includes('task_grades') && s.includes('graded_at'));
+  assert.ok(gradeSql, 'builderAnalytics must query task_grades');
+  for (const mark of PREDICATE_MARKS) {
+    assert.ok(gradeSql.includes(mark), `builderAnalytics grade query must carry "${mark}"`);
+  }
+  assert.ok(gradeSql.includes('FILTER (WHERE'), 'builderAnalytics grade query must FILTER');
+});
+
+await test('grading/db builderRollingAvgGrade (the documented twin) carries the same predicate', async () => {
+  const sql = (await captureSql(() => gradingDb.builderRollingAvgGrade(1, 14)))[0];
+  assertQualityFiltered(sql, 'builderRollingAvgGrade');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/publish_branch_route.mjs

@@ -311,6 +311,44 @@ await t('POST /tasks/:id/attest-gate: requireBuilder present, allowBoxScope ABSE
   assert.ok(!handles.includes(auth.allowBoxScope), 'must NOT carry allowBoxScope — a box session must reauth, never self-attest (#919)');
 });
 
+// task 1002645: the attest call is the ONE moment the laptop ci-land tells the
+// server its true pushed tip, so the route must record it on the claim
+// (claims.published_head_sha) — without it landProvenForTask has neither tip nor
+// PR and the reconciler strands the ship at 'confirmed' forever (wave PRs
+// 34/35/36). Recorded BEFORE the push-credential 503 on purpose: an unconfigured
+// server still captures the tip, so a later-provisioned credential heals the
+// strand retroactively — which is exactly the shape this test drives.
+await t('POST /tasks/:id/attest-gate records the pushed tip on the claim, even when push is unconfigured', async () => {
+  const dbMod = require('../modules/lifecycle/db.js');
+  const savedSet = dbMod.setClaimPublishedSha;
+  const recorded = [];
+  dbMod.setClaimPublishedSha = async (args) => { recorded.push(args); return 1; };
+  try {
+    await withEnv({
+      GITHUB_PUSH_TOKEN: undefined, GITHUB_APP_ID: undefined,
+      GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined,
+    }, async () => {
+      const router = buildTasksRouter();
+      const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
+      const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+      const out = { failCode: null, jsonBody: null };
+      const res = {
+        status() { return this; },
+        json(b) { out.jsonBody = b; return this; },
+        fail(code) { out.failCode = code; return this; },
+      };
+      // rank archon → gateTaskOwnership passes with no DB lookup, keeping the test hermetic.
+      const req = { params: { id: '77' }, body: { head_sha: 'a'.repeat(40) }, builder: { id: 95, rank: 'archon' } };
+      await handler(req, res);
+      assert.equal(out.failCode, 'push_unconfigured', 'no credential → still the usual 503 to the caller');
+      assert.deepEqual(recorded, [{ taskId: 77, builderId: 95, sha: 'a'.repeat(40) }],
+        'the tip is recorded BEFORE the credential check — the wave-strand cure');
+    });
+  } finally {
+    dbMod.setClaimPublishedSha = savedSet;
+  }
+});
+
 // ===========================================================================
 // GitHub App credential (task 1028 / ADR 0055 hardening): the server mints a
 // short-lived installation token from the App private key instead of holding a

package/tests/publish_reconciler.mjs

@@ -52,13 +52,14 @@ function mkDeps({
   statusByBranch = {},
   mergeByBranch = {},
   ancestryBySha = {},
+  taskPrByTask = {},
   shipImpl,
   broadcastImpl,
   conflictResolveImpl,
   refreshStaleImpl,
   healAttempts = new Map(),
 } = {}) {
-  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], resolve: [], refresh: [], flag: [], events: [], logs: [], errors: [] };
+  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], search: [], resolve: [], refresh: [], flag: [], events: [], logs: [], errors: [] };
   // isSafeBranch mirrors github-push's pattern enough for the test (rejects
   // option-like / traversal refs); we use the REAL module so the contract can't drift.
   const githubPush = require('../modules/lifecycle/github-push.js');
@@ -99,6 +100,16 @@ function mkDeps({
         if (s instanceof Error) throw s;
         return s || NONE;
       },
+      // task 1002645: the PR-title fallback locator. Default: nothing found (null),
+      // so pre-1002645 tests keep their exact behavior. Script per task id via
+      // taskPrByTask; an Error value throws (to prove the sweep swallows a search
+      // miss and continues).
+      findTaskPullRequest: async ({ taskId }) => {
+        calls.search.push(taskId);
+        const f = taskPrByTask[taskId];
+        if (f instanceof Error) throw f;
+        return f || null;
+      },
       // task 1313 head_sha land-check. Default: not on main. An Error value throws
       // (to prove a transient compare-API miss is swallowed, leaving it for next sweep).
       isAncestorOfDefaultBranch: async ({ sha }) => {
@@ -1077,6 +1088,106 @@ test('1002606 the aged stale strand now ALSO emits task.strand-flagged', async (
   assert.match(strandEvents[0].payload.reason, /^strand:no_branch_no_tip/);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002645 — the reconciler was blind to laptop/wave ships. The sweep derives
+// claude/<worktree_name> (dev-box convention); a wave ship pushes
+// worktree-<worktree_name>, so getPublishStatus saw pr_state:'none' and the whole
+// PR path (mergeIfGreen nudge — the ONLY merger where native auto-merge is
+// repo-disallowed — conflict heal, land proof) never engaged. PRs 34/35/36 all
+// stranded at 'confirmed' until a manual flip. The fallback finds the task's PR by
+// the "task <id>: …" TITLE convention and re-runs the branch path on its REAL head.
+// ---------------------------------------------------------------------------
+
+test('1002645 THE PIN: a worktree-named branch (laptop wave ship) lands UNATTENDED via the PR-title fallback', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 2645, builder_id: 95, worktree_name: 'task-2645', published_head_sha: ON_MAIN }],
+    statusByBranch: {
+      'claude/task-2645': NONE,                 // the derived dev-box branch has no PR
+      'worktree-task-2645': LANDED_NO_WORKFLOW, // the REAL branch: merged, pin-bump repo
+    },
+    taskPrByTask: { 2645: { branch: 'worktree-task-2645', pr_number: 36, pr_state: 'closed', merged: true } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the wave-5 strand shape must land with NO human step (ADR 0162)');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 2645, builderId: 95 }]);
+  assert.deepEqual(deps._calls.search, [2645], 'the fallback ran exactly once');
+  assert.ok(deps._calls.merge.includes('worktree-task-2645'),
+    'the merge nudge engages on the REAL branch — the only merger when native auto-merge is disallowed');
+});
+
+test('1002645 a green-but-unmerged PR on the real branch is server-merged via the fallback (no client poll needed)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 2646, builder_id: 95, worktree_name: 'task-2646' }],
+    statusByBranch: { 'claude/task-2646': NONE, 'worktree-task-2646': PENDING },
+    taskPrByTask: { 2646: { branch: 'worktree-task-2646', pr_number: 37, pr_state: 'open', merged: false } },
+    mergeByBranch: { 'worktree-task-2646': { merged: true, merged_now: true, number: 37 } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.merged, 1, 'the sweep merges the wave PR itself — the land no longer depends on a live ship.js poll');
+  assert.equal(r.reconciled, 0, 'ships on a later sweep once deploy + proof confirm');
+});
+
+test('1002645 a legacy laptop strand (no recorded tip) heals retroactively via the adopted PR reference', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 2616, builder_id: 95, worktree_name: 'task-2616' }], // no published_head_sha
+    statusByBranch: { 'claude/task-2616': NONE, 'worktree-task-2616': landedPrFor(2616) },
+    taskPrByTask: { 2616: { branch: 'worktree-task-2616', pr_number: 36, pr_state: 'closed', merged: true } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the PRs-34/35/36 shape heals with no manual POST /ship');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 2616, builderId: 95 }]);
+});
+
+test('1002645 the fallback does NOT fire when the derived branch already has a PR (dev-box path unchanged)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 900, builder_id: 1, worktree_name: 'wt-box' }],
+    statusByBranch: { 'claude/wt-box': PENDING },
+    taskPrByTask: { 900: new Error('search must not run') },
+  });
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.search.length, 0, 'a dev-box ship keeps the derived-branch path — no extra API call');
+});
+
+test('1002645 a PR-search failure is swallowed — the sweep continues to the next task and retries next sweep', async () => {
+  const deps = mkDeps({
+    rows: [
+      { task_id: 901, builder_id: 1, worktree_name: 'task-901' },
+      { task_id: 902, builder_id: 1, worktree_name: 'wt-ok', published_head_sha: ON_MAIN },
+    ],
+    statusByBranch: { 'claude/task-901': NONE, 'claude/wt-ok': LANDED },
+    taskPrByTask: { 901: new Error('GitHub 502') },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the healthy task still ships');
+  assert.equal(r.errors, 0, 'a transient search miss is not an error');
+});
+
+test('1002645 an unsafe adopted branch name is refused (the injection guard holds on the fallback)', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 903, builder_id: 1, worktree_name: null, published_head_sha: null,
+             confirmed_at: new Date().toISOString() }],
+    taskPrByTask: { 903: { branch: '-rf', pr_number: 1, pr_state: 'open', merged: false } },
+  });
+  await reconciler.runSweep(deps);
+  assert.equal(deps._calls.status.length, 0, 'a branch that fails isSafeBranch is never queried');
+  assert.equal(deps._calls.merge.length, 0, 'nor merge-nudged');
+});
+
+test('1002645 the reuse guard still holds through the fallback: adopted PR merged but tip NOT in main → NO ship', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 904, builder_id: 1, worktree_name: 'task-904', published_head_sha: NOT_ON_MAIN,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/task-904': NONE, 'worktree-task-904': LANDED_NO_WORKFLOW },
+    taskPrByTask: { 904: { branch: 'worktree-task-904', pr_number: 40, pr_state: 'closed', merged: true } },
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'adopting the real branch must not weaken the task-1547 per-task proof');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);

package/tests/ship_ci_deploy.mjs

@@ -607,6 +607,27 @@ test('1002606 landPendingLines: merged variant says deploy-only', () => {
   assert.match(unmerged, /GitHub will merge \+ deploy automatically/);
 });
 
+// ---- task 1002645: the merged-but-proof-refused close-out (reconcile_blocked) ----
+// GitHub can report merged+deployed while the SERVER refused the confirmed→shipped
+// flip (the task-1547 land proof missed). pollServerPublish used to print "Prod is
+// live" / the optimistic P-3 banner for that shape — a lie: without proof the
+// auto-land can NEVER finish. The close-out must name the refusal and the remedy,
+// and must never claim success or "NOT a failure".
+
+test('1002645 reconcileBlockedLines: names the refusal reason + the re-drive command', () => {
+  const lines = ship.reconcileBlockedLines(2645, 'published tip abcd1234 not in main (branch-reuse/stale PR)').join('\n');
+  assert.match(lines, /did NOT flip|could not prove/i, 'says the flip was refused');
+  assert.match(lines, /published tip abcd1234 not in main/, 'carries the server\'s exact reason');
+  assert.match(lines, /node scripts\/gds\/ship\.js 2645/, 'the re-drive command names THIS task');
+  assert.match(lines, /needs_rebase/, 'names the flag that gates a stuck strand');
+});
+
+test('1002645 reconcileBlockedLines: never reads as success (no "NOT a failure", no "Prod is live")', () => {
+  const lines = ship.reconcileBlockedLines(1, 'x').join('\n');
+  assert.ok(!/NOT a failure/.test(lines), 'the optimistic reassurance must not appear on a blocked land');
+  assert.ok(!/Prod is live/.test(lines), 'nor the success line');
+});
+
 console.log('');
 console.log(`ship_ci_deploy: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);