@bongos/core 1.19.318 → 1.19.320

package/scripts/gds/ship-memory-sync.js

@@ -0,0 +1,192 @@
+// scripts/gds/ship-memory-sync.js — memory sync-on-ship + transcript/model resolution (task #274, V3.R55).
+//
+// Carved out of scripts/gds/ship.js by task 1003205 (goal 1000079, the R03
+// de-monolith plan) — a STRUCTURAL move, not a rewrite: the code below is the
+// original ship.js lines 197-365 unchanged. ship.js remains the facade that
+// re-exports every name and owns the CLI entry point, so the ship contract and
+// every flag are untouched, and the other scripts that import from it are too.
+
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { cliClient } = require('./cli-lib');
+const { REPO_ROOT } = require('./ship-state.js');
+
+// ---------- Memory sync-on-ship (Task #274 / V3.R55) ----------
+//
+// After a successful ship, push the builder's local Claude Code memory dir to
+// the server (POST /api/gds/memory/sync), so a builder's MEMORY.md +
+// feedback_*.md follow them across machines and survive a dead laptop. This is
+// the push half of ADR 0024's cloneable-memory chain; #275 wires the pull side.
+//
+// Convention for locating the memory dir (NO hardcoded identity — CLAUDE.md §10):
+// Claude Code stores per-project memory under
+//   <homedir>/.claude/projects/<encoded-project-path>/memory/
+// where <encoded-project-path> is the project's ABSOLUTE path with every '/'
+// and '.' replaced by '-' (e.g. /Users/x/Desktop/Claude-OTB →
+// -Users-x-Desktop-Claude-OTB). We derive the project path from the MAIN
+// worktree root (REPO_ROOT), not this ephemeral feature worktree, because the
+// memory dir is keyed to the canonical project checkout. CLAUDE_CONFIG_DIR
+// overrides the ~/.claude base when set (matches Claude Code's own behavior).
+//
+// Conflict policy: storeMemoryFile is an unconditional UPSERT (last-write-wins,
+// server clock — ADR 0024 §3), so we push every file and let the server
+// overwrite. Smarter mtime-diffing (skip files the server already has newer) is
+// a possible follow-up; for #274 a full push is correct and cheap (KB of md).
+//
+// BEST-EFFORT: any failure here is logged as a warning and swallowed — a memory
+// sync hiccup (dir missing, API down, quota) must NEVER fail or undo a ship.
+
+function claudeConfigBase() {
+  // Claude Code honors CLAUDE_CONFIG_DIR as the base for its state dir; default
+  // is ~/.claude. Resolve via os.homedir() so this works for any user.
+  return process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
+}
+
+function encodeProjectPath(absProjectPath) {
+  // Claude Code's encoding: every NON-ALPHANUMERIC char becomes '-'. The old
+  // `[/.]` class silently no-op'd on Windows (separator '\', drive ':', spaces),
+  // so the transcript was never found, no session_record was written, and the
+  // cost-plus reward — the only stream a cost-plus-only instance pays (ADR 0146)
+  // — could never book: every Windows ship paid 0 (task 1002471). Same rule as
+  // scripts/gds/onboarding-config.js, which already had it right. POSIX output is
+  // unchanged for paths whose only specials are '/' and '.'.
+  return String(absProjectPath).replace(/[^a-zA-Z0-9]/g, '-');
+}
+
+// resolveTranscriptPath — find this session's transcript .jsonl. Claude Code
+// keys the transcript to the project dir of the CWD where the session RUNS, so
+// a session in a git worktree stores it under the WORKTREE-encoded dir, not the
+// main checkout. (6D.1 #540 shipped resolving only REPO_ROOT, which silently
+// missed every worktree session — #551.) We try the session-local dir
+// (process.cwd()) first, then REPO_ROOT as a fallback. Pure (exists + base
+// injectable for tests). Returns the first existing path, or null.
+function resolveTranscriptPath(sessionId, projectDirs, opts = {}) {
+  const exists = opts.existsFn || fs.existsSync;
+  const base = opts.base || claudeConfigBase();
+  for (const dir of projectDirs) {
+    if (!dir) continue;
+    const p = path.join(base, 'projects', encodeProjectPath(path.resolve(dir)), `${sessionId}.jsonl`);
+    if (exists(p)) return p;
+  }
+  return null;
+}
+
+// resolveBuilderModel — the REAL model that authored this session's work, read
+// from the session transcript (dominant by output tokens, synthetic turns
+// skipped), so selectGraderModel gets a true cross-model input instead of the
+// ASSUMED_BUILDER_MODEL fallback (task 1002659 — everything graded on the
+// assumed-builder default before this). Best-effort: no session id, no
+// transcript, or any read error → null → the grader assumes, as before.
+function resolveBuilderModel(opts = {}) {
+  try {
+    const sessionId = process.env.CLAUDE_CODE_SESSION_ID;
+    // Same path-traversal guard as uploadSessionOnShip: the id lands in a path.
+    if (!sessionId || !/^[A-Za-z0-9_-]+$/.test(sessionId)) return null;
+    const transcriptPath = resolveTranscriptPath(sessionId, [process.cwd(), REPO_ROOT].filter(Boolean), opts);
+    if (!transcriptPath) return null;
+    const perModel = new Map();
+    for (const line of fs.readFileSync(transcriptPath, 'utf8').split('\n')) {
+      if (!line.trim()) continue;
+      let o;
+      try { o = JSON.parse(line); } catch (_) { continue; }
+      const msg = o && o.message;
+      if (!msg || !msg.model || msg.model === '<synthetic>' || !msg.usage) continue;
+      perModel.set(msg.model, (perModel.get(msg.model) || 0) + (Number(msg.usage.output_tokens) || 0));
+    }
+    let best = null;
+    let bestTokens = 0;
+    for (const [model, tokens] of perModel) {
+      if (tokens > bestTokens) { best = model; bestTokens = tokens; }
+    }
+    return best;
+  } catch (_) {
+    return null;
+  }
+}
+
+function resolveMemoryDir() {
+  // REPO_ROOT is the main worktree (canonical project checkout). The memory dir
+  // is keyed to that path, not the per-task feature worktree we're shipping from.
+  const encoded = encodeProjectPath(path.resolve(REPO_ROOT));
+  return path.join(claudeConfigBase(), 'projects', encoded, 'memory');
+}
+
+// Enumerate the memory dir into [{ path, content, mtime }]. `path` is RELATIVE
+// to the memory dir (matches the server's (builder_id, relative-path) key).
+// Recurses so nested memory files (if Claude Code ever nests them) are caught.
+// Returns [] if the dir doesn't exist (not all builders have memory).
+function collectMemoryFiles(memDir) {
+  if (!fs.existsSync(memDir)) return [];
+  const out = [];
+  const walk = (absDir, relPrefix) => {
+    let entries;
+    try {
+      entries = fs.readdirSync(absDir, { withFileTypes: true });
+    } catch (_) {
+      return;
+    }
+    for (const ent of entries) {
+      const abs = path.join(absDir, ent.name);
+      const rel = relPrefix ? `${relPrefix}/${ent.name}` : ent.name;
+      if (ent.isDirectory()) {
+        walk(abs, rel);
+      } else if (ent.isFile()) {
+        try {
+          const content = fs.readFileSync(abs, 'utf8');
+          const mtime = fs.statSync(abs).mtime.toISOString();
+          // Use POSIX-style relative paths regardless of OS so the server key
+          // is stable across machines.
+          out.push({ path: rel.split(path.sep).join('/'), content, mtime });
+        } catch (_) {
+          /* skip unreadable file — best-effort */
+        }
+      }
+    }
+  };
+  walk(memDir, '');
+  return out;
+}
+
+async function syncMemoryOnShip() {
+  try {
+    const memDir = resolveMemoryDir();
+    const files = collectMemoryFiles(memDir);
+    if (files.length === 0) {
+      // Silent-ish: a builder with no memory dir is normal. One quiet line so
+      // the absence is visible in the ship log without looking like an error.
+      console.log('  memory sync: no local memory dir found — skipping (this is fine).');
+      return;
+    }
+    console.log(`  syncing ${files.length} memory file${files.length === 1 ? '' : 's'} to the server...`);
+    const r = await (await cliClient({ allowUnauthenticated: true })).memory.postMemorySync({ body: { files } });
+    if (r.status === 401) {
+      console.log('  memory sync: skipped (session not valid for sync; non-blocking).');
+      return;
+    }
+    const d = r.data || {};
+    if (r.ok) {
+      const errN = Array.isArray(d.errors) ? d.errors.length : 0;
+      console.log(
+        `  memory sync: ${d.stored ?? 0} stored, ${d.skipped ?? 0} skipped${errN ? `, ${errN} error(s)` : ''}.`
+      );
+    } else if (r.status === 413) {
+      console.log(`  memory sync: quota/size limit hit (${d.error || 'quota'}) — prune memory and re-sync. Non-blocking; ship is complete.`);
+    } else {
+      console.log(`  memory sync: server returned ${r.status} (non-blocking):`, d.error || d);
+    }
+  } catch (e) {
+    // Any error at all — network, fs, anything — must not fail the ship.
+    console.log('  memory sync failed (non-blocking):', e && e.message ? e.message : e);
+  }
+}
+
+module.exports = {
+  claudeConfigBase,
+  encodeProjectPath,
+  resolveBuilderModel,
+  resolveTranscriptPath,
+  syncMemoryOnShip,
+};

package/scripts/gds/ship-merge.js

@@ -0,0 +1,297 @@
+// scripts/gds/ship-merge.js — autoMerge — the merge/regen/push/land chain that puts the branch on main.
+//
+// Carved out of scripts/gds/ship.js by task 1003205 (goal 1000079, the R03
+// de-monolith plan) — a STRUCTURAL move, not a rewrite: the code below is the
+// original ship.js lines 2307-2579 unchanged. ship.js remains the facade that
+// re-exports every name and owns the CLI entry point, so the ship contract and
+// every flag are untouched, and the other scripts that import from it are too.
+
+'use strict';
+
+const path = require('node:path');
+const { cleanupMacFinderDupRefs } = require('../../modules/lifecycle/ship-preflight');
+const mergeLock = require('../../modules/lifecycle/merge-lock');
+const { buildMergeArgv, gitArgvOk, gitOk, shellOk } = require('./ship-git.js');
+const { mainIsProtected, pushVia, readDeployConfigRaw, resolveDeployMode, resolveDeployTarget, safeBranding, shouldBailOnFetchFailure } = require('./ship-deploy-target.js');
+const { ciLand, landBailed, landed } = require('./ship-land.js');
+const { runSmoke } = require('./ship-grade.js');
+const { currentBranch, mainWorktreeBusy, regenerateApiClient, regenerateApiDocs, regenerateDiagrams, regenerateFileMap, regenerateRepoMap, regenerateSessionIndex } = require('./ship-regen.js');
+const { REPO_ROOT } = require('./ship-state.js');
+
+function zeroCommitVerdict(commitsAhead, dbOnly) {
+  if (commitsAhead !== '0') return 'has-commits';
+  return dbOnly ? 'db-only' : 'refuse';
+}
+
+async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
+  const branch = currentBranch();
+  if (!branch || branch === 'main' || branch === 'HEAD') {
+    // task 1002723: an --allow-empty / --db-only ship legitimately runs FROM the
+    // main checkout (nothing was ever committed), but this bail fired BEFORE the
+    // deliberate-empty landing below could — the task parked at confirmed with no
+    // branch and no published tip, a shape the server sweep can never prove (the
+    // task-1002716 strand). Land it here iff the checkout has zero commits ahead
+    // of origin/main; anything else keeps the safe bail.
+    if (dbOnly && shellOk('git fetch origin main')
+        && zeroCommitVerdict(gitOk('git rev-list origin/main..HEAD --count'), true) === 'db-only') {
+      console.log('  auto-merge: deliberate empty ship (--db-only / --allow-empty) from the main checkout - nothing to merge; advancing to shipped without merge/deploy.');
+      return landed({ noArtifact: true, noArtifactReason: 'empty ship from the main checkout — no commits to merge' });
+    }
+    console.log(`  auto-merge: skipped (current branch is ${branch})`);
+    // The merge source IS the current branch, so on main there is nothing to
+    // merge. Half of the single-checkout catch-22 this task documents: the other
+    // half is the "main worktree is on <branch>, not main" bail below.
+    return landBailed(`nothing to merge — this checkout is on ${branch}, not a task branch`, '/merge-mode');
+  }
+
+  // Refresh the data-driven diagrams before computing commits-ahead, so a
+  // diagram-only refresh still counts as something to deploy.
+  regenerateDiagrams();
+  // Refresh the generated code symbol skeleton (Path B / task 1224) on the same beat.
+  regenerateRepoMap();
+  // Refresh the generated session-log index + the bounded CLAUDE.md §13 snippet (ADR 0062 §8 / task 1226).
+  regenerateSessionIndex();
+  // Refresh the generated file-map sections (skills + scheduled-tasks) on the same beat (ADR 0066 / task 1276).
+  regenerateFileMap();
+  // Refresh the generated OpenAPI spec + API reference from the shipped route tree (task 1918).
+  regenerateApiDocs();
+  // ...then the typed client FROM that spec (+ the devbox vendored copy) on the same beat (task 2051).
+  regenerateApiClient();
+
+  // Resolve the deploy mode ONCE (task 1093 / C9) — it reads config/deploy.json;
+  // reused at the fetch-bail check + the ci-land branch below.
+  const deployMode = resolveDeployMode();
+
+  // DB-only / no-op ship detection (task #219). Some legitimate ships have
+  // no commits to merge — e.g. a task whose work was a direct SQL write to
+  // the production DB. The change is already live; the merge step has
+  // nothing to push, merge, or deploy. Short-circuit so the caller's POST
+  // /tasks/:id/ship still flips status to shipped instead of stranding the
+  // task at confirmed forever.
+  // A credential-less dev box can't `git fetch origin main` (private origin, no
+  // creds — ADR 0053), but that's only fatal OFF the server-publish path: the
+  // box's ADR-0055 path bundles against its LOCAL origin/main and the server tops
+  // up main. Without this, the box dead-ends here and strands every ship at
+  // confirmed (task 1027). The `!fetchedMain &&` short-circuit keeps the gh-probe
+  // (pushVia) off the happy laptop path, so laptop behavior is byte-for-byte.
+  const fetchedMain = shellOk('git fetch origin main');
+  if (!fetchedMain && shouldBailOnFetchFailure(fetchedMain, deployMode, pushVia())) {
+    console.log('  auto-merge: fetch failed; task stays at confirmed for /merge-mode');
+    return landBailed('could not fetch origin/main', '/merge-mode');
+  }
+  const commitsAhead = gitOk('git rev-list origin/main..HEAD --count');
+  const verdict = zeroCommitVerdict(commitsAhead, dbOnly);
+  if (verdict === 'refuse') {
+    // task 391 (idea #37): the old code short-circuited ANY zero-commit branch
+    // straight to shipped — silently advancing a claim with empty/wrong touches[]
+    // or simply uncommitted work, awarding credit for no change. Now a zero-commit
+    // ship must be DELIBERATELY declared with --db-only. Fail-safe: the claim is
+    // already resolved by this point, so the task stays at confirmed and a plain
+    // re-run resumes the merge leg (task 941) once they commit or pass --db-only.
+    console.error('');
+    console.error('  Ship refused: no commits ahead of main, and --db-only was not passed.');
+    console.error('  A zero-commit ship is almost always a mistake (uncommitted work, wrong branch, or empty/incorrect touches[]).');
+    console.error('   • If you have local changes, commit them, then re-ship.');
+    console.error('   • If this is a DELIBERATE direct-SQL / DB-only ship (the work was a write straight to the prod');
+    console.error('     DB — nothing to merge or deploy), re-run with --db-only:');
+    console.error(`       node scripts/gds/ship.js ${taskId} --db-only`);
+    console.error('  The task stays at confirmed; nothing was merged or deployed.');
+    return landBailed('no commits ahead of main, and --db-only was not passed', `node scripts/gds/ship.js ${taskId} --db-only`);
+  }
+  if (verdict === 'db-only') {
+    console.log('  auto-merge: deliberate empty ship (--db-only / --allow-empty) - no commits ahead of main; advancing to shipped without merge/deploy.');
+    return landed({ noArtifact: true, noArtifactReason: 'empty ship — no commits ahead of main' });
+  }
+
+  // #679 / ADR 0042: in 'ci' deploy mode the operator's machine never merges or
+  // SSHes the droplet — ship lands via PR auto-merge and CI deploys. The laptop
+  // block below stays the default ('laptop' mode) so this is inert until the
+  // deliberate cutover. The DB-only short-circuit above is shared by both modes.
+  if (deployMode === 'ci') {
+    return await ciLand(taskId, branch, valueSummary);
+  }
+
+  console.log(`  pushing ${branch} to origin...`);
+  if (!gitArgvOk(['push', 'origin', branch])) {
+    console.log('  auto-merge: push failed; task stays at confirmed for /merge-mode');
+    return landBailed(`could not push ${branch} to origin`, '/merge-mode');
+  }
+
+  // Serialize the shared-main-worktree merge (#462 C4; #269 C6). Concurrent
+  // ships AND manual /merge-mode runs queue on this one lock; if a live holder
+  // is still merging past the wait window we bail cleanly to /merge-mode rather
+  // than racing its working tree.
+  if (!mergeLock.acquire(REPO_ROOT)) {
+    console.log('  auto-merge: another active ship or /merge-mode run holds the merge lock; task stays at confirmed for /merge-mode');
+    return landBailed('another ship or /merge-mode run holds the merge lock', '/merge-mode');
+  }
+  let mergedClean = false;
+  try {
+    // Never touch REPO_ROOT if a parallel session left it mid-merge or dirty —
+    // this is the exact collision that previously bailed with the misleading
+    // "main is ahead of origin somehow" (#462).
+    const busy = mainWorktreeBusy();
+    if (busy) {
+      console.log(`  auto-merge: main worktree busy (${busy}); task stays at confirmed for /merge-mode`);
+      return landBailed(`the main worktree is busy (${busy})`, '/merge-mode');
+    }
+
+    console.log(`  switching to main worktree (${REPO_ROOT}) for merge...`);
+    // Same cleanup as preflight: drop macOS Finder/iCloud `* 2` ref duplicates
+    // before fetching, otherwise `git fetch origin` fails with "bad object
+    // refs/heads/<name> 2" and the auto-merge bails. Was a recurring 2026-05-10
+    // failure mode — every ship of the day hit this and required /merge-mode.
+    const dupRefs = cleanupMacFinderDupRefs(REPO_ROOT);
+    if (dupRefs.length > 0) {
+      console.log(`  auto-merge: removed ${dupRefs.length} stray refs (macOS Finder duplicates)`);
+    }
+    if (!shellOk(`git fetch origin`, { cwd: REPO_ROOT })) {
+      console.log('  auto-merge: fetch failed; task stays at confirmed for /merge-mode');
+      return landBailed('could not fetch origin in the main worktree', '/merge-mode');
+    }
+
+    // The main worktree must currently have main checked out.
+    const onMain = gitOk('git rev-parse --abbrev-ref HEAD', { cwd: REPO_ROOT });
+    if (onMain !== 'main') {
+      console.log(`  auto-merge: main worktree is on ${onMain}, not main; task stays at confirmed`);
+      // The other half of the single-checkout catch-22: the merge target tree is
+      // the one holding the feature branch, so there is nowhere to merge INTO.
+      // Name the cure, not just the symptom — this is the bail that used to be
+      // invisible behind "landing automatically".
+      return landBailed(
+        `the main checkout is on ${onMain}, not main — work a task in its own worktree so the main checkout stays on main`,
+        '/merge-mode',
+      );
+    }
+
+    if (!gitArgvOk(['merge', '--ff-only', 'origin/main'], { cwd: REPO_ROOT })) {
+      console.log('  auto-merge: main is ahead of origin somehow; task stays at confirmed');
+      return landBailed('the local main is ahead of origin/main', '/merge-mode');
+    }
+
+    // #681: build the merge argv and run it WITHOUT a shell. valueSummary is
+    // DB-sourced (untrusted) — passing it as a literal argv element means
+    // `$(...)`/backticks in it can never be interpreted as a command.
+    if (!gitArgvOk(buildMergeArgv(branch, valueSummary), { cwd: REPO_ROOT })) {
+      console.log('  auto-merge: merge failed (conflicts?); task stays at confirmed for manual /merge-mode');
+      return landBailed(`merging ${branch} into main failed (conflicts?)`, '/merge-mode');
+    }
+
+    console.log('  smoke against post-merge state...');
+    if (!runSmoke().clean) {
+      console.log('  auto-merge: post-merge smoke failed; task stays at confirmed; investigate');
+      return landBailed('post-merge smoke tests failed', '/merge-mode');
+    }
+
+    console.log('  pushing merged main to origin...');
+    // SEC #863: route through push-main.js, which carries the
+    // OTB_ALLOW_MAIN_PUSH override so the pre-push permission gate lets THIS
+    // graded+confirmed pipeline push through while still blocking ad-hoc
+    // `git push origin main`. process.execPath (quoted) for the same
+    // cross-platform reason as the other node spawns here (#660).
+    if (!shellOk(`"${process.execPath}" ${JSON.stringify(path.join(__dirname, 'push-main.js'))}`, { cwd: REPO_ROOT })) {
+      console.log('  auto-merge: push failed; task stays at confirmed');
+      // task 1002629: a branch-protected main refuses EVERY direct push, so
+      // retrying here can never work — resolveDeployMode normally reroutes to
+      // the ci PR path before this point; reaching this with protection on
+      // means an env-forced 'laptop' or a failed protection probe.
+      if (mainIsProtected() === true) {
+        return landBailed('main is branch-protected — the direct push can never land; unset OTB_DEPLOY_MODE (the ci PR path lands it)', `node scripts/gds/ship.js ${taskId}`);
+      }
+      return landBailed('could not push the merged main to origin', '/merge-mode');
+    }
+
+    // Deploy step. The core carries NO deploy target of its own — under the
+    // standalone model a core change reaches a live instance via package-core +
+    // `bongos upgrade` (pin-bump), NOT an SSH deploy (ADR 0108). So unless an
+    // instance whose own checkout IS its live server has configured a target
+    // (config/deploy.json "sshTarget" or <PREFIX>_DEPLOY_SSH_TARGET), the land is
+    // complete at "merged + pushed to main" and the SSH deploy is skipped. (This
+    // used to SSH a hardcoded target — the founder instance's old game box, i.e. the
+    // WRONG server post-migration. task 1002202.)
+    const { sshTarget, healthzUrl } = resolveDeployTarget({
+      configRaw: readDeployConfigRaw(),
+      branding: safeBranding(),
+    });
+    if (!sshTarget) {
+      console.log('  merged + pushed to main. No deploy target configured, so no SSH deploy —');
+      console.log('  expected for the core. To publish to a live instance run the standalone release');
+      console.log('  flow: package-core → bongos upgrade (pin-bump), per ADR 0108. (Not an SSH deploy.)');
+    } else {
+      console.log(`  triggering deploy on ${sshTarget}...`);
+      // Quote ~/deploy.sh so the LOCAL shell doesn't tilde-expand it before ssh
+      // transmits the command; with the quotes ssh sends the literal `~/deploy.sh`
+      // and the REMOTE shell expands it. (Matches /merge-mode SKILL.md:81.)
+      if (!shellOk(`ssh -o ConnectTimeout=10 ${sshTarget} "~/deploy.sh"`)) {
+        // task 984 / idea 180: ~/deploy.sh's internal /healthz curl can race the
+        // service-restart window (Node not yet bound) and exit non-zero even though
+        // the deploy succeeded — which used to false-fail the ship and force a
+        // needless /merge-mode. Before concluding failure, re-probe the CONFIGURED
+        // /healthz with backoff (curl's own --retry; cross-platform, no sleep) —
+        // never a hardcoded host. --retry-all-errors retries connection-refused
+        // during the bind window; -f makes a non-200 an error so a 502/503 also
+        // retries. If it comes up within the window the deploy really succeeded.
+        if (healthzUrl) {
+          console.log('  auto-merge: ~/deploy.sh returned non-zero — re-probing /healthz with backoff before concluding...');
+          if (shellOk(`curl -fsS --max-time 10 --retry 5 --retry-delay 3 --retry-all-errors ${JSON.stringify(healthzUrl)} -o /dev/null`)) {
+            console.log('  auto-merge: /healthz 200 on re-probe — deploy actually succeeded (deploy.sh raced the restart window). Proceeding.');
+          } else {
+            console.log('  auto-merge: deploy failed (/healthz never returned 200 after retries); task stays at confirmed');
+            return landBailed('merged to main, but the deploy failed (/healthz never returned 200)', '/merge-mode');
+          }
+        } else {
+          console.log('  auto-merge: ~/deploy.sh returned non-zero and no healthzUrl configured to re-probe; task stays at confirmed');
+          return landBailed('merged to main, but ~/deploy.sh returned non-zero (no healthz to re-probe)', '/merge-mode');
+        }
+      }
+    }
+
+    // Merged + deployed — the feature branch is permanently in main's history
+    // (--no-ff merge commit) and no longer needed on origin. Deleting it keeps
+    // GitHub's "Create PR" affordance from offering empty PRs against zero-diff
+    // branches and prevents builder confusion about whether a branch landed.
+    // Local refs/heads ref stays so the worktree on the Mac isn't disturbed
+    // (cleanup of stale local refs happens next `git fetch --prune`).
+    // Non-blocking: a deploy that succeeded shouldn't be marked failed just
+    // because the cleanup push fails (e.g. branch already deleted manually,
+    // permission glitch, network blip).
+    console.log(`  cleaning up: deleting ${branch} on origin...`);
+    if (!gitArgvOk(['push', 'origin', '--delete', branch], { cwd: REPO_ROOT })) {
+      console.log(`  warn: could not delete origin/${branch} — may already be gone (non-blocking)`);
+    }
+
+    console.log('  flipping task to shipped...');
+    mergedClean = true;
+    return landed();
+  } finally {
+    // Leave REPO_ROOT clean for the NEXT ship/merge no matter how we exited.
+    // A failed merge here wedges everyone else: a conflict leaves the tree
+    // mid-merge (MERGE_HEAD + conflicted index → mainWorktreeBusy() rejects all
+    // future ships), and a failure AFTER the local merge commit but BEFORE push
+    // (post-merge smoke/push/deploy) leaves main ahead-but-unpushed (the next
+    // `git merge --ff-only origin/main` then fails with the misleading "main is
+    // ahead of origin somehow"). Only normalize on the failure path — on the
+    // success path we already pushed, so touching the tree is needless risk.
+    // Best-effort: cleanup must never mask the real outcome. This is the
+    // clean-failure twin of merge-lock.recoverWorktree() (which handles the
+    // crash/stale-reclaim case where we never reach this finally at all).
+    if (!mergedClean) {
+      try {
+        if (gitOk('git rev-parse -q --verify MERGE_HEAD', { cwd: REPO_ROOT })) {
+          shellOk('git merge --abort', { cwd: REPO_ROOT });
+        }
+        if (gitOk('git rev-parse --abbrev-ref HEAD', { cwd: REPO_ROOT }) === 'main') {
+          shellOk('git reset --hard origin/main', { cwd: REPO_ROOT });
+        }
+      } catch (_) {
+        /* best-effort cleanup; the lock release below is what matters most */
+      }
+    }
+    mergeLock.release(REPO_ROOT);
+  }
+}
+
+module.exports = {
+  autoMerge,
+  zeroCommitVerdict,
+};