@bongos/core 1.19.38 → 1.19.40

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.38",
-  "core_contract": "1.19.38",
-  "source_commit": "ba6a8f6285476ab3cd4e33f9278b333ac0fc3a29",
+  "core_version": "1.19.40",
+  "core_contract": "1.19.40",
+  "source_commit": "512e419a012e048b5e7d5904053cbc45df054a09",
   "source_ref": "HEAD",
-  "built_at": "2026-08-11T16:17:20.571Z",
+  "built_at": "2026-08-11T16:35:25.688Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 288,
+    "docs_redacted": 289,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1212,
+    "functional_verbatim": 1213,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1521,
-  "tree_sha256": "9d55773209aeb85fef771e85aa30e901c52e54e155601030e44cd16fd5c46bda",
+  "file_count": 1523,
+  "tree_sha256": "39b4dbb47e0100a520bddafb358c1c89d7a74bc6975261774d9dd12059d544dc",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -154,6 +154,11 @@
       "mode": "0000644",
       "sha256": "e789b9157c9817bac354eaeed8152b53f3013f677934b062bca1c8e07f1f2dc8"
     },
+    {
+      "path": ".claude/skills/grade-audit/SKILL.md",
+      "mode": "0000644",
+      "sha256": "2b4d33396291f58f1c0d7c01d173b64d587b2a0a483b17328e57eb602a8df9fe"
+    },
     {
       "path": ".claude/skills/grade-recover/SKILL.md",
       "mode": "0000644",
@@ -1362,7 +1367,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "f51d3978f50ec9b2a34dc12b8fa3b9e8874543e5ab3503f72a09d7d2b06c565b"
+      "sha256": "15801d1c51e7e46ccf4e52dad5d3d34e4adc96b72eed60e3ef2c9ccccf94d1da"
     },
     {
       "path": "docs/handoff-template.md",
@@ -3382,7 +3387,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "60b9338ed47d01e9f38fe3fa9f2f2cde6ff241b8e47efcb8fcf4c4f19d32c766"
+      "sha256": "9658ccf0dd332d6c4ce1e269c2966ebe2e2bed5f909d5d503722d8e8cfb1ebbc"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3437,7 +3442,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "964af2331007a4cfb9142e7245d7625cf21c973e4f885e0171855b9e188b9e95"
+      "sha256": "ad57ad242956c6ee3dc4aeddd66e980af48737fab644765aa3c400720f4a9668"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -4022,12 +4027,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "413f575fce07ba5b167f6492a4f1aed1f7eacb4f4351457303d3875f04557787"
+      "sha256": "290c88cdeae475bf124eb3e74292108c669006b69414d258ae3d961b9e80f743"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d0d31ac616a949591bca2975236bbf6d98437e969d1618bd68811620c2a130c3"
+      "sha256": "316768e98e388920e8710c944cd4fbfd7c2bf947a742a3aa6698d66b35e838e6"
     },
     {
       "path": "public-docs/index.html",
@@ -5647,7 +5652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2dfd2867ab83689497aff7a3b7f213e756c182e047ef8da754e098a945491ce7"
+      "sha256": "a122aca901bb83b94b1d475a651eae90c7a7f72251703ce3a81cd14dcf39fe66"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6417,7 +6422,7 @@
     {
       "path": "tests/github_push_merge_driver.mjs",
       "mode": "0000644",
-      "sha256": "1e038780532078d8d1a20feebb95ee6762fb300101f71cfff7076d2fa0d38b1b"
+      "sha256": "850113ed91babc9eb54dc22231f194d283fd3f94cee9deef1e6e0bf6f3a969c2"
     },
     {
       "path": "tests/github_repos_helpers.mjs",
@@ -7147,7 +7152,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "240337de03354de198d6baaaca9f33b267aceb40a8ba43d31303eb21fad9226c"
+      "sha256": "1aeb87a14e411160784c94ee5392f323a2ad0a373bd9acf91337289041e8d2bc"
     },
     {
       "path": "tests/rank_gate.mjs",
@@ -7464,6 +7469,11 @@
       "mode": "0000644",
       "sha256": "0eeccae9320f419667cf9ede3c13671a5b03571f7f2f17067bff1857234ddf91"
     },
+    {
+      "path": "tests/skill_grade_audit.mjs",
+      "mode": "0000644",
+      "sha256": "75ad6cd89f6e84e88764a99350e093df31a525eff392e3f84ce99fa32cb952c4"
+    },
     {
       "path": "tests/skill_grade_recover.mjs",
       "mode": "0000644",

package/.claude/skills/grade-audit/SKILL.md

@@ -0,0 +1,77 @@
+---
+name: grade-audit
+description: Manual-cadence accountability sweep over recent grades — the override ledger (what shipped despite a failing grade, and was it accounted for), dropped blocker/major findings on passing grades, a false-pass spot-check for runtime-behavior blindness, and an outage roll-up. Triggers when the user says "/grade-audit", "audit recent grades", "run the grade audit", "what shipped past the grader", or "weekly grader accountability sweep". Describes and queues follow-up work ONLY — it NEVER confirms a task, flips a status, or re-grades anything (ADR 0162; verdicts are advisory, never self-executing). Manually invoked; do not depend on scheduled routines.
+---
+
+You are auditing the last week of grades for accountability gaps: work that shipped past a failing grade unaccounted for, real findings that rode passing grades into production and evaporated, and passes the panel structurally could not have judged. You **describe and queue**. You never confirm, flip, re-grade, or add a gate — every follow-up lands as a queued idea or a handoff to another skill.
+
+## The sweep window
+
+```bash
+node scripts/gds/api.js GET "/api/gds/public/recent-shipped?days=7"
+```
+
+For each shipped task in the window, read its persisted grade:
+
+```bash
+node scripts/gds/api.js GET "/api/gds/tasks/<id>?include=grade"
+```
+
+Bucket by grade shape: `passed`, failed, `signals.panel_outcome='unavailable'` (outage — no quality signal existed), or no grade row at all.
+
+## Leg 1 — the override ledger
+
+For every shipped task whose grade **failed** (or is absent), the land needed an override. Cross-reference the ledger (Archon — `override_request.decide`):
+
+```bash
+node scripts/gds/api.js GET "/api/gds/override-requests?status=approved"
+```
+
+- Split **infra vs real** first: a fail that is actually `panel_outcome='unavailable'` (or the errored-worker zero-issue shape) is an outage artifact, not an overridden quality verdict — route those to the Leg 4 roll-up.
+- A shipped task with a real failing grade and **no approved override-request row** landed via the raw confirm — the un-audited path. Name it in the report and print its unaddressed `issues[]` verbatim. That set is the ledger's debt.
+- For each such task, queue the debt (see the queueing rule below) — do not chase the lander, do not un-ship anything.
+
+## Leg 2 — dropped findings on passing grades
+
+A pass with `blocker`/`major` entries in `issues[]` shipped real findings that no process ever picks up (the evaluation counted 274 findings on passing ships with zero conversion paths). For each:
+
+- **Worker-attribution filter:** findings attributed to the advisory **Narc** are the known noise class — triage them by hand (read the finding, decide), never auto-trust them into the queue. Findings from the gating workers (Quality, Hacker, Efficiency) or the deterministic pre-passes are higher-confidence — queue them unless plainly stale.
+- **Queueing rule (idempotent):** first read the open inbox (`node scripts/gds/api.js GET /api/gds/inbox`) and skip any finding already queued — the marker is the deterministic title prefix. Then:
+
+```bash
+node scripts/gds/capture.js "[grade-audit] task <id>: <finding summary>" --kind bug
+```
+
+One idea per surviving finding, titled exactly `[grade-audit] task <id>: …` so a re-run of this audit files nothing twice.
+
+## Leg 3 — false-pass spot-check (runtime-behavior blindness)
+
+The re-review found 2/8 material misses, both the same root cause: **the panel grades diff text and never reasons about runtime** — a CI workflow whose default shallow checkout broke on first run scored functional_fidelity 10/10, and an SSRF guard bypassable via HTTP redirect passed at 9.5. For the riskiest ships in the window — security surfaces, CI/workflow files, the largest diffs, and 9.5s with suspiciously few findings — re-read the merged diff asking one question: *what does this code do at runtime that the diff text does not show?* (defaults it inherits, redirects it follows, first-run behavior, tool/CI defaults). A suspicion is queued via the Leg 2 rule, prefixed the same way — never a re-grade, never a flipped verdict.
+
+## Leg 4 — outage roll-up
+
+Count the window's `panel_outcome='unavailable'` rows. One-off outages just get the `--regrade` pointer in the report; a streak (2+ consecutive, or clustered on one builder) is a health problem — hand off to **/grader-health**, which owns outage diagnosis. Do not diagnose here.
+
+## Report shape
+
+End with the ledger, most severe first:
+
+1. **Un-accounted overrides** — task, findings printed verbatim, queued-idea ref. A task that landed with no approved override-request row is the headline.
+2. **Queued findings** — what was filed this run, what was skipped as already-queued, what was held back by the Narc filter (and why).
+3. **Spot-check suspicions** — task, the runtime question the panel couldn't answer, queued-idea ref.
+4. **Outage roll-up** — count + the /grader-health handoff if a streak.
+
+A clean week is four one-liners.
+
+## Constraints
+
+- **Never confirm, never flip, never re-grade (ADR 0162).** Verdicts are advisory and never self-executing here — this skill's entire output is a report plus queued `idea_inbox` rows. If a leg tempts you to "just fix it", the fix is a queued idea or a claimed task, not an action inside the audit.
+- **Manual cadence.** Invoke by hand (weekly is the intended rhythm). Do not wire it to cron or depend on `.claude/scheduled-tasks/`.
+- **Idempotent re-runs.** The `[grade-audit] task <id>:` title marker + the inbox pre-check are what make running it twice harmless — keep both.
+- **Archon surfaces degrade gracefully.** Without `override_request.decide`, Leg 1 can only report "ledger unreadable at this rank" — say so rather than skipping silently.
+
+## Files this skill touches
+
+- Reads: `GET /api/gds/public/recent-shipped`, `GET /api/gds/tasks/:id?include=grade`, `GET /api/gds/override-requests?status=approved` (Archon), `GET /api/gds/inbox`.
+- Writes: `idea_inbox` rows via `node scripts/gds/capture.js` (queued follow-ups only).
+- Never calls: any confirm, status, grade, or regrade endpoint.

package/docs/file-map.md

@@ -350,6 +350,7 @@ tests/
 ├── fix-task/SKILL.md              ← /fix-task N — claim, fix (test-first), verify, and ship a single GDS task by id end to end; defers to /builder-claim + /builder-ship for their own mechanics
 ├── goal-create/SKILL.md           ← /goal-create — plan and create ONE goal (the module-scoped workspace between version and criteria, ADR 0086) in one session: <redacted>, scope wall, 2-4 criteria, seed tasks; also the auto-pickup when a task is created with no goal to live in (goal_advisory); Metic+ (Archon for a protected-module scope)
 ├── goal-review/SKILL.md           ← /goal-review — walk the criterion review queue: each auto-flagged 'met — pending review' criterion gets confirm / reject / defer; confirming a goal's last criterion auto-achieves it (ADR 0086 §6); Metic+
+├── grade-audit/SKILL.md           ← /grade-audit — manual-cadence accountability sweep: override ledger (shipped-despite-fail, infra vs real, un-requested confirms named), dropped blocker/major findings on passes queued via capture.js with the advisory-Narc filter, runtime-blindness false-pass spot-check, outage roll-up → /grader-health; describes and queues only, never confirms (ADR 0162, task 1002657)
 ├── grade-recover/SKILL.md         ← /grade-recover N — the 'my grade failed, now what' loop: diagnose outage vs fabricated fail vs genuine fail from the persisted grade, then run the right recovery (--regrade or the auditable override-request); adds no ship-path gate (ADR 0162, task 1002655)
 ├── grader-health/SKILL.md         ← /grader-health — read-only grader health check: outage runs (n_unavailable streaks, outage-vs-rejection confirmation), pass-rate drift vs baseline, per-grade cost anomalies, stale model pins; emits exact --regrade remediation lines; optional --probe live calibration (Metic+, paid) (task 1002656)
 ├── idea-triage/SKILL.md           ← /idea-triage — daily walk through the GDS idea_inbox (promote / discard / merge); Metic+

package/modules/lifecycle/github-push.js

@@ -675,6 +675,40 @@ async function mergeIfGreen({ branch }, deps = {}) {
   return { ...base, reason: `merge_api_${res.status}`, detail: detail.slice(0, 160) };
 }
 
+// task 1002666 — the carrier race. Publish-on-merge (ADR 0161) pushes a carrier
+// commit to main after EVERY land, so under an up-to-date branch-protection rule
+// a PR whose checks report after the previous merge's carrier goes BEHIND:
+// green, mergeable, and permanently stalled (GitHub's update-branch also disarms
+// auto-merge, so re-arming alone cannot recover it — observed on PR #48,
+// 2026-08-11). Server-side remedy: update the branch; checks re-run on the fresh
+// head and the next sweep's mergeIfGreen lands it. Fires ONLY on the definitive
+// BEHIND shape — GitHub reports the strict-up-to-date green-PR stall as BEHIND
+// once checks have reported; BLOCKED means checks are pending/missing and stays
+// untouched (updating there would loop on PRs that can never go green).
+// The state is re-read here even though the sweep's mergeIfGreen just read it:
+// update-branch is a WRITE, and the re-read guards against acting on a state
+// that changed between the two calls (e.g. the PR merged meanwhile) — the same
+// read-before-write discipline mergeIfGreen itself applies.
+async function updateBranchIfBehind({ branch }, deps = {}) {
+  const s = await getMergeState({ branch }, deps);
+  const base = { number: s.number, updated_now: false, merge_state: s.merge_state, reason: null };
+  if (s.merged) return { ...base, reason: 'already_merged' };
+  if (s.pr_state !== 'open') return { ...base, reason: 'no_open_pr' };
+  if (s.merge_state !== 'BEHIND') return { ...base, reason: mergeBlockReason(s) };
+  const token = await resolveToken(deps);
+  const repoInfo = deps.repoInfo || loadRepoInfo();
+  const { owner, repo } = repoInfo;
+  const doFetch = deps.fetchImpl || fetch;
+  const res = await doFetch(`https://api.github.com/repos/${owner}/${repo}/pulls/${s.number}/update-branch`, {
+    method: 'PUT',
+    headers: { ...ghHeaders(token), 'Content-Type': 'application/json' },
+    body: JSON.stringify(s.head_sha ? { expected_head_sha: s.head_sha } : {}),
+  });
+  if (res.ok) return { ...base, updated_now: true };
+  const detail = await res.text().catch(() => '');
+  return { ...base, reason: `update_api_${res.status}`, detail: detail.slice(0, 160) };
+}
+
 // task 1139 (ADR 0058): server-set commit status — the TRUSTLESS rank attestation the
 // gate-review CI check reads. Only the server (holding the App/PAT credential AND the
 // authenticated builder's server-resolved rank) can set it, so CI can trust it where it
@@ -1043,6 +1077,7 @@ module.exports = {
   getPublishStatus,
   getMergeState,
   mergeIfGreen,
+  updateBranchIfBehind,
   setCommitStatus,
   setGateOwnerApproved,
   listOpenPullRequests,

package/modules/lifecycle/publish-reconciler.js

@@ -200,6 +200,7 @@ async function runSweep(deps = {}) {
   let merged = 0;
   let resolvedConflicts = 0;
   let refreshedStale = 0; // task 1915: PRs whose stale generated indexes we regen+pushed
+  let behindUpdated = 0;  // task 1002666: green PRs behind main (carrier race) whose branch we updated
   let errors = 0;
   let unprovable = 0;   // confirmed tasks the sweep could not prove landed this pass
   let staleStrands = 0; // of those, the ones older than STALE_CONFIRMED_MS (WARN'd)
@@ -305,6 +306,38 @@ async function runSweep(deps = {}) {
             } catch (e) {
               errFn(`[publish-reconciler] conflict-resolve for task ${r.task_id} (non-blocking): ${e && e.message}`);
             }
+          } else if (
+            m && !m.merged && m.reason === 'branch_behind_base' &&
+            typeof push.updateBranchIfBehind === 'function'
+          ) {
+            // task 1002666: the ADR 0161 carrier race — every land pushes a
+            // carrier commit to main, so a green PR whose checks reported after
+            // the previous merge sits BEHIND forever (GitHub's update-branch
+            // disarms auto-merge, so it cannot recover on its own). Update the
+            // branch server-side; checks re-run on the fresh head and the NEXT
+            // sweep's mergeIfGreen lands it. Attempt-capped per branch on the
+            // shared heal map — on a hot fleet every update re-opens the race
+            // window, and a treadmill must surface, not spin.
+            const bKey = `behind:${branch}`;
+            const bn = attempts.get(bKey) || 0;
+            if (bn >= MAX_STALE_HEAL_ATTEMPTS) {
+              logFn(
+                `[publish-reconciler] task ${r.task_id} (${branch}) PR #${m.number} still behind main after ${bn} update-branch attempt(s) — capped (merge traffic is outracing this PR); left for a human`
+              );
+            } else {
+              attempts.set(bKey, bn + 1);
+              try {
+                const u = await push.updateBranchIfBehind({ branch });
+                if (u && u.updated_now) {
+                  behindUpdated++;
+                  logFn(
+                    `[publish-reconciler] task ${r.task_id} (${branch}) PR #${u.number} was green but behind main (carrier race) — server-updated the branch; checks re-run, lands next sweep`
+                  );
+                }
+              } catch (e) {
+                errFn(`[publish-reconciler] update-branch for task ${r.task_id} (non-blocking): ${e && e.message}`);
+              }
+            }
           } else if (
             m && couldBeStaleGenerated(m) &&
             typeof resolver.refreshStaleGenerated === 'function'
@@ -544,14 +577,17 @@ async function runSweep(deps = {}) {
   }
 
   // Prune the treadmill guard so it can't leak: a branch that left the confirmed set
-  // (landed, or released) never returns under the same name, so drop it.
+  // (landed, or released) never returns under the same name, so drop it. Keys may be
+  // namespaced ('behind:<branch>', task 1002666) — compare on the branch itself so a
+  // live branch's cap survives across sweeps and a departed branch's keys still prune.
   for (const b of attempts.keys()) {
-    if (!branchesSeen.has(b)) attempts.delete(b);
+    const plain = b.startsWith('behind:') ? b.slice('behind:'.length) : b;
+    if (!branchesSeen.has(plain)) attempts.delete(b);
   }
 
-  if (reconciled || merged || resolvedConflicts || refreshedStale) {
+  if (reconciled || merged || resolvedConflicts || refreshedStale || behindUpdated) {
     logFn(
-      `[publish-reconciler] swept ${rows.length} confirmed task(s); merged ${merged} stalled PR(s); auto-resolved ${resolvedConflicts} generated/index conflict(s); regen-healed ${refreshedStale} stale-generated PR(s); reconciled ${reconciled} → shipped`
+      `[publish-reconciler] swept ${rows.length} confirmed task(s); merged ${merged} stalled PR(s); auto-resolved ${resolvedConflicts} generated/index conflict(s); regen-healed ${refreshedStale} stale-generated PR(s); branch-updated ${behindUpdated} behind-main PR(s); reconciled ${reconciled} → shipped`
     );
   }
   if (staleStrands) {
@@ -559,7 +595,7 @@ async function runSweep(deps = {}) {
       `[publish-reconciler] ${staleStrands} stale strand(s): confirmed >${Math.round(STALE_CONFIRMED_MS / 60_000)}min with no provable land — credited but unlanded; see STRAND lines above`
     );
   }
-  return { checked: rows.length, reconciled, merged, resolvedConflicts, refreshedStale, errors, unprovable, staleStrands, strandsFlagged };
+  return { checked: rows.length, reconciled, merged, resolvedConflicts, refreshedStale, behindUpdated, errors, unprovable, staleStrands, strandsFlagged };
 }
 
 // task 1366 — server-side session-cost reconcile, piggybacked on the same 5-min

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.38",
+  "version": "1.19.40",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.38",
+      "version": "1.19.40",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.38",
+  "version": "1.19.40",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -503,8 +503,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.36 with no explicit bump. run 31510590459. (task 1002620)
 //   1.19.38 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.37 with no explicit bump. run 31511537558. (task 1002620)
+//   1.19.39 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.38 with no explicit bump. run 31512284325. (task 1002620)
+//   1.19.40 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.39 with no explicit bump. run 31513136724. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.38'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.40'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/github_push_merge_driver.mjs

@@ -169,6 +169,64 @@ test('mergeBlockReason maps the common blocker states', () => {
   assert.equal(gh.mergeBlockReason({ ...open, merged: true }), null);
 });
 
+// --- task 1002666: updateBranchIfBehind (the carrier-race branch updater) ---
+
+// fetchImpl serving graphql + recording the update-branch PUT.
+function mkUpdateFetch({ node, updateStatus = 202 } = {}) {
+  const calls = { graphql: 0, update: 0, updateArgs: null };
+  const fetchImpl = async (url, opts = {}) => {
+    if (String(url).includes('/graphql')) {
+      calls.graphql++;
+      return {
+        ok: true, status: 200,
+        json: async () => ({ data: { repository: { pullRequests: { nodes: node ? [node] : [] } } } }),
+      };
+    }
+    if (String(url).includes('/update-branch')) {
+      calls.update++;
+      calls.updateArgs = { url, body: JSON.parse(opts.body || '{}') };
+      return {
+        ok: updateStatus >= 200 && updateStatus < 300,
+        status: updateStatus,
+        text: async () => '{}',
+      };
+    }
+    throw new Error(`unexpected fetch: ${url}`);
+  };
+  return { fetchImpl, calls };
+}
+
+test('updateBranchIfBehind updates a BEHIND PR, pinning the expected head sha', async () => {
+  const { fetchImpl, calls } = mkUpdateFetch({ node: prNode({ mergeStateStatus: 'BEHIND', oid: 'headsha' }) });
+  const u = await gh.updateBranchIfBehind({ branch: 'claude/wt' }, DEPS(fetchImpl));
+  assert.equal(u.updated_now, true);
+  assert.equal(calls.update, 1);
+  assert.match(String(calls.updateArgs.url), /\/pulls\/125\/update-branch$/);
+  assert.equal(calls.updateArgs.body.expected_head_sha, 'headsha', 'a raced head 422s instead of updating blind');
+});
+
+test('updateBranchIfBehind refuses every non-BEHIND shape without calling the API', async () => {
+  for (const [node, reason] of [
+    [prNode({ mergeStateStatus: 'CLEAN' }), 'clean'],
+    [prNode({ merged: true }), 'already_merged'],
+    [prNode({ state: 'CLOSED' }), 'no_open_pr'],
+    [prNode({ mergeStateStatus: 'BLOCKED' }), 'blocked_required_review_or_pending_check'],
+  ]) {
+    const { fetchImpl, calls } = mkUpdateFetch({ node });
+    const u = await gh.updateBranchIfBehind({ branch: 'claude/wt' }, DEPS(fetchImpl));
+    assert.equal(u.updated_now, false);
+    assert.equal(calls.update, 0, 'no update PUT for a non-BEHIND PR');
+    if (reason) assert.equal(u.reason, reason);
+  }
+});
+
+test('updateBranchIfBehind surfaces an API refusal as update_api_<status>', async () => {
+  const { fetchImpl } = mkUpdateFetch({ node: prNode({ mergeStateStatus: 'BEHIND' }), updateStatus: 403 });
+  const u = await gh.updateBranchIfBehind({ branch: 'claude/wt' }, DEPS(fetchImpl));
+  assert.equal(u.updated_now, false);
+  assert.equal(u.reason, 'update_api_403');
+});
+
 setTimeout(() => {
   console.log(`\ngithub-push merge driver (task 1162) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);

package/tests/publish_reconciler.mjs

@@ -57,9 +57,10 @@ function mkDeps({
   broadcastImpl,
   conflictResolveImpl,
   refreshStaleImpl,
+  updateByBranch = {},
   healAttempts = new Map(),
 } = {}) {
-  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], search: [], resolve: [], refresh: [], flag: [], events: [], logs: [], errors: [] };
+  const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], search: [], resolve: [], refresh: [], update: [], flag: [], events: [], logs: [], errors: [] };
   // isSafeBranch mirrors github-push's pattern enough for the test (rejects
   // option-like / traversal refs); we use the REAL module so the contract can't drift.
   const githubPush = require('../modules/lifecycle/github-push.js');
@@ -110,6 +111,15 @@ function mkDeps({
         if (f instanceof Error) throw f;
         return f || null;
       },
+      // task 1002666: the carrier-race branch updater. Default: no open PR (a
+      // no-op), so pre-1002666 tests keep their exact behavior. Script per
+      // branch via updateByBranch; an Error value throws (swallowed, non-blocking).
+      updateBranchIfBehind: async ({ branch }) => {
+        calls.update.push(branch);
+        const u = updateByBranch[branch];
+        if (u instanceof Error) throw u;
+        return u || { updated_now: false, reason: 'no_open_pr' };
+      },
       // task 1313 head_sha land-check. Default: not on main. An Error value throws
       // (to prove a transient compare-API miss is swallowed, leaving it for next sweep).
       isAncestorOfDefaultBranch: async ({ sha }) => {
@@ -790,6 +800,79 @@ test('1915 mergeable-but-red PR → regen-heal fires on the right branch; refres
   assert.equal(deps._calls.ship.length, 0, 'the heal never ships (no phantom-ship — land still needs the tip proof)');
 });
 
+// --- task 1002666: the carrier race — green PR behind main gets its branch updated ---
+
+// mergeIfGreen shape for a green, mergeable PR that fell behind main (the ADR 0161
+// carrier landed after this PR's checks reported).
+const behindGreen = (number = 48) => ({
+  pr_state: 'open', number, merged: false, merged_now: false, mergeable: 'MERGEABLE', reason: 'branch_behind_base',
+});
+
+test('1002666 green-but-behind PR (carrier race) → server updates the branch; NOT shipped this sweep', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 500, builder_id: 5, worktree_name: 'wt-behind' }],
+    statusByBranch: { 'claude/wt-behind': PENDING },
+    mergeByBranch: { 'claude/wt-behind': behindGreen() },
+    updateByBranch: { 'claude/wt-behind': { number: 48, updated_now: true, merge_state: 'BEHIND', reason: null } },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.behindUpdated, 1, 'the behind PR was branch-updated');
+  assert.deepEqual(deps._calls.update, ['claude/wt-behind'], 'the update is invoked on exactly this task\'s branch');
+  assert.equal(r.reconciled, 0, 'no ship this sweep — checks re-run on the new head, lands next sweep');
+  assert.equal(deps._calls.ship.length, 0, 'the update never ships (land still needs the tip proof)');
+  assert.ok(deps._calls.logs.some((l) => /carrier race/.test(l)), 'the log names the carrier race');
+});
+
+test('1002666 update-branch attempts are capped on the shared heal map (a hot fleet must surface, not spin)', async () => {
+  const healAttempts = new Map([['behind:claude/wt-behind', 3]]);
+  const deps = mkDeps({
+    rows: [{ task_id: 501, builder_id: 5, worktree_name: 'wt-behind' }],
+    statusByBranch: { 'claude/wt-behind': PENDING },
+    mergeByBranch: { 'claude/wt-behind': behindGreen() },
+    updateByBranch: { 'claude/wt-behind': { number: 48, updated_now: true } },
+    healAttempts,
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(deps._calls.update.length, 0, 'at the cap the updater is not invoked');
+  assert.equal(r.behindUpdated, 0);
+  assert.ok(deps._calls.logs.some((l) => /capped/.test(l)), 'the cap is logged, not silent');
+});
+
+test('1002666 the behind-cap ACCUMULATES across sweeps for a live branch (the prune must not reset it)', async () => {
+  const healAttempts = new Map();
+  const mk = () => mkDeps({
+    rows: [{ task_id: 503, builder_id: 5, worktree_name: 'wt-behind' }],
+    statusByBranch: { 'claude/wt-behind': PENDING },
+    mergeByBranch: { 'claude/wt-behind': behindGreen() },
+    updateByBranch: { 'claude/wt-behind': { number: 48, updated_now: true } },
+    healAttempts,
+  });
+  for (let i = 1; i <= 3; i++) {
+    await reconciler.runSweep(mk());
+    assert.equal(healAttempts.get('behind:claude/wt-behind'), i, `attempt ${i} is remembered after the sweep's prune`);
+  }
+  const fourth = mk();
+  const r = await reconciler.runSweep(fourth);
+  assert.equal(fourth._calls.update.length, 0, 'the 4th sweep is capped — a permanently-behind PR surfaces instead of spinning');
+  assert.equal(r.behindUpdated, 0);
+  // A branch that LEAVES the confirmed set prunes its namespaced key too (no leak).
+  const empty = mkDeps({ rows: [], healAttempts });
+  await reconciler.runSweep(empty);
+  assert.equal(healAttempts.has('behind:claude/wt-behind'), false, 'departed branch prunes its behind: key');
+});
+
+test('1002666 an update-branch API failure is swallowed (non-blocking) and the sweep continues', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 502, builder_id: 5, worktree_name: 'wt-behind' }],
+    statusByBranch: { 'claude/wt-behind': PENDING },
+    mergeByBranch: { 'claude/wt-behind': behindGreen() },
+    updateByBranch: { 'claude/wt-behind': new Error('update-branch 403') },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.behindUpdated, 0);
+  assert.ok(deps._calls.errors.some((l) => /update-branch/.test(l)), 'the failure is logged to errFn');
+});
+
 test('1915 mergeable-but-red PR where regen yields NO diff → not healed, logged as a real check failure', async () => {
   const deps = mkDeps({
     rows: [{ task_id: 401, builder_id: 5, worktree_name: 'wt-realfail' }],

package/tests/skill_grade_audit.mjs

@@ -0,0 +1,50 @@
+// tests/skill_grade_audit.mjs — the /grade-audit skill exists and covers the
+// accountability sweep from the grader-hardening evaluation §6 (task 1002657):
+// the override ledger, dropped blocker/major findings on passing grades (with
+// the advisory-Narc attribution filter), the false-pass spot-check, and the
+// outage roll-up handoff — describing and queueing ONLY (ADR 0162/0158: it
+// never confirms a task or flips status).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SKILL = path.join(ROOT, '.claude', 'skills', 'grade-audit', 'SKILL.md');
+
+// .claude/skills is INSTANCE-materialized; a neutral core checkout carries none
+// (task 1002470) — skip there, same guard shape as file_map.mjs.
+const skillsDirExists = existsSync(path.join(ROOT, '.claude', 'skills'));
+
+test('/grade-audit exists, covers the sweep legs, and stays describe-and-queue only', (t) => {
+  if (!skillsDirExists) return t.skip('.claude/skills not materialized in this checkout');
+  assert.ok(existsSync(SKILL), '.claude/skills/grade-audit/SKILL.md must exist (task 1002657)');
+  const md = readFileSync(SKILL, 'utf8');
+
+  // Data surfaces.
+  assert.match(md, /\/api\/gds\/public\/recent-shipped/, 'sweeps the recent-shipped window');
+  assert.match(md, /include=grade/, 'reads each task\'s persisted grade');
+  assert.match(md, /\/api\/gds\/override-requests/, 'cross-references the override ledger');
+
+  // Leg 1 — override ledger: shipped-with-failing-grade, infra vs real split.
+  assert.match(md, /panel_outcome='unavailable'/, 'splits infra outage from a real fail');
+  assert.match(md, /no approved (override-)?request/i, 'names tasks that landed with no request row');
+
+  // Leg 2 — dropped findings with the worker-attribution filter.
+  assert.match(md, /blocker|major/, 'targets blocker/major findings on passing grades');
+  assert.match(md, /Narc/i, 'carries the advisory-Narc attribution filter');
+  assert.match(md, /capture\.js/, 'queues findings via capture.js');
+  assert.match(md, /\[grade-audit\]/, 'uses the deterministic title marker for idempotency');
+
+  // Leg 3 — false-pass spot-check (the 2/8 runtime-blindness classes).
+  assert.match(md, /runtime/i, 'spot-checks for runtime-behavior blindness');
+
+  // Leg 4 — outage roll-up handoff.
+  assert.match(md, /\/grader-health/, 'hands outage windows to /grader-health');
+
+  // The hard constraint.
+  assert.match(md, /never confirm/i, 'states it never confirms');
+  assert.match(md, /ADR 0162/, 'anchors the no-new-gates constraint');
+  assert.ok(!/curl[^\n]*\/confirm/.test(md), 'carries no ready-to-paste confirm curl');
+});