@bongos/core 1.19.689 → 1.19.691

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.689",
-  "core_contract": "1.19.689",
-  "source_commit": "636af32c2114ecf4e8b2fe03d2146106f8123776",
+  "core_version": "1.19.691",
+  "core_contract": "1.19.691",
+  "source_commit": "d6f9d26e0e431f817085c4f3e93cba48e534c2e7",
   "source_ref": "HEAD",
-  "built_at": "2026-09-12T23:51:28.908Z",
+  "built_at": "2026-09-13T00:51:33.922Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2125,
+    "functional_verbatim": 2126,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2626,
-  "tree_sha256": "480885e76086019b4dc2565be23ed784e8181134410c41afc8ef25da3374d72e",
+  "file_count": 2627,
+  "tree_sha256": "c8d122583fff727fc928395a6e21c2ec230528b5163e89020d1b5506c39376be",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "837ec3c7ddeb36761a1b67b765e28fa117b85f1e8e58795798024e1cd432d9c1"
+      "sha256": "d15899aa7ccc7cf1c4746843d0bc37487fcfaf1dabcbb6c9cac6ea8ccac49865"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "973f657a0c063434dec755b53ee29e1b8348c9f1f3f7e8762d937d79aead985e"
+      "sha256": "8ef95c8bad02f83fa9d831818ab483bc1fbf18fbaf3392f5d03ab82dea4a3a7b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "defc3109442ff69bb93889c12a876641ec174585697a93f12722e31a548c4848"
+      "sha256": "88f4f66604d980452d57d66d581170a45fd7e07464cf3699e390b34773105504"
     },
     {
       "path": "public-docs/index.html",
@@ -8077,7 +8077,7 @@
     {
       "path": "scripts/gds/conductor-dispatch.js",
       "mode": "0000644",
-      "sha256": "6f25380a8b715dad1ce9dd17c0f0a2d7fa7573db6e2434029f0ba1d3c1cdc730"
+      "sha256": "b0e5767d0a30e57130169b41f1dd0add6cfc54237bca6d731219d5aff5d38168"
     },
     {
       "path": "scripts/gds/context-pack.js",
@@ -8922,7 +8922,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "8bf28a3d4d15e83a1e94416ec2519d39bc2a3faa71303a4f2d22d429b6afaa95"
+      "sha256": "7f6c46f56fcd54c01b5dd0bd6fecd712962c87ed693a44bea1746cf4c6aacebb"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -8977,7 +8977,7 @@
     {
       "path": "scripts/gds/ship-resume.js",
       "mode": "0000644",
-      "sha256": "4d56098b0b7df003e7efece23b8d1bca55dd272774117cd75074a1c7609939ec"
+      "sha256": "20b91c52c75fae6355165941d1467081424614d46063f87137870ef291d442b9"
     },
     {
       "path": "scripts/gds/ship-session-upload.js",
@@ -9002,7 +9002,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "6fd0329b8ad7d45fbb93deda02142c2b766c9e01b669d2d94eeafcb1caa225b0"
+      "sha256": "a64455fdf9771e4ccb04b49d42b9bb0cb0fe45bc6cb36d4e5f3abe0c31fe99ff"
     },
     {
       "path": "scripts/gds/skill-lint.js",
@@ -9289,6 +9289,11 @@
       "mode": "0000644",
       "sha256": "7290d5d15b4c8283ebb17e28b17739b9dc5de4da3e916e9491248ba8acc24619"
     },
+    {
+      "path": "src/bongos/claim-attribution.js",
+      "mode": "0000644",
+      "sha256": "1c3c7bc5d3c72de526334866a966a2fc7c5c8a486e19d65fefd50431f982d77b"
+    },
     {
       "path": "src/bongos/db-kernel.js",
       "mode": "0000644",
@@ -9547,7 +9552,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "95a7e92acae45c56f040be85ecb6a2b65a6c240290af7f383b18672da4764ec8"
+      "sha256": "97d34718e5b331dc33b78b070ed6760c8113f383faf0a90cd8076f1ac5047fbb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10207,7 +10212,7 @@
     {
       "path": "tests/conductor.mjs",
       "mode": "0000644",
-      "sha256": "e2c338b765a7fccedd1730bb56e9338e022c41a40ed60406a94c1bb5b7b1599a"
+      "sha256": "e0d75747731cf45280dca2d36260a8b7799923dc1a2ffeb775cd37a0eb1f837c"
     },
     {
       "path": "tests/confirm_attribution.mjs",
@@ -12672,7 +12677,7 @@
     {
       "path": "tests/ship_resume.mjs",
       "mode": "0000644",
-      "sha256": "2b2ef91bda46ab9a764709ab30b97de6e184a3ab2b86c4b7cb8f1c168fc0a5b7"
+      "sha256": "e5305fa140de31d7e646e328b4a3956f845f62b335bf14285a91cc38a20f8e0f"
     },
     {
       "path": "tests/ship_smoke_gate.mjs",

package/docs/module-api-changelog.md

@@ -1837,5 +1837,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.687 with no explicit bump. run 34725902871. (task 1002620)
   1.19.689 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.688 with no explicit bump. run 34726470555. (task 1002620)
+  1.19.690 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.689 with no explicit bump. run 34727464797. (task 1002620)
+  1.19.691 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.690 with no explicit bump. run 34729018766. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.689",
+  "version": "1.19.691",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.689",
+      "version": "1.19.691",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.689",
+  "version": "1.19.691",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/conductor-dispatch.js

@@ -65,6 +65,9 @@ const { isSensitive } = require('../../src/bongos/sensitive-surfaces');
 // re-hand-rolled this coverage logic — the exact drift this PR fixed for the
 // sensitive-surface set. Route through the one matcher instead.)
 const { matchOne } = require('../../src/bongos/path-match');
+// The worktree→claim rule, shared with .claude/hooks/conductor.js — the third
+// member of this file's "one definition, both conductors" set (task 1003837).
+const { claimForWorktree } = require('../../src/bongos/claim-attribution');
 
 const GRADER_DIFF_CHAR_CAP = 250_000;
 const GRADER_TIMEOUT_MS = 240_000;
@@ -209,10 +212,11 @@ function diffStatsSince(base, untracked) {
 //
 // Claims from before the column existed carry a null worktree_name and are
 // simply not matched here — the heuristic still covers them.
-function claimForWorktree(claims, worktreeName) {
-  if (!Array.isArray(claims) || !worktreeName) return null;
-  return claims.find((c) => c && c.worktree_name && c.worktree_name === worktreeName) || null;
-}
+//
+// The rule itself moved to src/bongos/claim-attribution.js in task 1003837, so
+// the conductor HOOK can answer the same question the same way without pulling
+// this module (and cli-lib, and the grader) into a per-prompt hook. Re-exported
+// below, so every existing importer and test is unchanged.
 
 // Pick the active claim whose touches[] best overlap the changed files — the
 // claim the current diff most plausibly belongs to. With multiple (possibly
@@ -296,6 +300,13 @@ async function resolveTaskContext(changedFiles) {
         // one answered is reported to the reader rather than hidden.
         const attribution = attributeClaim(claims, changedFiles, path.basename(process.cwd()));
         const c = attribution.claim;
+        // attributeClaim's documented { claim: null, signal: 'none' } return —
+        // not dead defensive code, and not a crash path: the throw is caught by
+        // this function's own catch below, which is where the no-claim context
+        // is synthesized. Unreachable only because the caller happens to check
+        // claims.length first; it states the seam's contract rather than relying
+        // on that. (Task 1003834's grade panel read it as a dead branch and
+        // filed it as a nit; kept, with this sentence, per task 1003837.)
         if (!c) throw new Error('no claim attributed');
         // Pull the full description for richer context (best-effort). Coerce
         // task_id to an integer before interpolating it into the URL path —

package/scripts/gds/ship-flow.js

@@ -27,7 +27,7 @@ const { apiErrorLine, normalizeApiError, isUnknownFieldRejection } = require('./
 const { pushVia } = require('./ship-deploy-target.js');
 
 const { diffstatFor, finishShip } = require('./ship-finish.js');
-const { evaluateRegradeEligibility, evaluateResumeAction, resumeMerge } = require('./ship-resume.js');
+const { evaluateRegradeEligibility, evaluateResumeAction, resumeMerge, shouldConfirmWithoutGrade } = require('./ship-resume.js');
 const { noteServerReward } = require('./ship-state.js');
 
 // ---------- Main flow ----------
@@ -850,8 +850,66 @@ async function regradeMain() {
   const graderBaseline = computeGraderBaseline(claimLike);
   const committedFiles = computeChangedFiles(graderBaseline);
   if (committedFiles.length === 0) {
+    // task 1003147: a DELIBERATELY artifact-free task used to dead-end here.
+    // shipMain routes every 'completed' task to this re-grade BEFORE reading any
+    // flag (evaluateResumeAction takes none), so --allow-empty / --skip-grade never
+    // reached the manual-confirm path that a no-artifact task actually needs — and
+    // that path is unreachable from 'completed' any other way. Hit for real on task
+    // 1003146: a kind=verify task landed at 'completed' with no grade row, and
+    // --allow-empty, --skip-grade and --verified all bailed on this same line.
+    //
+    // BOTH conditions are required, and the diff emptiness is MEASURED, not taken
+    // on the builder's word. A flag alone must not reach confirm: a task with a
+    // real diff whose grade failed would then bypass the grader by passing
+    // --allow-empty, which is a quality hole, not a fix. Here the grader has
+    // nothing to read, so there is no verdict to dodge. Confirming is additionally
+    // permission-gated server-side on task.confirm.grade_bypass, so this widens
+    // no authority — it only stops the ONE shape that had no exit at all.
+    if (shouldConfirmWithoutGrade({ committedFileCount: committedFiles.length, args })) {
+      console.log('');
+      console.log(`Nothing to grade (the committed diff vs ${graderBaseline || 'baseline'} is empty) and this ship`);
+      console.log('declares itself artifact-free — manual-confirming via POST /tasks/:id/confirm.');
+      // A kind='verify' task cannot reach here without --verified: the gate above
+      // exits first, so the server's verify_attestation_required can't fire below.
+      const confirm = await (await cliClient()).tasks.postTasksIdConfirm({ id: taskId, body: { verified } });
+      if (!confirm.ok) {
+        const errObj = confirm.data && confirm.data.error;
+        const errCode = typeof errObj === 'string' ? errObj : (errObj && errObj.code);
+        if (confirm.status === 403 && errCode === 'permission_forbidden') {
+          const details = (errObj && typeof errObj === 'object' && errObj.details) || {};
+          const floor = details.floors && details.floors['task.confirm.grade_bypass'];
+          console.error('');
+          console.error(`✖ Confirming without a passing grade is permission-gated: task.confirm.grade_bypass${floor ? ` (floor: ${floor})` : ''}.`);
+          console.error('  This is an authorization wall, not a verdict on your work.');
+          console.error(`  Ask a builder whose role holds it to POST /api/gds/tasks/${taskId}/confirm.`);
+          process.exit(1);
+        }
+        console.error(`manual-confirm failed: ${apiErrorLine(confirm.data, confirm.status)}`);
+        process.exit(1);
+      }
+      const confirmedStatus = confirm.data.taskStatus;
+      printCreditsAndAchievements({
+        postGradeStatus: confirmedStatus,
+        credits: confirm.data.creditsAwarded ?? 0,
+        creditsRaw: null,
+        creditsMultiplier: null,
+        ideaBonusInfo: confirm.data.ideaBonus ?? null,
+        justUnlocked: confirm.data.just_unlocked || [],
+      });
+      // The same confirmed→shipped tail a normal ship runs, so a no-artifact resume
+      // lands identically instead of stopping one step short.
+      await finishShip({
+        taskId, summary, advanceToMerge: confirmedStatus === 'confirmed', skipMerge, dbOnly: true,
+        postGradeStatus: confirmedStatus,
+        doneLine: 'Done — confirmed with no artifact (grader had nothing to read).',
+        card: { title: task.title, valueSummary: summary, notes: '' },
+      });
+      return;
+    }
     console.error(`Nothing to grade: the committed diff vs ${graderBaseline || 'baseline'} is empty.`);
     console.error('The grader reads committed history, not the working tree — commit your fixes on this branch, then re-run --regrade.');
+    console.error('If this task is DELIBERATELY artifact-free (a DB-only close, an ops verification), say so:');
+    console.error(`  node scripts/gds/ship.js ${taskId} --allow-empty`);
     process.exit(1);
   }
 

package/scripts/gds/ship-resume.js

@@ -106,6 +106,27 @@ function evaluateResumeAction({ task, lastClaim, builder }) {
   return { action: 'error', reason: `Task #${task.id} is '${status}'. Nothing to resume.` };
 }
 
+// task 1003147: may a re-grade that has NOTHING to grade manual-confirm instead of
+// dead-ending? Pure + exported so the truth table is unit-tested with no git or
+// network, the same contract evaluateResumeAction above carries.
+//
+// Both halves are required, and they are different KINDS of evidence. The empty
+// diff is MEASURED (the caller passes what `git diff --name-only` actually
+// returned); the flag is the builder's DECLARATION that artifact-free is intended.
+// A declaration alone must never be enough — a task with a real diff whose grade
+// failed would otherwise bypass the grader by passing --allow-empty, turning a
+// deadlock fix into a quality hole. When the diff is genuinely empty the grader has
+// nothing to read, so there is no verdict being dodged.
+//
+// A bare re-run (neither flag) keeps dead-ending, deliberately: the overwhelmingly
+// common cause of an empty diff is uncommitted work, and silently confirming that
+// would ship nothing while reporting success.
+function shouldConfirmWithoutGrade({ committedFileCount, args = [] }) {
+  const emptyDiff = Number(committedFileCount) === 0;
+  const declaredNoArtifact = args.includes('--allow-empty') || args.includes('--skip-grade');
+  return emptyDiff && declaredNoArtifact;
+}
+
 // task 941: resume a `confirmed`-but-unshipped task — the merge/deploy leg only
 // (it already passed the grade + earned credits; this is the leg that stalls when
 // a box can't reach the server publish, a poll window expires, etc.). Mirrors the
@@ -148,4 +169,5 @@ module.exports = {
   evaluateRegradeEligibility,
   evaluateResumeAction,
   resumeMerge,
+  shouldConfirmWithoutGrade,
 };

package/scripts/gds/ship.js

@@ -152,7 +152,7 @@ const {
   formatGradeOutcome,
   gradeAndRecord,
 } = require('./ship-grade-steps.js');
-const { evaluateRegradeEligibility, evaluateResumeAction } = require('./ship-resume.js');
+const { evaluateRegradeEligibility, evaluateResumeAction, shouldConfirmWithoutGrade } = require('./ship-resume.js');
 const { regradeMain, shipMain } = require('./ship-flow.js');
 const { fatalRecoveryLines, smokeGateMessages } = require('./ship-honesty.js');
 const { chooseBroadcastTargets } = require('../../modules/discord/ship-broadcast');
@@ -213,6 +213,10 @@ module.exports = {
   // re-run — exported so the truth table (completed→grade, confirmed→merge,
   // ownership, terminal states) is unit-tested with no git/network.
   evaluateResumeAction,
+  // task 1003147: whether a re-grade with NOTHING to grade may manual-confirm
+  // instead of dead-ending — exported so the truth table (empty diff + declared
+  // no-artifact → confirm; a real diff, or no declaration → never) is unit-tested.
+  shouldConfirmWithoutGrade,
   // #747: pre-ship auto-linkify of the ship's own changed docs. The path
   // predicate is pure + exported so the regression test can assert which
   // changed files fall in the linkifier's domain without git/fs/API.

package/src/bongos/claim-attribution.js

@@ -0,0 +1,49 @@
+'use strict';
+// src/bongos/claim-attribution.js — which of a builder's open claims does THIS
+// working tree belong to? (task 1003837)
+//
+// WHY. Two things answer that question — `scripts/gds/conductor-dispatch.js`,
+// which briefs a reviewer on the claim a diff belongs to, and
+// `.claude/hooks/conductor.js`, which measures "changed files outside your
+// claim's declared touches[]" on every prompt. They must not answer it
+// differently, and the hook cannot simply require the dispatcher: the dispatcher
+// pulls in cli-lib, the grader and the autonomy gate at module scope, and the
+// hook's cost posture is explicit that it runs on EVERY prompt and must never
+// crash one. So the rule lives here, in a dependency-free core module both can
+// resolve — the same shape `sensitive-surfaces.js` and `path-match.js` already
+// take for this exact pair, after the Phase 4 dogfood flagged a hand-copied
+// pattern set as a drift risk.
+//
+// The worktree is a FACT, not a guess. `claim.js` records the worktree it was
+// run in, and the project default is one claim per worktree (task 1642), so a
+// name match attributes the tree with certainty. That is worth keeping separate
+// from the dispatcher's touches[]-overlap heuristic, which is a guess and is
+// labelled as one.
+
+const path = require('node:path');
+
+// The claim bound to `worktreeName`, or null. Exact match: the worktree name is
+// a recorded identifier, not a pattern, so a near-miss is a different tree.
+function claimForWorktree(claims, worktreeName) {
+  if (!Array.isArray(claims) || !worktreeName) return null;
+  return claims.find((c) => c && c.worktree_name && c.worktree_name === worktreeName) || null;
+}
+
+// The worktree name for a directory — its basename, which is what `claim.js`
+// stores. Returns null for an empty/garbage input so callers get "unknown"
+// rather than a name that cannot match anything.
+//
+// Backslashes are normalized BEFORE the basename, then `path.posix` does the
+// split, so the answer does not depend on which platform is asking. Plain
+// `path.basename` is the platform's: on POSIX it splits only on `/`, so a
+// Windows path arrives back whole — `C:\…\task-1003837` would BE the worktree
+// name, matching nothing. This repo keeps finding that same defect (task
+// 1003821 was two CI-invisible instances of it), and `scripts/gds/worktree.js`
+// already normalizes backslashes first for exactly this reason.
+function worktreeNameFor(dir) {
+  const d = String(dir || '').trim().replace(/\\/g, '/').replace(/\/+$/, '');
+  if (!d) return null;
+  return path.posix.basename(d) || null;
+}
+
+module.exports = { claimForWorktree, worktreeNameFor };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.689'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.691'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/conductor.mjs

@@ -10,6 +10,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
 import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
@@ -129,11 +130,15 @@ test('wandering: lowest priority — emitted after methodology/status advisories
   assert.equal(a[a.length - 1].id, 'wandering', 'wandering is emitted last');
 });
 
+// The nudge says "your claim's", singular, so it is measured against the claim
+// bound to THIS worktree (task 1003837). These three carry a worktree_name and a
+// matching `worktree` for that reason; the four below pin what changed.
 test('outside-touches fires for files outside the claim touches[]', () => {
   const a = conductor.evaluateTriggers({
     changedFiles: ['src/bongos/grader.js', 'server.js'],
     prompt: 'edits',
-    activeClaims: [{ task_id: 1, title: 't', touches: ['src/bongos/grader.js'] }],
+    activeClaims: [{ task_id: 1, title: 't', touches: ['src/bongos/grader.js'], worktree_name: 'task-1' }],
+    worktree: 'task-1',
   });
   const outside = a.find((x) => x.id === 'outside-touches');
   assert.ok(outside, 'expected outside-touches advisory');
@@ -144,7 +149,8 @@ test('outside-touches does NOT fire when all changes are covered', () => {
   const a = conductor.evaluateTriggers({
     changedFiles: ['src/bongos/grader.js', 'migrations/053_x.sql'],
     prompt: 'edits',
-    activeClaims: [{ task_id: 1, title: 't', touches: ['src/bongos/grader.js', 'migrations/'] }],
+    activeClaims: [{ task_id: 1, title: 't', touches: ['src/bongos/grader.js', 'migrations/'], worktree_name: 'task-1' }],
+    worktree: 'task-1',
   });
   assert.ok(!ids(a).includes('outside-touches'));
 });
@@ -153,7 +159,71 @@ test('outside-touches does NOT fire when the claim has empty touches[] (fresh ta
   const a = conductor.evaluateTriggers({
     changedFiles: ['src/bongos/grader.js'],
     prompt: 'edits',
-    activeClaims: [{ task_id: 1, title: 't', touches: [] }],
+    activeClaims: [{ task_id: 1, title: 't', touches: [], worktree_name: 'task-1' }],
+    worktree: 'task-1',
+  });
+  assert.ok(!ids(a).includes('outside-touches'));
+});
+
+// THE BUG (task 1003837). The pool measured the line partly against somebody
+// else's declared paths. The shape is the one observed on 2026-09-10: the claim
+// you are in declares three exact files, a concurrent claim declares four broad
+// directories, and those directories cover the very files the nudge should have
+// named. Under the pool this fired with ONE file; it must name both.
+test('outside-touches ignores a CONCURRENT claim\'s touches[] — the under-report', () => {
+  const a = conductor.evaluateTriggers({
+    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/gds/ship.js', 'docs/adr/0280-x.md'],
+    prompt: 'edits',
+    activeClaims: [
+      { task_id: 1, title: 'mine', touches: ['modules/hall-ui/public/studio.js'], worktree_name: 'task-1' },
+      { task_id: 2, title: 'theirs', touches: ['scripts/gds/', 'src/bongos/', 'modules/', 'clients/'], worktree_name: 'task-2' },
+    ],
+    worktree: 'task-1',
+  });
+  const outside = a.find((x) => x.id === 'outside-touches');
+  assert.ok(outside, 'expected outside-touches advisory');
+  // studio.js is covered by MY claim; the other two are not covered by anything
+  // of mine. Under the pool, `modules/` and `scripts/gds/` swallowed them and
+  // the line read "1 changed file(s)".
+  assert.match(outside.text, /^2 changed file\(s\)/, 'both uncovered files must be counted, not one');
+});
+
+test('outside-touches counts only what MY claim fails to cover', () => {
+  const a = conductor.evaluateTriggers({
+    changedFiles: ['modules/hall-ui/public/studio.js', 'scripts/gds/ship.js', 'docs/adr/0280-x.md'],
+    prompt: 'edits',
+    activeClaims: [
+      { task_id: 1, title: 'mine', touches: ['modules/hall-ui/public/studio.js'], worktree_name: 'task-1' },
+      { task_id: 2, title: 'theirs', touches: ['scripts/gds/', 'modules/'], worktree_name: 'task-2' },
+    ],
+    worktree: 'task-1',
+  });
+  const outside = a.find((x) => x.id === 'outside-touches');
+  assert.match(outside.text, /scripts\/gds\/ship\.js/, "the other claim's directory must not cover my diff");
+  assert.match(outside.text, /docs\/adr\/0280-x\.md/);
+  assert.doesNotMatch(outside.text, /studio\.js/, 'my own declared file is still covered');
+});
+
+// The owner's call, recorded in the task: an unbound tree is SILENT rather than
+// falling back to the pool. There is no "your claim" to measure against, and a
+// number derived from another claim's touches[] is the defect, not a degraded
+// version of it. Trigger 1 still covers having no claim at all.
+test('outside-touches is SILENT when no claim is bound to this worktree', () => {
+  const claims = [{ task_id: 2, title: 'theirs', touches: ['scripts/gds/'], worktree_name: 'task-2' }];
+  for (const worktree of ['cloud-bongos', null, undefined, '']) {
+    const a = conductor.evaluateTriggers({
+      changedFiles: ['server.js', 'scripts/gds/ship.js'], prompt: 'edits', activeClaims: claims, worktree,
+    });
+    assert.ok(!ids(a).includes('outside-touches'), `unbound tree (${String(worktree)}) must not borrow another claim's touches[]`);
+  }
+});
+
+test('outside-touches is SILENT for a claim predating the worktree_name column', () => {
+  const a = conductor.evaluateTriggers({
+    changedFiles: ['server.js'],
+    prompt: 'edits',
+    activeClaims: [{ task_id: 1, title: 'old', touches: ['src/bongos/'], worktree_name: null }],
+    worktree: 'task-1',
   });
   assert.ok(!ids(a).includes('outside-touches'));
 });
@@ -478,6 +548,36 @@ test('attribution: claimForWorktree ignores claims with no recorded worktree', (
   assert.equal(dispatch.claimForWorktree(null, 'task-x'), null);
 });
 
+// ONE DEFINITION, BOTH CONDUCTORS (task 1003837). The dispatcher and the hook
+// answer "which claim is this tree?" and must not answer it differently — the
+// drift this file's own header warns about, after the Phase 4 dogfood found a
+// hand-copied pattern set. The dispatcher re-exports the shared rule, so identity
+// is the assertion: a second copy would pass a behavioural test and fail this one.
+test('attribution: the hook and the dispatcher share ONE claimForWorktree', () => {
+  const shared = require('../src/bongos/claim-attribution.js');
+  assert.equal(dispatch.claimForWorktree, shared.claimForWorktree, 'the dispatcher must re-export the shared rule, not re-derive it');
+  // …and the hook resolves that same module rather than inlining a find().
+  const hookSrc = readFileSync(new URL('../.claude/hooks/conductor.js', import.meta.url), 'utf8');
+  assert.match(hookSrc, /requireCore\('src\/bongos\/claim-attribution'\)/, 'the hook resolves the shared module');
+  assert.doesNotMatch(hookSrc, /flatMap\(\(c\) => \(Array\.isArray\(c\.touches\)/, 'the touches POOL must not come back');
+});
+
+// PLATFORM-INDEPENDENT on purpose. These assertions must hold identically on the
+// Windows box a builder runs on and the POSIX box CI runs on — `path.basename`
+// splits only on `/` under POSIX, so a Windows path would come back whole and
+// match no claim, and this test would red on CI while passing locally.
+test('attribution: worktreeNameFor is the basename claim.js records, on either platform', () => {
+  const { worktreeNameFor } = require('../src/bongos/claim-attribution.js');
+  assert.equal(worktreeNameFor('/repo/.claude/worktrees/task-1003837'), 'task-1003837');
+  assert.equal(worktreeNameFor('C:\\repo\\.claude\\worktrees\\task-1003837'), 'task-1003837', 'a Windows path must resolve the same way under POSIX');
+  assert.equal(worktreeNameFor('C:/repo/.claude/worktrees/task-1003837'), 'task-1003837');
+  assert.equal(worktreeNameFor('/repo/.claude/worktrees/task-1003837/'), 'task-1003837', 'a trailing separator must not erase the name');
+  assert.equal(worktreeNameFor('C:\\repo\\worktrees\\task-1003837\\'), 'task-1003837');
+  assert.equal(worktreeNameFor(null), null);
+  assert.equal(worktreeNameFor(''), null);
+  assert.equal(worktreeNameFor('   '), null);
+});
+
 test('isCovered now delegates to the canonical matcher (still correct)', () => {
   // Regression guard for the dedup: isCovered is a thin wrapper over
   // path-match.matchOne (relocated from the deleted touches-scan in task 879),

package/tests/ship_resume.mjs

@@ -17,9 +17,11 @@
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
+import { shipCliSource } from './helpers.mjs';
+
 const require = createRequire(import.meta.url);
 const ship = require('../scripts/gds/ship.js');
-const { evaluateResumeAction } = ship;
+const { evaluateResumeAction, shouldConfirmWithoutGrade } = ship;
 
 let passed = 0;
 let failed = 0;
@@ -124,6 +126,57 @@ test('completed + owner with low rank still resumes (ownership, not rank)', () =
   assert.equal(a.via, 'owner');
 });
 
+// ---- task 1003147: the artifact-free resume that used to deadlock ----------
+// HIT FOR REAL on task 1003146. A kind=verify task landed at 'completed' with no
+// grade row; every documented escape (--allow-empty, --skip-grade, --verified) was
+// swallowed by the same "Nothing to grade" bail, because shipMain routes ANY
+// 'completed' task into the re-grade before reading a flag. The manual-confirm
+// path a no-artifact task needs is unreachable from 'completed' any other way.
+
+test('empty diff + --allow-empty → confirm instead of bailing (the 1003146 shape)', () => {
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--allow-empty'] }), true);
+});
+
+test('empty diff + --skip-grade → confirm (the other documented no-artifact flag)', () => {
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146', '--skip-grade'] }), true);
+});
+
+test('a REAL diff + --allow-empty still grades — the flag is not a grader bypass', () => {
+  // The hole this guard exists to avoid: if a declaration alone were enough, a task
+  // whose grade FAILED could dodge the verdict by re-running with --allow-empty.
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 3, args: ['1003146', '--allow-empty'] }), false);
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 1, args: ['1003146', '--skip-grade'] }), false);
+});
+
+test('empty diff with NO flag keeps dead-ending — uncommitted work must not "ship"', () => {
+  // The overwhelmingly common cause of an empty diff is forgetting to commit.
+  // Confirming that silently would report success having shipped nothing.
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0, args: ['1003146'] }), false);
+});
+
+test('the empty-diff guard is actually WIRED to the decision, not just exporting it', () => {
+  // A pure truth table proves the decision, not that anything calls it. Without
+  // this, the guard could revert to its unconditional `process.exit(1)` and every
+  // case above would still pass — the deadlock back, the tests still green.
+  const src = shipCliSource();
+  // Match the CALL, not the declaration. shipCliSource() spans the whole ship
+  // family including ship-resume.js, where the function is DEFINED as
+  // `shouldConfirmWithoutGrade({ committedFileCount, args })` — a looser pattern
+  // matches that signature and passes even with the call site deleted. Verified:
+  // with the guard stubbed to `if (false)`, the loose form stayed green.
+  // `committedFiles.length` exists only at the call site.
+  assert.match(src, /shouldConfirmWithoutGrade\(\{\s*committedFileCount:\s*committedFiles\.length/,
+    'the re-grade empty-diff guard must CALL shouldConfirmWithoutGrade, not merely export it');
+  assert.match(src, /postTasksIdConfirm\(\{ id: taskId, body: \{ verified \} \}\)/,
+    'and reaching it must land on the manual-confirm route a no-artifact task needs');
+});
+
+test('shouldConfirmWithoutGrade: defaults and odd inputs never throw', () => {
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: 0 }), false, 'no args → no declaration');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: '0', args: ['--allow-empty'] }), true, 'a numeric string still counts as empty');
+  assert.equal(shouldConfirmWithoutGrade({ committedFileCount: undefined, args: ['--allow-empty'] }), false, 'an unknown count is not an empty one');
+});
+
 console.log('');
 console.log(`ship_resume: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);