@bongos/core 1.19.74 → 1.19.76

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.74",
-  "core_contract": "1.19.74",
-  "source_commit": "d787054c27d08d176df33c8e399e418208c52970",
+  "core_version": "1.19.76",
+  "core_contract": "1.19.76",
+  "source_commit": "c120e5f2382927ea4eeb8b49b3a8f14bb5767fed",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T18:35:45.992Z",
+  "built_at": "2026-08-12T20:27:52.529Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 294,
+    "docs_redacted": 295,
     "agent_docs_stubbed": 21,
     "functional_verbatim": 1225,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1540,
-  "tree_sha256": "0a02d8b68bd8efadd9f7e743f3611f15df6386f7d00faada620f992f2c02c16b",
+  "file_count": 1541,
+  "tree_sha256": "256191beb3508d344b1cd505975827c265ec5fe89158c0bcbb92e5e7f0a0c030",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1384,6 +1384,11 @@
       "mode": "0000644",
       "sha256": "8a8430af4bbf082d3bab28d5b82b353a6921782014c2852a87eb1056ba101722"
     },
+    {
+      "path": "docs/design/projects-surfaces-redesign-direction.md",
+      "mode": "0000644",
+      "sha256": "90babf214f3ef90e44943af2dcb129aa2b8cfb9326d1f8cfdd19768db3fd6715"
+    },
     {
       "path": "docs/design/vanilla-hall-ui-redesign-scope.md",
       "mode": "0000644",
@@ -3407,7 +3412,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "9658ccf0dd332d6c4ce1e269c2966ebe2e2bed5f909d5d503722d8e8cfb1ebbc"
+      "sha256": "f090fbe484a1c9e8bf40d2871a150cef8ce73199455e54e44d117ce1ebc21da5"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3462,7 +3467,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "3f7f65007955c419ccce1c89cb1f6da6eeca6daa8a76a738540db2858ebff4e6"
+      "sha256": "54fd7ba3024169f5887fe58182ba03519e66acbbf28c1b753712dbd36f91da01"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -4052,12 +4057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d0b663a6340d0e7700e2fe992079b18ef944713ab0fa70cd2968d1e88b0a5d00"
+      "sha256": "599fff93b9ec8c3f6c83cd9a182d9338bea5c289ba1305bb66a69c2818aee8cf"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3a02ffaba36536f1cb94af269085f0c70917beaaf0f7d8352c80315df6b35047"
+      "sha256": "3e61cb13243d69633f0b8ba4f1b48492f3c16077ada93e1ce3105f16285c3b51"
     },
     {
       "path": "public-docs/index.html",
@@ -5252,7 +5257,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "aa77aef41188c5ef596c9c5e7e89f54f97c93b6e889e1c776b8fe34c8af66cce"
+      "sha256": "be7d4d35f8f19e4687e9a8444ca36c222895805a7ec35952f92a27ef567ed2b5"
     },
     {
       "path": "scripts/gds/smoke-batch-claim.sh",
@@ -5682,7 +5687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "86ff9793b37b3aa8d738e0856ae90bd5499e7c40189e4ecd72b950da14f74909"
+      "sha256": "b89d3c0f58693902c0632ef681849e5c0981a62d3eea34ae6096182c998419bf"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6467,7 +6472,7 @@
     {
       "path": "tests/github_push_land_proof.mjs",
       "mode": "0000644",
-      "sha256": "c55433099e4681a8dd091873e9f8687f35e629b4a4ad3a3c3dd462860070fc59"
+      "sha256": "3774072a50fb6ffdadfe2c890e8828473b72456f1c213f812c14eb08c74401a4"
     },
     {
       "path": "tests/github_push_merge_driver.mjs",
@@ -7227,7 +7232,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "1aeb87a14e411160784c94ee5392f323a2ad0a373bd9acf91337289041e8d2bc"
+      "sha256": "fe4b594292992429fe5e077491fa2916028a2f1815414f94434f83b4186b1138"
     },
     {
       "path": "tests/rank_gate.mjs",

package/docs/design/projects-surfaces-redesign-direction.md

@@ -0,0 +1,157 @@
+# Projects Surfaces — Redesign Direction
+
+> **Task 1002695** (goal 1000059 "Projects surface revamp", R06) · direction decided with the owner 2026-08-12.
+> Feeds **task 1002696** (R07 — the implementation carrier) and the re-walk (task 1002697, with task 1002715 folded in).
+> Findings feed: the QA/UAT checkpoint walk (task 1002702, [session log](../session-logs/<redacted>.md)) and the truthfulness cluster (task 1002720, findings F15–F23).
+
+Scope: the three owner-facing project surfaces — the **create wizard** (`public-landing/create.html`), the **done panel** (`panel-done` in the same file), and the **manage view** (`public-landing/projects.html`, served at `/projects`). **All three live on the apex host — `cloudbongos.com` — and stay there.** Project creation and management are not builders-hall surfaces; the hall (builders subdomain) may link *out* to them, nothing more. The gate catalog stays with goal 1000031; the hall's federation my-projects page is a different surface and is out of scope.
+
+---
+
+## 0. Starting point — what exists today
+
+- The flows **work end-to-end** (verified live on both venues by the checkpoint walk): create → address → GitHub sign-in → manage → teardown. What's broken is the *trust surface*, not the plumbing.
+- Both pages are self-contained orphans: one inline `<style>` each, hand-rolled `:root`, no shared components, ~half the palette hardcoded past the branding contract's reach. The repo holds three unrelated design systems (sunrise landing, indigo hall kit, marble status page); these surfaces belong to the sunrise family but share no code with anything.
+- Lifecycle truth lives in `provisioning_instances.status` — six runner-written states: `requested · provisioning · active · tearing_down · torn_down · error`. The UI maps them to chips (`queued / standing up / live / snagged / tearing down / torn down`).
+- The three failure themes the walk proved (details in §§2–5): the platform asserts states it never verified, in both directions; the copy speaks operator; and the first-run paths (self-host, first admin, newborn instance) were never designed.
+
+## 1. Decisions (owner, 2026-08-12)
+
+1. **Truth model: heartbeat + honest chips.** The platform re-checks liveness on a background cadence and the UI shows verification recency. "Live" becomes a verified claim.
+2. **Visual system: sunrise, tokenized — refined through design iterations.** Keep the sunrise landing brand; extract a shared token + component layer; the final look is nailed down through owner-review loops during implementation (§10), not invented in this doc.
+3. **First-run: designed now, delivered split.** This direction defines the shape-aware surfaces; task 1002696 implements the surface parts, and runner/infra hardening stays in its parallel lane (tasks 1002717–1002722).
+4. **Deliverable: this direction doc.** Owner sign-off on this doc is the task's done condition.
+
+Also folded in, decided earlier the same day: **task 1002704 — auto-assign `<slug>.cloudbongos.com` at creation, opt-out.** The address step collapses from a form into a confirmation (§6).
+
+## 2. Principles
+
+1. **The UI only asserts what the platform verified — and says when.** Every liveness claim carries recency. Unverified is stated as unverified, never dressed as fact.
+2. **Copy speaks owner, not operator.** No raw tool output on a card. No wall-clock promises. No process jargon. What happened, what it means, what (if anything) the owner can do.
+3. **Deliberate end-states are calm.** A teardown the owner asked for is not an error and is never styled as one.
+4. **Every flow owns its vocabulary.** Stage labels are never reused across flows — a card being torn down must not render a stage named "Live".
+5. **Surfaces are honest about hosting shape.** A step renders only if somebody real will actually perform it on this instance's shape. Dead copy is a broken promise.
+6. **One themeable token layer.** Everything an instance can't re-theme through the branding contract is a bug.
+
+## 3. Truth model — the verification overlay
+
+Verification is an **overlay on lifecycle, not a new lifecycle state**. The runner's six statuses stay untouched; verification adds recorded observations about whether the instance actually answers.
+
+**Server (small piece, ships inside task 1002696):**
+- `provisioning_instances` gains `last_verified_at` (timestamptz) and `last_verified_up` (boolean); both nullable.
+- A heartbeat sweep in the provisioning module (in-process interval on the control plane, ~5-minute cadence with jitter) probes every `active` instance: `GET https://<domain>/healthz` when addressed, the recorded local port otherwise, short timeout. It writes the two columns and never flips `status`.
+- `GET /provisioning/instances` and `/:id` expose both fields.
+
+**Display contract (chips on both surfaces):**
+
+| Condition | Chip |
+|---|---|
+| `active`, last probe up, fresh (≤ 2 cadences) | **live** · checked 2m ago (green) |
+| `active`, last probe failed | **unreachable** · since 14:02 (amber/red) |
+| `active`, never probed or stale probe | **live?** · last seen 3h ago (amber) |
+
+- The manage view refreshes settled cards on a slow interval (~60s) and on tab focus, so the overlay stays current while someone is looking. (Today an `active` card never polls again and can never self-correct.)
+- Provision-time gating (walk finding F15 — the runner declared `active` after a failed probe) is **task 1002720's** server work; this direction sets its display contract: the runner either gates `active` on a passing probe or writes `last_verified_up=false` that the UI must render.
+- The inverse direction (F23 — a *successful* GitHub-App setup recorded as failed after a restart race, then a single-use manifest code retried forever) is also task 1002720's; the display contract here is that the done panel's sign-in step **waits and re-verifies** before declaring failure, and never claims failure for a setup it hasn't conclusively observed failing.
+- Address attach (F16): "answering at `<domain>`" is claimed only after a probe **against the domain** succeeds. If DNS wiring was skipped (no hook), the card says exactly what's left: "point your domain's A record at `<ip>` — we'll confirm once it answers."
+
+## 4. Vocabulary — states, chips, strips
+
+**Chips** (one set, both surfaces): `queued · standing up · live (·recency) · live? · unreachable · snagged · tearing down · torn down`. `torn down` renders neutral (faint ink, no color), never red.
+
+**Progress strips are per-flow** — distinct labels, chosen by the open intent on the card (F22), not by lifecycle status alone:
+
+| Flow | Stages |
+|---|---|
+| Standup | Request filed → Standing it up → Live |
+| Teardown | Teardown queued → Winding down → Torn down |
+| Revive | Revive queued → Standing it up → Back live |
+| Address | Address queued → Wiring the address → Answering at `<domain>` |
+
+- A torn-down card with a pending revive intent shows the **revive strip** — never "you can start another project below" (F22's actively-wrong guidance).
+- A strip's final stage lights only when the truth model confirms it (probe answered), not when the runner finishes its script.
+
+## 5. Copy rules — owner voice
+
+1. **Errors are a plain sentence + a disclosure.** Map the failed runner step to an owner-facing category — "We couldn't reach the project's repository," "The server didn't come up," "The address didn't wire up." The raw `error_note` (git stderr, ssh noise) moves into a `<details>` labeled "Technical details" — present for whoever helps, never the headline.
+2. **No wall-clock promises.** Kill "usually under a minute" and friends. Describe what's happening and what happens next; never how long.
+3. **Retry honesty (F19).** Intents retire after 3 attempts and nothing auto-retries. The snagged card says so — "Stopped after 3 tries" — and gains an owner-facing **Try again** action that re-enqueues (the enqueue API already accepts re-provisioning; wire it). "The platform keeps retrying" copy dies.
+4. **Teardown truth (F17) — decided: the database is not dropped.** (Owner, 2026-08-12: no database drop unless we find otherwise — retention is policy, not an accident.) The confirm and the torn-down card say so plainly: the server goes away, the repository stays the owner's, the database is kept and recoverable by the operator. Copy always states exactly what the runner does.
+5. **Repo visibility is stated, always (task 1002721).** Every path that creates or adopts a repo says whether it will be public or private, before the owner commits — GitHub's own UI must never be the first place visibility appears.
+6. **Newborn welcome (idea 1000701).** A freshly-provisioned instance greets its founding owner with a welcome moment, and account nags (billing, art-key coverage) are suppressed until first-run completes.
+
+## 6. Surface · Create wizard
+
+Beats stay **Name · Home · Address · Create** — the flow shape survives; the address beat changes meaning and everything gets the copy + token pass.
+
+- **Gate panel:** unchanged in flow (GitHub sign-in, AGPL trust link); copy pass only.
+- **Name panel:** unchanged in flow; the live slug hint becomes the seed of the address confirmation.
+- **Home panel:** the three-way progressive branch (picker / manual / fresh) survives; the manual path and the fresh path both state repo visibility explicitly (§5.5).
+- **Address panel — collapses to a confirmation (task 1002704):** headline shows the assigned address — "`<slug>.cloudbongos.com` — yours from the moment it stands up." The slug stays editable inline (revalidating availability). A disclosure "Use a domain I own" holds the custom-domain input. Starting without an address remains possible only inside that disclosure, with the honest consequence stated: "sign-in on your instance can't be set up until it has an address."
+- **Review panel:** the Domain row becomes the Address row and always shows the resolved address.
+
+## 7. Surface · Done panel
+
+- **Keep** the canonical-plan rendering (task 1002694's work: checklist from `GET /provisioning/onboard-plan`, manifest-driven sign-in leg, live tick states).
+- **Shape-awareness:** the plan endpoint tags each step with the hosting shapes it applies to; the panel renders only steps real for this instance's shape. On shapes with no control-plane runner, `auto` steps either disappear or convert to explicit owner-instructions — no promise a runner will do what no runner exists to do.
+- **The progress strip obeys the truth model:** "Live" lights on a verified answer, not on script completion; a lost verification race shows "confirming…" rather than a false ✖ (F23 display contract).
+- **A door out:** the panel ends with a link to `/projects` — "watch it any time from Your projects."
+
+## 8. Surface · /projects (manage view)
+
+- **Card anatomy stays** (name + chip → meta → address → strip → message → actions) with the §3 chip overlay, §4 per-flow strips, and §5 message rules.
+- **New actions:**
+  - **Bring it back** on `torn_down` cards — the enqueue API already revives a torn-down slug; the walk had to do it raw. Button + confirm, revive strip while it runs.
+  - **Try again** on `snagged` cards (§5.3).
+- **Address row** shows the auto-assigned domain post-1002704; attach/change stays for custom domains, claiming "answering" only per §3.
+- **Navigation doors (the page is currently orphaned):** the gate gets a signed-in "Your projects" door; the done panel links out (§7); the hall gets a cross-host link out to `cloudbongos.com/projects` (a door only — the surface itself never moves to the hall host). At least the gate and done-panel doors ship with task 1002696.
+- **Refresh model:** slow interval + on-focus refetch for settled cards (§3); active-intent cards keep today's 5s poll.
+
+## 9. First-run — designed now, delivered split
+
+| First-run gap (walk source) | Design (this direction) | Delivery |
+|---|---|---|
+| Done panel promises a runner self-hosts don't have (task 1002717) | Shape-aware plan rendering (§7) | **task 1002696** |
+| `FIRST_ADMIN` invisible — first user bounced to a nonexistent Owner (task 1002717) | A virgin instance's sign-in surface says plainly: "No one is admitted yet — the instance operator names the first admin," and points at the one-line fix (env var / branding field) | copy surface with task 1002696 where it lives in core UI; self-host docs + recipe with the **1002717 lane** |
+| Newborn instance greets its founder with "your art coverage has ended" (idea 1000701) | §5.6 welcome + nag suppression until first-run completes | **task 1002696** if it stays a small `needs`-gating change; otherwise spun out as its own task |
+| `/create` + `/projects` unreachable on single-origin self-hosts (task 1002717) | Out of this direction's hands — a mounting/architecture question | **1002717 lane** |
+| Runner assumes the founder's box six ways; founder-identity hardcodes (tasks 1002718, 1002719) | Not a surface concern | **hardening lane** |
+| Refuse-unknown dispatch + runner-drift gate (task 1002722) | Not a surface concern | **hardening lane** |
+
+## 10. Visual system — sunrise, tokenized, iterated
+
+**Base:** the sunrise landing brand stays — these surfaces are continuous with the gate, not the hall.
+
+**Token + component layer** (new, shared by the three surfaces — e.g. `public-landing/assets/sunrise.css`):
+- Tokens aligned to the branding contract's themeable set. The currently-hardcoded semantics (`--card`, `--line`, `--ok`, `--err`, chip fills, strip states, sky gradients) become tokens **derived from contract vars via `color-mix`** where that reads well; the contract's `COLOR_VARS` set is extended only where derivation fails aesthetically. End state: an instance pack re-themes the whole page, not half of it.
+- Component set: page shell (sky header), card, chip, progress strip, step list, choice card, field row, disclosure, confirm dialog. Types and states defined once, used by all three surfaces.
+
+**Iteration loops (owner-requested — the look is nailed by review, not by this doc):**
+1. **Loop 1 — component sheet.** A static mock page showing the token palette and every component in every state (all chips, all strips, a card in each lifecycle). Owner reviews and directs before any surface is rebuilt.
+2. **Loop 2 — applied surfaces.** The three rebuilt surfaces staged for an owner walk (stage preview or static) before task 1002696 ships.
+3. **Final gate:** the re-walk (task 1002697, with the true-stranger pass task 1002715) is the acceptance test for the whole act.
+
+## 11. Scope boundaries
+
+**In (task 1002696 implements):** the three surfaces rebuilt on the shared token/component layer; heartbeat sweep + two columns + API exposure; chip overlay + per-flow strips; owner-voice copy pass incl. error categories + disclosures; address-step collapse (task 1002704); repo-visibility statements; Bring-it-back + Try-again actions; nav doors (gate, done panel); shape-aware done panel; newborn welcome/nag suppression (if small).
+
+**Parallel (hardening lane, already seeded):** provision-time healthz gating, no-hook attach honesty, teardown-vs-dropdb reality, manifest race + spent-code fix (task 1002720); self-host reachability + FIRST_ADMIN recipe (task 1002717); runner assumptions (task 1002718); founder-identity hardcodes (task 1002719); dispatch/drift gates (task 1002722).
+
+**Out:** the gate catalog (goal 1000031); the hall's federation my-projects surface; unreachable-instance Discord alerts (owner wants them — captured as idea 1000703, a follow-up on top of the heartbeat, deliberately not in task 1002696).
+
+## 12. Implementation seams — what task 1002696 must not break
+
+- The canonical onboard-plan contract (`GET /provisioning/onboard-plan`) and its consumers — the done panel renders *from* it; shape-awareness extends the plan, it doesn't fork it.
+- The GitHub-App manifest flow (`startManifest` → public status/callback routes) — the one-click sign-in leg keeps working mid-redesign.
+- The `sessionStorage` create-draft resume behavior.
+- Branding injection: `landingPage()` string tokens (`{{productName}}` etc.) and `themeMarkup()`'s `:root` override — the new token layer must sit *under* it, not fight it.
+- Apex-host mounting (`isApexHost`) — moving these pages off the control plane is 1002717-lane work, not this task.
+- The provisioning API surface consumed by other callers; additions only, no breaking changes.
+- `tests/onboard.mjs` and the walk's verified legs — the re-walk (task 1002697) must pass everything the checkpoint walk passed.
+
+## 13. Sign-off dispositions (owner, 2026-08-12)
+
+No open questions remain — both were decided at sign-off:
+
+1. **Teardown does not drop the database** — retention is deliberate policy unless we find otherwise (§5.4). Any future change starts with the runner, and the copy follows it.
+2. **Unreachable-instance Discord alerts: yes** — captured as idea 1000703, a follow-up on top of the heartbeat, outside task 1002696's scope.

package/modules/lifecycle/github-push.js

@@ -497,7 +497,12 @@ async function findTaskPullRequest({ taskId }, deps = {}) {
   if (!res.ok) throw err('STATUS_FETCH_FAILED', { status: res.status });
   const prs = await res.json();
   if (!Array.isArray(prs)) return null;
-  const titleRe = new RegExp(`^task\\s+#?${Number(taskId)}\\b`, 'i');
+  // task 1002723: real ships also title PRs with the COMMIT SUBJECT carrying a
+  // "(task <id>)" suffix (PR #89 — "docs: session log … (task 1002702)"), which the
+  // prefix-only match missed, stranding the task. A parenthesized exact id in the
+  // TITLE is still a title-level bind — body mentions stay excluded (see above).
+  const id = Number(taskId);
+  const titleRe = new RegExp(`(?:^task\\s+#?${id}\\b)|(?:\\(task\\s+#?${id}\\))`, 'i');
   for (const pr of prs) {
     if (!pr || !titleRe.test(String(pr.title || ''))) continue;
     const head = pr.head || {};

package/modules/lifecycle/publish-reconciler.js

@@ -78,8 +78,13 @@ const seams = require('../../src/module-api');
 const conflictResolve = require('./conflict-resolve');
 
 // 5-min cadence: frequent enough that a strand heals within minutes of CI
-// finishing, cheap enough that the GitHub API cost is negligible (2 calls per
-// confirmed task per sweep, a handful of tasks). Override for tests/ops.
+// finishing, cheap enough that the GitHub API cost is negligible: steady state
+// is 2 status-path calls per confirmed task per sweep (+1 title-search when no
+// PR is known). A task whose convention is not yet known walks up to three
+// candidates ONCE (≤6 calls); the winning branch — or, when nothing is found,
+// the conventional first candidate — is memoized per worktree, so every later
+// sweep probes one branch and leaves discovery to the title search. Override
+// for tests/ops.
 const INTERVAL_MS = Number(process.env.PUBLISH_RECONCILE_MS) || 5 * 60_000;
 // A first sweep shortly after boot so a strand left by the previous process (e.g.
 // a deploy that restarted the server mid-poll) heals fast, not on the next tick.
@@ -97,6 +102,10 @@ const STALE_CONFIRMED_MS = Number(process.env.PUBLISH_RECONCILE_STALE_MS) || 30
 // a persistently-red branch surfaces via the STALE strand WARN above).
 const MAX_STALE_HEAL_ATTEMPTS = Number(process.env.PUBLISH_RECONCILE_MAX_HEAL) || 3;
 const healAttempts = new Map(); // branch -> regen-heal attempts this process
+// task 1002723 (round 2): worktree_name -> the branch convention that owned its PR
+// last sweep, so steady-state sweeps probe ONE branch (2 calls) instead of walking
+// all three candidates every tick. In-memory like healAttempts; pruned per sweep.
+const branchHomes = new Map();
 
 let intervalTimer = null;
 let firstTimer = null;
@@ -186,14 +195,15 @@ async function runSweep(deps = {}) {
   }
 
   // Safety: a worktree_name can be reused across sequential (released) claims, so
-  // two confirmed tasks could derive the SAME branch. We can't tell which task a
-  // merged PR belongs to, so we skip ambiguous branches (logged) and leave them
+  // two confirmed tasks could derive the SAME branch set. We can't tell which task
+  // a merged PR belongs to, so we skip ambiguous worktrees (logged) and leave them
   // for manual handling rather than risk shipping the wrong task's row.
-  const branchCount = new Map();
+  // task 1002723: keyed on the worktree_name itself — every branch candidate is
+  // derived from it, so one ambiguous wt poisons all its candidates equally.
+  const wtCount = new Map();
   for (const r of rows) {
     if (!r.worktree_name) continue;
-    const b = `claude/${r.worktree_name}`;
-    branchCount.set(b, (branchCount.get(b) || 0) + 1);
+    wtCount.set(r.worktree_name, (wtCount.get(r.worktree_name) || 0) + 1);
   }
 
   let reconciled = 0;
@@ -205,8 +215,15 @@ async function runSweep(deps = {}) {
   let unprovable = 0;   // confirmed tasks the sweep could not prove landed this pass
   let staleStrands = 0; // of those, the ones older than STALE_CONFIRMED_MS (WARN'd)
   let strandsFlagged = 0; // task 1002606: needs_rebase flags NEWLY set this sweep (any site)
+  // task 1002723: one entry per confirmed task per sweep ("<id>:<disposition>").
+  // The 1002702/1002716 strands sat through 5+ sweeps with ZERO journal evidence
+  // the sweep even saw them — young unprovables were a silent `continue`. Silence
+  // must not masquerade as health; this feeds the always-on line below.
+  const dispositions = [];
   const attempts = deps.healAttempts || healAttempts; // injectable for deterministic tests
+  const homes = deps.branchHome || branchHomes;       // task 1002723: wt -> winning branch (injectable)
   const branchesSeen = new Set();                     // to prune the attempts map post-sweep
+  const wtSeen = new Set();                           // to prune the branchHomes map post-sweep
   const nowMs = Date.now();
 
   // task 1002606 — the ONE exit for every strand signal: flag needs_rebase
@@ -430,23 +447,62 @@ async function runSweep(deps = {}) {
   };
 
   for (const r of rows) {
-    let branch = r.worktree_name ? `claude/${r.worktree_name}` : null;
-    if (branch) branchesSeen.add(branch);
-    const branchUsable = !!branch && push.isSafeBranch(branch) && branchCount.get(branch) === 1;
-    if (branch && branchCount.get(branch) > 1) {
-      // A reused worktree_name maps a branch to >1 confirmed task, so a merged PR is
-      // ambiguous — but each task's OWN head_sha is not, so we skip only the branch/PR
-      // path and let the head_sha ancestry land-check below resolve it unambiguously.
-      logFn(`[publish-reconciler] task ${r.task_id}: branch ${branch} maps to >1 confirmed task — using head_sha land-check only`);
+    // task 1002723: claude/<wt> is only ONE of the branch names real ships push —
+    // a worktree/laptop ship pushes <wt> itself (the task-1002702 strand: PR #89 on
+    // branch task-1002702, invisible to claude/task-1002702) or worktree-<wt> (the
+    // task-1002645 wave). Try each convention until one has a PR, so the merge
+    // nudge / heals / land proof engage regardless of which client shipped.
+    const wt = r.worktree_name || null;
+    if (wt) wtSeen.add(wt);
+    let candidates = wt
+      ? [`claude/${wt}`, wt, `worktree-${wt}`].filter((b) => push.isSafeBranch(b))
+      : [];
+    // Cross-sweep memoization: once a sweep has found which convention owns the
+    // task's PR, later sweeps probe that branch first and break immediately —
+    // steady-state cost stays at the documented 2 calls per confirmed task.
+    // The home may also be an ADOPTED foreign branch name (title-search result) —
+    // it entered the memo through an isSafeBranch-verified path either way.
+    const home = wt ? homes.get(wt) : null;
+    if (home) {
+      candidates = [home, ...candidates.filter((b) => b !== home)];
+    }
+    const wtUsable = !!wt && wtCount.get(wt) === 1;
+    if (wt && wtCount.get(wt) > 1) {
+      // A reused worktree_name maps its branch set to >1 confirmed task, so a merged
+      // PR is ambiguous — but each task's OWN head_sha is not, so we skip only the
+      // branch/PR path and let the head_sha ancestry land-check below resolve it.
+      logFn(`[publish-reconciler] task ${r.task_id}: worktree ${wt} maps to >1 confirmed task — using head_sha land-check only`);
     }
 
+    let branch = null;
     let landed = false;
     let landNote = '';
     let branchStatus = null;
     let prNotLanded = false;
 
-    if (branchUsable) {
-      ({ status: branchStatus, prNotLanded } = await sweepBranchPath(r, branch));
+    if (wtUsable) {
+      const homeKnown = !!home;
+      for (const cand of candidates) {
+        branchesSeen.add(cand);
+        branch = cand;
+        ({ status: branchStatus, prNotLanded } = await sweepBranchPath(r, cand));
+        if (branchStatus && branchStatus.pr_state !== 'none') {
+          homes.set(wt, cand); // remember the PR home for the next sweep
+          break;
+        }
+        // A remembered home with no PR means the full walk already happened on an
+        // earlier sweep and found nothing — don't re-walk the other candidates
+        // every 5 minutes. The title-search fallback below still runs each sweep,
+        // so a late-appearing PR on ANY branch name is discovered there (and the
+        // adoption path re-homes it).
+        if (homeKnown) break;
+      }
+      // First full walk found no PR anywhere: pin the conventional candidate as
+      // home so later sweeps probe ONE branch, not three, for this class (the
+      // never-pushed / allow-empty shapes, where a PR essentially never appears).
+      if (!(branchStatus && branchStatus.pr_state !== 'none') && !homeKnown && candidates.length) {
+        homes.set(wt, candidates[0]);
+      }
     }
 
     // task 1002645 — the claude/<worktree_name> derivation is the DEV-BOX convention;
@@ -468,6 +524,8 @@ async function runSweep(deps = {}) {
           branch = found.branch;
           branchesSeen.add(branch);
           ({ status: branchStatus, prNotLanded } = await sweepBranchPath(r, branch));
+          // Memoize the adopted home too, so the next sweep skips the re-search.
+          if (wt && branchStatus && branchStatus.pr_state !== 'none') homes.set(wt, branch);
         }
       } catch (_) {
         /* best-effort: a PR-search miss waits for the next sweep */
@@ -525,6 +583,7 @@ async function runSweep(deps = {}) {
         : prNotLanded
           ? 'pr_not_landed'
           : (!branch && !r.published_head_sha) ? 'no_branch_no_tip' : 'land_not_proven';
+      dispositions.push(`${r.task_id}:${reason}`);
       const ageMs = r.confirmed_at ? (nowMs - new Date(r.confirmed_at).getTime()) : null;
       if (ageMs != null && ageMs > STALE_CONFIRMED_MS) {
         staleStrands++;
@@ -554,6 +613,7 @@ async function runSweep(deps = {}) {
     try {
       const shipped = await db.shipTask({ taskId: r.task_id, builderId: r.builder_id });
       reconciled++;
+      dispositions.push(`${r.task_id}:shipped`);
       logFn(
         `[publish-reconciler] task ${r.task_id} (${landNote}) landed → shipped`
       );
@@ -571,7 +631,10 @@ async function runSweep(deps = {}) {
       // in the race window — expected + idempotent, NOT an error.
       if (e && e.code !== 'TASK_NOT_CONFIRMED') {
         errors++;
+        dispositions.push(`${r.task_id}:ship_failed`);
         errFn(`[publish-reconciler] shipTask ${r.task_id} failed: ${e && e.message}`);
+      } else {
+        dispositions.push(`${r.task_id}:already_flipped`);
       }
     }
   }
@@ -584,6 +647,11 @@ async function runSweep(deps = {}) {
     const plain = b.startsWith('behind:') ? b.slice('behind:'.length) : b;
     if (!branchesSeen.has(plain)) attempts.delete(b);
   }
+  // Same leak guard for the branch-home memo: a worktree that left the confirmed
+  // set (landed or released) never returns under the same name.
+  for (const w of homes.keys()) {
+    if (!wtSeen.has(w)) homes.delete(w);
+  }
 
   if (reconciled || merged || resolvedConflicts || refreshedStale || behindUpdated) {
     logFn(
@@ -595,6 +663,14 @@ async function runSweep(deps = {}) {
       `[publish-reconciler] ${staleStrands} stale strand(s): confirmed >${Math.round(STALE_CONFIRMED_MS / 60_000)}min with no provable land — credited but unlanded; see STRAND lines above`
     );
   }
+  // task 1002723: the always-on per-sweep account. Every confirmed task the sweep
+  // saw gets a named disposition — so a strand is visible on its FIRST quiet sweep,
+  // not at the 30-min WARN (or never, as with the silent young-unprovable class).
+  if (dispositions.length) {
+    const shown = dispositions.slice(0, 20).join(' · ');
+    const more = dispositions.length > 20 ? ` (+${dispositions.length - 20} more)` : '';
+    logFn(`[publish-reconciler] dispositions: ${shown}${more}`);
+  }
   return { checked: rows.length, reconciled, merged, resolvedConflicts, refreshedStale, behindUpdated, errors, unprovable, staleStrands, strandsFlagged };
 }
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.74",
+  "version": "1.19.76",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.74",
+      "version": "1.19.76",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.74",
+  "version": "1.19.76",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship.js

@@ -2497,6 +2497,17 @@ function zeroCommitVerdict(commitsAhead, dbOnly) {
 async function autoMerge(taskId, valueSummary, { dbOnly = false } = {}) {
   const branch = currentBranch();
   if (!branch || branch === 'main' || branch === 'HEAD') {
+    // task 1002723: an --allow-empty / --db-only ship legitimately runs FROM the
+    // main checkout (nothing was ever committed), but this bail fired BEFORE the
+    // deliberate-empty landing below could — the task parked at confirmed with no
+    // branch and no published tip, a shape the server sweep can never prove (the
+    // task-1002716 strand). Land it here iff the checkout has zero commits ahead
+    // of origin/main; anything else keeps the safe bail.
+    if (dbOnly && shellOk('git fetch origin main')
+        && zeroCommitVerdict(gitOk('git rev-list origin/main..HEAD --count'), true) === 'db-only') {
+      console.log('  auto-merge: deliberate empty ship (--db-only / --allow-empty) from the main checkout - nothing to merge; advancing to shipped without merge/deploy.');
+      return landed();
+    }
     console.log(`  auto-merge: skipped (current branch is ${branch})`);
     // The merge source IS the current branch, so on main there is nothing to
     // merge. Half of the single-checkout catch-22 this task documents: the other

package/src/module-api.js

@@ -575,8 +575,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.72 with no explicit bump. run 31619275904. (task 1002620)
 //   1.19.74 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.73 with no explicit bump. run 31628379432. (task 1002620)
+//   1.19.75 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.74 with no explicit bump. run 31632769733. (task 1002620)
+//   1.19.76 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.75 with no explicit bump. run 31637719876. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.74'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.76'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/github_push_land_proof.mjs

@@ -187,6 +187,26 @@ test('findTaskPullRequest: "task <id>: …" title → returns the REAL head bran
   assert.equal(r.pr_number, 36);
 });
 
+test('findTaskPullRequest 1002723: a commit-subject title with a "(task <id>)" suffix binds (the PR #89 miss)', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 1002702 },
+    depsWithPulls([
+      pull('docs: session log — QA walk, 23 findings (task 1002702)', 'task-1002702', { merged: true, number: 89 }),
+    ])
+  );
+  assert.ok(r, 'the suffix convention must bind');
+  assert.equal(r.branch, 'task-1002702');
+  assert.equal(r.pr_number, 89);
+});
+
+test('findTaskPullRequest 1002723: a bare UNPARENTHESIZED mid-title id still does NOT bind', async () => {
+  const r = await gh.findTaskPullRequest(
+    { taskId: 55 },
+    depsWithPulls([pull('fix the thing near task 55 handling', 'other-branch')])
+  );
+  assert.equal(r, null, 'only the ^task-prefix or (task <id>) parenthesized forms are title-level binds');
+});
+
 test('findTaskPullRequest: a body-only mention must NOT bind (tighter than prReferencesTask)', async () => {
   const r = await gh.findTaskPullRequest(
     { taskId: 55 },

package/tests/publish_reconciler.mjs

@@ -59,6 +59,7 @@ function mkDeps({
   refreshStaleImpl,
   updateByBranch = {},
   healAttempts = new Map(),
+  branchHome = new Map(),
 } = {}) {
   const calls = { ship: [], broadcast: [], status: [], merge: [], ancestry: [], search: [], resolve: [], refresh: [], update: [], flag: [], events: [], logs: [], errors: [] };
   // isSafeBranch mirrors github-push's pattern enough for the test (rejects
@@ -189,6 +190,8 @@ function mkDeps({
     // task 1915: per-branch treadmill guard, injected so the cap is deterministic and
     // never leaks module state across tests.
     healAttempts,
+    // task 1002723: per-worktree branch-home memo, injected for the same reason.
+    branchHome,
     log: (m) => calls.logs.push(m),
     error: (m) => calls.errors.push(m),
     _calls: calls,
@@ -1194,7 +1197,10 @@ test('1002645 THE PIN: a worktree-named branch (laptop wave ship) lands UNATTEND
   const r = await reconciler.runSweep(deps);
   assert.equal(r.reconciled, 1, 'the wave-5 strand shape must land with NO human step (ADR 0162)');
   assert.deepEqual(deps._calls.ship, [{ taskId: 2645, builderId: 95 }]);
-  assert.deepEqual(deps._calls.search, [2645], 'the fallback ran exactly once');
+  // task 1002723: worktree-<wt> is now a first-class branch CANDIDATE, so this shape
+  // resolves before the title fallback is ever needed (the fallback stays for PRs on
+  // foreign branch names). The pin's intent — lands unattended — is what matters.
+  assert.equal(deps._calls.search.length, 0, 'candidate branches resolve it without the title search');
   assert.ok(deps._calls.merge.includes('worktree-task-2645'),
     'the merge nudge engages on the REAL branch — the only merger when native auto-merge is disallowed');
 });
@@ -1271,6 +1277,86 @@ test('1002645 the reuse guard still holds through the fallback: adopted PR merge
   assert.equal(deps._calls.ship.length, 0);
 });
 
+// --- task 1002723 — the 1002702/1002716 strand pair: bare-branch candidates +
+// the always-on disposition line (silence must not masquerade as health) --------
+
+test('1002723 THE PIN: a PR on the BARE worktree branch (task-<id>, no prefix) lands unattended', async () => {
+  // The 1002702 strand: ship pushed branch task-1002702 (== worktree_name), PR #89
+  // merged, and the sweep saw pr_state:none on claude/task-1002702 forever while
+  // the title search missed the commit-subject PR title. The bare name is now a
+  // first-class candidate.
+  const deps = mkDeps({
+    rows: [{ task_id: 77, builder_id: 3, worktree_name: 'task-77', confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'task-77': landedPrFor(77) },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the merged-PR-on-bare-branch shape must land with no manual flip');
+  assert.ok(deps._calls.status.includes('claude/task-77'), 'dev-box convention tried first');
+  assert.ok(deps._calls.status.includes('task-77'), 'then the bare worktree branch');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 77, builderId: 3 }]);
+});
+
+test('1002723 every confirmed task gets a per-sweep disposition entry — including silent young unprovables', async () => {
+  const deps = mkDeps({
+    rows: [
+      // the 1002716 shape: allow-empty ship — no branch, no tip, young
+      { task_id: 91, builder_id: 3, worktree_name: null, confirmed_at: new Date().toISOString() },
+      // a young task whose branches have no PR anywhere yet
+      { task_id: 92, builder_id: 3, worktree_name: 'wt-92', confirmed_at: new Date().toISOString() },
+    ],
+  });
+  await reconciler.runSweep(deps);
+  const line = deps._calls.logs.find((l) => typeof l === 'string' && l.includes('dispositions:'));
+  assert.ok(line, 'a dispositions line is logged whenever confirmed tasks were checked');
+  assert.ok(line.includes('91:no_branch_no_tip'), `task 91 named with its reason in: ${line}`);
+  assert.ok(line.includes('92:land_not_proven'), `task 92 named with its reason in: ${line}`);
+});
+
+test('1002723 the winning branch convention is MEMOIZED across sweeps (steady-state back to ~2 calls)', async () => {
+  const branchHome = new Map();
+  const row = { task_id: 78, builder_id: 3, worktree_name: 'task-78', confirmed_at: new Date().toISOString() };
+  const first = mkDeps({ rows: [row], statusByBranch: { 'task-78': PENDING }, branchHome });
+  await reconciler.runSweep(first);
+  assert.ok(first._calls.status.includes('claude/task-78'), 'first sweep walks the candidates');
+  const second = mkDeps({ rows: [row], statusByBranch: { 'task-78': PENDING }, branchHome });
+  await reconciler.runSweep(second);
+  assert.equal(second._calls.status[0], 'task-78', 'second sweep probes the memoized home first');
+  assert.ok(!second._calls.status.includes('claude/task-78'), 'losing candidates are not re-probed');
+});
+
+test('1002723 a NO-PR worktree walks the candidates once, then probes only its pinned home (title search stays the discovery channel)', async () => {
+  const branchHome = new Map();
+  const row = { task_id: 80, builder_id: 3, worktree_name: 'task-80', confirmed_at: new Date().toISOString() };
+  const first = mkDeps({ rows: [row], branchHome }); // no PR on any branch
+  await reconciler.runSweep(first);
+  assert.equal(first._calls.status.length, 3, 'first sweep walks all three candidates');
+  assert.equal(branchHome.get('task-80'), 'claude/task-80', 'conventional candidate pinned as home');
+  const second = mkDeps({ rows: [row], branchHome });
+  await reconciler.runSweep(second);
+  assert.deepEqual(second._calls.status, ['claude/task-80'], 'later sweeps probe ONE branch, not three');
+  assert.ok(second._calls.search.includes(80), 'the title-search fallback still runs — late PRs are discoverable');
+});
+
+test('1002723 the branch-home memo is pruned when its worktree leaves the confirmed set', async () => {
+  const branchHome = new Map();
+  const row = { task_id: 79, builder_id: 3, worktree_name: 'task-79', confirmed_at: new Date().toISOString() };
+  await reconciler.runSweep(mkDeps({ rows: [row], statusByBranch: { 'task-79': PENDING }, branchHome }));
+  assert.ok(branchHome.has('task-79'), 'memoized while confirmed');
+  await reconciler.runSweep(mkDeps({ rows: [], branchHome }));
+  assert.equal(branchHome.size, 0, 'pruned once the worktree leaves the set');
+});
+
+test('1002723 a shipped task appears in the dispositions line as shipped', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 93, builder_id: 3, worktree_name: 'wt-93', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-93': LANDED },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  await reconciler.runSweep(deps);
+  const line = deps._calls.logs.find((l) => typeof l === 'string' && l.includes('dispositions:'));
+  assert.ok(line && line.includes('93:shipped'), `shipped disposition in: ${line}`);
+});
+
 // Drain the microtask queue, then report + exit with the right code.
 setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);