@bongos/core 1.19.752 → 1.19.754

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.752",
-  "core_contract": "1.19.752",
-  "source_commit": "579246be74968f1b0ac143467ff0dd000c0db6d3",
+  "core_version": "1.19.754",
+  "core_contract": "1.19.754",
+  "source_commit": "8fd1dd9b3ddbc313d9e3bb09ba2a339cb9793e7f",
   "source_ref": "HEAD",
-  "built_at": "2026-09-15T23:12:05.100Z",
+  "built_at": "2026-09-16T00:24:38.617Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 482,
+    "docs_redacted": 483,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2110,
+    "functional_verbatim": 2111,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2617,
-  "tree_sha256": "45de4196d4c067e90b1267e93dea4420bbaa87784156a3c48412f9db9f06e12a",
+  "file_count": 2619,
+  "tree_sha256": "a2f5f1ae36d83e33d7e61bab1264bf62287f10d175f2c9e1f3cabd695bc2b757",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -1939,10 +1939,15 @@
       "mode": "0000644",
       "sha256": "df40904ac989d54ea6bea561649a35a98ec7dc1ba96ea65395cb314ffe2059a9"
     },
+    {
+      "path": "docs/adr/0287-a-backlog-task-that-nothing-gates-promotes-itself.md",
+      "mode": "0000644",
+      "sha256": "3990568d9257c263d629527bd4bfb143cbf211c5a61544bf8db527c9e3c11249"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "e7f895a2f6dc062acd2afcf2c477ab8e60f1cbc93a836d8759a47d204a55a450"
+      "sha256": "6e19a62c805b92eda9a318fe7d67cac22927a80d4ad6bdd681256f0cd06281cd"
     },
     {
       "path": "docs/api-reference.md",
@@ -2507,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "64c80e364b970b0da6d391873f6d80ee47a1f370b355588165c0050f837f6e49"
+      "sha256": "f367478f9031a67c77c1b43521aa215ea65068e9ad1b6b21540c81abd8a22dde"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5467,7 +5472,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "df48a62844d96e93bfa1e3c20031b4c4fbb1efda3e943b1374c3015cc1df9951"
+      "sha256": "2ec7c2bec4ef96b5ded094c69104fc30e53b7659cb2b2444ed4491df3f3836dc"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5627,7 +5632,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "9f3e3ae52f9fa49a1f5638d92a4b985d0c23fe0433d917d017aa78876c41ca43"
+      "sha256": "dce7913d2635c40ce9557e7cb554aa152dbbe4c40e88676faa3f5e5b34bc26ae"
     },
     {
       "path": "modules/lifecycle/rot.js",
@@ -7562,12 +7567,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5ac8fa7cd6f19e26e2cc023909a62d27a008dd9f9affb5260fc0faed61374b3b"
+      "sha256": "0b25947dcf9f2906d39aec4e4ad10e63dc42831cf593c5404ba77dc51c2be946"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "247f473ed0739975c6ba20694c49d14d8f7b21bd10b596fd66969349077ad2af"
+      "sha256": "f340a8707e0abe69d0e7d1028a0a96675b66099ce87af7932004393e02dc2a19"
     },
     {
       "path": "public-docs/index.html",
@@ -9367,7 +9372,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "951a6fd6ee9539693914e36609e4078793753c13e71965d9d154dfd09c6c3718"
+      "sha256": "df078d4bd7a6e0fda01ce242821141c66b6dc0f2d07ebfaf8de1a89ae279499e"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11994,6 +11999,11 @@
       "mode": "0000644",
       "sha256": "5444df365780c33d61ca9a18de08ed89ed2ff74d8af198d51edbaed19d6010c2"
     },
+    {
+      "path": "tests/promotion_sweep.mjs",
+      "mode": "0000644",
+      "sha256": "43246276a75ec8e7d01610b4f6c6988434144338804614b37b062c7a43a8beca"
+    },
     {
       "path": "tests/prose_edits.mjs",
       "mode": "0000644",
@@ -12417,7 +12427,7 @@
     {
       "path": "tests/session-cards.mjs",
       "mode": "0000644",
-      "sha256": "3b9ca3392533ade9dc8fecd33c705e844a3c3c692fd7ffb33a0d582bf8da6ca6"
+      "sha256": "9035468dcf1b6ef0bc0aaf5a665196a0eab321563ab84aa1133b1446ff1ce9cd"
     },
     {
       "path": "tests/session_506_regression.mjs",

package/docs/adr/0287-a-backlog-task-that-nothing-gates-promotes-itself.md

@@ -0,0 +1,35 @@
+# 0287 — A backlog task that nothing gates promotes itself
+
+**Status:** accepted · 2026-09-15 · [task 1003932](https://cloudbongos.com/builders#/task/1003932) (owner decision, same session)
+
+## Context
+
+Auto-promotion has been reactive-only since [migration 163](../../migrations/163_polymorphic_dependencies.sql). All three paths are `AFTER UPDATE` triggers that fire at the **dependency** end of an edge — a task ships, a criterion is satisfied, a goal is achieved — and then re-check `task_is_fully_unblocked` for that node's dependents.
+
+Two states are unreachable by any of them, and neither is rare:
+
+1. **No gating edge at all.** `createTask` inserts at `status='backlog'`. A task with no edges is nobody's dependent, so no trigger ever evaluates it.
+2. **An edge added after the dependency shipped.** The ship event already happened; creating the edge later re-evaluates nothing.
+
+Measured on the live database, 2026-09-15: **155 backlog tasks were promotable and parked** — 33 of 41 in goal 1000106 alone, the rest spread over ten other goals. 117 more were correctly waiting on unfinished work. The owner's framing was blunt: *"nothing should be owner held backlog, are things not auto promoting?"*
+
+This is the same failure `runCriterionSweep` was built for on the criterion axis ([ADR 0183](0183-criteria-close-themselves.md)): a reactive rule cannot drain rows whose event has already passed, and nothing will ever fire for them again.
+
+## Decision
+
+**A backlog task with no unmet dependency and no open blocker becomes `ready` on its own**, via a `runPromotionSweep` on the publish-reconciler tick, beside the criterion sweep it copies.
+
+The owner chose the widest rule: the sweep covers **spikes** (which migration 163 excluded on purpose) and the cascade's **artist-review** tasks (which `cascade.js` files at `backlog` deliberately). One rule, no carve-outs. Promoting only makes a task claimable; it compels nobody to take it, and `/builder-sequence` still halts on a `judgement_kind` spike.
+
+**It ships disarmed.** The sweep reports what it would promote until `BONGOS_PROMOTION_SWEEP_ARMED=1`. The owner asked to see the list before ~155 rows change status at once, and a mass status change with no preview is exactly the kind of thing that is easy to do and tedious to unpick.
+
+**The open-blocker guard lives in the sweep's own SQL**, not in `task_is_fully_unblocked`. [Migration 176](../../migrations/176_promotion_respects_open_blockers.sql) folded that clause into the predicate for V4.R15; [migration 178](../../migrations/178_reward_gate_auto_assign_revert_autopromote.sql) then replaced the body with one it described as "byte-identical to the 163 body" and dropped it. Production was verified during this task: the live predicate has no blocker clause, and one task already sits at `ready` carrying an open blocker. Restoring it is [task 1003934](https://cloudbongos.com/builders#/task/1003934). A sweep that promotes in bulk must not inherit a single point of failure that has already been reverted once, so it re-checks, and keeps re-checking even after 1003934 lands.
+
+## Consequences
+
+- **`backlog` stops being a resting state.** It becomes the brief gap between filing and being claimable. `/backlog-review` — "the state a human must say go on" — loses most of its purpose; it is not deleted here, but the next session to touch it should expect little left to walk.
+- **The claimable feed grows by roughly 155 rows once armed**, across eleven goals. Nothing is force-assigned; the queue simply stops lying about what is available.
+- **The `UPDATE` repeats the `WHERE`** rather than trusting the ids the `SELECT` returned, so a row that stops qualifying between the two statements is not promoted.
+- **Idempotent**: it reads only `status='backlog'` rows, and an empty candidate set issues no write at all.
+- Rejected — **promoting at creation time** (`createTask` inserting `ready` when a task has no edges): it would break `cascade.js`'s tested invariant that a cascade-filed review lands at `backlog`, and it fixes nothing already parked. A sweep handles both the backlog drain and the self-heal, which is why the criterion axis chose one too.
+- Rejected — **scoping the first run to one goal**: it proves the mechanism on 37 rows while leaving the same defect live in ten other goals, and needs a second task to finish.

package/docs/adr/README.md

@@ -378,3 +378,4 @@ This keeps the decision history honest and traceable.
 | 0284 | [**The control plane carries no metrics stack** ([task 1003876](https://cloudbongos.com/builders#/task/1003876) · goal 1000106). Supersedes ADR 0127. Grafana (187 MB, the box's largest process) + Prometheus (110 MB, 2.5 GB data) were removed from the `s-1vcpu-2gb` control plane every provisioned project shares; they scraped none of those projects and nothing in the core read them. Owner chose remove over move-to-own-droplet. The `/metrics` exporter stays in every instance, so a scraper can return from a box that is not the control plane. Leftovers (DNS record, co-hosting-box socat forwarders, instance `infra/` copies) filed as a follow-up.](0284-the-control-plane-carries-no-metrics-stack.md) | infra / Cloud Bongos |
 | 0285 | [**A shared box holds about twelve projects per GB, and memory is the wall** ([task 1003877](https://cloudbongos.com/builders#/task/1003877) · goal 1000106, a spike measured read-only on the live control plane at the owner's call). A project costs ~80 MB warm (70 MB Node + one busy Postgres backend); idle projects look like ~25 MB only because swap holds their cold pages, and swap is not capacity. Fixed base ~750 MB on a control plane. Ceiling per tier `floor((usable − fixed) / 80)`: 15 on today's `s-1vcpu-2gb` (11 live), 39 on `s-2vcpu-4gb`; resize at 12. RAM binds first, Postgres connections (pool default 10 × N vs 97) second; CPU, ports, units, disk and the backup window do not bind. Keep the three shapes, add placement ("standalone until the box is full, then the next box"); a shared slot costs box price ÷ ceiling ($0.62–0.80/mo), `dedicated` 8–40× that.](0285-a-shared-box-holds-about-twelve-projects-per-gb-and-memory-is-the-wall.md) | infra / Cloud Bongos |
 | 0286 | [**A gated project's manifest tells a stranger how to sign in, and nothing else** ([task 1003652](https://cloudbongos.com/builders#/task/1003652) · goal 1000106, from idea 1000845; closes ADR 0192's deferred item). `GET /instance` stays exempt from the member door, but on a gated project a caller with no live session gets `{ schema, name, brand: { identity.productName, project }, auth (incl. idp), admission }` — no modules, ranks, repo coordinates, dev-box flag or branding strings. Members get the full manifest; a failed lookup answers as a stranger; gated responses are `private, no-store` + `Vary: Cookie, Authorization`. Schema id stays `instance-manifest/v1` (a subset; `bongos login` refuses any other). Owner's call: sign-in basics only.](0286-a-gated-project-s-manifest-tells-a-stranger-how-to-sign-in-and-nothing-else.md) | security / Cloud Bongos |
+| 0287 | [**A backlog task that nothing gates promotes itself** ([task 1003932](https://cloudbongos.com/builders#/task/1003932), owner decision 2026-09-15). Every promotion path in migration 163 is an `AFTER UPDATE` trigger at the DEPENDENCY end of an edge, so two states are unreachable by all of them: a task with no gating edge is nobody's dependent and is never evaluated, and an edge added AFTER its dependency shipped missed the only event that would have fired. Measured live: **155 backlog tasks promotable and parked**, 33 of 41 in one goal. Same failure `runCriterionSweep` exists for on the criterion axis (ADR 0183) — a reactive rule cannot drain rows whose event has passed. **Decision: `runPromotionSweep` joins the publish-reconciler tick** and promotes any backlog task with no unmet dependency and no open blocker. The owner chose the widest rule — spikes (excluded by 163 on purpose) and cascade-filed artist reviews included, no carve-outs; promoting only makes a task claimable, it compels nobody. **It ships DISARMED**, reporting what it would promote until `BONGOS_PROMOTION_SWEEP_ARMED=1`, because ~155 rows changing status at once deserves a preview. The **open-blocker guard is re-checked in the sweep's own SQL**: migration 176 folded that clause into `task_is_fully_unblocked` and migration 178 dropped it while claiming to restore "the 163 body" — verified against production, where one task already sits at `ready` with an open blocker (its fix is task 1003934). A bulk promoter must not inherit a single point of failure that has been reverted once. Consequence the owner accepted: **`backlog` stops being a resting state** and `/backlog-review` loses most of its purpose. Rejected: promoting at creation (breaks `cascade.js`'s tested backlog invariant and fixes nothing already parked); scoping the first run to one goal (leaves the defect live in ten others).](0287-a-backlog-task-that-nothing-gates-promotes-itself.md) | lifecycle / work tracking |

package/docs/module-api-changelog.md

@@ -1978,5 +1978,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.750 with no explicit bump. run 35033016299. (task 1002620)
   1.19.752 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.751 with no explicit bump. run 35034524356. (task 1002620)
+  1.19.753 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.752 with no explicit bump. run 35036151976. (task 1002620)
+  1.19.754 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.753 with no explicit bump. run 35039836268. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-tasks.js

@@ -1037,6 +1037,66 @@ async function updateTaskStatus(id, status) {
   await pool.query(`UPDATE tasks SET status = $2 WHERE id = $1`, [id, status]);
 }
 
+// The UNSCOPED half of auto-promotion (task 1003932) — the backlog drain that
+// `runCriterionSweep` already is for criteria.
+//
+// Every promotion path migration 163 defines is an AFTER UPDATE trigger at the
+// DEPENDENCY end of an edge: a task ships, a criterion is satisfied, a goal is
+// achieved. Two states are therefore unreachable by any trigger, and neither is
+// rare: a task with NO gating edge is nobody's dependent, so nothing ever
+// evaluates it; and an edge added AFTER its dependency shipped missed the only
+// event that would have. Measured on the live DB 2026-09-15: 155 backlog tasks
+// project-wide were promotable and parked, 33 of 41 in one goal alone.
+//
+// TWO GUARDS, BOTH IN SQL, and the second is not redundant. `task_blockers` is
+// re-checked here rather than trusted to `task_is_fully_unblocked`, because
+// migration 176 folded that clause into the predicate and migration 178 replaced
+// the body with one it called "byte-identical to the 163 body" — dropping it.
+// Verified against production: the live predicate has no blocker clause (its own
+// fix is task 1003934). A sweep that promotes in bulk must not inherit a single
+// point of failure that has already been reverted once.
+//
+// The UPDATE repeats the WHERE rather than trusting the ids it just read, so a
+// row that stops qualifying between the two statements is not promoted anyway.
+const PROMOTABLE_BACKLOG_WHERE = `
+   WHERE t.status = 'backlog'
+     AND task_is_fully_unblocked(t.id)
+     AND NOT EXISTS (
+           SELECT 1
+             FROM task_blockers tb
+             JOIN blockers b ON b.id = tb.blocker_id
+            WHERE tb.task_id = t.id
+              AND b.status = 'open')`;
+
+// Runaway guard, not an expected limit (the runSweep precedent).
+const PROMOTION_SWEEP_LIMIT = 500;
+
+async function promoteUnblockedBacklogTasks(exec, { armed = false, limit = PROMOTION_SWEEP_LIMIT } = {}) {
+  const client = exec || pool;
+  const { rows: candidates } = await client.query(
+    `SELECT t.id, t.title, t.goal_id
+       FROM tasks t
+     ${PROMOTABLE_BACKLOG_WHERE}
+      ORDER BY t.id
+      LIMIT $1`,
+    [limit]
+  );
+  // Disarmed is the DEFAULT: this sweep can move hundreds of rows at once, so it
+  // reports first and promotes only once explicitly armed.
+  if (!armed || candidates.length === 0) return { armed, candidates, promoted: [] };
+  const { rows: promoted } = await client.query(
+    `UPDATE tasks t
+        SET status = 'ready',
+            promoted_at = COALESCE(t.promoted_at, now()),
+            updated_at = now()
+     ${PROMOTABLE_BACKLOG_WHERE}
+        AND t.id = ANY($1::bigint[])
+    RETURNING t.id, t.title, t.goal_id`,
+    [candidates.map((r) => r.id)]
+  );
+  return { armed, candidates, promoted };
+}
+
 // The cascade-filed ARTIST REVIEW rows that are still open (ADR 0241, task
 // 1003575) — the state the deploy gate reads. Narrow projection on purpose: the
 // caller needs an id and a filing date to name what holds a deploy and to apply
@@ -1111,6 +1171,7 @@ module.exports = {
   listClaimableTasks,
   listOpenArtistReviews,
   listTasks,
+  promoteUnblockedBacklogTasks,
   rankCrossDisciplineRecommendations,
   rewardGateAssignment,
   rewardGateError,

package/modules/lifecycle/publish-reconciler.js

@@ -886,6 +886,42 @@ async function runCriterionSweep(deps = {}) {
   }
 }
 
+// runPromotionSweep — the backlog drain (task 1003932). Same shape and same
+// reason as runCriterionSweep above: the three migration-163 promotion triggers
+// only fire at the DEPENDENCY end of an edge, so a backlog task with no edges is
+// never evaluated by anything and a late-added edge missed its only event.
+//
+// DISARMED BY DEFAULT. It can move hundreds of rows in one tick (155 were
+// promotable on 2026-09-15), so it reports what it WOULD promote until
+// BONGOS_PROMOTION_SWEEP_ARMED=1 says otherwise. Pure DB like runCostSweep — no
+// push credential — so it runs on hosts where getPublishStatus 503s.
+async function runPromotionSweep(deps = {}) {
+  const { logFn, errFn } = loggers(deps);
+  // Injected deps.tasksDb is the test seam; the sibling module is production.
+  const tasksDb = (deps.tasksDb && typeof deps.tasksDb.promoteUnblockedBacklogTasks === 'function')
+    ? deps.tasksDb
+    : require('./db-tasks.js');
+  const exec = deps.pool || seams.pool;
+  const armed = typeof deps.promotionArmed === 'boolean'
+    ? deps.promotionArmed
+    : process.env.BONGOS_PROMOTION_SWEEP_ARMED === '1';
+  try {
+    const out = await tasksDb.promoteUnblockedBacklogTasks(exec, { armed });
+    for (const t of out.promoted) {
+      logFn(`[publish-reconciler] task ${t.id} backlog→ready — every dependency is done and no blocker is open`);
+    }
+    if (!out.armed && out.candidates.length) {
+      const ids = out.candidates.map((t) => t.id).join(', ');
+      logFn(`[publish-reconciler] promotion sweep (report-only): ${out.candidates.length} task(s) would promote — ${ids}`);
+      logFn('[publish-reconciler] set BONGOS_PROMOTION_SWEEP_ARMED=1 to let it promote them');
+    }
+    return out;
+  } catch (e) {
+    errFn(`[publish-reconciler] promotion sweep (non-blocking): ${e && e.message}`);
+    return { skipped: 'error', error: e && e.message };
+  }
+}
+
 // Start the periodic sweep. Idempotent (a second call is a no-op). Kill-switched
 // by PUBLISH_RECONCILER_DISABLED=1 (purely additive bookkeeping, so it's ON by
 // default whenever a push credential is configured; the route's getPublishStatus
@@ -905,6 +941,7 @@ function start(deps = {}) {
     runSweep(deps).catch(crashHandler('sweep'));
     runCostSweep(deps).catch(crashHandler('cost sweep'));
     runCriterionSweep(deps).catch(crashHandler('criterion sweep'));
+    runPromotionSweep(deps).catch(crashHandler('promotion sweep'));
   };
 
   firstTimer = setTimeout(tick, FIRST_SWEEP_DELAY_MS);
@@ -941,6 +978,7 @@ module.exports = {
   stop,
   runSweep,
   runCostSweep,
+  runPromotionSweep,
   runCriterionSweep,
   couldBeStaleGenerated,
   describeTarget,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.752",
+  "version": "1.19.754",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.752",
+      "version": "1.19.754",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.752",
+  "version": "1.19.754",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.752'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.754'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/promotion_sweep.mjs

@@ -0,0 +1,210 @@
+// tests/promotion_sweep.mjs
+//
+// The backlog promotion sweep (task 1003932) — the UNSCOPED half of
+// auto-promotion, the exact shape runCriterionSweep already has for criteria.
+//
+// Why it exists: every promotion path in migration 163 is an AFTER UPDATE
+// trigger at the DEPENDENCY end of an edge (a task ships, a criterion is
+// satisfied, a goal is achieved). A task with NO gating edge is nobody's
+// dependent, so no trigger ever evaluates it and it cannot leave 'backlog' —
+// measured 2026-09-15: 33 of 41 backlog tasks in goal 1000106, and 155
+// project-wide. A task whose edge was added AFTER its dependency shipped is
+// stuck the same way: the ship event already happened.
+//
+// HOW THESE TESTS PROVE A GUARD, and where that proof stops. CI runs a DB-free
+// unit gate (scripts/gds/run-unit-tests.js excludes anything needing Postgres,
+// and no workflow provides a Postgres service), so a fixture-in-a-real-database
+// test would run nowhere. Instead the fake pool below answers the way the
+// database would GIVEN THE GUARDS THE STATEMENT ACTUALLY CARRIES: a blocked row
+// is withheld only because the SQL contains the blocker clause. Drop the clause
+// and that row starts coming back, and the "is NOT promoted" cases go red.
+//
+// The residual gap, stated rather than papered over: a guard NEUTERED while
+// keeping its wording (`AND b.status = 'open' AND FALSE`) still reads as present
+// here. Closing that needs Postgres. What stands in for it is a live read-only
+// verification recorded in the task's ship notes — against production, the
+// sweep's own candidate query returned 155 rows, of which 0 carried an open
+// blocker and 0 were not fully unblocked, while 2 backlog rows were excluded by
+// the blocker clause alone.
+//
+// Run:  node tests/promotion_sweep.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const dbTasks = require('../modules/lifecycle/db-tasks.js');
+const reconciler = require('../modules/lifecycle/publish-reconciler.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try {
+    await fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+// The two shapes that are stuck today, plus one row per guard the sweep must
+// respect. `why` is the reason the row must NOT be promoted.
+const QUALIFIES = [
+  { id: 1003930, title: 'no dependency edges at all', goal_id: 1000106 },
+  { id: 1002348, title: 'edge added after the dependency shipped', goal_id: 1000106 },
+];
+const EXCLUDED = [
+  { id: 2000001, title: 'a dependency has not shipped', goal_id: 1000106, why: 'unmetDep' },
+  { id: 2000002, title: 'carries an open blocker', goal_id: 1000106, why: 'openBlocker' },
+  { id: 2000003, title: 'already out of backlog', goal_id: 1000106, why: 'notBacklog' },
+];
+const FIXTURE = [...QUALIFIES, ...EXCLUDED];
+
+// Answer as the database would, given the guards this statement carries.
+function admittedBy(sql, rows) {
+  const backlogGuard = /status\s*=\s*'backlog'/i.test(sql);
+  const depGuard = /task_is_fully_unblocked\s*\(/i.test(sql);
+  const blockerGuard = /task_blockers/i.test(sql) && /b\.status\s*=\s*'open'/i.test(sql);
+  return rows.filter((r) => {
+    if (r.why === 'notBacklog' && backlogGuard) return false;
+    if (r.why === 'unmetDep' && depGuard) return false;
+    if (r.why === 'openBlocker' && blockerGuard) return false;
+    return true;
+  });
+}
+
+function mkPool({ rows = FIXTURE } = {}) {
+  const calls = [];
+  return {
+    calls,
+    async query(sql, params) {
+      const text = String(sql);
+      calls.push({ sql: text, params });
+      if (/^\s*UPDATE/i.test(text)) {
+        // The UPDATE re-checks the guards AND narrows to the ids it was handed.
+        const ids = Array.isArray(params && params[0]) ? params[0] : null;
+        const scoped = ids ? rows.filter((r) => ids.includes(r.id)) : rows;
+        return { rows: admittedBy(text, scoped) };
+      }
+      return { rows: admittedBy(text, rows) };
+    },
+  };
+}
+
+const updatesIn = (pool) => pool.calls.filter((c) => /^\s*UPDATE/i.test(c.sql));
+const idsOf = (rows) => rows.map((r) => r.id);
+
+// ---------- what gets promoted, and what does not ----------
+
+await test('report-only by default: it names candidates and writes NOTHING', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, {});
+  assert.equal(out.armed, false, 'default is report-only — arming is explicit');
+  assert.deepEqual(idsOf(out.candidates), idsOf(QUALIFIES));
+  assert.deepEqual(out.promoted, [], 'nothing is promoted while disarmed');
+  assert.equal(updatesIn(pool).length, 0, 'a disarmed sweep must never issue an UPDATE');
+});
+
+await test('armed: it promotes exactly the qualifying rows', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.equal(out.armed, true);
+  assert.deepEqual(idsOf(out.promoted), idsOf(QUALIFIES));
+  const update = updatesIn(pool)[0];
+  assert.ok(update, 'an armed sweep issues the UPDATE');
+  assert.match(update.sql, /status\s*=\s*'ready'/i, "it moves the task to 'ready'");
+  assert.match(update.sql, /promoted_at\s*=\s*COALESCE\(/i,
+    'and stamps promoted_at without overwriting an existing one (mirrors the 163 triggers)');
+});
+
+await test('a task whose dependency has not shipped is NOT promoted', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.ok(!idsOf(out.candidates).includes(2000001), 'never a candidate');
+  assert.ok(!idsOf(out.promoted).includes(2000001), 'and never promoted');
+});
+
+await test('a task carrying an open blocker is NOT promoted', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.ok(!idsOf(out.candidates).includes(2000002), 'never a candidate');
+  assert.ok(!idsOf(out.promoted).includes(2000002), 'and never promoted');
+});
+
+await test('a task already out of backlog is NOT touched', async () => {
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.ok(!idsOf(out.promoted).includes(2000003));
+});
+
+await test('the UPDATE re-checks the guards rather than trusting the ids it read', async () => {
+  const pool = mkPool();
+  await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  const update = updatesIn(pool)[0].sql;
+  assert.match(update, /status\s*=\s*'backlog'/i, 'backlog-only, restated in the write');
+  assert.match(update, /task_is_fully_unblocked\s*\(/i, 'dependency doneness, restated');
+  assert.match(update, /task_blockers/i, 'open-blocker guard, restated');
+  assert.match(update, /id = ANY\(/i, 'and narrowed to the candidates it just read');
+});
+
+await test('the guards are in the read as well as the write', async () => {
+  const pool = mkPool();
+  await dbTasks.promoteUnblockedBacklogTasks(pool, {});
+  const select = pool.calls.find((c) => /^\s*SELECT/i.test(c.sql)).sql;
+  assert.match(select, /status\s*=\s*'backlog'/i);
+  assert.match(select, /task_is_fully_unblocked\s*\(/i);
+  // The shared predicate LOST its blocker clause when migration 178 replaced
+  // migration 176's body (verified against production, task 1003934), so the
+  // sweep carries its own rather than inheriting a single point of failure that
+  // has already been reverted once.
+  assert.match(select, /task_blockers/i);
+  assert.match(select, /b\.status\s*=\s*'open'/i);
+});
+
+await test('nothing to do: no candidates means no UPDATE, even armed', async () => {
+  const pool = mkPool({ rows: EXCLUDED });
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.deepEqual(out.candidates, [], 'every fixture row is excluded by a guard');
+  assert.deepEqual(out.promoted, []);
+  assert.equal(updatesIn(pool).length, 0,
+    'an empty candidate set must not issue a write (the idempotent second run)');
+});
+
+// ---------- the sweep + its wiring ----------
+
+await test('runPromotionSweep reports through the injected logger and never throws', async () => {
+  const lines = [];
+  const out = await reconciler.runPromotionSweep({
+    pool: mkPool(),
+    promotionArmed: false,
+    log: (m) => lines.push(m),
+    error: (m) => lines.push(`ERR ${m}`),
+  });
+  assert.equal(out.armed, false);
+  assert.match(lines.join('\n'), /1003930/, 'it names the tasks it would promote');
+  assert.ok(!lines.some((l) => l.startsWith('ERR')), 'a clean run logs no error');
+});
+
+await test('a throwing pool is reported, not propagated (a sweep can never crash the tick)', async () => {
+  const errs = [];
+  const boom = { query: async () => { throw new Error('db exploded'); } };
+  const out = await reconciler.runPromotionSweep({ pool: boom, log: () => {}, error: (m) => errs.push(m) });
+  assert.equal(out.skipped, 'error', 'the failure is returned, not thrown');
+  assert.match(errs.join('\n'), /db exploded/, 'and it says what happened');
+});
+
+await test('the sweep runs on the tick, fire-and-forget like its siblings', async () => {
+  const src = readFileSync(new URL('../modules/lifecycle/publish-reconciler.js', import.meta.url), 'utf8')
+    .replace(/\r\n/g, '\n');
+  assert.match(src, /runPromotionSweep\(deps\)\.catch\(/, 'wired into tick() the way runCriterionSweep is');
+});
+
+// ---------- Summary ----------
+
+console.log('');
+console.log(`promotion-sweep tests: ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exitCode = 1;

package/tests/session-cards.mjs

@@ -136,6 +136,58 @@ test('empty / malformed envelope or missing title → empty string', () => {
   assert.equal(hook.buildAdditionalContext(onEnv, null), '', 'no title → nothing');
 });
 
+// ---------- buildAdditionalContext: delivery mode (task 1003933) ----------
+//
+// A prompt-MATCHED card is the whole answer — the builder typed /builder-start,
+// so rendering it and nothing else is right. A card delivered by the
+// prompt-INDEPENDENT land-watch hook is not: it rides whatever the builder
+// happened to say next, and the "verbatim as your reply" directive made it
+// displace a real question twice on 2026-09-15.
+
+test("default mode claims the reply; 'append' yields to the builder's message", () => {
+  const reply = hook.buildAdditionalContext(onEnv, 'status_card');
+  assert.ok(/as your reply/i.test(reply), 'default still says the card IS the reply');
+  const append = hook.buildAdditionalContext(onEnv, 'task_card', 'append');
+  assert.ok(/answer[\s\S]{0,40}first/i.test(append), "append tells the model to answer the builder first");
+  assert.ok(/after (?:you )?answer|end of your reply/i.test(append), 'and to place the card after that answer');
+  assert.ok(!/verbatim as your reply/i.test(append), 'append never claims the whole reply');
+});
+
+test("'append' still embeds both payloads verbatim, each fence exactly twice", () => {
+  const ctx = hook.buildAdditionalContext(onEnv, 'task_card', 'append');
+  assert.ok(ctx.includes('<div class="st-card">WIDGET-BODY</div>'), 'HTML verbatim');
+  assert.ok(ctx.includes('MARKDOWN-BODY'), 'markdown verbatim');
+  assert.equal(count(ctx, '<<<WIDGET_HTML>>>'), 2);
+  assert.equal(count(ctx, '<<<MARKDOWN_CARD>>>'), 2);
+  assert.ok(/do NOT run the script yourself/i.test(ctx), 'still forbids re-running the script');
+});
+
+test("'append' holds with widgets OFF (the markdown-only branch)", () => {
+  const ctx = hook.buildAdditionalContext(
+    { widgets_enabled: false, html: null, markdown: 'MD-ONLY', warnings: [] }, 'task_card', 'append');
+  assert.ok(ctx.includes('MD-ONLY'));
+  assert.ok(/answer[\s\S]{0,40}first/i.test(ctx), 'append wording reaches the widgets-off branch too');
+  assert.equal(count(ctx, '<<<WIDGET_HTML>>>'), 0);
+  assert.equal(count(ctx, '<<<MARKDOWN_CARD>>>'), 2);
+});
+
+test('an unknown mode falls back to the reply directive (fail-safe)', () => {
+  const ctx = hook.buildAdditionalContext(onEnv, 'status_card', 'nonsense');
+  assert.ok(/as your reply/i.test(ctx), 'unknown mode must not silently drop the directive');
+});
+
+test('land-watch-card.js requests the append mode', () => {
+  // The prompt-independent hook is the whole reason 'append' exists; a call
+  // without it would reintroduce the hijack. Source-level because the hook
+  // requires its sibling inside main() at runtime. CRLF-normalised: this
+  // checkout reads back \r\n and an anchored match would silently pass.
+  const src = require('node:fs')
+    .readFileSync(new URL('../.claude/hooks/land-watch-card.js', import.meta.url), 'utf8')
+    .replace(/\r\n/g, '\n');
+  assert.match(src, /buildAdditionalContext\(\s*envelope\s*,[^)]*,\s*'append'\s*\)/,
+    "land-watch-card must pass 'append' when building its directive");
+});
+
 // ---------- Summary ----------
 
 console.log('');