@bongos/core 1.19.80 → 1.19.82

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.80",
-  "core_contract": "1.19.80",
-  "source_commit": "e9830526a46cd238c6ea856406a1bcde6fcb6e4f",
+  "core_version": "1.19.82",
+  "core_contract": "1.19.82",
+  "source_commit": "9ca69eb29ee6b3ee602e17cbf1d1ef1ebc9df5f9",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T23:02:51.567Z",
+  "built_at": "2026-08-12T23:14:31.232Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 295,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1226,
+    "functional_verbatim": 1227,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1542,
-  "tree_sha256": "8efe860e490a9f9bca1f3739c652e205e29d50643e86361a1eb631f7474a1ba9",
+  "file_count": 1543,
+  "tree_sha256": "253f8de922c6d8cc2023e6a2d28b363fafa2cfdec666f96afc3a0e5d879a918f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -37,7 +37,7 @@
     {
       "path": ".claude/skills/builder-box/SKILL.md",
       "mode": "0000644",
-      "sha256": "d8bfc9298bbb136742147e83d2500b9cb0961fec35ca15dc3cb773c9ecdf8b4b"
+      "sha256": "e131788fccfd87e882ef4e03798513cf7ff41047a2908fca8cf6314ff12e0524"
     },
     {
       "path": ".claude/skills/builder-claim/SKILL.md",
@@ -1572,7 +1572,7 @@
     {
       "path": "docs/recipes/ops-gotchas.md",
       "mode": "0000644",
-      "sha256": "ddbb6d4e0569a6773b648a6fe97abb2e2e04c6e36a5f3100af0cd995688a4810"
+      "sha256": "1e35b15c1f366aae52aedbd12e4a193343f8fd13b2fc6bdec13f927b7a22e5f4"
     },
     {
       "path": "docs/recipes/overnight-builder.md",
@@ -3412,7 +3412,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "f090fbe484a1c9e8bf40d2871a150cef8ce73199455e54e44d117ce1ebc21da5"
+      "sha256": "1a7ef193f9f2829668f5dd612972e6cca43fd84dec1e13d2b1c20f7fd99766f9"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3467,7 +3467,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "54fd7ba3024169f5887fe58182ba03519e66acbbf28c1b753712dbd36f91da01"
+      "sha256": "6e41bbab9f8277a13178e4f9fcd278b47b8b34421114522ac113e57aedb631ac"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -4057,12 +4057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b7e3e581321a968a2978affc8766e5bc9ec8f412f0c3e7a94c47916138724de9"
+      "sha256": "b41abda8346dddd1c07e48067f2d9d0127aaad506519710b08cea5373a993b98"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "283e5a12a702be6937db0eb28a69775e3cb6b760ae217b3824d65ba7feb6743b"
+      "sha256": "0ed0a2fa31ababaeef64de35d41cba12b4308fef35fe2d831a0532ac503581c8"
     },
     {
       "path": "public-docs/index.html",
@@ -4552,7 +4552,7 @@
     {
       "path": "scripts/gds/box-sync.js",
       "mode": "0000644",
-      "sha256": "8169a34dcef766360d10c7d27c7404a776aeb0b8a43f8b91fc9bc12af35a8b1b"
+      "sha256": "981544bfd56d486c2017edd744c86089659771a74399b4780455821c45e3b3a9"
     },
     {
       "path": "scripts/gds/box.js",
@@ -5687,7 +5687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e85465ed2f13494396cf2d74bad0c8a2b6e52d42d48c493a3d0dcf4694f6072e"
+      "sha256": "793ab7f173efc8c4137e658cae4617f09a9c0df1e1783cd28396337eac6aa83b"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6029,6 +6029,11 @@
       "mode": "0000644",
       "sha256": "93bc891850e77350161214749954ddb257169ae323b7242f35becc4e6a9cabcf"
     },
+    {
+      "path": "tests/box_sync_scope_report.mjs",
+      "mode": "0000644",
+      "sha256": "010525c500aa1d5133f85a1a2ea7c23e9a680b08493a6f3b78c69a5108501468"
+    },
     {
       "path": "tests/box_task_scope.mjs",
       "mode": "0000644",
@@ -7227,7 +7232,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "99572892490e209835aae6479370e97b49585bfaa719c788a4d06d92407a9a7d"
+      "sha256": "e3f843387deb2d2a8f2668490bc740f7291d141b2de70c1556a84cb429bdc21d"
     },
     {
       "path": "tests/publish_manifest.mjs",
@@ -7237,7 +7242,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "fe4b594292992429fe5e077491fa2916028a2f1815414f94434f83b4186b1138"
+      "sha256": "ff2428b394a50abf4a593fcbfdb98afe4b56ffdbbffdc81198a102e72b480b9f"
     },
     {
       "path": "tests/rank_gate.mjs",

package/.claude/skills/builder-box/SKILL.md

@@ -16,12 +16,18 @@ The per-builder box lifecycle (ADR 0031 §2) auto-suspends when idle (snapshot-a
 
 ## How to use
 
-1. **Fetch the box + keys** (own-scoped; uses the builder's session token):
+1. **Fetch the box + keys + the resolved scope** (own-scoped; uses the builder's session token):
    ```bash
-   node -e 'const{apiCall}=require("./scripts/gds/cli-lib");(async()=>{for(const p of ["/api/gds/box/me","/api/gds/box/ssh-key"]){const r=await apiCall("GET",p);console.log(p,r.status,JSON.stringify(r.data));}})()'
+   node -e 'const{apiCall}=require("./scripts/gds/cli-lib");(async()=>{for(const p of ["/api/gds/box/me","/api/gds/box/ssh-key","/api/gds/box/scope"]){const r=await apiCall("GET",p);console.log(p,r.status,JSON.stringify(r.data));}})()'
    ```
    (If the script returns "no GDS session", run `/builder-setup` first.)
 
+   **Always report the scope, not just the state** (task 1002731). `/box/scope` returns `{scope, modules, sparse_paths, task_scope}`, and a too-narrow box is otherwise a *silent* failure — the builder sees a working box that is quietly missing the code they need. Read it out:
+   - `scope: 'task'` → name the modules: *"your box holds dev-box, hall-ui — and nothing else."*
+   - `scope: 'base'` → **say plainly that the box has no `modules/` code at all.** With no active claim that is expected; claiming a task and running `/builder-sync` fixes it.
+   - `scope: 'full'` with `modules: []` → the task-1002729 fallback fired: they hold claims, but those claims' goals declare no `scope_modules`, so the box fell back to their rank. Usable, but task-scoping is not actually doing anything — setting the goal's wall would give a tighter box.
+   - `scope: 'starter'` → the fixed newcomer slice, not scoped to their claim.
+
 2. **Relay it in plain language:**
    - **state = `none`** → they have no box yet. On a Mac/Windows: run `/builder-connect` (registers their SSH key + installs the Desktop file). To actually create the box hands-off, `POST /api/gds/box/ensure` queues the auto-provision (no operator CLI needed). *(The old path — ask an operator to `box.js onboard <login>` — still works but is no longer required.)*
    - **state = `active`** → box is up at `hostname` (`ip`). They can connect from Claude Desktop → Code → Environment → "Example Dev Box". For a browser/Chromebook (ADR 0038), the terminal comes from the web: `GET /api/gds/box/terminal` returns a `url` + a basic-auth `credential` (username `otb`, password = <redacted>; open the url, enter them, then type `claude` in the terminal. No SSH needed.

package/docs/recipes/ops-gotchas.md

@@ -187,6 +187,17 @@ Organized by topic, not chronology. New entries go in the matching section; crea
 - **Do NOT** use `POST /tasks/:id/confirm` to unstick *another* builder's task — it credits + attributes to the *caller* (the Archon), not the original builder. `/confirm` is for the shipping builder's own `--skip-grade` path. The override-request → approve flow is the correct tool when the work was someone else's.
 - **Why it bites:** the grader defaults to fail (by design — it's adversarial), so a false-negative looks identical to a real rejection. The fix is a documented, audited human-in-the-loop appeal, not a grader bypass — and the appeal pays the right person.
 
+### A task sits at `confirmed` and every sweep logs `pr_not_landed` for a PR GitHub says is MERGED
+
+- **Symptom:** `journalctl -u <instance>.service | grep publish-reconciler` shows the same task in the `dispositions:` line sweep after sweep as `pr_not_landed`, while `gh pr view <n>` reports `MERGED` with green checks. Only a manual `POST /api/gds/tasks/<id>/ship` clears it. Observed live 2026-08-12 (task 1002695 / PR 91, 18 min across 4 sweeps).
+- **Read the disposition first.** Since task 1002724 the line carries the probe detail — `1002695:pr_not_landed(deploy=unavailable http=403 pr=91 …)` — so you can tell the three cases apart without a shell:
+  - `deploy=pending` — a real deploy is in flight. Correct; wait.
+  - `deploy=unavailable http=403` — **the server's GitHub token cannot read Actions.** The probe is blind, not waiting. The sweep now falls back to the git-history land proof and lands the task anyway (a blind probe must not outrank main's history), but the underlying token permission is still worth fixing: grant the App/PAT `actions:read` so the deploy gate is real again. On a repo with no `deploy-prod.yml` at all, a token that CAN read Actions gets a clean 404 → `unconfigured` → the merge is the land.
+  - `deploy=unconfigured` — no `deploy-prod.yml`; the merge IS the land (ADR 0108 pin-bump publishing).
+- **Why it used to strand forever:** `getPublishStatus` folded every non-404 error into `pending` on the comment "5xx/403/rate limit is transient". A permissions 403 never resolves, and a MERGED PR at `pending` made the reconciler treat the task as mid-deploy, which *suppressed* the per-task land proof on every sweep. The blindness silently outranked proof that the work was already on `main`.
+- **Related:** publish-on-merge (ADR 0161) pushes a `release: core X.Y.Z` carrier commit after every land, so on an instance that DOES deploy, the deploy run belongs to the carrier's sha, not the merge commit's. A strict sha match never hit — hence the same permanent `pending`. The probe now also accepts a successful `main` deploy that started after the merge.
+- **The wait is bounded.** A probe stuck at `deploy=pending` for a reason that never resolves looks identical to a slow deploy on any single sweep, so after `<redacted>` (default 30 min) a task whose land is *provable on main* ships anyway, and the sweep logs `deploy still unconfirmed after Nmin`. This lifts only the deploy gate — the per-task land proof is untouched, so it can never become a branch-reuse false-ship. Raise the env var on an instance whose real deploy legitimately takes longer than 30 minutes.
+
 ---
 
 ## Status page + monitoring

package/modules/lifecycle/github-push.js

@@ -382,9 +382,13 @@ async function enableAutoMerge({ nodeId }, deps = {}) {
 
 // getPublishStatus — report the PR + prod-deploy state so ship.js can poll
 // WITHOUT gh on the box. Returns:
-//   { pr_state, merged, merge_sha, deploy_status }  where
-//   pr_state ∈ open|closed|none, deploy_status ∈ pending|success|none|unconfigured
-//   ('unconfigured' = this repo has no deploy-prod.yml — task 1002472).
+//   { pr_state, merged, merge_sha, deploy_status, deploy_probe }  where
+//   pr_state ∈ open|closed|none,
+//   deploy_status ∈ pending|success|none|unconfigured|unavailable
+//   ('unconfigured' = this repo has no deploy-prod.yml — task 1002472;
+//    'unavailable'  = we could not READ the deploy state at all — task 1002724).
+//   deploy_probe = { state, http, detail } — WHY the probe landed where it did,
+//   so a stuck disposition is diagnosable without a shell on the host.
 // Mirrors ship.js pollCiDeploy's two-stage check (PR merged -> deploy run).
 async function getPublishStatus({ branch }, deps = {}) {
   const token = await resolveToken(deps);
@@ -421,6 +425,7 @@ async function getPublishStatus({ branch }, deps = {}) {
 
   // Merged → did the prod-deploy workflow succeed for the merge commit?
   let deployStatus = 'pending';
+  let deployProbe = { state: 'pending', http: null, detail: 'no matching deploy run yet' };
   try {
     const runsRes = await doFetch(
       `${api}/actions/workflows/deploy-prod.yml/runs?branch=main&per_page=15`,
@@ -429,10 +434,29 @@ async function getPublishStatus({ branch }, deps = {}) {
     if (runsRes.ok) {
       const data = await runsRes.json();
       const runs = (data && data.workflow_runs) || [];
-      const hit = runs.some(
-        (r) => r && r.head_sha === mergeSha && r.status === 'completed' && r.conclusion === 'success'
-      );
-      if (hit) deployStatus = 'success';
+      const ok = (r) => r && r.status === 'completed' && r.conclusion === 'success';
+      // task 1002724 (idea 1000702) — the ADR 0161 CARRIER race. Publish-on-merge
+      // pushes a "release: core X.Y.Z" carrier commit to main after EVERY land, so
+      // the deploy run that actually deploys this merge is keyed to the CARRIER's
+      // head_sha, not the merge commit's. A strict head_sha === mergeSha match then
+      // never hits, deploy_status stays 'pending' forever, and the reconciler treats
+      // a fully-landed task as mid-deploy for good. Accept either: the run FOR this
+      // merge, or any successful main deploy that started after the merge landed —
+      // deploying main after the merge necessarily deploys the merge.
+      const mergedAtMs = pr.merged_at ? Date.parse(pr.merged_at) : NaN;
+      const exact = runs.some((r) => ok(r) && r.head_sha === mergeSha);
+      const afterMerge = !exact && Number.isFinite(mergedAtMs) && runs.some((r) => {
+        if (!ok(r)) return false;
+        const startedMs = Date.parse(r.run_started_at || r.created_at || '');
+        return Number.isFinite(startedMs) && startedMs >= mergedAtMs;
+      });
+      if (exact || afterMerge) {
+        deployStatus = 'success';
+        deployProbe = {
+          state: 'success', http: runsRes.status,
+          detail: exact ? 'deploy run for the merge commit' : 'main deploy succeeded after the merge (ADR 0161 carrier)',
+        };
+      }
     } else if (runsRes.status === 404) {
       // task 1002472 — the workflow FILE does not exist in this repo, so there is no
       // deploy to wait for and 'pending' would never resolve. The 404 is unambiguous:
@@ -442,12 +466,30 @@ async function getPublishStatus({ branch }, deps = {}) {
       // (package-core → bongos upgrade, ADR 0108) never have a deploy-prod.yml at all;
       // reporting 'pending' pinned every merged PR at confirmed forever.
       deployStatus = 'unconfigured';
+      deployProbe = { state: 'unconfigured', http: 404, detail: 'no deploy-prod.yml in this repo' };
+    } else {
+      // task 1002724 — this branch used to fall through as 'pending' on the comment
+      // "5xx/403/rate-limit is transient". A 403 from a token without `actions:read`
+      // is NOT transient, it is forever — and 'pending' on a MERGED PR makes the
+      // reconciler suppress the land proof on every sweep (prMidDeploy), so the task
+      // strands at 'confirmed' permanently with a bare 'pr_not_landed' and no clue
+      // why. That is exactly the live 2026-08-12 strand (task 1002695 / PR 91:
+      // GitHub reported MERGED with green checks, the server reported deploy
+      // 'pending' for 18 min across 4 sweeps, and only a manual ship cleared it).
+      // Call it what it is — we could not READ the deploy state — and let the
+      // reconciler decide whether git history already proves the land.
+      deployStatus = 'unavailable';
+      deployProbe = { state: 'unavailable', http: runsRes.status, detail: `workflow-runs read failed (HTTP ${runsRes.status})` };
     }
-    // Any other non-ok (5xx, 403, rate limit) is transient → stay 'pending' and retry.
-  } catch (_) {
-    /* leave pending on a transient runs-API miss */
+  } catch (e) {
+    // A network-level miss is genuinely transient — keep waiting, but say so.
+    deployProbe = { state: 'pending', http: null, detail: `workflow-runs fetch threw: ${e && e.message}` };
   }
-  return { pr_state: pr.state, merged: true, merge_sha: mergeSha, deploy_status: deployStatus, pr_url: pr.html_url, ...prMeta };
+  return {
+    pr_state: pr.state, merged: true, merge_sha: mergeSha,
+    deploy_status: deployStatus, deploy_probe: deployProbe,
+    pr_url: pr.html_url, ...prMeta,
+  };
 }
 
 // task 1547 — does the PR matched by getPublishStatus actually belong to THIS task?
@@ -755,11 +797,23 @@ async function setCommitStatus({ sha, state, context, description, targetUrl },
 // is the land, and requiring a deploy that can never run pinned every merged PR at
 // 'confirmed' forever. MERGED stays mandatory, and this is only the gate on the
 // branch/PR path — landProvenForTask still has to prove the land is THIS task's.
+// task 1002724 — 'unavailable' deliberately does NOT count as landed here. On an
+// instance that really does deploy, a blind probe must not be promoted into
+// "deployed". It is the RECONCILER that treats blindness differently from a real
+// in-flight deploy (see deployProbeBlind): a probe that cannot see anything must
+// not veto a positive git-history proof of the land.
 function landConfirmed(status) {
   if (!status || status.merged !== true) return false;
   return status.deploy_status === 'success' || status.deploy_status === 'unconfigured';
 }
 
+// Is the deploy probe BLIND (we could not read the deploy state) as opposed to
+// legitimately waiting on a deploy we can see? Exported so the reconciler and the
+// publish-status route agree on the distinction.
+function deployProbeBlind(status) {
+  return !!status && status.deploy_status === 'unavailable';
+}
+
 // task 1547 — is a landConfirmed status PROVEN to be THIS task's land, and not a
 // reused worktree branch matching an OLDER task's already-merged PR (the BV1.R04/R05
 // false-ship: branch claude/jovial-rosalind-84d6c3 → PR #386 / task 1297, merged,
@@ -1090,6 +1144,7 @@ module.exports = {
   recheckPullRequest,
   GATE_OWNER_APPROVED_CONTEXT,
   landConfirmed,
+  deployProbeBlind,
   landProvenForTask,
   prReferencesTask,
   findTaskPullRequest,

package/modules/lifecycle/publish-reconciler.js

@@ -96,6 +96,18 @@ const SWEEP_LIMIT = 100;
 // landed and that is OLDER than this is a strand — credited but with no provable
 // land — and gets a WARN. Default 30 min; tune/disable via env.
 const STALE_CONFIRMED_MS = Number(process.env.PUBLISH_RECONCILE_STALE_MS) || 30 * 60_000;
+
+// task 1002724 — how long a MERGED PR may claim "still deploying" before the sweep
+// stops letting that claim veto a git-history-proven land.
+//
+// The blindness fix below handles the case where the probe REPORTS it cannot read
+// the deploy state ('unavailable'). It cannot handle a probe that keeps answering
+// 'pending' for a reason that never resolves — e.g. the workflow-runs fetch throwing
+// every sweep, which is indistinguishable from a slow deploy on any single pass. So
+// bound the wait: past this age, a task whose land is PROVABLE on main ships, and the
+// sweep says loudly that it stopped waiting. Anything unprovable is untouched — this
+// relaxes only the deploy gate, never the per-task land proof.
+const DEPLOY_WAIT_BOUND_MS = Number(process.env.PUBLISH_RECONCILE_DEPLOY_WAIT_MS) || 30 * 60_000;
 // task 1915: cap the speculative regen-heal per branch so a genuine treadmill (main
 // churning faster than CI clears a re-freshened branch) can't loop forever. In-memory
 // per process — a restart resets the guard, which is fine (heals are idempotent and
@@ -206,6 +218,18 @@ async function runSweep(deps = {}) {
     wtCount.set(r.worktree_name, (wtCount.get(r.worktree_name) || 0) + 1);
   }
 
+  // task 1002724 — a one-line, log-safe summary of WHY the deploy probe landed
+  // where it did, so 'pr_not_landed' in a journal line is self-explaining.
+  const describeProbe = (status) => {
+    if (!status) return 'no status';
+    const p = status.deploy_probe || null;
+    const bits = [`deploy=${status.deploy_status ?? 'unknown'}`];
+    if (p && p.http) bits.push(`http=${p.http}`);
+    if (status.pr_number) bits.push(`pr=${status.pr_number}`);
+    if (p && p.detail) bits.push(String(p.detail).slice(0, 80));
+    return bits.join(' ');
+  };
+
   let reconciled = 0;
   let merged = 0;
   let resolvedConflicts = 0;
@@ -545,7 +569,30 @@ async function runSweep(deps = {}) {
     // task 1002615: only a MERGED PR that is still deploying suppresses the proof
     // (the deploy gate governs); an un-merged PR — open, or closed without merging —
     // cannot veto what git history on main already shows.
-    const prMidDeploy = prNotLanded && !!(branchStatus && branchStatus.merged === true);
+    // task 1002724 — a MERGED PR still deploying may veto the land proof, but only
+    // while we can actually SEE the deploy. When the probe is blind (deploy_status
+    // 'unavailable' — e.g. a token without `actions:read` 403s, permanently), the
+    // old code called that "mid-deploy" and suppressed the proof on every sweep
+    // forever: the task stranded at 'confirmed' even though main's git history
+    // already proved the land. Blindness must not outrank evidence.
+    const probeBlind = typeof push.deployProbeBlind === 'function'
+      ? push.deployProbeBlind(branchStatus)
+      : false;
+    // …and a deploy we can "see" but that never resolves is the same trap wearing a
+    // different hat, so the wait is bounded too (DEPLOY_WAIT_BOUND_MS). Both escapes
+    // only lift the DEPLOY gate — landProvenForTask below still has to prove the land
+    // belongs to this task, so neither can cause a branch-reuse false-ship.
+    const confirmedAgeMs = r.confirmed_at ? (nowMs - new Date(r.confirmed_at).getTime()) : null;
+    const deployWaitExpired = confirmedAgeMs != null && confirmedAgeMs > DEPLOY_WAIT_BOUND_MS;
+    const prMidDeploy = prNotLanded
+      && !!(branchStatus && branchStatus.merged === true)
+      && !probeBlind
+      && !deployWaitExpired;
+    if (prNotLanded && !!(branchStatus && branchStatus.merged === true) && (probeBlind || deployWaitExpired)) {
+      logFn(
+        `[publish-reconciler] task ${r.task_id}: ${probeBlind ? 'deploy probe BLIND' : `deploy still unconfirmed after ${Math.round(confirmedAgeMs / 60_000)}min`} (${describeProbe(branchStatus)}) — consulting the git-history land proof instead of waiting on a deploy state that is not resolving`
+      );
+    }
     if (!landed && !prMidDeploy && typeof push.landProvenForTask === 'function') {
       try {
         const proof = await push.landProvenForTask({
@@ -583,7 +630,11 @@ async function runSweep(deps = {}) {
         : prNotLanded
           ? 'pr_not_landed'
           : (!branch && !r.published_head_sha) ? 'no_branch_no_tip' : 'land_not_proven';
-      dispositions.push(`${r.task_id}:${reason}`);
+      // task 1002724 — a bare 'pr_not_landed' says a PR exists and did not land, but
+      // not WHICH probe refused or why, so the 2026-08-12 strand needed a host shell
+      // and a hand-run of getPublishStatus to explain. Carry the probe detail into
+      // the disposition so the log line alone is diagnosable.
+      dispositions.push(`${r.task_id}:${reason}${reason === 'pr_not_landed' ? `(${describeProbe(branchStatus)})` : ''}`);
       const ageMs = r.confirmed_at ? (nowMs - new Date(r.confirmed_at).getTime()) : null;
       if (ageMs != null && ageMs > STALE_CONFIRMED_MS) {
         staleStrands++;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.80",
+  "version": "1.19.82",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.80",
+      "version": "1.19.82",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.80",
+  "version": "1.19.82",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/box-sync.js

@@ -57,10 +57,77 @@ function main(argv = process.argv.slice(2)) {
     console.error(`sync: could not run the fetch (${r.error.message})`);
     process.exit(1);
   }
-  if (r.status === 0) console.log('sync: done — your box now holds the code for your active claim.');
-  process.exit(r.status == null ? 1 : r.status);
+  if (r.status !== 0) process.exit(r.status == null ? 1 : r.status);
+  console.log('sync: done — your box now holds the code for your active claim.');
+  // Then say WHAT it holds, so a base-only box is visible instead of silent.
+  reportScope().then(() => process.exit(0), () => process.exit(0));
+}
+
+// ---------------------------------------------------------------------------
+// task 1002731 — say what scope the box ACTUALLY got
+// ---------------------------------------------------------------------------
+
+// The failure this exists for is a SILENT one: a box comes up holding only the
+// base slice (no modules/ at all) and nothing anywhere says so. Live, that was
+// 247 of 248 source grants — including an Archon with 7 active claims — and the
+// only way to see it was reading box_events on the control plane. GET /box/scope
+// already returns the resolved decision; nothing ever showed it to a human.
+//
+// PURE so it is unit-testable without a box or a network: takes the /box/scope
+// body, returns the lines to print. null/garbage in → one honest line rather
+// than a crash, because this is diagnostic output on an already-degraded path
+// and must never be the thing that fails.
+function formatScopeReport(scope) {
+  if (!scope || typeof scope !== 'object' || Array.isArray(scope)) {
+    return ['scope: could not read your box scope (GET /box/scope did not answer).'];
+  }
+  const modules = Array.isArray(scope.modules) ? scope.modules : null;
+  const paths = Array.isArray(scope.sparse_paths) ? scope.sparse_paths : [];
+  const out = [];
+
+  if (scope.scope === 'task' && modules && modules.length) {
+    out.push(`scope: task — your box holds ${modules.length} module(s): ${modules.join(', ')}`);
+  } else if (scope.scope === 'base') {
+    out.push('scope: BASE ONLY — your box holds no modules/ code at all.');
+    out.push(scope.task_scope
+      ? '  Why: you hold no active claim, so there is no work to scope the box to.'
+      : '  Why: this instance resolved no claim scope.');
+    out.push('  Fix: claim a task (/builder-claim N), then re-run this sync.');
+  } else if (scope.scope === 'full') {
+    out.push('scope: full — your box holds the whole repo (your rank allows it).');
+    if (modules && modules.length === 0) {
+      // The task-1002729 fallback fired: claims held, but their goals declare no
+      // wall. Worth naming — the box is usable, but task-scoping is doing nothing.
+      out.push('  Note: your claimed work declares no module scope, so this fell back to');
+      out.push("  your rank rather than scoping to the task. Setting the goal's");
+      out.push('  scope_modules would give you a tighter box.');
+    }
+  } else if (scope.scope === 'starter') {
+    out.push('scope: starter — a fixed slice for newcomers, not scoped to your claim.');
+  } else {
+    out.push(`scope: ${String(scope.scope || 'unknown')}`);
+  }
+  if (paths.length) out.push(`  paths: ${paths.length} sparse entr${paths.length === 1 ? 'y' : 'ies'}`);
+  return out;
+}
+
+// Read the resolved scope and print it. Never throws and never changes the exit
+// status — a diagnostic that could fail the sync it reports on would be worse
+// than no diagnostic.
+async function reportScope() {
+  try {
+    const { apiCall } = require('./cli-lib');
+    const r = await apiCall('GET', '/api/gds/box/scope');
+    if (!r || r.status !== 200) {
+      console.log('scope: could not read your box scope right now (that does not affect the sync above).');
+      return;
+    }
+    for (const line of formatScopeReport(r.data)) console.log(line);
+  } catch (_) {
+    console.log('scope: could not read your box scope right now (that does not affect the sync above).');
+  }
 }
 
 if (require.main === module) main();
 
-module.exports = { resolveFetchScript, FETCH_SCRIPT };
+module.exports = { resolveFetchScript, FETCH_SCRIPT, formatScopeReport };

package/src/module-api.js

@@ -587,8 +587,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.78 with no explicit bump. run 31648954641. (task 1002620)
 //   1.19.80 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.79 with no explicit bump. run 31649366675. (task 1002620)
+//   1.19.81 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.80 with no explicit bump. run 31649705242. (task 1002620)
+//   1.19.82 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.81 with no explicit bump. run 31650108283. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.80'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.82'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/box_sync_scope_report.mjs

@@ -0,0 +1,81 @@
+// tests/box_sync_scope_report.mjs
+//
+// Task 1002731 — the scope read-out that makes a too-narrow box VISIBLE.
+//
+// The failure being guarded is a silent one: a box comes up holding only the
+// base slice (no modules/ at all) and nothing tells the builder. Live, that was
+// 247 of 248 source grants on the cloudbongos fleet — including an Archon
+// holding 7 active claims — and the only way to see it was reading box_events
+// on the control plane.
+//
+// formatScopeReport is PURE (takes the GET /box/scope body, returns lines), so
+// this needs no box, no network and no DB.
+//
+// Run:  node tests/box_sync_scope_report.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { formatScopeReport } = require('../scripts/gds/box-sync.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+const joined = (scope) => formatScopeReport(scope).join('\n');
+
+t('base-only is stated in plain words, with a why and a fix', () => {
+  const out = joined({ scope: 'base', mode: 'sparse', modules: [], sparse_paths: ['docs', 'scripts'], task_scope: true });
+  assert.match(out, /BASE ONLY/, 'the degraded state is named, not buried');
+  assert.match(out, /no modules\/ code at all/, 'says what is actually missing');
+  assert.match(out, /Why:/, 'explains the cause');
+  assert.match(out, /builder-claim/, 'gives the builder the actual next step');
+});
+
+t('task scope names the modules the box holds', () => {
+  const out = joined({ scope: 'task', mode: 'sparse', modules: ['dev-box', 'hall-ui'], sparse_paths: ['a', 'b', 'c'], task_scope: true });
+  assert.match(out, /scope: task/);
+  assert.match(out, /dev-box, hall-ui/, 'names them rather than just counting');
+  assert.match(out, /3 sparse entries/);
+});
+
+t('full + EMPTY modules surfaces the 1002729 fallback rather than looking healthy', () => {
+  // The exact live shape: claims held, but their goals declare no scope_modules.
+  // The box works, so nothing complains — but task-scoping is not doing anything,
+  // and that is worth telling someone.
+  const out = joined({ scope: 'full', mode: 'full', modules: [], sparse_paths: null, task_scope: true });
+  assert.match(out, /scope: full/);
+  assert.match(out, /declares no module scope/, 'names why it fell back');
+  assert.match(out, /scope_modules/, 'points at the thing to fix');
+});
+
+t('full with real modules does NOT nag about the fallback', () => {
+  const out = joined({ scope: 'full', mode: 'full', modules: ['kernel'], sparse_paths: null, task_scope: false });
+  assert.match(out, /scope: full/);
+  assert.ok(!/declares no module scope/.test(out), 'no false alarm when nothing is wrong');
+});
+
+t('starter is distinguished from a claim-scoped box', () => {
+  const out = joined({ scope: 'starter', mode: 'sparse', modules: null, sparse_paths: ['x'], task_scope: false });
+  assert.match(out, /starter/);
+  assert.match(out, /not scoped to your claim/);
+});
+
+t('a missing or malformed body degrades to one honest line, never a throw', () => {
+  // This runs on an already-degraded path; it must not be the thing that fails.
+  for (const bad of [null, undefined, 'nope', 42, []]) {
+    const lines = formatScopeReport(bad);
+    assert.ok(Array.isArray(lines) && lines.length >= 1, `handled ${JSON.stringify(bad)}`);
+  }
+  assert.match(joined(null), /could not read/);
+});
+
+t('an unknown scope value is reported verbatim rather than swallowed', () => {
+  assert.match(joined({ scope: 'something-new', sparse_paths: [] }), /something-new/);
+});
+
+console.log(`\nbox_sync_scope_report.mjs: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/publish_branch_route.mjs

@@ -242,7 +242,11 @@ await t('getPublishStatus: merged + workflow-runs 404 → unconfigured (no deplo
   assert.equal(s.deploy_status, 'unconfigured', 'an absent workflow is permanent, not pending');
 });
 
-await t('getPublishStatus: merged + workflow-runs 5xx/403 → still pending (transient stays transient)', async () => {
+// task 1002724 — an unreadable deploy state is its OWN thing: not "no workflow"
+// (which would land it) and not "a deploy is running" (which vetoes the land proof
+// forever). A 403 from a token without `actions:read` never resolves, and calling
+// it 'pending' stranded task 1002695 at confirmed across 4 sweeps on 2026-08-12.
+await t('getPublishStatus: merged + workflow-runs 5xx/403 → unavailable, never landConfirmed', async () => {
   const mergeSha = 'e'.repeat(40);
   const mk = (code) => async (url) => {
     if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
@@ -251,10 +255,67 @@ await t('getPublishStatus: merged + workflow-runs 5xx/403 → still pending (tra
   };
   for (const code of [500, 502, 403]) {
     const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl: mk(code) });
-    assert.equal(s.deploy_status, 'pending', `${code} must NOT be read as "no workflow"`);
+    assert.equal(s.deploy_status, 'unavailable', `${code} must NOT be read as "no workflow" nor as a running deploy`);
+    assert.equal(s.deploy_probe.http, code, 'the probe must carry the HTTP status for diagnosis');
+    assert.equal(gp.landConfirmed(s), false, 'a blind probe must never be promoted into "deployed"');
+    assert.equal(gp.deployProbeBlind(s), true);
   }
 });
 
+await t('getPublishStatus: a network throw stays pending (genuinely transient), not unavailable', async () => {
+  const mergeSha = 'e'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
+    if (url.includes('deploy-prod.yml/runs')) throw new Error('ECONNRESET');
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'pending');
+  assert.equal(gp.deployProbeBlind(s), false, 'a socket blip is a retry, not blindness');
+  assert.match(s.deploy_probe.detail, /threw/);
+});
+
+// task 1002724 / idea 1000702 — the ADR 0161 carrier race. Publish-on-merge pushes
+// a "release: core X.Y.Z" carrier commit to main after every land, so the deploy run
+// that deploys THIS merge is keyed to the carrier's sha, not the merge commit's.
+await t('getPublishStatus: a successful main deploy AFTER the merge counts (ADR 0161 carrier)', async () => {
+  const mergeSha = 'a'.repeat(40);
+  const carrierSha = 'b'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) {
+      return jsonRes(200, [{ state: 'closed', merged_at: '2026-08-12T20:25:23Z', merge_commit_sha: mergeSha, html_url: 'http://pr/91' }]);
+    }
+    if (url.includes('deploy-prod.yml/runs')) {
+      return jsonRes(200, { workflow_runs: [
+        // the carrier's deploy — a different head_sha, started after the merge
+        { head_sha: carrierSha, status: 'completed', conclusion: 'success', run_started_at: '2026-08-12T20:27:00Z' },
+      ] });
+    }
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'success', 'deploying main after the merge deploys the merge');
+  assert.equal(gp.landConfirmed(s), true);
+  assert.match(s.deploy_probe.detail, /carrier/i);
+});
+
+await t('getPublishStatus: a main deploy that finished BEFORE the merge does not count', async () => {
+  const mergeSha = 'a'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) {
+      return jsonRes(200, [{ state: 'closed', merged_at: '2026-08-12T20:25:23Z', merge_commit_sha: mergeSha, html_url: 'http://pr/91' }]);
+    }
+    if (url.includes('deploy-prod.yml/runs')) {
+      return jsonRes(200, { workflow_runs: [
+        { head_sha: 'c'.repeat(40), status: 'completed', conclusion: 'success', run_started_at: '2026-08-12T20:00:00Z' },
+      ] });
+    }
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'pending', 'an earlier deploy cannot have carried this merge');
+});
+
 await t('getPublishStatus: merged, workflow EXISTS but no successful run yet → pending', async () => {
   const mergeSha = 'f'.repeat(40);
   const fetchImpl = async (url) => {

package/tests/publish_reconciler.mjs

@@ -129,6 +129,9 @@ function mkDeps({
         if (a instanceof Error) throw a;
         return !!a;
       },
+      // task 1002724: the REAL blindness predicate, so the sweep's "is this deploy
+      // state unreadable?" decision cannot drift from getPublishStatus's answer.
+      deployProbeBlind: githubPush.deployProbeBlind,
       // task 1547 per-task land proof. Mirrors the real github-push.landProvenForTask
       // shape but routes its network hops (the ancestry compares) through the mock
       // above so the sweep stays DB/network-free, and reuses the REAL prReferencesTask
@@ -333,6 +336,122 @@ test('1002472 merged + deploy unconfigured + published tip in main → ships', a
   assert.deepEqual(deps._calls.broadcast, [63]);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002724 — the deploy probe went BLIND and vetoed a provable land forever.
+//
+// Live on 2026-08-12: task 1002695 / PR 91 was MERGED with green checks at
+// 20:25:23Z, but the server's deploy probe answered 'pending' (a 403 from a token
+// without `actions:read` — permanent, not transient). merged + !landConfirmed made
+// prMidDeploy true, which SUPPRESSED landProvenForTask on every sweep, so four
+// sweeps across 18 minutes all logged a bare '1002695:pr_not_landed' and only a
+// manual POST /ship cleared it. A probe that cannot see anything must not outrank
+// main's git history, and the disposition must say which probe refused.
+// ---------------------------------------------------------------------------
+const BLIND = (id) => ({
+  ...landedPrFor(id),
+  deploy_status: 'unavailable',
+  deploy_probe: { state: 'unavailable', http: 403, detail: 'workflow-runs read failed (HTTP 403)' },
+  merge_sha: MERGE_SHA,
+});
+
+test('1002724 blind deploy probe no longer vetoes a tip-proven land', async () => {
+  const tip = 'd'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 1002695, builder_id: 9, worktree_name: 'wt-blind', published_head_sha: tip,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-blind': BLIND(1002695) },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the published tip is in main — that IS the land');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 1002695, builderId: 9 }]);
+});
+
+test('1002724 blind probe + merged PR naming the task → the merge-commit proof still lands it', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 1002695, builder_id: 9, worktree_name: 'wt-blind2', published_head_sha: null,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-blind2': BLIND(1002695) },
+    ancestryBySha: { [MERGE_SHA]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'a merged PR naming this task whose merge sha is in main is a land');
+});
+
+test('1002724 a REAL in-flight deploy still vetoes the proof (the gate is not weakened)', async () => {
+  const tip = 'e'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 65, builder_id: 4, worktree_name: 'wt-realdeploy', published_head_sha: tip,
+             confirmed_at: new Date().toISOString() }],
+    // deploy_status 'pending' = we CAN read the deploy state and it has not succeeded.
+    statusByBranch: { 'claude/wt-realdeploy': { ...landedPrFor(65), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'merged-but-still-deploying must keep waiting — shipped means deployed');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('1002724 a deploy that never resolves stops vetoing a provable land once the wait is bounded', async () => {
+  // The blindness escape only fires when the probe SAYS it is blind. A probe that
+  // keeps answering 'pending' forever (e.g. the runs fetch throwing every sweep)
+  // looks identical to a slow deploy on any single pass — so the wait is bounded.
+  const tip = '1'.repeat(40);
+  const old = new Date(Date.now() - 45 * 60_000).toISOString(); // 45min > the 30min bound
+  const deps = mkDeps({
+    rows: [{ task_id: 67, builder_id: 4, worktree_name: 'wt-forever', published_head_sha: tip, confirmed_at: old }],
+    statusByBranch: { 'claude/wt-forever': { ...landedPrFor(67), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'past the bound, a provable land must not wait on a deploy forever');
+  assert.ok(
+    deps._calls.logs.some((l) => /deploy still unconfirmed after \d+min/.test(l)),
+    'the sweep must say it stopped waiting, not ship silently'
+  );
+});
+
+test('1002724 the bound lifts only the DEPLOY gate — an unprovable land still strands', async () => {
+  const tip = '2'.repeat(40);
+  const old = new Date(Date.now() - 45 * 60_000).toISOString();
+  const deps = mkDeps({
+    rows: [{ task_id: 68, builder_id: 4, worktree_name: 'wt-forever-unproven', published_head_sha: tip, confirmed_at: old }],
+    statusByBranch: { 'claude/wt-forever-unproven': { ...landedPrFor(68), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: false }, // tip NOT in main — no land to prove
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'the bound must never become a branch-reuse false-ship');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('1002724 a young in-flight deploy is still waited on (the bound does not fire early)', async () => {
+  const tip = '3'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 69, builder_id: 4, worktree_name: 'wt-young', published_head_sha: tip,
+             confirmed_at: new Date(Date.now() - 60_000).toISOString() }], // 1min old
+    statusByBranch: { 'claude/wt-young': { ...landedPrFor(69), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'shipped means deployed while the deploy is plausibly still running');
+});
+
+test('1002724 an unprovable pr_not_landed disposition names the failing probe', async () => {
+  const tip = 'f'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 66, builder_id: 4, worktree_name: 'wt-diag', published_head_sha: tip,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-diag': { ...landedPrFor(66), deploy_status: 'pending', pr_number: 91 } },
+    ancestryBySha: { [tip]: false },
+  });
+  await reconciler.runSweep(deps);
+  const line = deps._calls.logs.find((l) => /dispositions:/.test(l));
+  assert.ok(line, 'the sweep must emit a dispositions line');
+  assert.match(line, /66:pr_not_landed\(/, 'the disposition must carry probe detail, not be bare');
+  assert.match(line, /deploy=pending/);
+  assert.match(line, /pr=91/, 'the PR number makes the strand traceable from the log alone');
+});
+
 test('1002472 merged + deploy unconfigured but tip NOT in main → NO ship (1547 proof intact)', async () => {
   const deps = mkDeps({
     rows: [{ task_id: 64, builder_id: 4, worktree_name: 'wt-nowf-reuse', published_head_sha: NOT_ON_MAIN }],