@bongos/core 1.19.807 → 1.19.809

package/modules/hall-ui/public/record.css

@@ -356,6 +356,29 @@
 
 /* ---- the actions --------------------------------------------------------- */
 .rec-actions { display: flex; align-items: center; gap: 12px; flex-wrap: wrap; }
+
+/* task 1002858 — the shaping verbs on the task record.
+
+   The RETIRE row sits under the button row rather than in it, and is separated
+   by a rule: it is the one control on this page that destroys the plan instead
+   of advancing it, so it does not share a line with Ship it and Copy prompt. */
+.rec-actions--retire { margin: 14px 0 0; padding: 12px 0 0; border-top: var(--line) solid var(--rule-soft); }
+.td-btn--danger { color: var(--danger); border-color: var(--danger); }
+.td-btn--danger:hover:not(:disabled) { background: var(--danger-weak); color: var(--danger); border-color: var(--danger); }
+
+/* The × that cuts a dependency edge. Quiet until the row is hovered or it is
+   focused, because the list's job is to be READ — the control is for the rare
+   moment the chain is wrong, and a column of red crosses would say otherwise. */
+.rec-dep__cut {
+  flex: none; margin-left: 4px; padding: 0 6px; min-width: 24px; line-height: 20px;
+  background: none; border: var(--line) solid transparent; border-radius: var(--radius-sm);
+  color: var(--ink-faint); font-size: 15px; cursor: pointer; opacity: 0;
+}
+.rec-deplist li:hover .rec-dep__cut, .rec-dep__cut:focus-visible { opacity: 1; }
+.rec-dep__cut:hover:not(:disabled) { color: var(--danger); border-color: var(--danger); }
+.rec-dep__cut:disabled { color: var(--ink-faint); cursor: default; opacity: 1; }
+/* Touch has no hover, so the control must simply be there. */
+@media (hover: none) { .rec-dep__cut { opacity: 1; } }
 /* Where a lifecycle control would be but is not, the record says why in words.
    Nothing here is pressable-or-live, so nothing here is warm. */
 .rec-actnote { margin: 0; flex: 1 1 240px; font-size: 14px; color: var(--ink-soft); max-width: var(--measure); }

package/modules/hall-ui/public/task.js

@@ -7,10 +7,18 @@
 // the page itself (SIGNEDIN_BUILDERS_PAGE_RE + the two-segment TASK_DETAIL_PAGE_RE),
 // so an unauthenticated visitor never reaches this script.
 //
-// READ + NAVIGATION ONLY (task 751 scope) — no claim/release/ship action lives
-// here. The "Copy prompt" button is purely client-side (clipboard write, no
-// server call), same posture as the Work Board's copy action. Claim/release
-// from the browser is the dependent follow-up task.
+// NOT READ-ONLY ANY MORE, and this comment is the third thing to say so: task
+// 751 opened the page read+navigation only, task 759 added Ship it / Confirm,
+// task 1003063 added the goal move, and task 1002858 adds the task-SHAPING
+// verbs — priority, dependency add/remove, and abandon. "Copy prompt" is still
+// the only purely client-side control (a clipboard write, no server call).
+//
+// THE RULE EVERY WRITE ON THIS PAGE FOLLOWS (ADR 0016): the server owns every
+// rank and ownership gate; this file only decides which control to SURFACE, and
+// maps a refusal to a sentence. isSupervisor here is the client's read of the
+// Metic floor those permissions share (task.edit, task.abandon,
+// task.dependency.manage) — it is a display hint, never the gate. Claim/release
+// from the browser is still the dependent follow-up task.
 
 (() => {
   'use strict';
@@ -21,6 +29,9 @@
   // builds through unchanged; result-mode ({ status, ok, data }) preserves control flow 1:1.
   const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
   const AUTH_NEEDED = 'auth-needed';
+  // task 1002858 — whether the retire disclosure is expanded. Module-level
+  // because renderTask() rebuilds #task-body wholesale on every call.
+  let abandonOpen = false;
   const { escapeHtml, $, fmtDate, errCode, errMessage } = window.OTB; // task 1002462: envelope readers
   const toast = (msg) => window.OTB.toast(msg, { duration: 2600 });
   const curLabel = () => (window.__BRANDING__ && window.__BRANDING__.currency && window.__BRANDING__.currency.label) || 'credits';
@@ -84,6 +95,24 @@
     return data;
   }
 
+  // task 1002858: mutating call for removing a dependency edge. Same posture as
+  // postJSON/patchJSON — resolves to the parsed 2xx body, throws an Error carrying
+  // { status, data } so the caller can print the server's own refusal. DELETE
+  // carries no body by design; the edge to cut is named in the path.
+  async function delJSON(path) {
+    const res = await api.request('DELETE', path);
+    if (res.status === 401) { toAuth(); throw new Error('redirecting to auth'); }
+    let data = null;
+    try { data = res.data; } catch (_) { /* empty / non-JSON body */ }
+    if (!res.ok) {
+      const err = new Error(`${path} → ${res.status}`);
+      err.status = res.status;
+      err.data = data || {};
+      throw err;
+    }
+    return data;
+  }
+
   // Map the server's typed lifecycle-error to a builder-readable line. Codes are
   // exactly those POST /tasks/:id/ship + /confirm can return. The server is the
   // authority (ADR 0016); the UI only surfaces the refusal.
@@ -235,11 +264,21 @@
     return `<span class="rec-pill${tone ? ` rec-pill--${tone}` : ''}${extraClass ? ` ${extraClass}` : ''}">${escapeHtml(s)}</span>`;
   }
 
-  function depList(kindWord, items) {
+  // `removable` is passed ONLY for "Blocked by" (task 1002858), and the asymmetry
+  // is deliberate. DELETE /tasks/:id/dependencies/:depId removes the edge where
+  // THIS task depends on another, which is this record's own business. The
+  // "Blocks" list is the same edges seen from the far end: dropping one there
+  // would be editing a DIFFERENT task's dependency set from a page that is not
+  // showing it, with no sight of why that other task was made to wait. Open that
+  // task and remove it there.
+  function depList(kindWord, items, { removable = false } = {}) {
     const rows = items.map((d) => {
       const status = d.status ? statusPill(d.status, 'rec-pill--sm') : '';
+      const cut = removable
+        ? `<button class="rec-dep__cut" type="button" data-cut-dep="${escapeHtml(String(d.id))}" title="Stop waiting on task ${escapeHtml(String(d.id))}" aria-label="Stop waiting on task ${escapeHtml(String(d.id))}">×</button>`
+        : '';
       return `<li><a class="rec-dep" href="${hallBase()}/task/${escapeHtml(String(d.id))}">` +
-        `<b class="rec-dep__id">${escapeHtml(String(d.id))}</b>${escapeHtml(d.title || 'task')}</a>${status}</li>`;
+        `<b class="rec-dep__id">${escapeHtml(String(d.id))}</b>${escapeHtml(d.title || 'task')}</a>${status}${cut}</li>`;
     }).join('');
     return `<section><p class="rec-sec__h">${escapeHtml(kindWord)}</p><ul class="rec-deplist">${rows}</ul></section>`;
   }
@@ -459,6 +498,21 @@
     // gates read the same rank once, rather than risking drift between copies.
     const rank = (viewer && viewer.rank) ? String(viewer.rank).toLowerCase() : '';
     const isSupervisor = rank === 'metic' || rank === 'archon';
+    // task 1002858 — the SHAPING verbs (priority, dependencies, abandon) share one
+    // floor: task.edit, task.dependency.manage and task.abandon are all Metic+
+    // (ADR 0090; abandon re-ranked down from Archon by ADR 0152). A separate name
+    // from isSupervisor because they are separate ideas that merely agree today —
+    // if one of those permissions moves, this line moves and the lifecycle
+    // controls do not. It is a DISPLAY hint: the server re-checks every one.
+    //
+    // Goal LEAD status deliberately confers nothing here. Whether leading a goal
+    // should carry these permissions is a governance change that needs its own
+    // ADR, so this surfaces controls only for builders who already hold the atoms.
+    const canShape = isSupervisor;
+    // render() rebuilds #task-body wholesale, so a disclosure cannot keep its
+    // state in the DOM. This re-renders the SAME data without a refetch — the
+    // toggle is a view change, not a reason to ask the server anything.
+    const rerender = () => renderTask(t, lastClaim, viewer, goal, extras);
 
     const parts = [];
     parts.push(`<p class="rec-kind">Task ${statusPill(t.status)}</p>`);
@@ -520,6 +574,41 @@
       `);
     }
 
+    // task 1002858 — the two remaining SHAPING verbs, next to the goal move
+    // because they are the same kind of act: correcting how the work is routed
+    // and ordered, not moving it through its lifecycle.
+    //
+    // PRIORITY IS NOT COSMETIC, which is why it earns a control rather than a
+    // note: the DB weights version progress as `6 - COALESCE(priority, 5)` and
+    // the session optimizer orders claimable work by `priority ASC NULLS LAST`,
+    // so a wrong value at create time steers what every builder claims until
+    // someone fixes it. Until task 1003750 it was write-once at every rank and a
+    // whole-goal re-rank had to run as raw SQL. 1..5 mirrors tasks_priority_check;
+    // the empty option clears it back to unset, which is a real state (NULLS LAST)
+    // and not the same as P5.
+    if (canShape) {
+      const pOpts = ['', '1', '2', '3', '4', '5'].map((v) => {
+        const cur = t.priority == null ? '' : String(t.priority);
+        const label = v === '' ? '— unset —' : `P${v}`;
+        return `<option value="${v}"${v === cur ? ' selected' : ''}>${label}</option>`;
+      }).join('');
+      parts.push(`
+        <div class="td-form" id="shape-form">
+          <label class="td-field"><span>Priority</span>
+            <select id="priority-select">${pOpts}</select>
+          </label>
+          <label class="td-field"><span>Wait for task</span>
+            <input id="dep-add-input" type="number" min="1" step="1" inputmode="numeric" placeholder="task id">
+          </label>
+          <div class="td-actions">
+            <button type="button" class="td-btn" id="priority-btn">Set priority</button>
+            <button type="button" class="td-btn" id="dep-add-btn">Add dependency</button>
+          </div>
+          <p class="td-form-hint">A dependency keeps this task out of the claimable queue until that one ships. Remove one with the × beside it under “Blocked by”.</p>
+        </div>
+      `);
+    }
+
     const creditVal = window.OTBBranding?.taskCreditValue?.(t) ?? t.credits_reward;
     parts.push(figureBand([
       [window.OTBBranding?.taskCreditLabel?.(t) ?? curLabel(), creditVal],
@@ -577,7 +666,7 @@
     const deps = Array.isArray(t.dependencies) ? t.dependencies : [];
     const dependents = Array.isArray(t.dependents) ? t.dependents : [];
     if (deps.length || dependents.length) {
-      parts.push(`<div class="rec-sec rec-depcols">${deps.length ? depList('Blocked by', deps) : ''}${dependents.length ? depList('Blocks', dependents) : ''}</div>`);
+      parts.push(`<div class="rec-sec rec-depcols">${deps.length ? depList('Blocked by', deps, { removable: canShape }) : ''}${dependents.length ? depList('Blocks', dependents) : ''}</div>`);
     }
 
     if (t.shipped_at) {
@@ -614,6 +703,40 @@
       lifecycle = `<p class="rec-actnote">This task has shipped and its credits have landed. Neither Ship it nor Confirm is available.</p>`;
     }
 
+    // task 1002858 — RETIRE. Kept out of the button row and behind a disclosure
+    // because it is the one control here that destroys the plan rather than
+    // advancing it, and because the server demands a reason it can put in the
+    // audit log.
+    //
+    // THE TWO REFUSALS ARE PRE-ANSWERED IN WORDS RATHER THAN OFFERED AS A BUTTON
+    // THAT CANNOT WORK. A shipped task is immutable history, and a task with an
+    // active claim must be released first — both are 409s the server will raise
+    // anyway, and both are knowable from this record. Offering the control and
+    // letting it fail would teach the reader that the page guesses.
+    const claimIsLive = !!(lastClaim && !lastClaim.released_at);
+    let retire = '';
+    if (canShape && t.status === 'shipped') {
+      retire = '<p class="rec-actnote">A shipped task cannot be retired — it is immutable history now.</p>';
+    } else if (canShape && claimIsLive) {
+      retire = '<p class="rec-actnote">Someone is holding a claim on this task. It has to be released before the task can be retired.</p>';
+    } else if (canShape && t.status === 'abandoned') {
+      retire = '<p class="rec-actnote">This task is already retired. Promote restores it to the backlog.</p>';
+    } else if (canShape) {
+      retire = abandonOpen
+        ? `
+          <div class="td-form" id="abandon-form">
+            <label class="td-field td-field--wide"><span>Why retire this task?</span>
+              <input id="abandon-reason" type="text" maxlength="2000" placeholder="e.g. superseded by task 1002891">
+            </label>
+            <div class="td-actions">
+              <button type="button" class="td-btn td-btn--danger" id="abandon-btn">Retire this task</button>
+              <button type="button" class="td-btn" id="abandon-cancel-btn">Cancel</button>
+            </div>
+            <p class="td-form-hint">The reason is recorded in the audit log. This is recoverable: a retired task can be restored to the backlog with Promote.</p>
+          </div>`
+        : '<button class="td-btn" type="button" id="abandon-open-btn">Retire this task…</button>';
+    }
+
     // Copy prompt (the "ship link") — the same claim/build/ship prompt the Work
     // Board hands an agent. Purely client-side (clipboard write, no server call).
     parts.push(`
@@ -624,6 +747,7 @@
           <button class="td-btn" type="button" id="copy-prompt-btn">Copy prompt</button>
           ${exitLinkHtml()}
         </div>
+        ${retire ? `<div class="rec-actions rec-actions--retire">${retire}</div>` : ''}
       </section>
     `);
 
@@ -660,6 +784,99 @@
     // task 1003063 (R10): PATCH goal_id, then a full reload so the goal line, the
     // picker's preselected option and everything else on the record re-render
     // against the server's own state — no local patchwork of the DOM.
+    // task 1002858 — the shaping handlers. Each one: disable while in flight, send,
+    // then `load()` so the whole record re-renders against the SERVER's state
+    // rather than a local patch of the DOM (the idiom the goal move set below).
+    // Every refusal prints the server's own sentence where it has one — those are
+    // more specific than anything this page could invent, and one of them
+    // (dependency.cross_tier.manage, Archon-only under ADR 0157) names a gate this
+    // file deliberately does not model rather than re-deriving it client-side.
+    async function runWrite(btn, fn, okMsg) {
+      if (!btn || btn.disabled) return;
+      const orig = btn.textContent;
+      btn.disabled = true;
+      btn.textContent = '…';
+      try {
+        await fn();
+        toast(okMsg);
+        await load();
+      } catch (err) {
+        if (err && err.message === 'redirecting to auth') return;
+        toast(errMessage(err && err.data) || `That did not go through (${(err && err.status) || '?'}). Try again.`);
+        btn.disabled = false;
+        btn.textContent = orig;
+      }
+    }
+
+    const priorityBtn = $('#priority-btn');
+    if (priorityBtn) {
+      priorityBtn.addEventListener('click', () => {
+        const raw = $('#priority-select')?.value ?? '';
+        // '' is the unset option, and it is sent as null ON PURPOSE — "no priority"
+        // is a real state the optimizer sorts last (NULLS LAST), not a synonym for
+        // P5. Sending nothing at all would 400 as no_supported_fields.
+        const priority = raw === '' ? null : Number(raw);
+        if (priority !== null && !Number.isInteger(priority)) { toast('Pick a priority first.'); return; }
+        const was = t.priority == null ? 'unset' : `P${t.priority}`;
+        const now = priority == null ? 'unset' : `P${priority}`;
+        if (was === now) { toast(`Priority is already ${now}.`); return; }
+        runWrite(priorityBtn,
+          () => patchJSON(`${API}/tasks/${encodeURIComponent(t.id)}`, { priority }),
+          `Priority ${was} → ${now}.`);
+      });
+    }
+
+    const depAddBtn = $('#dep-add-btn');
+    if (depAddBtn) {
+      depAddBtn.addEventListener('click', () => {
+        const raw = $('#dep-add-input')?.value ?? '';
+        const depId = Number(raw);
+        if (!Number.isInteger(depId) || depId <= 0) { toast('Enter the id of the task this one should wait for.'); return; }
+        // Caught here only to say something better than the server's 'self_dep';
+        // the server still refuses it if this check is ever wrong.
+        if (String(depId) === String(t.id)) { toast('A task cannot wait for itself.'); return; }
+        runWrite(depAddBtn,
+          () => postJSON(`${API}/tasks/${encodeURIComponent(t.id)}/dependencies`, { depends_on_task_id: depId }),
+          `Task ${t.id} now waits for task ${depId}.`);
+      });
+    }
+
+    // Wired per row, because the × lives inside a list this function rebuilds on
+    // every render and the nodes are replaced with it.
+    for (const cut of document.querySelectorAll('[data-cut-dep]')) {
+      cut.addEventListener('click', () => {
+        const depId = cut.getAttribute('data-cut-dep');
+        runWrite(cut,
+          () => delJSON(`${API}/tasks/${encodeURIComponent(t.id)}/dependencies/${encodeURIComponent(depId)}`),
+          `Task ${t.id} no longer waits for task ${depId}.`);
+      });
+    }
+
+    const abandonOpenBtn = $('#abandon-open-btn');
+    if (abandonOpenBtn) {
+      abandonOpenBtn.addEventListener('click', () => { abandonOpen = true; rerender(); });
+    }
+    const abandonCancelBtn = $('#abandon-cancel-btn');
+    if (abandonCancelBtn) {
+      abandonCancelBtn.addEventListener('click', () => { abandonOpen = false; rerender(); });
+    }
+    const abandonBtn = $('#abandon-btn');
+    if (abandonBtn) {
+      abandonBtn.addEventListener('click', () => {
+        const reason = ($('#abandon-reason')?.value || '').trim();
+        // A REASON IS REQUIRED HERE THOUGH THE SERVER ACCEPTS AN EMPTY ONE. The
+        // value of the audit_log row is the sentence in it; a retire with a blank
+        // reason is the record noting that someone did this and declining to say
+        // why. Asking costs one line.
+        if (!reason) { toast('Say why it is being retired — the reason goes in the record.'); return; }
+        if (!window.confirm(`Retire task ${t.id}? It leaves the claimable queue. Promote restores it to the backlog.`)) return;
+        abandonOpen = false;
+        runWrite(abandonBtn,
+          () => postJSON(`${API}/tasks/${encodeURIComponent(t.id)}/abandon`, { reason }),
+          `Task ${t.id} retired. Promote restores it to the backlog.`);
+      });
+    }
+
     const moveGoalBtn = $('#move-goal-btn');
     if (moveGoalBtn) {
       moveGoalBtn.addEventListener('click', async () => {

package/modules/lifecycle/abandon-leftovers.js

@@ -0,0 +1,103 @@
+'use strict';
+
+// modules/lifecycle/abandon-leftovers.js — what a retired task leaves behind
+// (task 1003779).
+//
+// THE DEFECT THIS EXISTS FOR. Abandoning a task retires the ROW and nothing else.
+// Task 1002464 was abandoned carrying two commits on `task-1002464` that are not
+// ancestors of origin/main, and an open PR. Nothing said so — not at the moment
+// of abandonment, not afterwards — so the branch read as live work, and a
+// follow-up filed off its grading pass (task 1003626) sat at `ready` asking for
+// three nits in a function that exists nowhere on main. `sequence.js --check`
+// called it "clear to run". The cost landed on whoever claimed it.
+//
+// SIBLING OF dead-deps.js, deliberately. That file makes an abandoned
+// DEPENDENCY observable; this one makes abandoned CODE observable. Same posture:
+// pure and git-free here so the CLI is the only place that shells out, and the
+// rule can be tested without a repository.
+//
+// WHAT THIS IS NOT. It does not delete a branch, close a PR, or touch the
+// remote. Retiring a row is reversible (POST /tasks/:id/promote); deleting the
+// only copy of unmerged work is not, and which of the two a leftover branch
+// deserves is a human call. This reports, loudly, with the commands to hand.
+//
+// WHY NOT source_ref, which the report suggested. The incident that motivated
+// this task is the counter-example: 1003626's `source_ref` is `idea:1000935`,
+// not the branch or task it was stranded behind — the relationship lived only in
+// the prose of its description. A source_ref sweep would have found nothing.
+// The branch is the artifact that actually exists, so the branch is what is
+// checked.
+
+// A branch belongs to task N if it is `task-N` or `task-N-<slug>` (the two
+// shapes worktree.js produces). Anchored at both ends so task-1002450 never
+// matches task-10024501 — a prefix match here would report another task's work
+// as this one's leftovers, which is worse than reporting nothing.
+function branchesForTask(taskId, branches) {
+  const id = String(taskId == null ? '' : taskId).trim();
+  if (!/^\d+$/.test(id)) return [];
+  const re = new RegExp(`^task-${id}(?:-[A-Za-z0-9._-]+)?$`);
+  // Deduped after stripping the remote prefix: a caller may pass the same branch
+  // as both 'task-N' and 'origin/task-N' (git branch -r vs ls-remote), and the
+  // notice would then tell a builder to delete one branch twice.
+  const seen = new Set();
+  for (const raw of branches || []) {
+    const b = String(raw || '').trim().replace(/^origin\//, '');
+    if (re.test(b)) seen.add(b);
+  }
+  return [...seen];
+}
+
+// Pure: the leftover report for one task. `aheadCount(branch)` answers "how many
+// commits does this branch carry that main does not" — a number, or null when it
+// could not be determined.
+//
+// null is NOT folded into 0. "I could not look" and "there is nothing there"
+// must not render as the same sentence (the strand-watch.js rule): an
+// undetermined branch is reported as undetermined, so a network failure cannot
+// quietly certify a branch as clean.
+function leftoversForTask(taskId, { branches, aheadCount }) {
+  const out = [];
+  for (const branch of branchesForTask(taskId, branches)) {
+    let raw;
+    try { raw = aheadCount(branch); } catch (_) { raw = null; }
+    const n = Number(raw);
+    // Anything that is not a finite number is UNDETERMINED, not zero. The first
+    // cut of this tested only for null/undefined, so a NaN — what
+    // `Number(git rev-list output)` yields when the command prints nothing —
+    // fell through to the "> 0" test, failed it, and was dropped as clean. That
+    // is the exact failure this module's header forbids: a branch nobody could
+    // read certified as a branch with nothing on it.
+    if (raw === null || raw === undefined || !Number.isFinite(n)) {
+      out.push({ branch, ahead: null, undetermined: true });
+      continue;
+    }
+    if (n > 0) out.push({ branch, ahead: n, undetermined: false });
+  }
+  return out;
+}
+
+// The message a builder sees. Returns null when there is nothing to say, so the
+// caller can stay silent on the clean path rather than printing a reassurance
+// nobody reads (and which would train people to skip the line that matters).
+function leftoverNotice(taskId, leftovers) {
+  if (!leftovers || !leftovers.length) return null;
+  const lines = [`\n⚠ Task #${taskId} is retired, but its work is still on the remote:`];
+  for (const l of leftovers) {
+    lines.push(l.undetermined
+      ? `  - ${l.branch} — could not tell whether it carries unmerged commits`
+      : `  - ${l.branch} — ${l.ahead} commit(s) not on main`);
+  }
+  lines.push(
+    '',
+    'An abandoned task with a live branch reads as live work, and anything filed',
+    'off its review sits against code that does not exist on main. Decide which:',
+    '',
+    `  git push origin --delete ${leftovers[0].branch}    # the work is cut — drop it`,
+    `  node scripts/gds/api.js POST /api/gds/tasks/${taskId}/promote   # it is not cut — revive the task`,
+    '',
+    'Close or draft the branch\'s PR either way — the remote is not this tool\'s to change.',
+  );
+  return lines.join('\n');
+}
+
+module.exports = { branchesForTask, leftoversForTask, leftoverNotice };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.807",
+  "version": "1.19.809",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.807",
+      "version": "1.19.809",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.807",
+  "version": "1.19.809",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/abandon.js

@@ -21,6 +21,38 @@ const { cliClient, requireSession, arg } = require('./cli-lib');
 // task 1003153 — the live-status set, shared with the dead-edge detector so
 // "who did this cut strand" means the same thing in both places.
 const { LIVE_STATUSES } = require('../../modules/lifecycle/dead-deps.js');
+// task 1003779 — the other thing a cut leaves behind: the code itself.
+const { leftoversForTask, leftoverNotice } = require('../../modules/lifecycle/abandon-leftovers.js');
+const { execFileSync } = require('node:child_process');
+
+// Best-effort git, always. Every call here is advisory decoration on an abandon
+// that has ALREADY landed, so a missing git, a detached network or a shallow
+// clone must return "I don't know" — never throw, and never abort the command.
+function git(args, ms = 20000) {
+  return execFileSync('git', args, { encoding: 'utf8', timeout: ms, stdio: ['ignore', 'pipe', 'ignore'] });
+}
+
+// The remote branches this task owns. ONE network round trip, scoped to the two
+// name shapes worktree.js produces — listing all 800-odd heads to filter locally
+// would be the expensive way to learn the same thing.
+function remoteBranchesFor(taskId) {
+  try {
+    const out = git(['ls-remote', '--heads', 'origin', `refs/heads/task-${taskId}`, `refs/heads/task-${taskId}-*`]);
+    return out.split('\n').map((l) => l.split('\t')[1] || '').filter(Boolean)
+      .map((r) => r.replace(/^refs\/heads\//, ''));
+  } catch (_) { return null; }  // null = could not look
+}
+
+// How many commits the branch carries that main does not. Returns null when it
+// cannot be determined, which leftoversForTask reports as undetermined rather
+// than folding into "clean" — see that module's header.
+function commitsAheadOfMain(branch) {
+  try {
+    git(['fetch', 'origin', '--quiet', branch, 'main']);
+    const n = Number(String(git(['rev-list', '--count', 'FETCH_HEAD', '--not', 'origin/main'])).trim());
+    return Number.isFinite(n) ? n : null;
+  } catch (_) { return null; }
+}
 
 
 (async () => {
@@ -79,6 +111,22 @@ const { LIVE_STATUSES } = require('../../modules/lifecycle/dead-deps.js');
       console.log('  Sweep for any you miss:  node scripts/gds/audit-deps.js --stranded');
     }
   } catch (_) { /* the abandon already landed — the report is advisory */ }
+
+  // task 1003779 — REPORT the code this cut orphaned. Abandoning retires the ROW;
+  // the branch and its PR stay exactly where they were, reading as live work.
+  // Task 1002464 was cut carrying two commits never merged to main, and the
+  // follow-up filed off its review (task 1003626) then sat at 'ready' asking for
+  // changes to a function that exists nowhere on main — 'sequence.js --check'
+  // called it clear to run. Nothing had said the branch was dead, so nothing could.
+  // Same posture as the stranded-dependents report above: best-effort, and it
+  // never fails an abandon that already landed.
+  try {
+    const branches = remoteBranchesFor(taskId);
+    if (branches && branches.length) {
+      const notice = leftoverNotice(taskId, leftoversForTask(taskId, { branches, aheadCount: commitsAheadOfMain }));
+      if (notice) console.log(notice);
+    }
+  } catch (_) { /* advisory only */ }
 })().catch((err) => {
   console.error('fatal:', err);
   process.exit(1);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.807'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.809'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/abandon_leftovers.mjs

@@ -0,0 +1,87 @@
+// tests/abandon_leftovers.mjs — what a retired task leaves on the remote
+// (task 1003779). Pure + git-free: the ancestry oracle is injected, so these run
+// with no repository, no network and no fixtures.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { branchesForTask, leftoversForTask, leftoverNotice } =
+  require(path.join(ROOT, 'modules', 'lifecycle', 'abandon-leftovers.js'));
+
+test('both branch shapes worktree.js produces belong to the task', () => {
+  const branches = ['task-1002464', 'task-1002503-backfill-recovery', 'main'];
+  assert.deepEqual(branchesForTask(1002464, branches), ['task-1002464']);
+  assert.deepEqual(branchesForTask(1002503, branches), ['task-1002503-backfill-recovery']);
+});
+
+test('THE MISREPORT THIS MUST NOT MAKE: a longer id is not a prefix match', () => {
+  // task-10024501 is ANOTHER task's branch. Matching it would tell a builder to
+  // delete someone else's unmerged work as their own leftovers — worse than
+  // reporting nothing at all, which is why the pattern is anchored at both ends.
+  assert.deepEqual(branchesForTask(1002450, ['task-10024501', 'task-1002450x', 'xtask-1002450']), []);
+  assert.deepEqual(branchesForTask(1002450, ['task-1002450', 'task-10024501']), ['task-1002450']);
+});
+
+test('the same branch given twice is reported once', () => {
+  // Callers may pass `git branch -r` output (origin/task-N) and `ls-remote`
+  // output (task-N) together; the notice would otherwise say "delete it" twice.
+  assert.deepEqual(branchesForTask(1002464, ['task-1002464', 'origin/task-1002464']), ['task-1002464']);
+});
+
+test('a non-numeric or missing id matches nothing rather than building a loose regex', () => {
+  for (const id of ['', null, undefined, 'x', '10*', '.*']) {
+    assert.deepEqual(branchesForTask(id, ['task-1002464', 'task-x']), [], `id ${JSON.stringify(id)}`);
+  }
+});
+
+test('a branch already merged into main is not a leftover — the silent path', () => {
+  // The load-bearing negative. Every shipped task keeps its branch, so if a
+  // merged branch counted, the notice would fire on nearly every abandon and
+  // become weather (the lesson task 1003770 recorded about the drift advisory).
+  assert.deepEqual(leftoversForTask(1002464, { branches: ['task-1002464'], aheadCount: () => 0 }), []);
+  assert.equal(leftoverNotice(1002464, []), null, 'nothing to say means say nothing');
+});
+
+test('unmerged commits are reported with their count', () => {
+  assert.deepEqual(
+    leftoversForTask(1002464, { branches: ['task-1002464'], aheadCount: () => 2 }),
+    [{ branch: 'task-1002464', ahead: 2, undetermined: false }],
+  );
+});
+
+test('"could not look" is never folded into "nothing there"', () => {
+  // A network failure must not silently certify a branch as clean — the
+  // strand-watch.js rule. null and a throw both surface as undetermined.
+  for (const oracle of [() => null, () => undefined, () => { throw new Error('offline'); }, () => NaN]) {
+    const r = leftoversForTask(1002464, { branches: ['task-1002464'], aheadCount: oracle });
+    assert.equal(r.length, 1);
+    assert.equal(r[0].undetermined, true);
+    assert.equal(r[0].ahead, null);
+  }
+  assert.match(leftoverNotice(1002464, leftoversForTask(1002464,
+    { branches: ['task-1002464'], aheadCount: () => null })), /could not tell/);
+});
+
+test('the notice names the task, the branch, and both ways out', () => {
+  const notice = leftoverNotice(1002464, leftoversForTask(1002464,
+    { branches: ['task-1002464'], aheadCount: () => 2 }));
+  assert.match(notice, /#1002464/);
+  assert.match(notice, /task-1002464 — 2 commit\(s\) not on main/);
+  // Both dispositions, because which one applies is a human call: the work is
+  // cut (drop the branch) or it is not (revive the task).
+  assert.match(notice, /git push origin --delete task-1002464/);
+  assert.match(notice, /tasks\/1002464\/promote/);
+});
+
+test('a mixed set reports only the branches that actually carry work', () => {
+  const branches = ['task-1002464', 'task-1002464-followup'];
+  const r = leftoversForTask(1002464, {
+    branches,
+    aheadCount: (b) => (b === 'task-1002464' ? 3 : 0),
+  });
+  assert.deepEqual(r, [{ branch: 'task-1002464', ahead: 3, undetermined: false }]);
+});