@bongos/core 1.19.81 → 1.19.82

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.81",
-  "core_contract": "1.19.81",
-  "source_commit": "c19697303b3961520ebb175928cde6beddf00896",
+  "core_version": "1.19.82",
+  "core_contract": "1.19.82",
+  "source_commit": "9ca69eb29ee6b3ee602e17cbf1d1ef1ebc9df5f9",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T23:08:05.391Z",
+  "built_at": "2026-08-12T23:14:31.232Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 295,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1543,
-  "tree_sha256": "799b7337a46edabc3eb3adca6a29fb43c274e1ab27a9b130d09a986d4177cd9b",
+  "tree_sha256": "253f8de922c6d8cc2023e6a2d28b363fafa2cfdec666f96afc3a0e5d879a918f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1572,7 +1572,7 @@
     {
       "path": "docs/recipes/ops-gotchas.md",
       "mode": "0000644",
-      "sha256": "ddbb6d4e0569a6773b648a6fe97abb2e2e04c6e36a5f3100af0cd995688a4810"
+      "sha256": "1e35b15c1f366aae52aedbd12e4a193343f8fd13b2fc6bdec13f927b7a22e5f4"
     },
     {
       "path": "docs/recipes/overnight-builder.md",
@@ -3412,7 +3412,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "f090fbe484a1c9e8bf40d2871a150cef8ce73199455e54e44d117ce1ebc21da5"
+      "sha256": "1a7ef193f9f2829668f5dd612972e6cca43fd84dec1e13d2b1c20f7fd99766f9"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3467,7 +3467,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "54fd7ba3024169f5887fe58182ba03519e66acbbf28c1b753712dbd36f91da01"
+      "sha256": "6e41bbab9f8277a13178e4f9fcd278b47b8b34421114522ac113e57aedb631ac"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -4057,12 +4057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "845771b9d06a05dcb4eb8b90a0002b26d1fc105c2d27d24f870f89640fb09769"
+      "sha256": "b41abda8346dddd1c07e48067f2d9d0127aaad506519710b08cea5373a993b98"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "04febc37475484098b13f52462cda84d2a120c5ef64b7c2edf733e14ac6b3e1f"
+      "sha256": "0ed0a2fa31ababaeef64de35d41cba12b4308fef35fe2d831a0532ac503581c8"
     },
     {
       "path": "public-docs/index.html",
@@ -5687,7 +5687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3e4f5f5d1cb49b46416308dc7a4fa145b8260ca8dd0c63ed1a16ba499b622bc2"
+      "sha256": "793ab7f173efc8c4137e658cae4617f09a9c0df1e1783cd28396337eac6aa83b"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7232,7 +7232,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "99572892490e209835aae6479370e97b49585bfaa719c788a4d06d92407a9a7d"
+      "sha256": "e3f843387deb2d2a8f2668490bc740f7291d141b2de70c1556a84cb429bdc21d"
     },
     {
       "path": "tests/publish_manifest.mjs",
@@ -7242,7 +7242,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "fe4b594292992429fe5e077491fa2916028a2f1815414f94434f83b4186b1138"
+      "sha256": "ff2428b394a50abf4a593fcbfdb98afe4b56ffdbbffdc81198a102e72b480b9f"
     },
     {
       "path": "tests/rank_gate.mjs",

package/docs/recipes/ops-gotchas.md

@@ -187,6 +187,17 @@ Organized by topic, not chronology. New entries go in the matching section; crea
 - **Do NOT** use `POST /tasks/:id/confirm` to unstick *another* builder's task — it credits + attributes to the *caller* (the Archon), not the original builder. `/confirm` is for the shipping builder's own `--skip-grade` path. The override-request → approve flow is the correct tool when the work was someone else's.
 - **Why it bites:** the grader defaults to fail (by design — it's adversarial), so a false-negative looks identical to a real rejection. The fix is a documented, audited human-in-the-loop appeal, not a grader bypass — and the appeal pays the right person.
 
+### A task sits at `confirmed` and every sweep logs `pr_not_landed` for a PR GitHub says is MERGED
+
+- **Symptom:** `journalctl -u <instance>.service | grep publish-reconciler` shows the same task in the `dispositions:` line sweep after sweep as `pr_not_landed`, while `gh pr view <n>` reports `MERGED` with green checks. Only a manual `POST /api/gds/tasks/<id>/ship` clears it. Observed live 2026-08-12 (task 1002695 / PR 91, 18 min across 4 sweeps).
+- **Read the disposition first.** Since task 1002724 the line carries the probe detail — `1002695:pr_not_landed(deploy=unavailable http=403 pr=91 …)` — so you can tell the three cases apart without a shell:
+  - `deploy=pending` — a real deploy is in flight. Correct; wait.
+  - `deploy=unavailable http=403` — **the server's GitHub token cannot read Actions.** The probe is blind, not waiting. The sweep now falls back to the git-history land proof and lands the task anyway (a blind probe must not outrank main's history), but the underlying token permission is still worth fixing: grant the App/PAT `actions:read` so the deploy gate is real again. On a repo with no `deploy-prod.yml` at all, a token that CAN read Actions gets a clean 404 → `unconfigured` → the merge is the land.
+  - `deploy=unconfigured` — no `deploy-prod.yml`; the merge IS the land (ADR 0108 pin-bump publishing).
+- **Why it used to strand forever:** `getPublishStatus` folded every non-404 error into `pending` on the comment "5xx/403/rate limit is transient". A permissions 403 never resolves, and a MERGED PR at `pending` made the reconciler treat the task as mid-deploy, which *suppressed* the per-task land proof on every sweep. The blindness silently outranked proof that the work was already on `main`.
+- **Related:** publish-on-merge (ADR 0161) pushes a `release: core X.Y.Z` carrier commit after every land, so on an instance that DOES deploy, the deploy run belongs to the carrier's sha, not the merge commit's. A strict sha match never hit — hence the same permanent `pending`. The probe now also accepts a successful `main` deploy that started after the merge.
+- **The wait is bounded.** A probe stuck at `deploy=pending` for a reason that never resolves looks identical to a slow deploy on any single sweep, so after `<redacted>` (default 30 min) a task whose land is *provable on main* ships anyway, and the sweep logs `deploy still unconfirmed after Nmin`. This lifts only the deploy gate — the per-task land proof is untouched, so it can never become a branch-reuse false-ship. Raise the env var on an instance whose real deploy legitimately takes longer than 30 minutes.
+
 ---
 
 ## Status page + monitoring

package/modules/lifecycle/github-push.js

@@ -382,9 +382,13 @@ async function enableAutoMerge({ nodeId }, deps = {}) {
 
 // getPublishStatus — report the PR + prod-deploy state so ship.js can poll
 // WITHOUT gh on the box. Returns:
-//   { pr_state, merged, merge_sha, deploy_status }  where
-//   pr_state ∈ open|closed|none, deploy_status ∈ pending|success|none|unconfigured
-//   ('unconfigured' = this repo has no deploy-prod.yml — task 1002472).
+//   { pr_state, merged, merge_sha, deploy_status, deploy_probe }  where
+//   pr_state ∈ open|closed|none,
+//   deploy_status ∈ pending|success|none|unconfigured|unavailable
+//   ('unconfigured' = this repo has no deploy-prod.yml — task 1002472;
+//    'unavailable'  = we could not READ the deploy state at all — task 1002724).
+//   deploy_probe = { state, http, detail } — WHY the probe landed where it did,
+//   so a stuck disposition is diagnosable without a shell on the host.
 // Mirrors ship.js pollCiDeploy's two-stage check (PR merged -> deploy run).
 async function getPublishStatus({ branch }, deps = {}) {
   const token = await resolveToken(deps);
@@ -421,6 +425,7 @@ async function getPublishStatus({ branch }, deps = {}) {
 
   // Merged → did the prod-deploy workflow succeed for the merge commit?
   let deployStatus = 'pending';
+  let deployProbe = { state: 'pending', http: null, detail: 'no matching deploy run yet' };
   try {
     const runsRes = await doFetch(
       `${api}/actions/workflows/deploy-prod.yml/runs?branch=main&per_page=15`,
@@ -429,10 +434,29 @@ async function getPublishStatus({ branch }, deps = {}) {
     if (runsRes.ok) {
       const data = await runsRes.json();
       const runs = (data && data.workflow_runs) || [];
-      const hit = runs.some(
-        (r) => r && r.head_sha === mergeSha && r.status === 'completed' && r.conclusion === 'success'
-      );
-      if (hit) deployStatus = 'success';
+      const ok = (r) => r && r.status === 'completed' && r.conclusion === 'success';
+      // task 1002724 (idea 1000702) — the ADR 0161 CARRIER race. Publish-on-merge
+      // pushes a "release: core X.Y.Z" carrier commit to main after EVERY land, so
+      // the deploy run that actually deploys this merge is keyed to the CARRIER's
+      // head_sha, not the merge commit's. A strict head_sha === mergeSha match then
+      // never hits, deploy_status stays 'pending' forever, and the reconciler treats
+      // a fully-landed task as mid-deploy for good. Accept either: the run FOR this
+      // merge, or any successful main deploy that started after the merge landed —
+      // deploying main after the merge necessarily deploys the merge.
+      const mergedAtMs = pr.merged_at ? Date.parse(pr.merged_at) : NaN;
+      const exact = runs.some((r) => ok(r) && r.head_sha === mergeSha);
+      const afterMerge = !exact && Number.isFinite(mergedAtMs) && runs.some((r) => {
+        if (!ok(r)) return false;
+        const startedMs = Date.parse(r.run_started_at || r.created_at || '');
+        return Number.isFinite(startedMs) && startedMs >= mergedAtMs;
+      });
+      if (exact || afterMerge) {
+        deployStatus = 'success';
+        deployProbe = {
+          state: 'success', http: runsRes.status,
+          detail: exact ? 'deploy run for the merge commit' : 'main deploy succeeded after the merge (ADR 0161 carrier)',
+        };
+      }
     } else if (runsRes.status === 404) {
       // task 1002472 — the workflow FILE does not exist in this repo, so there is no
       // deploy to wait for and 'pending' would never resolve. The 404 is unambiguous:
@@ -442,12 +466,30 @@ async function getPublishStatus({ branch }, deps = {}) {
       // (package-core → bongos upgrade, ADR 0108) never have a deploy-prod.yml at all;
       // reporting 'pending' pinned every merged PR at confirmed forever.
       deployStatus = 'unconfigured';
+      deployProbe = { state: 'unconfigured', http: 404, detail: 'no deploy-prod.yml in this repo' };
+    } else {
+      // task 1002724 — this branch used to fall through as 'pending' on the comment
+      // "5xx/403/rate-limit is transient". A 403 from a token without `actions:read`
+      // is NOT transient, it is forever — and 'pending' on a MERGED PR makes the
+      // reconciler suppress the land proof on every sweep (prMidDeploy), so the task
+      // strands at 'confirmed' permanently with a bare 'pr_not_landed' and no clue
+      // why. That is exactly the live 2026-08-12 strand (task 1002695 / PR 91:
+      // GitHub reported MERGED with green checks, the server reported deploy
+      // 'pending' for 18 min across 4 sweeps, and only a manual ship cleared it).
+      // Call it what it is — we could not READ the deploy state — and let the
+      // reconciler decide whether git history already proves the land.
+      deployStatus = 'unavailable';
+      deployProbe = { state: 'unavailable', http: runsRes.status, detail: `workflow-runs read failed (HTTP ${runsRes.status})` };
     }
-    // Any other non-ok (5xx, 403, rate limit) is transient → stay 'pending' and retry.
-  } catch (_) {
-    /* leave pending on a transient runs-API miss */
+  } catch (e) {
+    // A network-level miss is genuinely transient — keep waiting, but say so.
+    deployProbe = { state: 'pending', http: null, detail: `workflow-runs fetch threw: ${e && e.message}` };
   }
-  return { pr_state: pr.state, merged: true, merge_sha: mergeSha, deploy_status: deployStatus, pr_url: pr.html_url, ...prMeta };
+  return {
+    pr_state: pr.state, merged: true, merge_sha: mergeSha,
+    deploy_status: deployStatus, deploy_probe: deployProbe,
+    pr_url: pr.html_url, ...prMeta,
+  };
 }
 
 // task 1547 — does the PR matched by getPublishStatus actually belong to THIS task?
@@ -755,11 +797,23 @@ async function setCommitStatus({ sha, state, context, description, targetUrl },
 // is the land, and requiring a deploy that can never run pinned every merged PR at
 // 'confirmed' forever. MERGED stays mandatory, and this is only the gate on the
 // branch/PR path — landProvenForTask still has to prove the land is THIS task's.
+// task 1002724 — 'unavailable' deliberately does NOT count as landed here. On an
+// instance that really does deploy, a blind probe must not be promoted into
+// "deployed". It is the RECONCILER that treats blindness differently from a real
+// in-flight deploy (see deployProbeBlind): a probe that cannot see anything must
+// not veto a positive git-history proof of the land.
 function landConfirmed(status) {
   if (!status || status.merged !== true) return false;
   return status.deploy_status === 'success' || status.deploy_status === 'unconfigured';
 }
 
+// Is the deploy probe BLIND (we could not read the deploy state) as opposed to
+// legitimately waiting on a deploy we can see? Exported so the reconciler and the
+// publish-status route agree on the distinction.
+function deployProbeBlind(status) {
+  return !!status && status.deploy_status === 'unavailable';
+}
+
 // task 1547 — is a landConfirmed status PROVEN to be THIS task's land, and not a
 // reused worktree branch matching an OLDER task's already-merged PR (the BV1.R04/R05
 // false-ship: branch claude/jovial-rosalind-84d6c3 → PR #386 / task 1297, merged,
@@ -1090,6 +1144,7 @@ module.exports = {
   recheckPullRequest,
   GATE_OWNER_APPROVED_CONTEXT,
   landConfirmed,
+  deployProbeBlind,
   landProvenForTask,
   prReferencesTask,
   findTaskPullRequest,

package/modules/lifecycle/publish-reconciler.js

@@ -96,6 +96,18 @@ const SWEEP_LIMIT = 100;
 // landed and that is OLDER than this is a strand — credited but with no provable
 // land — and gets a WARN. Default 30 min; tune/disable via env.
 const STALE_CONFIRMED_MS = Number(process.env.PUBLISH_RECONCILE_STALE_MS) || 30 * 60_000;
+
+// task 1002724 — how long a MERGED PR may claim "still deploying" before the sweep
+// stops letting that claim veto a git-history-proven land.
+//
+// The blindness fix below handles the case where the probe REPORTS it cannot read
+// the deploy state ('unavailable'). It cannot handle a probe that keeps answering
+// 'pending' for a reason that never resolves — e.g. the workflow-runs fetch throwing
+// every sweep, which is indistinguishable from a slow deploy on any single pass. So
+// bound the wait: past this age, a task whose land is PROVABLE on main ships, and the
+// sweep says loudly that it stopped waiting. Anything unprovable is untouched — this
+// relaxes only the deploy gate, never the per-task land proof.
+const DEPLOY_WAIT_BOUND_MS = Number(process.env.PUBLISH_RECONCILE_DEPLOY_WAIT_MS) || 30 * 60_000;
 // task 1915: cap the speculative regen-heal per branch so a genuine treadmill (main
 // churning faster than CI clears a re-freshened branch) can't loop forever. In-memory
 // per process — a restart resets the guard, which is fine (heals are idempotent and
@@ -206,6 +218,18 @@ async function runSweep(deps = {}) {
     wtCount.set(r.worktree_name, (wtCount.get(r.worktree_name) || 0) + 1);
   }
 
+  // task 1002724 — a one-line, log-safe summary of WHY the deploy probe landed
+  // where it did, so 'pr_not_landed' in a journal line is self-explaining.
+  const describeProbe = (status) => {
+    if (!status) return 'no status';
+    const p = status.deploy_probe || null;
+    const bits = [`deploy=${status.deploy_status ?? 'unknown'}`];
+    if (p && p.http) bits.push(`http=${p.http}`);
+    if (status.pr_number) bits.push(`pr=${status.pr_number}`);
+    if (p && p.detail) bits.push(String(p.detail).slice(0, 80));
+    return bits.join(' ');
+  };
+
   let reconciled = 0;
   let merged = 0;
   let resolvedConflicts = 0;
@@ -545,7 +569,30 @@ async function runSweep(deps = {}) {
     // task 1002615: only a MERGED PR that is still deploying suppresses the proof
     // (the deploy gate governs); an un-merged PR — open, or closed without merging —
     // cannot veto what git history on main already shows.
-    const prMidDeploy = prNotLanded && !!(branchStatus && branchStatus.merged === true);
+    // task 1002724 — a MERGED PR still deploying may veto the land proof, but only
+    // while we can actually SEE the deploy. When the probe is blind (deploy_status
+    // 'unavailable' — e.g. a token without `actions:read` 403s, permanently), the
+    // old code called that "mid-deploy" and suppressed the proof on every sweep
+    // forever: the task stranded at 'confirmed' even though main's git history
+    // already proved the land. Blindness must not outrank evidence.
+    const probeBlind = typeof push.deployProbeBlind === 'function'
+      ? push.deployProbeBlind(branchStatus)
+      : false;
+    // …and a deploy we can "see" but that never resolves is the same trap wearing a
+    // different hat, so the wait is bounded too (DEPLOY_WAIT_BOUND_MS). Both escapes
+    // only lift the DEPLOY gate — landProvenForTask below still has to prove the land
+    // belongs to this task, so neither can cause a branch-reuse false-ship.
+    const confirmedAgeMs = r.confirmed_at ? (nowMs - new Date(r.confirmed_at).getTime()) : null;
+    const deployWaitExpired = confirmedAgeMs != null && confirmedAgeMs > DEPLOY_WAIT_BOUND_MS;
+    const prMidDeploy = prNotLanded
+      && !!(branchStatus && branchStatus.merged === true)
+      && !probeBlind
+      && !deployWaitExpired;
+    if (prNotLanded && !!(branchStatus && branchStatus.merged === true) && (probeBlind || deployWaitExpired)) {
+      logFn(
+        `[publish-reconciler] task ${r.task_id}: ${probeBlind ? 'deploy probe BLIND' : `deploy still unconfirmed after ${Math.round(confirmedAgeMs / 60_000)}min`} (${describeProbe(branchStatus)}) — consulting the git-history land proof instead of waiting on a deploy state that is not resolving`
+      );
+    }
     if (!landed && !prMidDeploy && typeof push.landProvenForTask === 'function') {
       try {
         const proof = await push.landProvenForTask({
@@ -583,7 +630,11 @@ async function runSweep(deps = {}) {
         : prNotLanded
           ? 'pr_not_landed'
           : (!branch && !r.published_head_sha) ? 'no_branch_no_tip' : 'land_not_proven';
-      dispositions.push(`${r.task_id}:${reason}`);
+      // task 1002724 — a bare 'pr_not_landed' says a PR exists and did not land, but
+      // not WHICH probe refused or why, so the 2026-08-12 strand needed a host shell
+      // and a hand-run of getPublishStatus to explain. Carry the probe detail into
+      // the disposition so the log line alone is diagnosable.
+      dispositions.push(`${r.task_id}:${reason}${reason === 'pr_not_landed' ? `(${describeProbe(branchStatus)})` : ''}`);
       const ageMs = r.confirmed_at ? (nowMs - new Date(r.confirmed_at).getTime()) : null;
       if (ageMs != null && ageMs > STALE_CONFIRMED_MS) {
         staleStrands++;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.81",
+  "version": "1.19.82",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.81",
+      "version": "1.19.82",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.81",
+  "version": "1.19.82",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -589,8 +589,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.79 with no explicit bump. run 31649366675. (task 1002620)
 //   1.19.81 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.80 with no explicit bump. run 31649705242. (task 1002620)
+//   1.19.82 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.81 with no explicit bump. run 31650108283. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.81'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.82'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_branch_route.mjs

@@ -242,7 +242,11 @@ await t('getPublishStatus: merged + workflow-runs 404 → unconfigured (no deplo
   assert.equal(s.deploy_status, 'unconfigured', 'an absent workflow is permanent, not pending');
 });
 
-await t('getPublishStatus: merged + workflow-runs 5xx/403 → still pending (transient stays transient)', async () => {
+// task 1002724 — an unreadable deploy state is its OWN thing: not "no workflow"
+// (which would land it) and not "a deploy is running" (which vetoes the land proof
+// forever). A 403 from a token without `actions:read` never resolves, and calling
+// it 'pending' stranded task 1002695 at confirmed across 4 sweeps on 2026-08-12.
+await t('getPublishStatus: merged + workflow-runs 5xx/403 → unavailable, never landConfirmed', async () => {
   const mergeSha = 'e'.repeat(40);
   const mk = (code) => async (url) => {
     if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
@@ -251,10 +255,67 @@ await t('getPublishStatus: merged + workflow-runs 5xx/403 → still pending (tra
   };
   for (const code of [500, 502, 403]) {
     const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl: mk(code) });
-    assert.equal(s.deploy_status, 'pending', `${code} must NOT be read as "no workflow"`);
+    assert.equal(s.deploy_status, 'unavailable', `${code} must NOT be read as "no workflow" nor as a running deploy`);
+    assert.equal(s.deploy_probe.http, code, 'the probe must carry the HTTP status for diagnosis');
+    assert.equal(gp.landConfirmed(s), false, 'a blind probe must never be promoted into "deployed"');
+    assert.equal(gp.deployProbeBlind(s), true);
   }
 });
 
+await t('getPublishStatus: a network throw stays pending (genuinely transient), not unavailable', async () => {
+  const mergeSha = 'e'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
+    if (url.includes('deploy-prod.yml/runs')) throw new Error('ECONNRESET');
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'pending');
+  assert.equal(gp.deployProbeBlind(s), false, 'a socket blip is a retry, not blindness');
+  assert.match(s.deploy_probe.detail, /threw/);
+});
+
+// task 1002724 / idea 1000702 — the ADR 0161 carrier race. Publish-on-merge pushes
+// a "release: core X.Y.Z" carrier commit to main after every land, so the deploy run
+// that deploys THIS merge is keyed to the carrier's sha, not the merge commit's.
+await t('getPublishStatus: a successful main deploy AFTER the merge counts (ADR 0161 carrier)', async () => {
+  const mergeSha = 'a'.repeat(40);
+  const carrierSha = 'b'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) {
+      return jsonRes(200, [{ state: 'closed', merged_at: '2026-08-12T20:25:23Z', merge_commit_sha: mergeSha, html_url: 'http://pr/91' }]);
+    }
+    if (url.includes('deploy-prod.yml/runs')) {
+      return jsonRes(200, { workflow_runs: [
+        // the carrier's deploy — a different head_sha, started after the merge
+        { head_sha: carrierSha, status: 'completed', conclusion: 'success', run_started_at: '2026-08-12T20:27:00Z' },
+      ] });
+    }
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'success', 'deploying main after the merge deploys the merge');
+  assert.equal(gp.landConfirmed(s), true);
+  assert.match(s.deploy_probe.detail, /carrier/i);
+});
+
+await t('getPublishStatus: a main deploy that finished BEFORE the merge does not count', async () => {
+  const mergeSha = 'a'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) {
+      return jsonRes(200, [{ state: 'closed', merged_at: '2026-08-12T20:25:23Z', merge_commit_sha: mergeSha, html_url: 'http://pr/91' }]);
+    }
+    if (url.includes('deploy-prod.yml/runs')) {
+      return jsonRes(200, { workflow_runs: [
+        { head_sha: 'c'.repeat(40), status: 'completed', conclusion: 'success', run_started_at: '2026-08-12T20:00:00Z' },
+      ] });
+    }
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'pending', 'an earlier deploy cannot have carried this merge');
+});
+
 await t('getPublishStatus: merged, workflow EXISTS but no successful run yet → pending', async () => {
   const mergeSha = 'f'.repeat(40);
   const fetchImpl = async (url) => {

package/tests/publish_reconciler.mjs

@@ -129,6 +129,9 @@ function mkDeps({
         if (a instanceof Error) throw a;
         return !!a;
       },
+      // task 1002724: the REAL blindness predicate, so the sweep's "is this deploy
+      // state unreadable?" decision cannot drift from getPublishStatus's answer.
+      deployProbeBlind: githubPush.deployProbeBlind,
       // task 1547 per-task land proof. Mirrors the real github-push.landProvenForTask
       // shape but routes its network hops (the ancestry compares) through the mock
       // above so the sweep stays DB/network-free, and reuses the REAL prReferencesTask
@@ -333,6 +336,122 @@ test('1002472 merged + deploy unconfigured + published tip in main → ships', a
   assert.deepEqual(deps._calls.broadcast, [63]);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002724 — the deploy probe went BLIND and vetoed a provable land forever.
+//
+// Live on 2026-08-12: task 1002695 / PR 91 was MERGED with green checks at
+// 20:25:23Z, but the server's deploy probe answered 'pending' (a 403 from a token
+// without `actions:read` — permanent, not transient). merged + !landConfirmed made
+// prMidDeploy true, which SUPPRESSED landProvenForTask on every sweep, so four
+// sweeps across 18 minutes all logged a bare '1002695:pr_not_landed' and only a
+// manual POST /ship cleared it. A probe that cannot see anything must not outrank
+// main's git history, and the disposition must say which probe refused.
+// ---------------------------------------------------------------------------
+const BLIND = (id) => ({
+  ...landedPrFor(id),
+  deploy_status: 'unavailable',
+  deploy_probe: { state: 'unavailable', http: 403, detail: 'workflow-runs read failed (HTTP 403)' },
+  merge_sha: MERGE_SHA,
+});
+
+test('1002724 blind deploy probe no longer vetoes a tip-proven land', async () => {
+  const tip = 'd'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 1002695, builder_id: 9, worktree_name: 'wt-blind', published_head_sha: tip,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-blind': BLIND(1002695) },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the published tip is in main — that IS the land');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 1002695, builderId: 9 }]);
+});
+
+test('1002724 blind probe + merged PR naming the task → the merge-commit proof still lands it', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 1002695, builder_id: 9, worktree_name: 'wt-blind2', published_head_sha: null,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-blind2': BLIND(1002695) },
+    ancestryBySha: { [MERGE_SHA]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'a merged PR naming this task whose merge sha is in main is a land');
+});
+
+test('1002724 a REAL in-flight deploy still vetoes the proof (the gate is not weakened)', async () => {
+  const tip = 'e'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 65, builder_id: 4, worktree_name: 'wt-realdeploy', published_head_sha: tip,
+             confirmed_at: new Date().toISOString() }],
+    // deploy_status 'pending' = we CAN read the deploy state and it has not succeeded.
+    statusByBranch: { 'claude/wt-realdeploy': { ...landedPrFor(65), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'merged-but-still-deploying must keep waiting — shipped means deployed');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('1002724 a deploy that never resolves stops vetoing a provable land once the wait is bounded', async () => {
+  // The blindness escape only fires when the probe SAYS it is blind. A probe that
+  // keeps answering 'pending' forever (e.g. the runs fetch throwing every sweep)
+  // looks identical to a slow deploy on any single pass — so the wait is bounded.
+  const tip = '1'.repeat(40);
+  const old = new Date(Date.now() - 45 * 60_000).toISOString(); // 45min > the 30min bound
+  const deps = mkDeps({
+    rows: [{ task_id: 67, builder_id: 4, worktree_name: 'wt-forever', published_head_sha: tip, confirmed_at: old }],
+    statusByBranch: { 'claude/wt-forever': { ...landedPrFor(67), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'past the bound, a provable land must not wait on a deploy forever');
+  assert.ok(
+    deps._calls.logs.some((l) => /deploy still unconfirmed after \d+min/.test(l)),
+    'the sweep must say it stopped waiting, not ship silently'
+  );
+});
+
+test('1002724 the bound lifts only the DEPLOY gate — an unprovable land still strands', async () => {
+  const tip = '2'.repeat(40);
+  const old = new Date(Date.now() - 45 * 60_000).toISOString();
+  const deps = mkDeps({
+    rows: [{ task_id: 68, builder_id: 4, worktree_name: 'wt-forever-unproven', published_head_sha: tip, confirmed_at: old }],
+    statusByBranch: { 'claude/wt-forever-unproven': { ...landedPrFor(68), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: false }, // tip NOT in main — no land to prove
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'the bound must never become a branch-reuse false-ship');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('1002724 a young in-flight deploy is still waited on (the bound does not fire early)', async () => {
+  const tip = '3'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 69, builder_id: 4, worktree_name: 'wt-young', published_head_sha: tip,
+             confirmed_at: new Date(Date.now() - 60_000).toISOString() }], // 1min old
+    statusByBranch: { 'claude/wt-young': { ...landedPrFor(69), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'shipped means deployed while the deploy is plausibly still running');
+});
+
+test('1002724 an unprovable pr_not_landed disposition names the failing probe', async () => {
+  const tip = 'f'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 66, builder_id: 4, worktree_name: 'wt-diag', published_head_sha: tip,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-diag': { ...landedPrFor(66), deploy_status: 'pending', pr_number: 91 } },
+    ancestryBySha: { [tip]: false },
+  });
+  await reconciler.runSweep(deps);
+  const line = deps._calls.logs.find((l) => /dispositions:/.test(l));
+  assert.ok(line, 'the sweep must emit a dispositions line');
+  assert.match(line, /66:pr_not_landed\(/, 'the disposition must carry probe detail, not be bare');
+  assert.match(line, /deploy=pending/);
+  assert.match(line, /pr=91/, 'the PR number makes the strand traceable from the log alone');
+});
+
 test('1002472 merged + deploy unconfigured but tip NOT in main → NO ship (1547 proof intact)', async () => {
   const deps = mkDeps({
     rows: [{ task_id: 64, builder_id: 4, worktree_name: 'wt-nowf-reuse', published_head_sha: NOT_ON_MAIN }],