@bongos/core 1.19.81 → 1.19.83

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.81",
-  "core_contract": "1.19.81",
-  "source_commit": "c19697303b3961520ebb175928cde6beddf00896",
+  "core_version": "1.19.83",
+  "core_contract": "1.19.83",
+  "source_commit": "fff49f72b2b345f6b610b37c943bc45b963f2b40",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T23:08:05.391Z",
+  "built_at": "2026-08-12T23:29:40.091Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 295,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1227,
+    "functional_verbatim": 1228,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1543,
-  "tree_sha256": "799b7337a46edabc3eb3adca6a29fb43c274e1ab27a9b130d09a986d4177cd9b",
+  "file_count": 1544,
+  "tree_sha256": "ec5d11dea2b4d13543a2593e7b1c13583eefea55e3ffca3b42cd9835cfdd134a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -707,7 +707,7 @@
     {
       "path": "docs/adr/0055-server-mediated-branch-publish.md",
       "mode": "0000644",
-      "sha256": "a574107524d7b0c85130df49b2b165b94dc1d1b0efe1493b7952e49c053c8a53"
+      "sha256": "6f51c67939eacaf510774894625d0a09e6883e4c8e1d8fdea2cf35f8d9f58ea4"
     },
     {
       "path": "docs/adr/0056-prod-deploy-script-mirror-and-healthcheck-retry.md",
@@ -1572,7 +1572,7 @@
     {
       "path": "docs/recipes/ops-gotchas.md",
       "mode": "0000644",
-      "sha256": "ddbb6d4e0569a6773b648a6fe97abb2e2e04c6e36a5f3100af0cd995688a4810"
+      "sha256": "1e35b15c1f366aae52aedbd12e4a193343f8fd13b2fc6bdec13f927b7a22e5f4"
     },
     {
       "path": "docs/recipes/overnight-builder.md",
@@ -3412,7 +3412,7 @@
     {
       "path": "modules/lifecycle/github-push.js",
       "mode": "0000644",
-      "sha256": "f090fbe484a1c9e8bf40d2871a150cef8ce73199455e54e44d117ce1ebc21da5"
+      "sha256": "0534cf4522f5a644301946abf6a703852375fe269401902dfae10d7b9192c3d5"
     },
     {
       "path": "modules/lifecycle/goal-advisory.js",
@@ -3467,7 +3467,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "54fd7ba3024169f5887fe58182ba03519e66acbbf28c1b753712dbd36f91da01"
+      "sha256": "6e41bbab9f8277a13178e4f9fcd278b47b8b34421114522ac113e57aedb631ac"
     },
     {
       "path": "modules/lifecycle/routes/analytics.js",
@@ -4057,12 +4057,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "845771b9d06a05dcb4eb8b90a0002b26d1fc105c2d27d24f870f89640fb09769"
+      "sha256": "4e476d4e4a1ce4f6f0065ee8a18903571b5c89783f90929d62b5b5d9b4afe385"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "04febc37475484098b13f52462cda84d2a120c5ef64b7c2edf733e14ac6b3e1f"
+      "sha256": "db68efb63158fb5e544d9afc252161739f7c54c832509dc03fa45878675cb990"
     },
     {
       "path": "public-docs/index.html",
@@ -5039,6 +5039,11 @@
       "mode": "0000644",
       "sha256": "7ad384495370312a57f7c1f0dab4770888c83afd08b89a8dc27aebae408abfd1"
     },
+    {
+      "path": "scripts/gds/publish-credential-check.js",
+      "mode": "0000644",
+      "sha256": "0d700716747617c43e3cf410ef9395cc2f28fff342feef400a8ae45209e893c1"
+    },
     {
       "path": "scripts/gds/publish-manifest.js",
       "mode": "0000644",
@@ -5687,7 +5692,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3e4f5f5d1cb49b46416308dc7a4fa145b8260ca8dd0c63ed1a16ba499b622bc2"
+      "sha256": "95dd72f2698cf288bc35875f4c9a0503393024525c6c2918902e6b22ce1f93f5"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -7232,7 +7237,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "99572892490e209835aae6479370e97b49585bfaa719c788a4d06d92407a9a7d"
+      "sha256": "ea46629917c3236b9dfb7133af643a9fecc9a205323c345e16671b5093606fd6"
     },
     {
       "path": "tests/publish_manifest.mjs",
@@ -7242,7 +7247,7 @@
     {
       "path": "tests/publish_reconciler.mjs",
       "mode": "0000644",
-      "sha256": "fe4b594292992429fe5e077491fa2916028a2f1815414f94434f83b4186b1138"
+      "sha256": "ff2428b394a50abf4a593fcbfdb98afe4b56ffdbbffdc81198a102e72b480b9f"
     },
     {
       "path": "tests/rank_gate.mjs",

package/docs/adr/0055-server-mediated-branch-publish.md

@@ -38,6 +38,10 @@ A **fine-grained GitHub PAT** scoped to the single repo: `Contents: read/write`
 
 > **Update (2026-06-13, task 1028 — GitHub App):** the preferred server credential is now a **GitHub App**, not a standing PAT. The server holds only the App private key (`GITHUB_APP_ID` + `GITHUB_APP_INSTALLATION_ID` + `GITHUB_APP_PRIVATE_KEY`) and mints a short-lived (~1h), repo-scoped **installation token** per push window — so there's no standing push secret at rest. `github-push.js resolveToken()` prefers the App and falls back to the PAT (`GITHUB_PUSH_TOKEN`) during cutover; `isConfigured()` is true if **either** is set, so the route's inert-safe `503` is unchanged. The App JWT is RS256-signed with `node:crypto` (no new dependency). Same single-repo scopes (Contents r/w + PR r/w + Actions read) and the same can't-touch-`main` guarantee. **LIVE on prod as of 2026-06-13 (task 1043 cutover, blocker 31 resolved):** the App (App ID 4047551, installation 140135657, `repository_selection=selected`) is installed and its key is set in `/etc/example/web-source.env`; verified that the server mints + uses an installation token (`publish-status` → 200, and a broken key fails loud as `503`/error rather than falling back). The old `GITHUB_PUSH_TOKEN` was **removed** — there is now **no standing push secret at rest**, only the App private key.
 
+> **Update (2026-08-12, task 1002733 — verify `Actions: read`, and verify WHICH credential is live):** the 2026-06-13 note above says the PAT was removed and the App is live. **On cloudbongos.com that is no longer true.** Checked on the host this session: <redacted> sets `GITHUB_PUSH_TOKEN` and **none** of `GITHUB_APP_ID` / `GITHUB_APP_INSTALLATION_ID` / `GITHUB_APP_PRIVATE_KEY`. So `appConfigured()` is false and `resolveToken()` falls through to the **PAT** — the App is not the running credential here. Whichever one an instance is actually on, **that** one needs `Actions: read`; don't assume from this ADR's history. If the live credential lacks it, `getPublishStatus`'s deploy probe cannot see workflow runs and reports a merged PR as still deploying **forever**, which stranded task 1002695 at `confirmed` across four reconciler sweeps on 2026-08-12. That failure is invisible from the outside: on a private repo GitHub returns 404 for both "no such workflow" and "not yours", so a single probe cannot tell a legitimately workflow-less instance (the ADR 0108 pin-bump shape) from a blind credential.
+>
+> Check it with `node scripts/gds/publish-credential-check.js` on the host — it lists the repo's workflows as a control call first, so `blind` and `readable_no_workflow` are distinguishable. Task 1002724 makes a blind probe non-fatal (the reconciler falls back to the git-history land proof), but a blind credential means the deploy gate is **not being enforced**, only bypassed.
+
 ## Consequences
 
 - A dev-box builder ships end-to-end: `/builder-reauth` → claim → edit → `/builder-stage` ([ADR 0046](<redacted>.md)) → `/builder-ship`, with the GDS doing the push. The box holds no GitHub credential, so the [ADR 0053](0053-scoped-dev-box-session.md) blast-radius argument still holds.

package/docs/recipes/ops-gotchas.md

@@ -187,6 +187,17 @@ Organized by topic, not chronology. New entries go in the matching section; crea
 - **Do NOT** use `POST /tasks/:id/confirm` to unstick *another* builder's task — it credits + attributes to the *caller* (the Archon), not the original builder. `/confirm` is for the shipping builder's own `--skip-grade` path. The override-request → approve flow is the correct tool when the work was someone else's.
 - **Why it bites:** the grader defaults to fail (by design — it's adversarial), so a false-negative looks identical to a real rejection. The fix is a documented, audited human-in-the-loop appeal, not a grader bypass — and the appeal pays the right person.
 
+### A task sits at `confirmed` and every sweep logs `pr_not_landed` for a PR GitHub says is MERGED
+
+- **Symptom:** `journalctl -u <instance>.service | grep publish-reconciler` shows the same task in the `dispositions:` line sweep after sweep as `pr_not_landed`, while `gh pr view <n>` reports `MERGED` with green checks. Only a manual `POST /api/gds/tasks/<id>/ship` clears it. Observed live 2026-08-12 (task 1002695 / PR 91, 18 min across 4 sweeps).
+- **Read the disposition first.** Since task 1002724 the line carries the probe detail — `1002695:pr_not_landed(deploy=unavailable http=403 pr=91 …)` — so you can tell the three cases apart without a shell:
+  - `deploy=pending` — a real deploy is in flight. Correct; wait.
+  - `deploy=unavailable http=403` — **the server's GitHub token cannot read Actions.** The probe is blind, not waiting. The sweep now falls back to the git-history land proof and lands the task anyway (a blind probe must not outrank main's history), but the underlying token permission is still worth fixing: grant the App/PAT `actions:read` so the deploy gate is real again. On a repo with no `deploy-prod.yml` at all, a token that CAN read Actions gets a clean 404 → `unconfigured` → the merge is the land.
+  - `deploy=unconfigured` — no `deploy-prod.yml`; the merge IS the land (ADR 0108 pin-bump publishing).
+- **Why it used to strand forever:** `getPublishStatus` folded every non-404 error into `pending` on the comment "5xx/403/rate limit is transient". A permissions 403 never resolves, and a MERGED PR at `pending` made the reconciler treat the task as mid-deploy, which *suppressed* the per-task land proof on every sweep. The blindness silently outranked proof that the work was already on `main`.
+- **Related:** publish-on-merge (ADR 0161) pushes a `release: core X.Y.Z` carrier commit after every land, so on an instance that DOES deploy, the deploy run belongs to the carrier's sha, not the merge commit's. A strict sha match never hit — hence the same permanent `pending`. The probe now also accepts a successful `main` deploy that started after the merge.
+- **The wait is bounded.** A probe stuck at `deploy=pending` for a reason that never resolves looks identical to a slow deploy on any single sweep, so after `<redacted>` (default 30 min) a task whose land is *provable on main* ships anyway, and the sweep logs `deploy still unconfirmed after Nmin`. This lifts only the deploy gate — the per-task land proof is untouched, so it can never become a branch-reuse false-ship. Raise the env var on an instance whose real deploy legitimately takes longer than 30 minutes.
+
 ---
 
 ## Status page + monitoring

package/modules/lifecycle/github-push.js

@@ -382,9 +382,13 @@ async function enableAutoMerge({ nodeId }, deps = {}) {
 
 // getPublishStatus — report the PR + prod-deploy state so ship.js can poll
 // WITHOUT gh on the box. Returns:
-//   { pr_state, merged, merge_sha, deploy_status }  where
-//   pr_state ∈ open|closed|none, deploy_status ∈ pending|success|none|unconfigured
-//   ('unconfigured' = this repo has no deploy-prod.yml — task 1002472).
+//   { pr_state, merged, merge_sha, deploy_status, deploy_probe }  where
+//   pr_state ∈ open|closed|none,
+//   deploy_status ∈ pending|success|none|unconfigured|unavailable
+//   ('unconfigured' = this repo has no deploy-prod.yml — task 1002472;
+//    'unavailable'  = we could not READ the deploy state at all — task 1002724).
+//   deploy_probe = { state, http, detail } — WHY the probe landed where it did,
+//   so a stuck disposition is diagnosable without a shell on the host.
 // Mirrors ship.js pollCiDeploy's two-stage check (PR merged -> deploy run).
 async function getPublishStatus({ branch }, deps = {}) {
   const token = await resolveToken(deps);
@@ -421,6 +425,7 @@ async function getPublishStatus({ branch }, deps = {}) {
 
   // Merged → did the prod-deploy workflow succeed for the merge commit?
   let deployStatus = 'pending';
+  let deployProbe = { state: 'pending', http: null, detail: 'no matching deploy run yet' };
   try {
     const runsRes = await doFetch(
       `${api}/actions/workflows/deploy-prod.yml/runs?branch=main&per_page=15`,
@@ -429,10 +434,29 @@ async function getPublishStatus({ branch }, deps = {}) {
     if (runsRes.ok) {
       const data = await runsRes.json();
       const runs = (data && data.workflow_runs) || [];
-      const hit = runs.some(
-        (r) => r && r.head_sha === mergeSha && r.status === 'completed' && r.conclusion === 'success'
-      );
-      if (hit) deployStatus = 'success';
+      const ok = (r) => r && r.status === 'completed' && r.conclusion === 'success';
+      // task 1002724 (idea 1000702) — the ADR 0161 CARRIER race. Publish-on-merge
+      // pushes a "release: core X.Y.Z" carrier commit to main after EVERY land, so
+      // the deploy run that actually deploys this merge is keyed to the CARRIER's
+      // head_sha, not the merge commit's. A strict head_sha === mergeSha match then
+      // never hits, deploy_status stays 'pending' forever, and the reconciler treats
+      // a fully-landed task as mid-deploy for good. Accept either: the run FOR this
+      // merge, or any successful main deploy that started after the merge landed —
+      // deploying main after the merge necessarily deploys the merge.
+      const mergedAtMs = pr.merged_at ? Date.parse(pr.merged_at) : NaN;
+      const exact = runs.some((r) => ok(r) && r.head_sha === mergeSha);
+      const afterMerge = !exact && Number.isFinite(mergedAtMs) && runs.some((r) => {
+        if (!ok(r)) return false;
+        const startedMs = Date.parse(r.run_started_at || r.created_at || '');
+        return Number.isFinite(startedMs) && startedMs >= mergedAtMs;
+      });
+      if (exact || afterMerge) {
+        deployStatus = 'success';
+        deployProbe = {
+          state: 'success', http: runsRes.status,
+          detail: exact ? 'deploy run for the merge commit' : 'main deploy succeeded after the merge (ADR 0161 carrier)',
+        };
+      }
     } else if (runsRes.status === 404) {
       // task 1002472 — the workflow FILE does not exist in this repo, so there is no
       // deploy to wait for and 'pending' would never resolve. The 404 is unambiguous:
@@ -442,12 +466,111 @@ async function getPublishStatus({ branch }, deps = {}) {
       // (package-core → bongos upgrade, ADR 0108) never have a deploy-prod.yml at all;
       // reporting 'pending' pinned every merged PR at confirmed forever.
       deployStatus = 'unconfigured';
+      deployProbe = { state: 'unconfigured', http: 404, detail: 'no deploy-prod.yml in this repo' };
+    } else {
+      // task 1002724 — this branch used to fall through as 'pending' on the comment
+      // "5xx/403/rate-limit is transient". A 403 from a token without `actions:read`
+      // is NOT transient, it is forever — and 'pending' on a MERGED PR makes the
+      // reconciler suppress the land proof on every sweep (prMidDeploy), so the task
+      // strands at 'confirmed' permanently with a bare 'pr_not_landed' and no clue
+      // why. That is exactly the live 2026-08-12 strand (task 1002695 / PR 91:
+      // GitHub reported MERGED with green checks, the server reported deploy
+      // 'pending' for 18 min across 4 sweeps, and only a manual ship cleared it).
+      // Call it what it is — we could not READ the deploy state — and let the
+      // reconciler decide whether git history already proves the land.
+      deployStatus = 'unavailable';
+      deployProbe = { state: 'unavailable', http: runsRes.status, detail: `workflow-runs read failed (HTTP ${runsRes.status})` };
     }
-    // Any other non-ok (5xx, 403, rate limit) is transient → stay 'pending' and retry.
-  } catch (_) {
-    /* leave pending on a transient runs-API miss */
+  } catch (e) {
+    // A network-level miss is genuinely transient — keep waiting, but say so.
+    deployProbe = { state: 'pending', http: null, detail: `workflow-runs fetch threw: ${e && e.message}` };
   }
-  return { pr_state: pr.state, merged: true, merge_sha: mergeSha, deploy_status: deployStatus, pr_url: pr.html_url, ...prMeta };
+  return {
+    pr_state: pr.state, merged: true, merge_sha: mergeSha,
+    deploy_status: deployStatus, deploy_probe: deployProbe,
+    pr_url: pr.html_url, ...prMeta,
+  };
+}
+
+// probeDeployVisibility (task 1002733) — can this instance's publish credential READ
+// the Actions API at all?
+//
+// WHY THIS EXISTS. getPublishStatus's deploy probe answers a question about ONE
+// workflow, and on a private repo GitHub deliberately blurs "not there" and "not
+// yours" — both can surface as 404. So a single call cannot distinguish "this repo
+// has no deploy-prod.yml" (fine; the merge is the land, ADR 0108) from "this token
+// cannot see Actions" (a silent misconfiguration that made task 1002695 strand at
+// confirmed across 4 sweeps on 2026-08-12). Until task 1002724 there was no way to
+// tell them apart without a shell on the host and a hand-run of the API.
+//
+// The fix is a CONTROL call: list the repo's workflows. If that succeeds we can read
+// Actions, so a 404 on deploy-prod.yml genuinely means the file is absent. If the
+// list itself is refused, the credential is blind and every deploy verdict it gives
+// is meaningless.
+//
+// ADR 0055 specifies this credential as Contents rw + Pull requests rw + Actions:
+// read. NOTE resolveToken precedence is deps.token > App installation token > PAT, so
+// an instance runs on ONE of them and the other is irrelevant: a correctly-scoped PAT
+// can be masked by a narrower App grant, and equally an App that was never configured
+// means the PAT is live no matter what the ADR's history says. cloudbongos.com is the
+// second case — checked 2026-08-12, web.env sets GITHUB_PUSH_TOKEN and no GITHUB_APP_*.
+// The remediation string below resolves which one is live rather than guessing.
+async function probeDeployVisibility(deps = {}) {
+  const token = await resolveToken(deps);
+  if (!token) {
+    return { state: 'no_credential', http: null, detail: 'no push credential configured (GITHUB_PUSH_TOKEN / App)', remediation: null };
+  }
+  const repoInfo = deps.repoInfo || loadRepoInfo();
+  if (!repoInfo || repoInfo.error) {
+    return { state: 'no_repo_info', http: null, detail: 'repo owner/name could not be resolved', remediation: null };
+  }
+  const { owner, repo } = repoInfo;
+  const doFetch = deps.fetchImpl || fetch;
+  const api = `https://api.github.com/repos/${owner}/${repo}`;
+  // Name the credential that is ACTUALLY live, so the remediation points at the right
+  // one. resolveToken() prefers the App and falls back to GITHUB_PUSH_TOKEN, so an
+  // instance can be on either — and cloudbongos.com is on the PAT despite ADR 0055's
+  // history saying the App replaced it (task 1002733).
+  const live = appConfigured() ? 'the GitHub App (GITHUB_APP_* are set — it wins over any PAT)' : 'the PAT in GITHUB_PUSH_TOKEN (no GITHUB_APP_* configured)';
+  const GRANT = `Grant 'Actions: read' on ${owner}/${repo} to ${live} (ADR 0055).`;
+
+  let listRes;
+  try {
+    listRes = await doFetch(`${api}/actions/workflows?per_page=1`, { headers: ghHeaders(token) });
+  } catch (e) {
+    return { state: 'unknown', http: null, detail: `workflows list threw: ${e && e.message}`, remediation: null };
+  }
+  if (!listRes.ok) {
+    return {
+      state: 'blind',
+      http: listRes.status,
+      detail: `cannot list workflows (HTTP ${listRes.status}) — every deploy verdict from this credential is unreliable`,
+      remediation: GRANT,
+    };
+  }
+
+  // Actions is readable. Now the specific workflow: present, or genuinely absent?
+  let runsRes;
+  try {
+    runsRes = await doFetch(`${api}/actions/workflows/deploy-prod.yml/runs?branch=main&per_page=1`, { headers: ghHeaders(token) });
+  } catch (e) {
+    return { state: 'unknown', http: null, detail: `workflow-runs threw: ${e && e.message}`, remediation: null };
+  }
+  if (runsRes.ok) {
+    return { state: 'readable', http: runsRes.status, detail: 'Actions readable; deploy-prod.yml present — the deploy gate is real', remediation: null };
+  }
+  if (runsRes.status === 404) {
+    return {
+      state: 'readable_no_workflow', http: 404,
+      detail: 'Actions readable and deploy-prod.yml is genuinely absent — the merge IS the land (ADR 0108 pin-bump publishing)',
+      remediation: null,
+    };
+  }
+  return {
+    state: 'blind', http: runsRes.status,
+    detail: `workflows list succeeded but deploy-prod.yml runs returned HTTP ${runsRes.status}`,
+    remediation: GRANT,
+  };
 }
 
 // task 1547 — does the PR matched by getPublishStatus actually belong to THIS task?
@@ -755,11 +878,23 @@ async function setCommitStatus({ sha, state, context, description, targetUrl },
 // is the land, and requiring a deploy that can never run pinned every merged PR at
 // 'confirmed' forever. MERGED stays mandatory, and this is only the gate on the
 // branch/PR path — landProvenForTask still has to prove the land is THIS task's.
+// task 1002724 — 'unavailable' deliberately does NOT count as landed here. On an
+// instance that really does deploy, a blind probe must not be promoted into
+// "deployed". It is the RECONCILER that treats blindness differently from a real
+// in-flight deploy (see deployProbeBlind): a probe that cannot see anything must
+// not veto a positive git-history proof of the land.
 function landConfirmed(status) {
   if (!status || status.merged !== true) return false;
   return status.deploy_status === 'success' || status.deploy_status === 'unconfigured';
 }
 
+// Is the deploy probe BLIND (we could not read the deploy state) as opposed to
+// legitimately waiting on a deploy we can see? Exported so the reconciler and the
+// publish-status route agree on the distinction.
+function deployProbeBlind(status) {
+  return !!status && status.deploy_status === 'unavailable';
+}
+
 // task 1547 — is a landConfirmed status PROVEN to be THIS task's land, and not a
 // reused worktree branch matching an OLDER task's already-merged PR (the BV1.R04/R05
 // false-ship: branch claude/jovial-rosalind-84d6c3 → PR #386 / task 1297, merged,
@@ -1090,6 +1225,8 @@ module.exports = {
   recheckPullRequest,
   GATE_OWNER_APPROVED_CONTEXT,
   landConfirmed,
+  deployProbeBlind,
+  probeDeployVisibility,
   landProvenForTask,
   prReferencesTask,
   findTaskPullRequest,

package/modules/lifecycle/publish-reconciler.js

@@ -96,6 +96,18 @@ const SWEEP_LIMIT = 100;
 // landed and that is OLDER than this is a strand — credited but with no provable
 // land — and gets a WARN. Default 30 min; tune/disable via env.
 const STALE_CONFIRMED_MS = Number(process.env.PUBLISH_RECONCILE_STALE_MS) || 30 * 60_000;
+
+// task 1002724 — how long a MERGED PR may claim "still deploying" before the sweep
+// stops letting that claim veto a git-history-proven land.
+//
+// The blindness fix below handles the case where the probe REPORTS it cannot read
+// the deploy state ('unavailable'). It cannot handle a probe that keeps answering
+// 'pending' for a reason that never resolves — e.g. the workflow-runs fetch throwing
+// every sweep, which is indistinguishable from a slow deploy on any single pass. So
+// bound the wait: past this age, a task whose land is PROVABLE on main ships, and the
+// sweep says loudly that it stopped waiting. Anything unprovable is untouched — this
+// relaxes only the deploy gate, never the per-task land proof.
+const DEPLOY_WAIT_BOUND_MS = Number(process.env.PUBLISH_RECONCILE_DEPLOY_WAIT_MS) || 30 * 60_000;
 // task 1915: cap the speculative regen-heal per branch so a genuine treadmill (main
 // churning faster than CI clears a re-freshened branch) can't loop forever. In-memory
 // per process — a restart resets the guard, which is fine (heals are idempotent and
@@ -206,6 +218,18 @@ async function runSweep(deps = {}) {
     wtCount.set(r.worktree_name, (wtCount.get(r.worktree_name) || 0) + 1);
   }
 
+  // task 1002724 — a one-line, log-safe summary of WHY the deploy probe landed
+  // where it did, so 'pr_not_landed' in a journal line is self-explaining.
+  const describeProbe = (status) => {
+    if (!status) return 'no status';
+    const p = status.deploy_probe || null;
+    const bits = [`deploy=${status.deploy_status ?? 'unknown'}`];
+    if (p && p.http) bits.push(`http=${p.http}`);
+    if (status.pr_number) bits.push(`pr=${status.pr_number}`);
+    if (p && p.detail) bits.push(String(p.detail).slice(0, 80));
+    return bits.join(' ');
+  };
+
   let reconciled = 0;
   let merged = 0;
   let resolvedConflicts = 0;
@@ -545,7 +569,30 @@ async function runSweep(deps = {}) {
     // task 1002615: only a MERGED PR that is still deploying suppresses the proof
     // (the deploy gate governs); an un-merged PR — open, or closed without merging —
     // cannot veto what git history on main already shows.
-    const prMidDeploy = prNotLanded && !!(branchStatus && branchStatus.merged === true);
+    // task 1002724 — a MERGED PR still deploying may veto the land proof, but only
+    // while we can actually SEE the deploy. When the probe is blind (deploy_status
+    // 'unavailable' — e.g. a token without `actions:read` 403s, permanently), the
+    // old code called that "mid-deploy" and suppressed the proof on every sweep
+    // forever: the task stranded at 'confirmed' even though main's git history
+    // already proved the land. Blindness must not outrank evidence.
+    const probeBlind = typeof push.deployProbeBlind === 'function'
+      ? push.deployProbeBlind(branchStatus)
+      : false;
+    // …and a deploy we can "see" but that never resolves is the same trap wearing a
+    // different hat, so the wait is bounded too (DEPLOY_WAIT_BOUND_MS). Both escapes
+    // only lift the DEPLOY gate — landProvenForTask below still has to prove the land
+    // belongs to this task, so neither can cause a branch-reuse false-ship.
+    const confirmedAgeMs = r.confirmed_at ? (nowMs - new Date(r.confirmed_at).getTime()) : null;
+    const deployWaitExpired = confirmedAgeMs != null && confirmedAgeMs > DEPLOY_WAIT_BOUND_MS;
+    const prMidDeploy = prNotLanded
+      && !!(branchStatus && branchStatus.merged === true)
+      && !probeBlind
+      && !deployWaitExpired;
+    if (prNotLanded && !!(branchStatus && branchStatus.merged === true) && (probeBlind || deployWaitExpired)) {
+      logFn(
+        `[publish-reconciler] task ${r.task_id}: ${probeBlind ? 'deploy probe BLIND' : `deploy still unconfirmed after ${Math.round(confirmedAgeMs / 60_000)}min`} (${describeProbe(branchStatus)}) — consulting the git-history land proof instead of waiting on a deploy state that is not resolving`
+      );
+    }
     if (!landed && !prMidDeploy && typeof push.landProvenForTask === 'function') {
       try {
         const proof = await push.landProvenForTask({
@@ -583,7 +630,11 @@ async function runSweep(deps = {}) {
         : prNotLanded
           ? 'pr_not_landed'
           : (!branch && !r.published_head_sha) ? 'no_branch_no_tip' : 'land_not_proven';
-      dispositions.push(`${r.task_id}:${reason}`);
+      // task 1002724 — a bare 'pr_not_landed' says a PR exists and did not land, but
+      // not WHICH probe refused or why, so the 2026-08-12 strand needed a host shell
+      // and a hand-run of getPublishStatus to explain. Carry the probe detail into
+      // the disposition so the log line alone is diagnosable.
+      dispositions.push(`${r.task_id}:${reason}${reason === 'pr_not_landed' ? `(${describeProbe(branchStatus)})` : ''}`);
       const ageMs = r.confirmed_at ? (nowMs - new Date(r.confirmed_at).getTime()) : null;
       if (ageMs != null && ageMs > STALE_CONFIRMED_MS) {
         staleStrands++;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.81",
+  "version": "1.19.83",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.81",
+      "version": "1.19.83",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.81",
+  "version": "1.19.83",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/publish-credential-check.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// scripts/gds/publish-credential-check.js — can the publish credential SEE Actions?
+// (task 1002733, promoted from idea 1000705.)
+//
+// Run ON THE HOST, where GITHUB_PUSH_TOKEN / the GitHub App env lives:
+//   node scripts/gds/publish-credential-check.js
+//
+// WHY. On 2026-08-12 task 1002695 stranded at 'confirmed' across four reconciler
+// sweeps: its PR was MERGED with green checks, but the server's deploy probe kept
+// answering 'pending' because the credential could not read the Actions API. That
+// blindness was invisible — the only way to find it was to notice a strand and
+// hand-run getPublishStatus against the live server. This turns a silent
+// misconfiguration into a one-command answer.
+//
+// Task 1002724 stopped the blindness from stranding work (a blind probe no longer
+// vetoes a git-history-proven land). This tells you whether you are relying on that
+// fallback instead of a real deploy gate.
+//
+// Exit codes: 0 = credential can read Actions (gate is real, or the workflow is
+// legitimately absent), 1 = BLIND (remediation printed), 2 = nothing to check.
+
+const githubPush = require('../../modules/lifecycle/github-push');
+const { cliExit } = require('./cli-lib');
+
+const C = process.stdout.isTTY
+  ? { g: '\x1b[32m', y: '\x1b[33m', r: '\x1b[31m', b: '\x1b[1m', x: '\x1b[0m' }
+  : { g: '', y: '', r: '', b: '', x: '' };
+
+(async () => {
+  if (!githubPush.isConfigured()) {
+    console.log(`${C.y}!${C.x} No publish credential configured on this machine.`);
+    console.log('  This check belongs on the server/host that holds GITHUB_PUSH_TOKEN or the GitHub App env.');
+    return cliExit(2);
+  }
+
+  let probe;
+  try {
+    probe = await githubPush.probeDeployVisibility();
+  } catch (e) {
+    console.log(`${C.r}✖${C.x} probe failed: ${e && e.message}`);
+    return cliExit(1);
+  }
+
+  const http = probe.http ? ` (HTTP ${probe.http})` : '';
+  switch (probe.state) {
+    case 'readable':
+      console.log(`${C.g}✓${C.x} ${C.b}Actions readable${C.x}${http} — ${probe.detail}`);
+      return cliExit(0);
+    case 'readable_no_workflow':
+      console.log(`${C.g}✓${C.x} ${C.b}Actions readable${C.x}${http} — ${probe.detail}`);
+      return cliExit(0);
+    case 'blind':
+      console.log(`${C.r}✖${C.x} ${C.b}BLIND${C.x}${http} — ${probe.detail}`);
+      console.log('');
+      console.log(`  ${C.b}Fix:${C.x} ${probe.remediation}`);
+      console.log('  Until then the reconciler falls back to the git-history land proof (task 1002724),');
+      console.log('  so work still lands — but the deploy gate is not actually being enforced.');
+      return cliExit(1);
+    default:
+      console.log(`${C.y}!${C.x} ${probe.state}${http} — ${probe.detail}`);
+      return cliExit(2);
+  }
+})();

package/src/module-api.js

@@ -589,8 +589,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.79 with no explicit bump. run 31649366675. (task 1002620)
 //   1.19.81 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.80 with no explicit bump. run 31649705242. (task 1002620)
+//   1.19.82 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.81 with no explicit bump. run 31650108283. (task 1002620)
+//   1.19.83 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.82 with no explicit bump. run 31651046759. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.81'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.83'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_branch_route.mjs

@@ -242,7 +242,11 @@ await t('getPublishStatus: merged + workflow-runs 404 → unconfigured (no deplo
   assert.equal(s.deploy_status, 'unconfigured', 'an absent workflow is permanent, not pending');
 });
 
-await t('getPublishStatus: merged + workflow-runs 5xx/403 → still pending (transient stays transient)', async () => {
+// task 1002724 — an unreadable deploy state is its OWN thing: not "no workflow"
+// (which would land it) and not "a deploy is running" (which vetoes the land proof
+// forever). A 403 from a token without `actions:read` never resolves, and calling
+// it 'pending' stranded task 1002695 at confirmed across 4 sweeps on 2026-08-12.
+await t('getPublishStatus: merged + workflow-runs 5xx/403 → unavailable, never landConfirmed', async () => {
   const mergeSha = 'e'.repeat(40);
   const mk = (code) => async (url) => {
     if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
@@ -251,10 +255,67 @@ await t('getPublishStatus: merged + workflow-runs 5xx/403 → still pending (tra
   };
   for (const code of [500, 502, 403]) {
     const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl: mk(code) });
-    assert.equal(s.deploy_status, 'pending', `${code} must NOT be read as "no workflow"`);
+    assert.equal(s.deploy_status, 'unavailable', `${code} must NOT be read as "no workflow" nor as a running deploy`);
+    assert.equal(s.deploy_probe.http, code, 'the probe must carry the HTTP status for diagnosis');
+    assert.equal(gp.landConfirmed(s), false, 'a blind probe must never be promoted into "deployed"');
+    assert.equal(gp.deployProbeBlind(s), true);
   }
 });
 
+await t('getPublishStatus: a network throw stays pending (genuinely transient), not unavailable', async () => {
+  const mergeSha = 'e'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) return jsonRes(200, [{ state: 'closed', merged_at: '2026-07-26T00:00:00Z', merge_commit_sha: mergeSha, html_url: 'http://pr/1' }]);
+    if (url.includes('deploy-prod.yml/runs')) throw new Error('ECONNRESET');
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'pending');
+  assert.equal(gp.deployProbeBlind(s), false, 'a socket blip is a retry, not blindness');
+  assert.match(s.deploy_probe.detail, /threw/);
+});
+
+// task 1002724 / idea 1000702 — the ADR 0161 carrier race. Publish-on-merge pushes
+// a "release: core X.Y.Z" carrier commit to main after every land, so the deploy run
+// that deploys THIS merge is keyed to the carrier's sha, not the merge commit's.
+await t('getPublishStatus: a successful main deploy AFTER the merge counts (ADR 0161 carrier)', async () => {
+  const mergeSha = 'a'.repeat(40);
+  const carrierSha = 'b'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) {
+      return jsonRes(200, [{ state: 'closed', merged_at: '2026-08-12T20:25:23Z', merge_commit_sha: mergeSha, html_url: 'http://pr/91' }]);
+    }
+    if (url.includes('deploy-prod.yml/runs')) {
+      return jsonRes(200, { workflow_runs: [
+        // the carrier's deploy — a different head_sha, started after the merge
+        { head_sha: carrierSha, status: 'completed', conclusion: 'success', run_started_at: '2026-08-12T20:27:00Z' },
+      ] });
+    }
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'success', 'deploying main after the merge deploys the merge');
+  assert.equal(gp.landConfirmed(s), true);
+  assert.match(s.deploy_probe.detail, /carrier/i);
+});
+
+await t('getPublishStatus: a main deploy that finished BEFORE the merge does not count', async () => {
+  const mergeSha = 'a'.repeat(40);
+  const fetchImpl = async (url) => {
+    if (url.includes('/pulls?head=')) {
+      return jsonRes(200, [{ state: 'closed', merged_at: '2026-08-12T20:25:23Z', merge_commit_sha: mergeSha, html_url: 'http://pr/91' }]);
+    }
+    if (url.includes('deploy-prod.yml/runs')) {
+      return jsonRes(200, { workflow_runs: [
+        { head_sha: 'c'.repeat(40), status: 'completed', conclusion: 'success', run_started_at: '2026-08-12T20:00:00Z' },
+      ] });
+    }
+    throw new Error('unexpected ' + url);
+  };
+  const s = await gp.getPublishStatus({ branch: 'claude/x' }, { token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(s.deploy_status, 'pending', 'an earlier deploy cannot have carried this merge');
+});
+
 await t('getPublishStatus: merged, workflow EXISTS but no successful run yet → pending', async () => {
   const mergeSha = 'f'.repeat(40);
   const fetchImpl = async (url) => {
@@ -509,5 +570,74 @@ await t('landConfirmed: unconfigured deploy counts as landed, but ONLY when merg
   assert.equal(gp.landConfirmed({ merged: true, deploy_status: 'none' }), false, 'none ≠ unconfigured — no PR at all is not a land');
 });
 
+// ===========================================================================
+// task 1002733 — probeDeployVisibility: is the publish credential BLIND?
+//
+// On a private repo GitHub deliberately blurs "not there" and "not yours" — both
+// can surface as 404 — so one call cannot tell "this repo has no deploy-prod.yml"
+// (fine) from "this credential cannot read Actions" (the silent misconfiguration
+// that stranded task 1002695 across 4 sweeps). The CONTROL call is listing the
+// repo's workflows: if that works, a 404 on the specific workflow is genuine.
+// ===========================================================================
+
+await t('probeDeployVisibility: workflows list 403 → blind, with remediation', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(403, { message: 'Resource not accessible' });
+    throw new Error('must not probe the specific workflow once the list is refused: ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'blind');
+  assert.equal(p.http, 403);
+  assert.match(p.remediation, /Actions: read/i);
+  // The remediation must name the credential that is ACTUALLY live rather than
+  // guessing: resolveToken prefers the App and falls back to GITHUB_PUSH_TOKEN, and an
+  // instance runs on exactly one of them. Pointing at the wrong one sends the operator
+  // to widen permissions on a credential that is not in play (cloudbongos.com is on
+  // the PAT, despite ADR 0055's history saying the App replaced it — task 1002733).
+  assert.match(
+    p.remediation, /GITHUB_APP_\*|GITHUB_PUSH_TOKEN/,
+    'must identify which credential resolveToken will actually use'
+  );
+});
+
+await t('probeDeployVisibility: list OK + runs 404 → readable_no_workflow (NOT blind)', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(200, { workflows: [{ id: 1, path: '.github/workflows/unit.yml' }] });
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(404, { message: 'Not Found' });
+    throw new Error('unexpected ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'readable_no_workflow', 'a 404 behind a readable list means the workflow is genuinely absent');
+  assert.equal(p.remediation, null, 'nothing to fix — this is the ADR 0108 pin-bump shape');
+});
+
+await t('probeDeployVisibility: list OK + runs OK → readable (the deploy gate is real)', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(200, { workflows: [] });
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(200, { workflow_runs: [] });
+    throw new Error('unexpected ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'readable');
+  assert.equal(p.remediation, null);
+});
+
+await t('probeDeployVisibility: list OK but runs 403 → still blind', async () => {
+  const fetchImpl = async (url) => {
+    if (url.includes('/actions/workflows?')) return jsonRes(200, { workflows: [] });
+    if (url.includes('deploy-prod.yml/runs')) return jsonRes(403, { message: 'nope' });
+    throw new Error('unexpected ' + url);
+  };
+  const p = await gp.probeDeployVisibility({ token: 'TT', repoInfo: REPO, fetchImpl });
+  assert.equal(p.state, 'blind');
+  assert.equal(p.http, 403);
+});
+
+await t('probeDeployVisibility: no credential → no_credential, not a false alarm', async () => {
+  const p = await gp.probeDeployVisibility({ token: null, repoInfo: REPO, fetchImpl: async () => { throw new Error('must not fetch'); } });
+  assert.equal(p.state, 'no_credential');
+  assert.equal(p.remediation, null);
+});
+
 console.log(`\n${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);

package/tests/publish_reconciler.mjs

@@ -129,6 +129,9 @@ function mkDeps({
         if (a instanceof Error) throw a;
         return !!a;
       },
+      // task 1002724: the REAL blindness predicate, so the sweep's "is this deploy
+      // state unreadable?" decision cannot drift from getPublishStatus's answer.
+      deployProbeBlind: githubPush.deployProbeBlind,
       // task 1547 per-task land proof. Mirrors the real github-push.landProvenForTask
       // shape but routes its network hops (the ancestry compares) through the mock
       // above so the sweep stays DB/network-free, and reuses the REAL prReferencesTask
@@ -333,6 +336,122 @@ test('1002472 merged + deploy unconfigured + published tip in main → ships', a
   assert.deepEqual(deps._calls.broadcast, [63]);
 });
 
+// ---------------------------------------------------------------------------
+// task 1002724 — the deploy probe went BLIND and vetoed a provable land forever.
+//
+// Live on 2026-08-12: task 1002695 / PR 91 was MERGED with green checks at
+// 20:25:23Z, but the server's deploy probe answered 'pending' (a 403 from a token
+// without `actions:read` — permanent, not transient). merged + !landConfirmed made
+// prMidDeploy true, which SUPPRESSED landProvenForTask on every sweep, so four
+// sweeps across 18 minutes all logged a bare '1002695:pr_not_landed' and only a
+// manual POST /ship cleared it. A probe that cannot see anything must not outrank
+// main's git history, and the disposition must say which probe refused.
+// ---------------------------------------------------------------------------
+const BLIND = (id) => ({
+  ...landedPrFor(id),
+  deploy_status: 'unavailable',
+  deploy_probe: { state: 'unavailable', http: 403, detail: 'workflow-runs read failed (HTTP 403)' },
+  merge_sha: MERGE_SHA,
+});
+
+test('1002724 blind deploy probe no longer vetoes a tip-proven land', async () => {
+  const tip = 'd'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 1002695, builder_id: 9, worktree_name: 'wt-blind', published_head_sha: tip,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-blind': BLIND(1002695) },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'the published tip is in main — that IS the land');
+  assert.deepEqual(deps._calls.ship, [{ taskId: 1002695, builderId: 9 }]);
+});
+
+test('1002724 blind probe + merged PR naming the task → the merge-commit proof still lands it', async () => {
+  const deps = mkDeps({
+    rows: [{ task_id: 1002695, builder_id: 9, worktree_name: 'wt-blind2', published_head_sha: null,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-blind2': BLIND(1002695) },
+    ancestryBySha: { [MERGE_SHA]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'a merged PR naming this task whose merge sha is in main is a land');
+});
+
+test('1002724 a REAL in-flight deploy still vetoes the proof (the gate is not weakened)', async () => {
+  const tip = 'e'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 65, builder_id: 4, worktree_name: 'wt-realdeploy', published_head_sha: tip,
+             confirmed_at: new Date().toISOString() }],
+    // deploy_status 'pending' = we CAN read the deploy state and it has not succeeded.
+    statusByBranch: { 'claude/wt-realdeploy': { ...landedPrFor(65), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'merged-but-still-deploying must keep waiting — shipped means deployed');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('1002724 a deploy that never resolves stops vetoing a provable land once the wait is bounded', async () => {
+  // The blindness escape only fires when the probe SAYS it is blind. A probe that
+  // keeps answering 'pending' forever (e.g. the runs fetch throwing every sweep)
+  // looks identical to a slow deploy on any single pass — so the wait is bounded.
+  const tip = '1'.repeat(40);
+  const old = new Date(Date.now() - 45 * 60_000).toISOString(); // 45min > the 30min bound
+  const deps = mkDeps({
+    rows: [{ task_id: 67, builder_id: 4, worktree_name: 'wt-forever', published_head_sha: tip, confirmed_at: old }],
+    statusByBranch: { 'claude/wt-forever': { ...landedPrFor(67), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 1, 'past the bound, a provable land must not wait on a deploy forever');
+  assert.ok(
+    deps._calls.logs.some((l) => /deploy still unconfirmed after \d+min/.test(l)),
+    'the sweep must say it stopped waiting, not ship silently'
+  );
+});
+
+test('1002724 the bound lifts only the DEPLOY gate — an unprovable land still strands', async () => {
+  const tip = '2'.repeat(40);
+  const old = new Date(Date.now() - 45 * 60_000).toISOString();
+  const deps = mkDeps({
+    rows: [{ task_id: 68, builder_id: 4, worktree_name: 'wt-forever-unproven', published_head_sha: tip, confirmed_at: old }],
+    statusByBranch: { 'claude/wt-forever-unproven': { ...landedPrFor(68), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: false }, // tip NOT in main — no land to prove
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'the bound must never become a branch-reuse false-ship');
+  assert.equal(deps._calls.ship.length, 0);
+});
+
+test('1002724 a young in-flight deploy is still waited on (the bound does not fire early)', async () => {
+  const tip = '3'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 69, builder_id: 4, worktree_name: 'wt-young', published_head_sha: tip,
+             confirmed_at: new Date(Date.now() - 60_000).toISOString() }], // 1min old
+    statusByBranch: { 'claude/wt-young': { ...landedPrFor(69), deploy_status: 'pending' } },
+    ancestryBySha: { [tip]: true },
+  });
+  const r = await reconciler.runSweep(deps);
+  assert.equal(r.reconciled, 0, 'shipped means deployed while the deploy is plausibly still running');
+});
+
+test('1002724 an unprovable pr_not_landed disposition names the failing probe', async () => {
+  const tip = 'f'.repeat(40);
+  const deps = mkDeps({
+    rows: [{ task_id: 66, builder_id: 4, worktree_name: 'wt-diag', published_head_sha: tip,
+             confirmed_at: new Date().toISOString() }],
+    statusByBranch: { 'claude/wt-diag': { ...landedPrFor(66), deploy_status: 'pending', pr_number: 91 } },
+    ancestryBySha: { [tip]: false },
+  });
+  await reconciler.runSweep(deps);
+  const line = deps._calls.logs.find((l) => /dispositions:/.test(l));
+  assert.ok(line, 'the sweep must emit a dispositions line');
+  assert.match(line, /66:pr_not_landed\(/, 'the disposition must carry probe detail, not be bare');
+  assert.match(line, /deploy=pending/);
+  assert.match(line, /pr=91/, 'the PR number makes the strand traceable from the log alone');
+});
+
 test('1002472 merged + deploy unconfigured but tip NOT in main → NO ship (1547 proof intact)', async () => {
   const deps = mkDeps({
     rows: [{ task_id: 64, builder_id: 4, worktree_name: 'wt-nowf-reuse', published_head_sha: NOT_ON_MAIN }],