@bongos/core 1.19.835 → 1.19.837

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.835",
-  "core_contract": "1.19.835",
-  "source_commit": "31b17fb901dd65b7c6893f797e935c3b503a0de9",
+  "core_version": "1.19.837",
+  "core_contract": "1.19.837",
+  "source_commit": "d3feb6abfa5bf8256137d7be87929d517c266c48",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T16:17:34.798Z",
+  "built_at": "2026-09-17T16:49:51.613Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 493,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2248,
+    "functional_verbatim": 2253,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2767,
-  "tree_sha256": "a2ec29793c06b863434f540138312423bddbe46023b7584468bbbdb7d5dfd2b2",
+  "file_count": 2772,
+  "tree_sha256": "ce96f2d9d0c9b141f032d74100c6f505b5c6fdce72de9da3a6a8620538af685b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -52,7 +52,7 @@
     {
       "path": ".claude/skills/builder-claim/SKILL.md",
       "mode": "0000644",
-      "sha256": "2fb6020a75965376ec426eec1bfc7e850d2cd659ce9e2205cffa76956f3e1ea7"
+      "sha256": "6e5555dccf68419b690ec2f4ac1f31c98399f946f9c39f23503afbbfe808ee15"
     },
     {
       "path": ".claude/skills/builder-cost/SKILL.md",
@@ -87,7 +87,7 @@
     {
       "path": ".claude/skills/builder-release/SKILL.md",
       "mode": "0000644",
-      "sha256": "8076ea3f6c74cfa18eb18f68a40a9c8d7d941f18437e64bae8e96d24d01ef3fe"
+      "sha256": "c9f9607939f1048370e0fd35626b5d8dc0d6c7285d0b6aa4bbb745c5cb4b16a5"
     },
     {
       "path": ".claude/skills/builder-sequence/SKILL.md",
@@ -102,7 +102,7 @@
     {
       "path": ".claude/skills/builder-ship/SKILL.md",
       "mode": "0000644",
-      "sha256": "d7f935846a7f53ad66bc08de00747b5c1719bf6c6a5df47fd7f88743db63b49d"
+      "sha256": "dca7c8f6e31c21c08ab2c4810cb6345b35bb287d51be93ed46d793c2096b86b4"
     },
     {
       "path": ".claude/skills/builder-stage/SKILL.md",
@@ -112,7 +112,7 @@
     {
       "path": ".claude/skills/builder-start/SKILL.md",
       "mode": "0000644",
-      "sha256": "919fd6a9a93baeab66181a47cb7cf7459de6cc0efae4afb51afe0b0413f56001"
+      "sha256": "db68cfce733b850121f3b3e6ec094bd2864a85b36c414626037200fa69f34529"
     },
     {
       "path": ".claude/skills/design-sync/SKILL.md",
@@ -2562,7 +2562,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "6cd1402c15f4a97fe2e7da159ad42f283992d01058781df987f5948c25ff9df4"
+      "sha256": "7b2488f4099bcc1060d6257077010857c05b886459ad106f722ed19b0b5178f0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5587,7 +5587,7 @@
     {
       "path": "modules/lifecycle/db-claims.js",
       "mode": "0000644",
-      "sha256": "1c250de70282c19f66324f9203d0899eb874c8d59f14af940a004a235bf9d1b9"
+      "sha256": "4b9beaede9eec500e1d25739f33f0903b0262f7ec8be7374279a4c6c3d38fa36"
     },
     {
       "path": "modules/lifecycle/db-deps-criteria.js",
@@ -5627,7 +5627,7 @@
     {
       "path": "modules/lifecycle/db-ship.js",
       "mode": "0000644",
-      "sha256": "19e70254936af3f51fa12d3b9aa9d25dbc0a84761aee84b5143ebfe6a8654b30"
+      "sha256": "02b7d3ca2ec138b1ffd8509e48702a68f79faab3a16dfdc3f223ce807fdf9e90"
     },
     {
       "path": "modules/lifecycle/db-tasks.js",
@@ -5792,7 +5792,7 @@
     {
       "path": "modules/lifecycle/publish-reconciler.js",
       "mode": "0000644",
-      "sha256": "dce7913d2635c40ce9557e7cb554aa152dbbe4c40e88676faa3f5e5b34bc26ae"
+      "sha256": "6176e109575f02c681240b809b85b272c438c7284a7fdd290cd87b46abdb9e7c"
     },
     {
       "path": "modules/lifecycle/rot.js",
@@ -7852,12 +7852,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "72ff1b680bbebe422781c8e96ff9da2627b98581a871e0f826907525a0eecf04"
+      "sha256": "376f02b1d5253b7b790331c0f6639d16da022314d4a83c58ca10a9648337f01e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "95c3f6f48a670b840fbf7b1f05f97b5fa93fa06ed08b6322d766b19e46beeef5"
+      "sha256": "f8da5247d7da8fdcdb322b12a5ebb362315389a7049ea4d76160115066a6cf3f"
     },
     {
       "path": "public-docs/index.html",
@@ -7952,7 +7952,7 @@
     {
       "path": "scripts/gds/api.js",
       "mode": "0000644",
-      "sha256": "af8c10397ffeca0e74f520b277f0bb1044cef9a62318552ee5a2b911d33f560f"
+      "sha256": "d36fa664267d64796faf071278437cb7cfa8c2b1c7ae2140bcb01d7c2ddf16e1"
     },
     {
       "path": "scripts/gds/api.ps1",
@@ -8097,7 +8097,7 @@
     {
       "path": "scripts/gds/box.js",
       "mode": "0000644",
-      "sha256": "bf2f9c0ccbdaaa615bcd4020402dac32466a5a3ace6a1fb5cb543baa905a2ecd"
+      "sha256": "a2d44a3c30aa83d675edc985bb562ed0599ed1a59bdca3efb515c8be2abcea35"
     },
     {
       "path": "scripts/gds/bug-attachment-audit.js",
@@ -8117,7 +8117,7 @@
     {
       "path": "scripts/gds/build-cli-package.js",
       "mode": "0000644",
-      "sha256": "8286f8bf978cfb49b96e035eefbbc40878c73b8a14f16f6a9c11c308f74d4cd3"
+      "sha256": "630bdedb252e6d77a3427d962fca94094c747c377679ec1157644d76f142b6e8"
     },
     {
       "path": "scripts/gds/bump-version.js",
@@ -8152,7 +8152,7 @@
     {
       "path": "scripts/gds/claim.js",
       "mode": "0000644",
-      "sha256": "2d225377a6ab3bdc8e8cb195d5e6588517275179fe49100c42362c88a3465324"
+      "sha256": "a02e76a5f817501745c843c1df25fdd9584e91eb3d97fe76976fd508b70f72d9"
     },
     {
       "path": "scripts/gds/classify-discipline.js",
@@ -8177,7 +8177,7 @@
     {
       "path": "scripts/gds/cli-lib.js",
       "mode": "0000644",
-      "sha256": "9aaa511f1c889717a21636f53bd3cf588fed740490c11b29b48b1f90de1c0729"
+      "sha256": "d320945b629ad20f4e6cc272f3b531d6f98ed2dae2f07286b459db5b15d2c07a"
     },
     {
       "path": "scripts/gds/client-baseurl-guard.js",
@@ -8317,7 +8317,7 @@
     {
       "path": "scripts/gds/doctor.js",
       "mode": "0000644",
-      "sha256": "2fcc3f97558ed6a653638df96d585dc7a1ef7dd884657a63d3a9545dbdb03e92"
+      "sha256": "eaae00a0124635c26f45b4f6620ed95e913a5c2140178fb85bd3f5020dab5d44"
     },
     {
       "path": "scripts/gds/enroll-control-plane.js",
@@ -8714,6 +8714,11 @@
       "mode": "0000644",
       "sha256": "b61317006e5df92afb5744bd9fb9b3180bf8a674b7f691773114280660a42a2a"
     },
+    {
+      "path": "scripts/gds/plain-cards.js",
+      "mode": "0000644",
+      "sha256": "7f54da72ae01fa7db57098e3dfd523f9f65a65efa316e8962b9cf7d60faf9be0"
+    },
     {
       "path": "scripts/gds/portability-smoke-art.sh",
       "mode": "0000644",
@@ -8787,7 +8792,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "4f60207affe476f637b2b2c13c38ab785940deef9bf8b5a8fa43b5d6448a408a"
+      "sha256": "94a77427cb16c8a959eb279866f3777830d7a33617f02aed5eedb383ca26e84a"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -8817,7 +8822,7 @@
     {
       "path": "scripts/gds/push-path-brief.js",
       "mode": "0000644",
-      "sha256": "3e4d1f99b3edd2883ba63fecfd3718f26b6e53f2255f5669ab7f5e4afe3f9c34"
+      "sha256": "4fbbb81668b9fa2d7713ba9585bfe8dfacba25c5bd87c9368d1078cec6d985a3"
     },
     {
       "path": "scripts/gds/read-session-export.js",
@@ -8847,7 +8852,7 @@
     {
       "path": "scripts/gds/release.js",
       "mode": "0000644",
-      "sha256": "e1eee039027e79ab3dfee9bcfe12af43c96e788c39c7861b4910a83eeddb90e7"
+      "sha256": "997c4c4f45d360b765877e3583038be21b52267112b7b33e9c673ab245d682fc"
     },
     {
       "path": "scripts/gds/rename-goals.js",
@@ -8904,6 +8909,11 @@
       "mode": "0000644",
       "sha256": "c5fb602f48d48ca31f5f5290d3624050267ec9bdf4b0c2988e3ff7d59e523bff"
     },
+    {
+      "path": "scripts/gds/runner-drift.js",
+      "mode": "0000644",
+      "sha256": "2a0919b7769007eba2b58f2c0a3f77d42a644c8c2912059ae2af689e06302d6e"
+    },
     {
       "path": "scripts/gds/sandbox-stage.js",
       "mode": "0000644",
@@ -9127,7 +9137,7 @@
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "bb39ac6572410567ce0a2881f26b0512df817fd04cec9130792ca24c48e8d02a"
+      "sha256": "c29075a13419ef2bc13f2ff1fd921c725c633ab1e3284dbe9531e1fb55219678"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -9137,7 +9147,7 @@
     {
       "path": "scripts/gds/ship-grade-steps.js",
       "mode": "0000644",
-      "sha256": "98731f2d03f4465ebb018e1384829f0ed84a8a57ae88912bb4406d1d96f8bd0b"
+      "sha256": "158a01214499cd229a51819cd2dfcfee2eae34475f87f23795f81ec83d54f337"
     },
     {
       "path": "scripts/gds/ship-grade.js",
@@ -9157,7 +9167,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "0ae08db904a8777c7b6402ab2064d0ee092cf014a63a4c5421582d5aa998e7c3"
+      "sha256": "fafa751359543787133e26a7aa18307fec163b0955eea38677a1b319d4dc6162"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -9272,7 +9282,7 @@
     {
       "path": "scripts/gds/start.js",
       "mode": "0000644",
-      "sha256": "b5f2ae50f30ccd55f7ff7d1ea10ec971a9972ad7c2cd8bfdba33c205cf9f0799"
+      "sha256": "70aa432e6142fa7a5e7ca5232aa0f362c1e2b891b8ac34ad7d34a4665abe043f"
     },
     {
       "path": "scripts/gds/status.js",
@@ -9777,7 +9787,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a5a74874643eb65e4e9727c492b8990e42dd5b28d13c40e5a523abcbc1aa320d"
+      "sha256": "5434f6390d888bb9c3181c449483867da3fd6637a8748fe98f0609cc57f75022"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10457,7 +10467,7 @@
     {
       "path": "tests/claim_gate_rebase.mjs",
       "mode": "0000644",
-      "sha256": "64b24b9706f542b6cff381cfa4e9f59ceb91ce30aa92c5c34d41b43da76e0b46"
+      "sha256": "944e025c19ed31efbe04bf27dccccd0705782a5c028271299c8982461d050eb7"
     },
     {
       "path": "tests/claim_recall.mjs",
@@ -12374,6 +12384,11 @@
       "mode": "0000644",
       "sha256": "c3ceef2141a0f5f19c6dacfa0f9c927e5904757c39925e852b34b08c4c2576a5"
     },
+    {
+      "path": "tests/plain_cards.mjs",
+      "mode": "0000644",
+      "sha256": "925f4ffa450b2eddff31712b8ea1cd3e7853110f156d8fd4574f1ba1d05d16a8"
+    },
     {
       "path": "tests/planning_session_skill.mjs",
       "mode": "0000644",
@@ -12592,7 +12607,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "56be00457be12f34e12658e032285865a6e3a2997df629e4d8dec3ec78c52b31"
+      "sha256": "09a759a1b1e0cac3ddafdd64adca4daed0f6a8ab4c48a07f42954f38ed510433"
     },
     {
       "path": "tests/provision_disconnect.mjs",
@@ -12809,6 +12824,11 @@
       "mode": "0000644",
       "sha256": "f9e7b2e7ae906198ef0badd1bbbe8e28cd4e8d20770ddc351b85aa2c8ce85198"
     },
+    {
+      "path": "tests/rebase_gate_unprovable.mjs",
+      "mode": "0000644",
+      "sha256": "07a40476b9215049c2e61ae2323ade7443b23dab6ca7bac3cd9d6041103d250e"
+    },
     {
       "path": "tests/recall_cli.mjs",
       "mode": "0000644",
@@ -12959,6 +12979,11 @@
       "mode": "0000644",
       "sha256": "b5698af4ca50c44b384a3adfd1a1b1132bab630241ebb70ac77b13a67ffc8eae"
     },
+    {
+      "path": "tests/runner_drift.mjs",
+      "mode": "0000644",
+      "sha256": "51e07247e84af72a316fac8b3c373198d80af6f97ec3fd08a9e99ab010a1b6ff"
+    },
     {
       "path": "tests/sandbox_stage.mjs",
       "mode": "0000644",

package/.claude/skills/builder-claim/SKILL.md

@@ -6,6 +6,8 @@ description: >-
 
 **Script skill (authoritative).** The core action is `node scripts/gds/claim.js <task-id> [--worktree NAME]`. Once the args are determined, run it and relay its output verbatim — do not paraphrase error messages or reformat the claimed card.
 
+**The one exception — a refusal, for a non-technical builder (task 1003989).** Every refusal now ends with an `[otb-plain]` card: what happened, what you will do next, whether a person is needed (and who), and whether this is a rule or a fault. Read the session's interaction profile (the Conductor injects it; with none injected, assume non-technical — CLAUDE.md §2). **Non-technical or mixed:** lead with the card in your own plain words and do what its "What I will do" line says; keep the raw text back unless they ask for it. **Engineer:** relay verbatim, as above. **Any profile:** `By design: Yes` means the refusal is a rule, not breakage — never look for a way round it and never offer one.
+
 You are claiming a task on behalf of the current builder. The claim is atomic — either it succeeds (and the task is locked to this session) or it fails with a clear reason and the user picks differently.
 
 ## What this skill does

package/.claude/skills/builder-release/SKILL.md

@@ -4,7 +4,7 @@ description: >-
   Cancel an active claim without shipping: the task returns to 'ready' and no credits are awarded. Triggers: "/builder-release N", "cancel my claim", "I'm dropping this task", "give it back".
 ---
 
-**Script skill (authoritative).** The core action is `node scripts/gds/release.js <task-id> --reason "..."`. Once the task id and reason are determined, run it and print its output verbatim — do not editorialize the result.
+**Script skill (authoritative).** The core action is `node scripts/gds/release.js <task-id> --reason "..."`. Once the task id and reason are determined, run it and print its output verbatim — do not editorialize the result. If the release is refused, the output closes with an `[otb-plain]` card; for a builder whose interaction profile is not `engineer`, tell them what that card says instead of pasting the refusal (the rule is spelled out in `/builder-claim`).
 
 You are releasing a task on behalf of the current builder. Releasing is the honest "I started this, but I'm not finishing it right now" exit.
 

package/.claude/skills/builder-ship/SKILL.md

@@ -25,6 +25,8 @@ The CLI drives a **three-state lifecycle** with a subagent grader between states
 - **`GRADER UNAVAILABLE`** (`panel_outcome='unavailable'`) — the grading panel could not run (worker infra outage or a pre-spawn bypass). This is **not a quality rejection**: no quality signal was produced, there are no findings to fix, and the task parks at `completed` ungraded (aggregates exclude these rounds as `n_unavailable` — an outage never counts as a zero). Recovery: when the grader is reachable again, re-run just the grade step — `node scripts/gds/ship.js <id> --regrade`.
 - **A genuine `FAIL`** — the panel ran and returned findings. Fix the real issues, commit on the claim branch (the grader reads committed history, not the working tree), then re-grade with the same command: `node scripts/gds/ship.js <id> --regrade`.
 
+**Every way a ship can stall closes with an `[otb-plain]` card** (task 1003989) — both shapes above, an authorization refusal, a red pull request, a failed push, a land still pending, a land the server could not prove. When the builder's interaction profile is not `engineer`, that card is what you tell them: what happened, what you are doing about it, and whether they need to ask anyone. Its `By design` line decides your next move — `Yes` is a rule to respect (a pending land needs nothing; a protected path cannot be re-graded past), `No` is a fault to go and fix. Do not answer a stall by running the ship again unchanged.
+
 (Game-surface changes, `--approved`) Persists the builder's sandbox self-approval to `tasks.sandbox_review` — `{ by, at, stamp, url, method }`, with `by`/`at` stamped server-side ([#1048](https://example.com/builders#/task/1048), ADR 0046).
 
 ## How to use

package/.claude/skills/builder-start/SKILL.md

@@ -40,7 +40,7 @@ Delivery is now deterministic (task 1288). The **card-delivery hook** (`.claude/
   Either way, don't hand-run internal scripts; the package isn't unpacked yet.
 - **The card says the instance isn't reachable / running.** Same branch. **Hosted:** the server is not this machine's to start — check the origin is up (`curl -sI <buildersOrigin>/healthz`) and re-run; `bongos dev` cannot reach it, and starting a local instance instead would hide the outage behind an empty board. **Local:** the server was never brought up — route: `bongos dev`, then re-run. (`start.js` prints a guided card itself on a connection failure — relay it verbatim.)
 - **Exit code 3 / "Wrong instance — refusing to act".** This machine's signed-in session targets a *different* instance than this project's `config/branding.json`. This is correct-by-design (it prevents writing to the wrong place). Route: run the exact `bongos login <origin>` line the message prints (the origin is right there), then re-run. **Do not** set an env override to force the mismatched instance.
-- **"no Bongos session"** — the auth case above (`/builder-setup` for a first-timer, `/builder-reauth` for a stale session).
+- **"no Bongos session"** — the auth case above (`/builder-setup` for a first-timer, `/builder-reauth` for a stale session). The sign-in guidance blocks end with an `[otb-plain]` card (task 1003989): unless the builder's interaction profile is `engineer`, say what the card says and then walk the sign-in with them, rather than relaying the block.
 
 Emit one guided next step, not a wall of options. These are the same fixes `bongos doctor` and the environment preflight (`preflight.js`) describe — this just front-loads them onto the first command so a newcomer isn't diagnosing a crash.
 

package/docs/module-api-changelog.md

@@ -2144,5 +2144,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.833 with no explicit bump. run 35244719662. (task 1002620)
   1.19.835 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.834 with no explicit bump. run 35245617627. (task 1002620)
+  1.19.836 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.835 with no explicit bump. run 35247495964. (task 1002620)
+  1.19.837 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.836 with no explicit bump. run 35248928789. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-claims.js

@@ -29,7 +29,7 @@ const { unsatisfiedDeps } = require('./db-deps-criteria.js');
 const { depRefusalRow } = require('./dead-deps.js');
 const { claimGate, claimPermissionsFor, disambiguateWorktreeName, foldWorktreeName } = require('./db-rank-authz.js');
 const { sealSessionLog } = require('./db-shared.js');
-const { needsRebaseTasksForBuilder, shouldRefuseClaimResolve } = require('./db-ship.js');
+const { gatingRebaseTasksForBuilder, shouldRefuseClaimResolve } = require('./db-ship.js');
 const { REWARD_SUGGESTION_CAP, rewardGateAssignment } = require('./db-tasks.js');
 
 // -------------------------------------------------------------------------
@@ -108,7 +108,9 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // the builder is motivated to clear it; since it gates their queue, they
     // can't walk away from it. Runs in THIS txn so it can't race a concurrent
     // ship that clears the last flag.
-    const owedRebases = await needsRebaseTasksForBuilder(builderId, client);
+    // The GATING subset, not the surfacing one: a strand the builder cannot clear
+    // stops blocking after a grace, while still being reported (task 1003294).
+    const owedRebases = await gatingRebaseTasksForBuilder(builderId, client);
     if (owedRebases.length > 0) {
       throw {
         code: 'REBASE_REQUIRED',

package/modules/lifecycle/db-ship.js

@@ -377,6 +377,67 @@ async function flagTaskNeedsRebase(taskId, reason = null) {
 // claims and by the hall/CLI surfacing (part 5). Accepts an optional client so
 // it can run inside claimTask's FOR UPDATE txn or standalone on the pool.
 // Ordered oldest-flagged first so the surfacing can show the longest-outstanding.
+// UNPROVABLE_GATE_GRACE_MS — how long a strand the builder may be UNABLE to clear
+// keeps gating their queue before the gate lets go of it (task 1003294).
+//
+// ADR 0120 part 3 blocks a builder's NEW claims while they owe a rebase, because
+// the rebase is a chore only they can do and the gate is what makes them do it.
+// That reasoning holds for every strand reason EXCEPT one.
+//
+// 'no_branch_no_tip' means: no branch in the CORE repo, and no published tip on the
+// claim. Two very different situations produce it and the reconciler cannot tell
+// them apart:
+//
+//   (a) the builder never pushed        -> THEY CAN FIX IT. The gate is working.
+//   (b) the task delivered to the INSTANCE repo, not the core -- e.g. task 1003253,
+//       whose commit is real, complete and deployed on the instance host. The core
+//       reconciler has structurally no way to see that repository, so the land can
+//       NEVER be proven here.
+//
+// In case (b) the gate blocks every future claim by that builder over a task that
+// cannot be cleared by any action available to them, and the recorded remedy has
+// been a hand-run SQL UPDATE on the droplet -- exactly the surgery this reconciler
+// exists to remove. Two builders hit it in one session (1002459, then 1003253).
+//
+// So the gate keeps its teeth for a bounded window -- long enough to motivate the
+// builder in case (a), who only has to push -- and then stops BLOCKING. It does not
+// stop REPORTING: the flag stays set, the row keeps its reason, and every surfacing
+// (me.js, the hall, the CLI) still shows it, because needsRebaseTasksForBuilder is
+// deliberately left unfiltered. A strand that outlives the window needs a human
+// disposition, and a frozen queue is not how to ask for one.
+const UNPROVABLE_GATE_GRACE_MS = Number(process.env.REBASE_GATE_UNPROVABLE_GRACE_MS) || 24 * 60 * 60_000;
+
+// The reason that carries this ambiguity. Stored by the reconciler as
+// `strand:<reason>` (announceStrand), so it is matched here in that spelling.
+const UNPROVABLE_STRAND_REASON = 'strand:no_branch_no_tip';
+
+// gatingRebaseTasksForBuilder — the subset of owed rebases that may REFUSE a new
+// claim. Split from needsRebaseTasksForBuilder on purpose: that one answers "what
+// does this builder owe?" (surfacing, part 5) and must stay complete, while this one
+// answers "what may stop them working?" (the gate, part 3). Collapsing the two is
+// what would turn "stop blocking" into "stop telling them", which is the opposite of
+// the fix.
+//
+// COALESCE, not a bare comparison: a NULL reason or NULL timestamp must fall through
+// to "still gating". Written as NOT(...) over non-NULL operands so no row can be
+// dropped by three-valued logic -- an unknown is a reason to keep the gate, never to
+// release it.
+async function gatingRebaseTasksForBuilder(builderId, client = pool, graceMs = UNPROVABLE_GATE_GRACE_MS) {
+  const { rows } = await client.query(
+    `SELECT id, title, needs_rebase_reason, needs_rebase_at
+       FROM tasks
+      WHERE needs_rebase = true AND status = 'confirmed' AND shipped_by = $1
+        AND NOT (
+              COALESCE(needs_rebase_reason, '') = $3
+          AND needs_rebase_at IS NOT NULL
+          AND needs_rebase_at < now() - ($2::bigint * interval '1 millisecond')
+        )
+      ORDER BY needs_rebase_at ASC NULLS LAST, id ASC`,
+    [builderId, Math.max(0, Number(graceMs) || 0), UNPROVABLE_STRAND_REASON]
+  );
+  return rows;
+}
+
 async function needsRebaseTasksForBuilder(builderId, client = pool) {
   const { rows } = await client.query(
     `SELECT id, title, needs_rebase_reason, needs_rebase_at
@@ -1297,6 +1358,9 @@ module.exports = {
   getClaimPublishedSha,
   listConfirmedTasksForReconcile,
   needsRebaseTasksForBuilder,
+  gatingRebaseTasksForBuilder,
+  UNPROVABLE_GATE_GRACE_MS,
+  UNPROVABLE_STRAND_REASON,
   releaseClaimOnBehalf,
   resolveClaim,
   restoreTask,

package/modules/lifecycle/publish-reconciler.js

@@ -76,6 +76,10 @@
 const githubPush = require('./github-push');
 const seams = require('../../src/module-api');
 const conflictResolve = require('./conflict-resolve');
+// The claim gate's grace for a strand its builder may be unable to clear — imported
+// rather than restated so the sweep's escalation and the gate agree on one number
+// (task 1003294).
+const { UNPROVABLE_GATE_GRACE_MS, UNPROVABLE_STRAND_REASON } = require('./db-ship.js');
 
 // 5-min cadence: frequent enough that a strand heals within minutes of CI
 // finishing, cheap enough that the GitHub API cost is negligible: steady state
@@ -281,6 +285,7 @@ async function runSweep(deps = {}) {
   let errors = 0;
   let unprovable = 0;   // confirmed tasks the sweep could not prove landed this pass
   let staleStrands = 0; // of those, the ones older than STALE_CONFIRMED_MS (WARN'd)
+  let unprovableUngated = 0; // strands past the grace that no longer gate (task 1003294)
   let strandsFlagged = 0; // task 1002606: needs_rebase flags NEWLY set this sweep (any site)
   // task 1002723: one entry per confirmed task per sweep ("<id>:<disposition>").
   // The 1002702/1002716 strands sat through 5+ sweeps with ZERO journal evidence
@@ -722,6 +727,23 @@ async function runSweep(deps = {}) {
           `strand:${reason}`,
           `confirmed ~${Math.round(ageMs / 3_600_000)}h ago, unprovable (${reason}) — no landed proof`
         );
+        // ESCALATE rather than keep blocking silently (task 1003294). Past the
+        // grace, a 'no_branch_no_tip' strand has stopped gating its builder's
+        // queue — see gatingRebaseTasksForBuilder. That is deliberate, because it
+        // may be a task delivered to the INSTANCE repo, which this reconciler has
+        // no way to see. It is NOT a resolution: the row is still flagged and still
+        // unlanded, and it now needs a human to dispose of it. Say so on every
+        // sweep, with the age, so it cannot rot unnoticed the way a frozen queue
+        // at least made loud.
+        if (`strand:${reason}` === UNPROVABLE_STRAND_REASON && ageMs > UNPROVABLE_GATE_GRACE_MS) {
+          unprovableUngated++;
+          errFn(
+            `[publish-reconciler] UNPROVABLE task ${r.task_id}: no core branch and no published tip after ` +
+            `~${Math.round(ageMs / 3_600_000)}h — no longer gating its builder's queue (grace ` +
+            `${Math.round(UNPROVABLE_GATE_GRACE_MS / 3_600_000)}h). It is still confirmed and still unlanded: ` +
+            `push the branch, or dispose of it deliberately if the work landed outside this repository.`
+          );
+        }
       } else if (prClosedUnmerged) {
         await announceStrand(
           r,
@@ -789,7 +811,7 @@ async function runSweep(deps = {}) {
   }
   if (staleStrands) {
     errFn(
-      `[publish-reconciler] ${staleStrands} stale strand(s): confirmed >${Math.round(STALE_CONFIRMED_MS / 60_000)}min with no provable land — credited but unlanded; see STRAND lines above`
+      `[publish-reconciler] ${staleStrands} stale strand(s): confirmed >${Math.round(STALE_CONFIRMED_MS / 60_000)}min with no provable land — credited but unlanded; see STRAND lines above${unprovableUngated ? `; ${unprovableUngated} past the gate grace and no longer blocking (see UNPROVABLE lines)` : ''}`
     );
   }
   // task 1002723: the always-on per-sweep account. Every confirmed task the sweep

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.835",
+  "version": "1.19.837",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.835",
+      "version": "1.19.837",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.835",
+  "version": "1.19.837",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/api.js

@@ -20,6 +20,7 @@
 const fs = require('node:fs');
 const { cliClient, arg, stripBom, resolveQuiet, isBoxScope, printBoxScopeGuidanceAndExit, cliExit, repairMsysMangledPath,
   instanceDevBoxSupport, devBoxUnavailableMessage } = require('./cli-lib');
+const { plainCardLines } = require('./plain-cards');
 
 
 (async () => {
@@ -96,7 +97,10 @@ const { cliClient, arg, stripBom, resolveQuiet, isBoxScope, printBoxScopeGuidanc
   // that a /box/ 404 always means — and only for a reader who typed a box command.
   if (res.status === 404 && /^\/api\/(?:bongos\/v1|bongos|gds)\/box\b/.test(urlPath)) {
     const { available } = await instanceDevBoxSupport();
-    if (!available) console.error(`\n✖ ${devBoxUnavailableMessage()}`);
+    if (!available) {
+      console.error(`\n✖ ${devBoxUnavailableMessage()}`);
+      for (const line of plainCardLines('dev_box_unavailable')) console.error(line);
+    }
   }
   // task 1002734: process.exit() here aborted node 5/5 on Windows —
   // "Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), file src\win\async.c"

package/scripts/gds/box.js

@@ -54,6 +54,8 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // INSTANCE root, riding ADR 0108's resolvers, instead of assuming it sits beside
 // box.js. ADR 0150 (BV1.R97/R98).
 const instanceConfig = require(path.join(REPO_ROOT, 'src/instance-config'));
+const { installedCoreVersion, runnerBanner } = require('./runner-drift.js');
+const { coreVersionSafe } = require('./provision-config.js');
 const BOX_INFRA_TEMPLATE = 'builder-box-cloud-init.yaml';
 
 // Ordered candidate infra/ dirs — first that actually holds the cloud-init
@@ -1120,6 +1122,8 @@ async function cmdReconcileDrift(pool, boxes, { apply }) {
 const MAX_INTENT_ATTEMPTS = numEnv('BOX_INTENT_MAX_ATTEMPTS', 3);
 
 async function cmdRunIntents(pool, boxes, boxOnboard, { apply }) {
+  const instanceRoot = process.env.BONGOS_INSTANCE_ROOT || process.cwd();
+  console.log(runnerBanner({ runnerVersion: coreVersionSafe(), runnerRoot: REPO_ROOT, instanceVersion: installedCoreVersion(instanceRoot), instanceRoot }));
   if (!apply) {
     const { rows } = await pool.query(
       `SELECT bi.*, b.github_login FROM box_intents bi
@@ -1325,4 +1329,4 @@ async function main() {
 
 if (require.main === module) main();
 
-module.exports = { cmdProvision, deprovisionOne, parkOne, cmdSweepIdle, cmdSweepDormant, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, buildBoxEnv, BOX_INFRA_TEMPLATE };
+module.exports = { cmdProvision, cmdRunIntents, deprovisionOne, parkOne, cmdSweepIdle, cmdSweepDormant, deleteWithRetry, cmdReconcileDrift, runDnsHook, runDnsHookBlackhole, markErrorUnlessDestroyed, resolveBoxInfraDir, boxInfraCandidates, readCloudInit, buildBoxEnv, BOX_INFRA_TEMPLATE };

package/scripts/gds/build-cli-package.js

@@ -56,6 +56,7 @@ const FILES = [
   'scripts/gds/install-git-hooks.js', // lazy dep of setup.js
   'scripts/gds/preflight.js',
   'scripts/gds/surface.js',   // who the output is for: agent vs terminal (task 1003680)
+  'scripts/gds/plain-cards.js', // required by cli-lib + release; prints nothing on the terminal surface (task 1003989)
   // The partial-checkout preflight (task 1003098). start/claim/ship require it
   // ABOVE their first module require, so an absent file here breaks every verb in
   // the published package -- which is exactly how tests/cli_package.mjs caught it.

package/scripts/gds/claim.js

@@ -31,6 +31,7 @@ const { CORE_NS } = require('./migration-namespace');
 const { contextPack, formatContextPack, resolveWorktreeRoot } = require('./context-pack');
 const { printClaimRecall } = require('./claim-recall');
 const { decideWorktreeClaim, ESCAPE_FLAG } = require('./worktree-claim-guard');
+const { plainCardLines } = require('./plain-cards');
 // task 1003153 — the DEAD dependency edge, one definition shared with the route
 // and the detector. A lifecycle CLI may require the lifecycle module directly
 // (the documented exception in modules/lifecycle/CLAUDE.md).
@@ -164,7 +165,10 @@ function enforceWorktreeClaim(taskId, { allowMainCheckout }) {
   });
   if (d.verdict === 'allow') return tree;
   for (const line of d.lines) console.error(line);
-  if (d.verdict === 'refuse') process.exit(2);
+  if (d.verdict === 'refuse') {
+    for (const line of plainCardLines('main_checkout_claim')) console.error(line);
+    process.exit(2);
+  }
   console.error('');
   return tree;
 }
@@ -315,8 +319,19 @@ function clip(s, max = 160) {
 // conflict apart from a failed worktree detection. Optional and defaulted — the
 // function stays pure and every existing caller/test keeps working.
 function formatClaimFailure(r, taskId, ctx) {
+  const info = claimErrorInfo(r);
+  const { lines, exit } = claimFailureGuidance(info, r, taskId, ctx);
+  // task 1003989: the same refusal in plain words, AFTER the curated text so nothing
+  // an engineer relies on moves. The owed-task gate names a flagged reason per task;
+  // the first one is translated too, because that token is what a builder is stuck on.
+  const { code, d } = info;
+  const owed = code === 'REBASE_REQUIRED' ? (d.rebaseTasks || d.rebase_tasks || []) : [];
+  const flagged = owed.length ? plainCardLines(String(owed[0].reason || '')) : [];
+  return { lines: [...lines, ...plainCardLines(code), ...flagged], exit };
+}
+
+function claimFailureGuidance({ code, message, d }, r, taskId, ctx) {
   const lines = [];
-  const { code, message, d } = claimErrorInfo(r);
 
   // #766: a generic onboarding stage gate (kept rendering cleanly, not as raw JSON).
   if (code === 'stage_required') {