@bongos/core 1.19.883 → 1.19.884

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.883",
-  "core_contract": "1.19.883",
-  "source_commit": "38ac16c0f1716d2a3d3b040a38b4d61bcafb4598",
+  "core_version": "1.19.884",
+  "core_contract": "1.19.884",
+  "source_commit": "3f7e3ac7e91fe3fb3fdddb27aaf5b35aa5dbac69",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T19:12:16.216Z",
+  "built_at": "2026-09-19T19:21:38.333Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 498,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2315,
+    "functional_verbatim": 2316,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2839,
-  "tree_sha256": "d96e15159f4ccd498d4c218b70f298a70541b1d97dae0f21124c8fde891881f0",
+  "file_count": 2840,
+  "tree_sha256": "6ecb18c6aa4049ca3b7a3d42526392093f1fbf7df2dcda05ec5cb24a73783653",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "a433058b1d11a710689cb4eebe94d4182f5d644bc2df341359ee4ec6348718b4"
+      "sha256": "890072b8a2de95a5f1913f4a5fdefc7462f1977b8cb7a18869cb50706c5a645e"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2052,7 +2052,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "4a74552e803444eb13792a0c61fc41da324bda5c35c50b070d8980025d4d4935"
+      "sha256": "19cb42bb52d123f89bf24d9e4b8667955f0fc682b2481790f0c48d8d1ed09e79"
     },
     {
       "path": "docs/architecture.md",
@@ -2607,7 +2607,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "a8791c0dfacd9fb522681fa5af7ddfcc63937dd597f0c30a2fa1b42498f4ee01"
+      "sha256": "6b51b92e71f93545a7e272f422f229831541e92eb5c90859d3f4e1fd629a7598"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5947,7 +5947,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "d6b50dd007aefca08424f63b648cd07f139b98b696f470b83e7adb33bb7fc5c7"
+      "sha256": "45d897c864cea14dfc02c706c6c0b4838ad5869fad81e30843fcc5d9736340a2"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7917,12 +7917,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "469884a3047b45a3ef2d4913c2316c2a8e2c7232bba7ff0c3d7ee3002b964be0"
+      "sha256": "b60a400b217ed94a7b0ffd2575edd06201aff6c044a5e83d7d96cdba2195f825"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1651df890fb2d85a35efe8281ba5c81a0c683b16db37158b2ed985d11544c683"
+      "sha256": "c148cb29465f0fd0441a9f172d5340d973cc462fa607c4a0757681dec0b22380"
     },
     {
       "path": "public-docs/index.html",
@@ -9292,7 +9292,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "805017578a7d69ca2c79d105e21add7862b41e352256e5fbdfad3e3740e69ced"
+      "sha256": "53f43c609206ea62e71f562aaceed316b6aea217612f74dcd800e30f06b17ea5"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -9307,7 +9307,7 @@
     {
       "path": "scripts/gds/ship-merge.js",
       "mode": "0000644",
-      "sha256": "b85dd18d8214f1e732d4bd584fbad037c5505a16703e867e18e42bafef0bed33"
+      "sha256": "dae19af925b80dfb2755fbf5f854ae29d04050f3b2217d99c3619e6debf067ee"
     },
     {
       "path": "scripts/gds/ship-preflight-steps.js",
@@ -9347,7 +9347,7 @@
     {
       "path": "scripts/gds/ship.js",
       "mode": "0000644",
-      "sha256": "9c279a8852e46758e498334fbeb25e94be2895930a6c65b400c2c1baaac1c270"
+      "sha256": "d17284c5e00afe793c967c3ef0a1ef34b53fa6495ae137fb2724d8f7ebeb6afc"
     },
     {
       "path": "scripts/gds/skill-lint.js",
@@ -9932,7 +9932,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b64003ea52fe47207f7723521aba5b1bec5b7286f3e545a4b323d379259b99ab"
+      "sha256": "f217dfe6e71dd6bd38f0ca7a02d4a7b85a2c49301d552dd4b1b098114db04985"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13072,7 +13072,7 @@
     {
       "path": "tests/publish_branch_route.mjs",
       "mode": "0000644",
-      "sha256": "f688f5da9bfc392ce203ee3b89dfa9ba23fd66ca4ebac603f6fb6faedb83b5c7"
+      "sha256": "27bf0ca4f9a5a2067e584d91fecf11da8daadea70fccf5e3fb48ee3bbbed39a4"
     },
     {
       "path": "tests/publish_gate.mjs",
@@ -13579,6 +13579,11 @@
       "mode": "0000644",
       "sha256": "a3b7858c255f1c7ea692866dbadd7321f77bd88c8380c429b7cb5f6b1b65496b"
     },
+    {
+      "path": "tests/ship_land_proof.mjs",
+      "mode": "0000644",
+      "sha256": "53ed4c14be08e332622708f79e7bc856b6cc81ee3f14f561f39edd23bca378c3"
+    },
     {
       "path": "tests/ship_merge_gate.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -410,7 +410,7 @@ export interface PostSsoTokenResponse { github_id: unknown; github_login: unknow
 export interface PostTaskRecommendationsRequest { task_id: number; recommended_to: number; reason: string }
 export interface PostTaskRecommendationsResponse { ok: boolean; recommendation: unknown }
 export interface PostTasksIdAttestGateRequest { head_sha: string }
-export interface PostTasksIdAttestGateResponse { ok: boolean; attested: unknown; reason: unknown }
+export interface PostTasksIdAttestGateResponse { ok: boolean; attested: unknown; reason: unknown; tip_recorded: unknown }
 export interface PostTasksIdConfirmRequest { verified?: unknown }
 export interface PostTasksIdCriteriaRequest { criterion_ids?: unknown[]; criterion_id?: StringifiableId }
 export interface PostTasksIdCriteriaResponse { ok: boolean; added: unknown; criteria: unknown }

package/docs/api/openapi.json

@@ -24632,12 +24632,14 @@
             "type": "boolean"
           },
           "attested": {},
-          "reason": {}
+          "reason": {},
+          "tip_recorded": {}
         },
         "required": [
           "ok",
           "attested",
-          "reason"
+          "reason",
+          "tip_recorded"
         ]
       },
       "PostTasksIdConfirmRequest": {

package/docs/module-api-changelog.md

@@ -2240,5 +2240,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.881 with no explicit bump. run 35463113839. (task 1002620)
   1.19.883 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.882 with no explicit bump. run 35463573638. (task 1002620)
+  1.19.884 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.883 with no explicit bump. run 35464075741. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/routes/tasks.js

@@ -1357,17 +1357,31 @@ module.exports = function buildTasksRouter() {
     // it here too. Sits BEFORE the credential 503 on purpose: the tip is true
     // regardless, and a later-provisioned credential lets the sweep heal
     // retroactively. Best-effort, mirroring publish-branch.
+    //
+    // task 1004055: and SAY whether it took. setClaimPublishedSha returns null when
+    // no claim row matched, which read identically to success — so a caller that had
+    // just merged to main was told nothing, and only found out one call later as an
+    // opaque ship_land_not_proven 409, with the work already on main and the task
+    // parked at 'confirmed'. `tip_recorded` travels on BOTH exits, so the answer does
+    // not depend on which one the request happens to take.
+    let tipRecorded = false;
     try {
-      await db.setClaimPublishedSha({ taskId: id, builderId: req.builder.id, sha: headSha });
+      const claimId = await db.setClaimPublishedSha({ taskId: id, builderId: req.builder.id, sha: headSha });
+      tipRecorded = claimId != null;
+      if (!tipRecorded) log.warn('[gds] attest-gate: no claim row to record the published tip on', id);
     } catch (e) {
       log.error('[gds] setClaimPublishedSha via attest-gate (non-blocking)', id, e && e.message);
     }
     if (!githubPush.isConfigured()) {
-      return res.fail('push_unconfigured', { status: 503, message: 'No server push credential (GitHub App / GITHUB_PUSH_TOKEN) to post the gate attestation. ' +
-          'A gate-surface PR will need an owner review until the operator provisions it.' });
+      return res.fail('push_unconfigured', {
+        status: 503,
+        message: 'No server push credential (GitHub App / GITHUB_PUSH_TOKEN) to post the gate attestation. ' +
+          'A gate-surface PR will need an owner review until the operator provisions it.',
+        details: { tip_recorded: tipRecorded },
+      });
     }
     const { attested, reason } = await postGateAuthorTrust({ rank: req.builder.rank, sha: headSha, taskId: id });
-    return res.json({ ok: true, attested, reason });
+    return res.json({ ok: true, attested, reason, tip_recorded: tipRecorded });
   });
 
   // GET /override-requests?status=open — Archon queue. Status defaults to open;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.883",
+  "version": "1.19.884",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.883",
+      "version": "1.19.884",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.883",
+  "version": "1.19.884",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/ship-land.js

@@ -438,24 +438,100 @@ async function pollServerPublish(taskId, branch) {
 // Best-effort + never throws: a non-Metic author, an unconfigured server, or a
 // transient failure just leaves the PR un-attested → it escalates (the safe
 // direction). A non-gate PR is unaffected by the attestation either way.
+//
+// task 1004055 — the endpoint does TWO things, and only one of them was ever
+// reported. Besides the attestation (best-effort, and declining is a legitimate
+// answer) it records claims.published_head_sha, the tip that makes the ship
+// PROVABLE — and that half is load-bearing, not best-effort: without it POST /ship
+// refuses the confirmed→shipped flip. So this returns { recorded, attested, reason }
+// rather than undefined, and callers act on `recorded`. It still never throws.
 async function attestGateTrust(taskId, headSha) {
-  if (!headSha) return;
+  if (!headSha) return { recorded: false, attested: false, reason: 'no head SHA to attest' };
+  let r;
   try {
-    const r = await (await cliClient()).tasks.postTasksIdAttestGate({ id: taskId, body: { head_sha: headSha } });
-    if (r.ok && r.data) {
-      if (r.data.attested) {
-        console.log('  ci-land: gate-author-trust attested on the head SHA (Metic+) — a gate-surface PR auto-passes the ADR-0058 gatekeeper.');
-      } else {
-        console.log(`  ci-land: gate-author-trust NOT attested (${r.data.reason || 'rank below Metic'}) — a gate-surface PR will need owner approval; a non-gate PR is unaffected.`);
-      }
-    } else if (r.status === 503) {
-      console.log('  ci-land: the server has no push credential to post the gate attestation (operator: GITHUB_APP_* / GITHUB_PUSH_TOKEN). A gate-surface PR will need owner approval.');
+    r = await (await cliClient()).tasks.postTasksIdAttestGate({ id: taskId, body: { head_sha: headSha } });
+  } catch (e) {
+    // task 1004055: a bare `catch (_) {}` here meant a thrown request error left NO
+    // trace at all — the quietest of the failure shapes, and the one that reached
+    // the builder as an unexplained ship_land_not_proven.
+    console.log(`  ci-land: gate attestation request failed (${(e && e.message) || 'unknown error'}).`);
+    return { recorded: false, attested: false, reason: `request failed (${(e && e.message) || 'unknown error'})` };
+  }
+  const recorded = landProofRecorded(r);
+  if (r.ok && r.data) {
+    if (r.data.attested) {
+      console.log('  ci-land: gate-author-trust attested on the head SHA (Metic+) — a gate-surface PR auto-passes the ADR-0058 gatekeeper.');
     } else {
-      console.log(`  ci-land: gate attestation request failed (HTTP ${r.status}); a gate-surface PR may need a manual re-run / owner approval.`);
+      console.log(`  ci-land: gate-author-trust NOT attested (${r.data.reason || 'rank below Metic'}) — a gate-surface PR will need owner approval; a non-gate PR is unaffected.`);
     }
-  } catch (_) {
-    /* best-effort — never block the ship on the attestation */
+    return { recorded, attested: !!r.data.attested, reason: r.data.reason || null };
+  }
+  if (r.status === 503) {
+    console.log('  ci-land: the server has no push credential to post the gate attestation (operator: GITHUB_APP_* / GITHUB_PUSH_TOKEN). A gate-surface PR will need owner approval.');
+    return { recorded, attested: false, reason: 'the server has no push credential' };
   }
+  console.log(`  ci-land: gate attestation request failed (HTTP ${r.status}); a gate-surface PR may need a manual re-run / owner approval.`);
+  return { recorded, attested: false, reason: `HTTP ${r.status}` };
+}
+
+// landProofRecorded — PURE. Did an attest-gate response actually record
+// claims.published_head_sha (task 1004055)? That row is the durable per-task land
+// proof; without it POST /tasks/:id/ship refuses with ship_land_not_proven and the
+// task strands at 'confirmed' with its work already on main.
+//
+// The server SAYS so in `tip_recorded` — on the 200 body and in the 503's details,
+// because the write deliberately sits BEFORE the credential check. Prefer that.
+// A server that predates the field sends neither, which is the NORMAL state here:
+// an instance runs a PINNED core, so it lags main by however long the pin sits
+// still. For those, fall back to the route's contract — the write is above the
+// credential 503, so 200 and 503 both mean the tip landed and nothing else does.
+// Exported so the truth table is pinned with no server.
+function landProofRecorded(r) {
+  if (!r || typeof r.status !== 'number') return false;
+  const body = r.data || {};
+  const explicit = body.tip_recorded !== undefined
+    ? body.tip_recorded
+    : (body.error && body.error.details ? body.error.details.tip_recorded : undefined);
+  if (explicit !== undefined) return explicit === true;
+  return r.status === 200 || r.status === 503;
+}
+
+// landProofWarningLines — PURE. What to print when the proof did NOT get recorded
+// (task 1004055). Without it POST /ship refuses, the task parks at 'confirmed' —
+// which gates the builder's WHOLE queue — and the publish-reconciler eventually
+// writes strand:land_not_proven, after which nothing heals it. Say it HERE, while
+// the sha is still on screen, and hand over the calls that fix it, rather than
+// letting it surface as an opaque 409 later.
+//
+// `merged` is the tense, and it is the whole difference between the two callers:
+// the local-merge path has ALREADY put the work on main and needs the full
+// two-call recovery now; the PR path has only pushed, so the land may still be
+// minutes away and the same recovery would be premature. Exported so both
+// wordings are pinned.
+function landProofWarningLines(taskId, sha, reason, { merged = true } = {}) {
+  const head = sha || '<the merge commit on main>';
+  const why = `  WARNING: the land proof for task ${taskId} was NOT recorded (${reason || 'unknown'}).`;
+  const fix = `    node scripts/gds/api.js POST /tasks/${taskId}/attest-gate --body '{"head_sha":"${head}"}'`;
+  if (!merged) {
+    return [
+      '',
+      why,
+      '  Nothing is lost yet — the branch is pushed and the PR still lands normally.',
+      '  But if the ship then refuses with ship_land_not_proven, re-record the tip',
+      '  against the merge commit and re-run the ship:',
+      `    node scripts/gds/api.js POST /tasks/${taskId}/attest-gate --body '{"head_sha":"<the merge commit on main>"}'`,
+      `    node scripts/gds/ship.js ${taskId}`,
+    ];
+  }
+  return [
+    '',
+    why,
+    '  The merge IS on main, but the server cannot prove the land is this task\'s, so',
+    '  the confirmed -> shipped flip will be refused (ship_land_not_proven) and the',
+    '  task will park at confirmed — which blocks every new claim you make. Fix it:',
+    fix,
+    `    node scripts/gds/api.js POST /tasks/${taskId}/ship --body '{}'`,
+  ];
 }
 
 // pickStaleGateReviewRun — PURE. Among `gh run list --json
@@ -596,7 +672,14 @@ async function ciLandLocal(taskId, branch, valueSummary) {
   // and a Metic+ gate-surface PR auto-passes — race-free for a fresh PR, since the
   // `gh pr create` below is what fires gate-review and it runs only after this
   // returns. (A reused open PR is handled by the re-run nudge after auto-merge.)
-  await attestGateTrust(taskId, headSha);
+  // task 1004055: the same call also records the land proof, so a miss here is not
+  // cosmetic — check it rather than firing and forgetting. Not fatal on this path:
+  // the branch is pushed and the PR lands regardless, so say what to do IF the ship
+  // is later refused, and carry on.
+  const gateProof = await attestGateTrust(taskId, headSha);
+  if (!gateProof.recorded) {
+    for (const line of landProofWarningLines(taskId, headSha, gateProof.reason, { merged: false })) console.log(line);
+  }
 
   // Ensure exactly one PR for this branch. gh pr create is idempotent-ish: it
   // errors if a PR already exists, so check first and reuse it.
@@ -723,6 +806,12 @@ module.exports = {
   ciLand,
   classifyLandOutcome,
   formatPublishFailure,
+  // task 1004055: the land-proof half of attest-gate. attestGateTrust is exported
+  // so the LOCAL-merge path can record a proof it previously never recorded at all;
+  // the two pure halves so the truth table + the wording are pinned without a server.
+  attestGateTrust,
+  landProofRecorded,
+  landProofWarningLines,
   // task 1002572 (PART 2): the bail ids + the pure "can a PR still land this?"
   // decision, so the single-checkout fallback is opt-in per bail and unit-tested.
   LAND_BAIL_MAIN_CHECKOUT_ON_BRANCH,

package/scripts/gds/ship-merge.js

@@ -20,9 +20,11 @@ const { mainIsProtected, pushVia, readDeployConfigRaw, resolveDeployMode, resolv
 const {
   LAND_BAIL_MAIN_CHECKOUT_ON_BRANCH,
   LAND_BAIL_NO_TASK_BRANCH,
+  attestGateTrust,
   ciLand,
   landBailRecoverableByPr,
   landBailed,
+  landProofWarningLines,
   landed,
 } = require('./ship-land.js');
 const { runSmoke } = require('./ship-grade.js');
@@ -301,6 +303,32 @@ async function mergeLocally(taskId, valueSummary, { dbOnly = false } = {}) {
       return landBailed('could not push the merged main to origin', '/merge-mode');
     }
 
+    // task 1004055: RECORD THE LAND PROOF — the step this path never had.
+    //
+    // The two OTHER land paths each tell the server which commit is this task's:
+    // ciLandLocal posts attest-gate after its push, ciLandServer gets it from
+    // publish-branch. This path merges and pushes main ITSELF, so nothing ever did,
+    // and claims.published_head_sha stayed NULL. It also opens no PR and deletes the
+    // branch below, so getPublishStatus can find nothing by head ref either — which
+    // left deriveShipAssurance with neither of its two proofs and made the POST /ship
+    // three lines later refuse with ship_land_not_proven, EVERY time, with the work
+    // already merged. The task then parked at 'confirmed', gating its builder's whole
+    // queue, until someone ran the recovery by hand (five consecutive ships,
+    // 2026-09-19; twelve refusals in one day's audit log).
+    //
+    // The merge commit is the sha to record: the push above just put it on main, so
+    // the ancestry check cannot fail, and it is what the hand-recovery always used.
+    // It goes HERE, immediately after the push and BEFORE both the deploy step (which
+    // can bail) and the branch deletion (which destroys the only other evidence) —
+    // the proof must exist from the first moment the work is on main.
+    const mergeSha = gitOk('git rev-parse HEAD', { cwd: REPO_ROOT });
+    const proof = await attestGateTrust(taskId, mergeSha);
+    if (proof.recorded) {
+      console.log(`  auto-merge: land proof recorded (merge ${String(mergeSha).slice(0, 8)} on main).`);
+    } else {
+      for (const line of landProofWarningLines(taskId, mergeSha, proof.reason)) console.log(line);
+    }
+
     // Deploy step. The core carries NO deploy target of its own — under the
     // standalone model a core change reaches a live instance via package-core +
     // `bongos upgrade` (pin-bump), NOT an SSH deploy (ADR 0108). So unless an

package/scripts/gds/ship.js

@@ -127,6 +127,8 @@ const {
   landPending,
   landPendingLines,
   landPollAfterAutoMerge,
+  landProofRecorded,
+  landProofWarningLines,
   landed,
   pickStaleGateReviewRun,
   reconcileBlockedLines,
@@ -266,6 +268,12 @@ module.exports = {
   // object, so a consumer MUST test `.ok`; the old `if (!merged)` would sail past
   // a bail. Also pins pending (a poll timeout) as distinct from bailed.
   landed, landPending, landBailed, strandCommand,
+  // task 1004055: the land proof the LOCAL-merge path never recorded. landProofRecorded
+  // is the "did the tip actually land?" truth table (explicit tip_recorded wins; a
+  // pinned older core falls back to the route's before-the-credential-check contract);
+  // landProofWarningLines is the recovery the builder gets when it did not, in the
+  // tense of whichever path is speaking. Both pure — exported so they pin without a server.
+  landProofRecorded, landProofWarningLines,
   // task 1001916: the publish-branch failure formatter — exported pure so both
   // wire shapes (envelope + legacy flat), the step/reason surfacing, and the
   // non-fast-forward remedy hint are pinned without a server.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.883'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.884'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_branch_route.mjs

@@ -471,11 +471,11 @@ await t('POST /tasks/:id/attest-gate records the pushed tip on the claim, even w
       const router = buildTasksRouter();
       const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
       const handler = layer.route.stack[layer.route.stack.length - 1].handle;
-      const out = { failCode: null, jsonBody: null };
+      const out = { failCode: null, failOpts: null, jsonBody: null };
       const res = {
         status() { return this; },
         json(b) { out.jsonBody = b; return this; },
-        fail(code) { out.failCode = code; return this; },
+        fail(code, opts) { out.failCode = code; out.failOpts = opts; return this; },
       };
       // rank archon → gateTaskOwnership passes with no DB lookup, keeping the test hermetic.
       const req = { params: { id: '77' }, body: { head_sha: 'a'.repeat(40) }, builder: { id: 95, rank: 'archon' } };
@@ -483,9 +483,77 @@ await t('POST /tasks/:id/attest-gate records the pushed tip on the claim, even w
       assert.equal(out.failCode, 'push_unconfigured', 'no credential → still the usual 503 to the caller');
       assert.deepEqual(recorded, [{ taskId: 77, builderId: 95, sha: 'a'.repeat(40) }],
         'the tip is recorded BEFORE the credential check — the wave-strand cure');
+      // task 1004055: and the 503 must SAY the tip landed. This exit is the one a
+      // caller is most likely to misread as total failure; ship.js decides whether
+      // to warn the builder off this flag, so it has to travel on the error too.
+      assert.equal(out.failOpts && out.failOpts.details && out.failOpts.details.tip_recorded, true,
+        'the 503 must carry tip_recorded:true — the write happened before it');
+    });
+  } finally {
+    dbMod.setClaimPublishedSha = savedSet;
+  }
+});
+
+// task 1004055: the SILENT MISS. setClaimPublishedSha returns null when the UPDATE
+// matched no claim row, and the old route discarded that return value — so a caller
+// that had already merged to main was told nothing was wrong, and only found out one
+// call later as an opaque ship_land_not_proven 409, with the task parked at
+// 'confirmed' gating its builder's whole queue. `tip_recorded` is what makes that
+// answerable at the moment it happens.
+await t('POST /tasks/:id/attest-gate reports tip_recorded:false when no claim row matched', async () => {
+  const dbMod = require('../modules/lifecycle/db.js');
+  const savedSet = dbMod.setClaimPublishedSha;
+  const savedHolder = dbMod.getLastClaimHolder;
+  // null = "the UPDATE matched nothing", the shape db-ship.js really returns.
+  dbMod.setClaimPublishedSha = async () => null;
+  dbMod.getLastClaimHolder = async () => ({ builder_id: 95 });
+  try {
+    // A credential IS configured, so the handler reaches res.json; a below-Metic rank
+    // means postGateAuthorTrust declines on the pure rank check and never fetches.
+    await withEnv({ GITHUB_APP_ID: undefined, GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined, GITHUB_PUSH_TOKEN: 'ghp_fake_for_isConfigured' }, async () => {
+      const router = buildTasksRouter();
+      const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
+      const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+      const out = { failCode: null, jsonBody: null };
+      const res = {
+        status() { return this; },
+        json(b) { out.jsonBody = b; return this; },
+        fail(code) { out.failCode = code; return this; },
+      };
+      const req = { params: { id: '77' }, body: { head_sha: 'b'.repeat(40) }, builder: { id: 95, rank: 'thetes' } };
+      await handler(req, res);
+      assert.equal(out.failCode, null, 'a below-Metic attest is a 200, not a failure');
+      assert.equal(out.jsonBody.ok, true);
+      assert.equal(out.jsonBody.attested, false, 'below Metic → no attestation, as before');
+      assert.equal(out.jsonBody.tip_recorded, false,
+        'nothing was recorded, and the response must say so rather than reading as success');
+    });
+  } finally {
+    dbMod.setClaimPublishedSha = savedSet;
+    dbMod.getLastClaimHolder = savedHolder;
+  }
+});
+
+await t('POST /tasks/:id/attest-gate reports tip_recorded:true on the happy path', async () => {
+  const dbMod = require('../modules/lifecycle/db.js');
+  const savedSet = dbMod.setClaimPublishedSha;
+  const savedHolder = dbMod.getLastClaimHolder;
+  dbMod.setClaimPublishedSha = async () => 4242; // a claim id = the UPDATE matched
+  dbMod.getLastClaimHolder = async () => ({ builder_id: 95 });
+  try {
+    await withEnv({ GITHUB_APP_ID: undefined, GITHUB_APP_INSTALLATION_ID: undefined, GITHUB_APP_PRIVATE_KEY: undefined, GITHUB_PUSH_TOKEN: 'ghp_fake_for_isConfigured' }, async () => {
+      const router = buildTasksRouter();
+      const layer = findRouteLayer(router, '/tasks/:id/attest-gate', 'post');
+      const handler = layer.route.stack[layer.route.stack.length - 1].handle;
+      const out = { jsonBody: null };
+      const res = { status() { return this; }, json(b) { out.jsonBody = b; return this; }, fail() { return this; } };
+      const req = { params: { id: '77' }, body: { head_sha: 'c'.repeat(40) }, builder: { id: 95, rank: 'thetes' } };
+      await handler(req, res);
+      assert.equal(out.jsonBody.tip_recorded, true);
     });
   } finally {
     dbMod.setClaimPublishedSha = savedSet;
+    dbMod.getLastClaimHolder = savedHolder;
   }
 });
 

package/tests/ship_land_proof.mjs

@@ -0,0 +1,218 @@
+// tests/ship_land_proof.mjs
+//
+// task 1004055 — the ship that merges to main and then refuses to record it.
+//
+// ship.js has three land paths. Two of them tell the server which commit is this
+// task's: ciLandLocal posts attest-gate after its push, ciLandServer gets it from
+// publish-branch. The LOCAL-merge path (mergeLocally, 'laptop' deploy mode) merged
+// into main and pushed it ITSELF, and told the server nothing — so
+// claims.published_head_sha stayed NULL. It also opens no PR and deletes the branch
+// on origin, so getPublishStatus finds nothing by head ref either. That left
+// deriveShipAssurance with neither of its two proofs, and the POST /ship three lines
+// later refused with ship_land_not_proven EVERY time, with the work already merged.
+// The task parked at 'confirmed', gating its builder's whole queue, until someone ran
+// attest-gate + ship by hand. Five consecutive ships on 2026-09-19; twelve refusals
+// in that day's audit log.
+//
+// What is pinned here:
+//   1. attestGateTrust REPORTS whether the tip landed, and never throws
+//   2. landProofRecorded's truth table — including the pinned-older-core fallback
+//   3. the warning is in the right TENSE for the path that emits it
+//   4. the local-merge path records a tip, before it deletes the branch
+//
+// DB-free and network-free: the only collaborator attestGateTrust has is cli-lib's
+// cliClient, stubbed through the require cache below. Nothing here spawns git, gh,
+// or a server.
+//
+// Run:  node tests/ship_land_proof.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+
+// The stub MUST be in place before ship-land.js is first required — it destructures
+// cliClient at module load.
+let nextAttest = null;
+const cliLibPath = require.resolve('../scripts/gds/cli-lib');
+require.cache[cliLibPath] = {
+  id: cliLibPath,
+  filename: cliLibPath,
+  loaded: true,
+  exports: {
+    cliClient: async () => ({
+      tasks: {
+        postTasksIdAttestGate: async ({ id, body }) => {
+          if (typeof nextAttest === 'function') return nextAttest({ id, body });
+          return nextAttest;
+        },
+      },
+    }),
+    isBoxScope: () => false,
+  },
+};
+
+const { attestGateTrust, landProofRecorded, landProofWarningLines } = require('../scripts/gds/ship-land.js');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// attestGateTrust narrates to stdout; swallow that so the test output stays readable.
+async function quietly(fn) {
+  const real = console.log;
+  const said = [];
+  console.log = (...a) => said.push(a.join(' '));
+  try { return { value: await fn(), said: said.join('\n') }; }
+  finally { console.log = real; }
+}
+
+const MERGE_SHA = '5c4db10e2a1f4c6b8d3e9f70a1b2c3d4e5f60718';
+
+// --- 1. attestGateTrust reports, and never throws -----------------------------
+
+await t('a 200 carrying tip_recorded:true → recorded, and the sha is what we sent', async () => {
+  let seen = null;
+  nextAttest = ({ id, body }) => {
+    seen = { id, body };
+    return { ok: true, status: 200, data: { ok: true, attested: true, reason: null, tip_recorded: true } };
+  };
+  const { value } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.recorded, true);
+  assert.equal(value.attested, true);
+  assert.deepEqual(seen, { id: 1004055, body: { head_sha: MERGE_SHA } });
+});
+
+// The case the field exists for: the attestation succeeded, so the old code called
+// the whole thing a success — but no claim row matched, so nothing was recorded and
+// the ship was already doomed.
+await t('a 200 whose claim lookup matched nothing → NOT recorded, even though attested', async () => {
+  nextAttest = { ok: true, status: 200, data: { ok: true, attested: true, reason: null, tip_recorded: false } };
+  const { value } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.attested, true, 'the gate attestation did succeed');
+  assert.equal(value.recorded, false, 'but the land proof did not land');
+});
+
+await t('a 503 push_unconfigured still recorded the tip (the write precedes the credential check)', async () => {
+  nextAttest = { ok: false, status: 503, data: { error: { code: 'push_unconfigured', details: { tip_recorded: true } } } };
+  const { value } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.recorded, true);
+  assert.equal(value.attested, false);
+});
+
+await t('a 403 never reached the write → NOT recorded', async () => {
+  nextAttest = { ok: false, status: 403, data: { error: { code: 'not_your_task' } } };
+  const { value } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.recorded, false);
+});
+
+// The quietest of the old failure shapes: a bare `catch (_) {}` left no trace at all.
+await t('a thrown request is reported, not swallowed, and never propagates', async () => {
+  nextAttest = () => { throw new Error('fetch failed'); };
+  const { value, said } = await quietly(() => attestGateTrust(1004055, MERGE_SHA));
+  assert.equal(value.recorded, false);
+  assert.match(value.reason, /fetch failed/);
+  assert.match(said, /fetch failed/, 'the failure must reach the log too, not only the return value');
+});
+
+await t('no head SHA → not recorded, and no request is attempted', async () => {
+  nextAttest = () => { throw new Error('should not have been called'); };
+  const { value } = await quietly(() => attestGateTrust(1004055, null));
+  assert.equal(value.recorded, false);
+});
+
+// --- 2. landProofRecorded: the truth table ------------------------------------
+
+await t('explicit tip_recorded wins over any status reading', () => {
+  assert.equal(landProofRecorded({ ok: true, status: 200, data: { tip_recorded: true } }), true);
+  assert.equal(landProofRecorded({ ok: true, status: 200, data: { tip_recorded: false } }), false);
+  assert.equal(landProofRecorded({ ok: false, status: 503, data: { error: { details: { tip_recorded: false } } } }), false);
+});
+
+// A live instance runs a PINNED core, so it lags main by however long the pin sits
+// still — cloudbongos.com was serving 1.19.871 against a main declaring 1.19.881 on
+// the day this was diagnosed. Those servers send no tip_recorded at all, and reading
+// its absence as "not recorded" would make every healthy land cry wolf.
+await t('older core, no tip_recorded: 200 and 503 both mean the tip landed', () => {
+  assert.equal(landProofRecorded({ ok: true, status: 200, data: { ok: true, attested: false, reason: 'rank_below_metic' } }), true);
+  assert.equal(landProofRecorded({ ok: false, status: 503, data: { error: { code: 'push_unconfigured' } } }), true);
+});
+
+await t('older core: every other status → NOT recorded', () => {
+  for (const status of [400, 403, 404, 409, 500, 502]) {
+    assert.equal(
+      landProofRecorded({ ok: false, status, data: { error: { code: 'not_your_task' } } }),
+      false,
+      `HTTP ${status} must not count as a recorded tip`
+    );
+  }
+});
+
+await t('no response at all → NOT recorded', () => {
+  assert.equal(landProofRecorded(null), false);
+  assert.equal(landProofRecorded(undefined), false);
+  assert.equal(landProofRecorded({}), false);
+});
+
+// --- 3. the warning is in the right tense -------------------------------------
+
+await t('merged path: names the merge sha and gives the full two-call recovery', () => {
+  const lines = landProofWarningLines(1004055, MERGE_SHA).join('\n');
+  assert.match(lines, /NOT recorded/);
+  assert.match(lines, /merge IS on main/);
+  assert.ok(lines.includes(`"head_sha":"${MERGE_SHA}"`), 'must name the exact sha to re-record');
+  assert.match(lines, /POST \/tasks\/1004055\/attest-gate/);
+  assert.match(lines, /POST \/tasks\/1004055\/ship/);
+});
+
+// The PR path has only PUSHED — the land may still be minutes out, and telling a
+// builder their merge is on main when it is not is the same class of lie this whole
+// task is about.
+await t('un-merged path: does not claim the work is on main, and does not ship blind', () => {
+  const lines = landProofWarningLines(1004055, MERGE_SHA, 'HTTP 403', { merged: false }).join('\n');
+  assert.doesNotMatch(lines, /merge IS on main/);
+  assert.match(lines, /the PR still lands normally/);
+  assert.ok(!lines.includes('/ship --body'), 'must not hand over a ship call before anything merged');
+  assert.match(lines, /ship\.js 1004055/);
+});
+
+await t('the reason is surfaced, and a missing sha degrades to a placeholder', () => {
+  assert.match(landProofWarningLines(7, MERGE_SHA, 'HTTP 403').join('\n'), /HTTP 403/);
+  assert.match(landProofWarningLines(7, null).join('\n'), /<the merge commit on main>/);
+});
+
+// --- 4. the local-merge path records a tip at all -----------------------------
+//
+// mergeLocally has no dependency seam — it merges a real second checkout, runs smoke
+// and pushes main — so this is asserted against the source. Weaker than driving it,
+// but it is exactly the assertion that failed before the fix: the file contained no
+// reference to ANY of the three ways to record a tip, and the order of the two calls
+// is the other half of the bug (deleting the branch first destroys the only evidence
+// a later sweep could have used).
+
+const mergeSrc = fs.readFileSync(fileURLToPath(new URL('../scripts/gds/ship-merge.js', import.meta.url)), 'utf8');
+
+await t('ship-merge.js records the merge commit as this task\'s land proof', () => {
+  assert.match(mergeSrc, /attestGateTrust\(taskId, mergeSha\)/,
+    'the local-merge path must record a land proof — before the fix it recorded none');
+});
+
+await t('the proof is recorded BEFORE the origin branch is deleted', () => {
+  const attestAt = mergeSrc.indexOf('attestGateTrust(taskId, mergeSha)');
+  const deleteAt = mergeSrc.indexOf("'--delete'");
+  assert.ok(attestAt > 0, 'the attest call must be present');
+  assert.ok(deleteAt > 0, 'the branch delete must be present');
+  assert.ok(attestAt < deleteAt, 'the land proof must be recorded before the branch is deleted');
+});
+
+await t('a miss reaches the builder at the merge, not as an opaque 409 later', () => {
+  assert.match(mergeSrc, /landProofWarningLines\(taskId, mergeSha, proof\.reason\)/);
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);