@bongos/core 1.20.31 → 1.20.33

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.31",
-  "core_contract": "1.20.31",
-  "source_commit": "7d9880eac50e580874638a8cca10da6606c18228",
+  "core_version": "1.20.33",
+  "core_contract": "1.20.33",
+  "source_commit": "9b3842cb58220f06a93271aaf4d5c78088cf4374",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T21:24:24.438Z",
+  "built_at": "2026-09-30T22:01:27.383Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 562,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2666,
+    "functional_verbatim": 2671,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3254,
-  "tree_sha256": "88a5431f2eb9f9248c57014423f4881035e2d1b9a6cee88740a6800ab933ba38",
+  "file_count": 3259,
+  "tree_sha256": "aed626c2d3ddceedaf350fb3e2b40ada409404d6f830499bb790de6dec0f03d6",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "fd78a2ab7d52f77fbd7181a64af68b8cf4c45c25693bf7dbf31e1b9bba69ada7"
+      "sha256": "62c1b89b8efed5d249b25f70db5bfb238cb9240c748122406d74fdc718e8b903"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3057,7 +3057,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "169e4aedf245478230027ad6a202aa7dd2ce35f019d489d2ea4c0735647d0fe6"
+      "sha256": "81df5ffa3f55b075b284c51790fd1fea78ae7cab6af46460fcbf648987f7eb11"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -4077,7 +4077,7 @@
     {
       "path": "modules/autonomy/cadence.js",
       "mode": "0000644",
-      "sha256": "8c482afe460f9a9a8315b549c8e48c35e42dc05ce76e708baa24133046917af0"
+      "sha256": "24e717247143b6fae013c344d36f8b74dc3e4a228396dcfff39c383c2a762e6c"
     },
     {
       "path": "modules/autonomy/db.js",
@@ -4087,7 +4087,7 @@
     {
       "path": "modules/autonomy/digest.js",
       "mode": "0000644",
-      "sha256": "cfe22a887e5a69cf314a318f7b410c81f91cfba65f7643605e9f3ac1ebef8022"
+      "sha256": "f40114fde91ae3453ed58cd4c37d0ce4b292ae1a84b3faa6af62c8f2e500a33c"
     },
     {
       "path": "modules/autonomy/fence.js",
@@ -7469,6 +7469,11 @@
       "mode": "0000644",
       "sha256": "a93d8946cbe4631b2af64b2e3638dca188981032a08f5d29d63e4d0adb22d235"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_032_intent_remedied_reason.sql",
+      "mode": "0000644",
+      "sha256": "73794821e3beca0129a435747e89dd5755b26f054dca0d8ca0b421392abf7127"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -8987,12 +8992,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "892ad66ccaa864ee07860cd8578f134a72f8cc48625f728f186eaa0f994ac8ad"
+      "sha256": "faabe741a65a2f632b26900d4d5aeac7e489263d0140c9d8633a1edf9761b8a9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "fdebee1582c5673a44b97471f05814ab6bc8e850958ca3131e4a356f3a663d90"
+      "sha256": "de12fffa22b571c06d6757c17cc153ef9a3867bc44893d572141bf989b80c185"
     },
     {
       "path": "public-docs/index.html",
@@ -9012,7 +9017,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "4398d89d420cf704f3030db8752e1f9e67321e43e49b0765e23329c26160385e"
+      "sha256": "695627258a4d47ae703472c86e7fb573ed751e6e2d351e47441c9ff29be824e5"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9172,7 +9177,7 @@
     {
       "path": "scripts/gds/autobongos-run.js",
       "mode": "0000644",
-      "sha256": "c8e6967fe75be8573e65c1fd73caec6912aeb75648dfdb3c82a04cd7bc7f6a6d"
+      "sha256": "667d8acc1ca0b709a61aebabd0ab79171873d66c32b42dcff2e86829adc2cae0"
     },
     {
       "path": "scripts/gds/autobongos-service.cmd",
@@ -9307,7 +9312,7 @@
     {
       "path": "scripts/gds/claim.js",
       "mode": "0000644",
-      "sha256": "78a7e407218051892c1aa0934474084deec94768fdd28fe2c3fa447fe48905fd"
+      "sha256": "77c5d63df2ba881c11e184f11e7972527bac310d856a82d0d7cd234de514665c"
     },
     {
       "path": "scripts/gds/classify-discipline.js",
@@ -9859,6 +9864,11 @@
       "mode": "0000644",
       "sha256": "2bb8d87422e2b24db1ea9fa0c51556b09a7bea99da5af7ad3798c3b386809f4b"
     },
+    {
+      "path": "scripts/gds/move-escalation.js",
+      "mode": "0000644",
+      "sha256": "de4251cf593b77a9dee3590de55319127b0e84d3bb9560ce7f07ee3f4628a23e"
+    },
     {
       "path": "scripts/gds/newcomer-floor.config.json",
       "mode": "0000644",
@@ -9977,7 +9987,7 @@
     {
       "path": "scripts/gds/provision-core-upgrade.js",
       "mode": "0000644",
-      "sha256": "58599968201f98723a531c19f77985c0b26b9afa6d6448ae4803074497a6f2ad"
+      "sha256": "53904eb7a91f7f0c7c80c3caaceed29d6317652d6830e1f575198b0ba9f5158f"
     },
     {
       "path": "scripts/gds/provision-disconnect.js",
@@ -10032,7 +10042,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "4da6314b41905bcffbc51abe127911512743ad14f8130b4c6a25c23600a3eb7f"
+      "sha256": "a014e09f61a19cf16380ae35d5ab93661b65e3fd037d7fddc0fe5ab046a6e699"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -10647,7 +10657,7 @@
     {
       "path": "scripts/gds/upgrade-outcome.js",
       "mode": "0000644",
-      "sha256": "a4f05b5e1042cf3d8c7096ef413b47fd039a02b78f2e4dbefb5bd002973784cb"
+      "sha256": "3bd19ba68a09a6739379bdd626bcf5b93addccdf1cd8774e20857dc9a66686fb"
     },
     {
       "path": "scripts/gds/upgrade.js",
@@ -10679,6 +10689,11 @@
       "mode": "0000644",
       "sha256": "cf034e9c4c5887dde47951272dba1e31b9b94a212640181de1cc3086e225b357"
     },
+    {
+      "path": "scripts/gds/wedge-remedy.js",
+      "mode": "0000644",
+      "sha256": "abe6ecedc808f3f57ef2dc5e9f953792ae26f39625425952a8ce529dbf6de576"
+    },
     {
       "path": "scripts/gds/worktree-claim-guard.js",
       "mode": "0000644",
@@ -11142,7 +11157,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8acd38044812dee3022427fad27e12cc7f9d81a90c1a0d921e860135a30f9e43"
+      "sha256": "0969a3b47823d6b24c9eaaeb777a69c2e6d20688908bb1995dd5893cd5ae6cf2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11587,7 +11602,7 @@
     {
       "path": "tests/autobongos_cadence.mjs",
       "mode": "0000644",
-      "sha256": "98f86c0f7cb84ecfe955f74a066326d82e8af1008c17d0a28c0ad40042f876b8"
+      "sha256": "d6afd12b3d2da5e77f832e8206defb676840b340d6e7a5f064fc2bb96a7c2ffb"
     },
     {
       "path": "tests/autobongos_fence.mjs",
@@ -11602,7 +11617,7 @@
     {
       "path": "tests/autobongos_loop.mjs",
       "mode": "0000644",
-      "sha256": "e14d2c211c28ebada8e915d0d336989e74410afb68924d9b89dc8efd666457c8"
+      "sha256": "2d2017585d61ee15f217bd6eaae26025732ef099dbcfebd26f3729790b8c9078"
     },
     {
       "path": "tests/autobongos_service_ps1.mjs",
@@ -11622,7 +11637,7 @@
     {
       "path": "tests/autonomy_digest.mjs",
       "mode": "0000644",
-      "sha256": "633ede3096916c1d5571def211fabac9ae934f48723d182c54f2fe27c2ead105"
+      "sha256": "928a8a0461adab72037a03d184966e7c1e20838e72421b0ed93c6ce5b8c84520"
     },
     {
       "path": "tests/autonomy_gate.mjs",
@@ -11827,7 +11842,7 @@
     {
       "path": "tests/claim_error_surface.mjs",
       "mode": "0000644",
-      "sha256": "ad5b5b24942ff31930bb1c718e9a4ac7f8934dfe5d016225b6f7a3911ae50d36"
+      "sha256": "7678a98254284a541684292b3615bd02729003dfddbdd9d7b24bd895f63fb908"
     },
     {
       "path": "tests/claim_from_task_and_home.mjs",
@@ -11902,7 +11917,7 @@
     {
       "path": "tests/cli_exit_no_abort.mjs",
       "mode": "0000644",
-      "sha256": "39b63a76b153426f486240e4c57d4fafb2b5b130fb9853c800d20d9f4e5acdde"
+      "sha256": "bce64eee77c2fb5af0fdab2a1c4b7d59cd1465817724ca7065572ba466a16fe5"
     },
     {
       "path": "tests/cli_lib_formatters.mjs",
@@ -14214,6 +14229,11 @@
       "mode": "0000644",
       "sha256": "ee165bd5e817b909be4299014646d3c8b5e34bf00854491ea42cc5afc663fdc3"
     },
+    {
+      "path": "tests/move_escalation.mjs",
+      "mode": "0000644",
+      "sha256": "0406212bd27e4b878b27414625071b646e4e023af1694f8fc2449fdc61be243c"
+    },
     {
       "path": "tests/my_projects_surface.mjs",
       "mode": "0000644",
@@ -14457,7 +14477,7 @@
     {
       "path": "tests/plain_cards.mjs",
       "mode": "0000644",
-      "sha256": "ccf7558194db8894811399aba8ec548cbb4a74b474ff6fd534d496bf98cf516f"
+      "sha256": "731956f3836cd73878668d0d2707f18eaec64ed70495ce1beaf5410d3fb9af8a"
     },
     {
       "path": "tests/planning_session_skill.mjs",
@@ -16229,6 +16249,11 @@
       "mode": "0000644",
       "sha256": "456b20334164a710f59116d6a6c4b85090dc0e65668284d0a736e6ee1df5dea6"
     },
+    {
+      "path": "tests/wedge_remedy.mjs",
+      "mode": "0000644",
+      "sha256": "9810e6b2cf5ec77fad5af12b195a3ff4919143b146ff43f106c67c4090c61c25"
+    },
     {
       "path": "tests/wizard_born_first_board.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2719,5 +2719,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.29 with no explicit bump. run 36777226204. (task 1002620)
   1.20.31 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.30 with no explicit bump. run 36779142919. (task 1002620)
+  1.20.32 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.31 with no explicit bump. run 36781343271. (task 1002620)
+  1.20.33 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.32 with no explicit bump. run 36783021915. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/upgrading-the-core.md

@@ -179,6 +179,8 @@ running a go-live.
 
 ## Gotchas
 
+- **The Deploy door fixes three known snags by itself, once** (task 1004448, `scripts/gds/wedge-remedy.js`). When a core move through `/deploy` fails on a **dirty tree** (it commits the tracked changes inside the project), a **full disk** (it prunes that project's own nightly dumps down to the newest 7) or a **database behind its code** (it migrates that database with its own `PGDATABASE` before the code moves), the runner applies the fix, records a `core-upgrade-remedy` event on the project, and tries the move once more on the next tick. If the retry fails for the same reason, or the fix itself fails, the move is retired as `unknown` (`remedy_did_not_hold` / `remedy_failed`) for a person — never a second fix. The manual fixes below still apply to the unattended nightly sweep, which does not go through the door.
+- **A Deploy-door move nobody can fix files a blocker and posts to Discord — once** (task 1004449, `scripts/gds/move-escalation.js`). A move retired as `unknown` (including `remedy_did_not_hold`, `remedy_failed` and a failed rollback) files one blocker (`source=provisioning`, `source_ref=core-move:<instance id>:<intent id>`) with the reason and what the move reported, and posts one notice to `#ship-news` that names the project only if it is public. The next core move on that project that lands closes the blocker by itself and posts an all-clear. Refusals the owner can act on (`needs_decision`) are shown on the deploy page instead, not filed.
 - **`--registry` needs no credential at all** (task 1003878). `@bongos/core` is **public** on npm (task 1003872), so `bongos upgrade --registry` resolves it from the default registry like any other dependency — no token, no login, and no instance `.npmrc`. An install failure on this path is therefore a *real* failure (network, registry outage, or a version that was never published), never a missing credential.
   *History, so the symptom is recognisable on an old instance:* the core used to publish private, and the instance `.npmrc` read `_authToken=<redacted> npm gives that per-project key precedence, so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** — npm went anonymous, the private core 404'd, and the error blamed a credential the box actually held. Task 1002754 worked around it by resolving the token in-process; task 1003878 deleted the whole mechanism along with the `.npmrc` that caused it. An instance still carrying a committed `.npmrc` from a pre-1003878 scaffold can safely delete it.
 - **A green `publish` run is not evidence of a publish.** The publish-on-merge lane succeeds on its no-op paths too (cascade terminator, armed-gate). Read the run's **job summary**, which now states the verdict explicitly: `PUBLISHED @bongos/core@<v>` vs `NO-OP — nothing was published this run`.

package/modules/autonomy/cadence.js

@@ -178,6 +178,15 @@ function classifyEvent(row = {}) {
 
   if (event === 'verify_halt') return { class: 'transient', detail: 'the ledger could not be read back after a worker' };
 
+  if (event === 'queue_gated') {
+    // A stranded ship refuses EVERY claim (task 1004396). That is somebody's
+    // unlanded work, not this machine breaking, so it is quiet: escalating would
+    // slow the runner for a fault it cannot fix. The wait already wakes early when
+    // main moves, and a strand landing is a merge to main.
+    const on = Array.isArray(row.waiting_on) && row.waiting_on.length ? row.waiting_on.map((id) => `task ${id}`).join(', ') : 'a stranded task';
+    return { class: 'quiet', detail: `waiting for ${on} to land — every claim is refused until then` };
+  }
+
   if (event === 'pick_failed' || event === 'worktree_failed' || event === 'claim_failed') {
     return {
       class: looksSystemic(reason) ? 'systemic' : 'transient',

package/modules/autonomy/digest.js

@@ -173,7 +173,9 @@ function buildDigest(rows = [], { gauge = null, nowEpochS = null, sinceMs = null
     }
   }
 
-  const held = all.filter((r) => r.event === 'hold').map((r) => ({ reason: r.reason || null, sleepUntil: r.sleep_until ?? null }));
+  // A queue gate (task 1004396) is a hold too: the runner chose not to claim, and
+  // the reason names the stranded task it is waiting on.
+  const held = all.filter((r) => r.event === 'hold' || r.event === 'queue_gated').map((r) => ({ reason: r.reason || null, sleepUntil: r.sleep_until ?? null }));
 
   // 3. WHAT EACH WORKER DECIDED that its spec did not determine — grouped by task,
   // because the SHAPE of this list is the signal. One task with six decisions is a
@@ -211,7 +213,8 @@ function buildDigest(rows = [], { gauge = null, nowEpochS = null, sinceMs = null
   // How the runner spent the night, so "nothing shipped" can be told apart from
   // "nothing ran".
   const KNOWN = new Set(['worked', 'fenced', 'hold', 'nothing_claimable', 'dry_run',
-    'pick_failed', 'worktree_failed', 'claim_failed', 'verify_halt', 'cadence', 'boot_reconcile']);
+    'pick_failed', 'worktree_failed', 'claim_failed', 'verify_halt', 'cadence', 'boot_reconcile',
+    'queue_gated', 'queue_gate_cleared']);
   const byEvent = {};
   let unrecognised = 0;
   for (const r of all) {

package/modules/provisioning/migrations/provisioning_032_intent_remedied_reason.sql

@@ -0,0 +1,19 @@
+-- provisioning_032_intent_remedied_reason.sql — which known snag the runner already fixed
+-- for a core move (task 1004448, goal 1000090 deploy self-heal).
+--
+-- WHY. A core move that fails on a known snag (a dirty checkout, a full disk, a database
+-- behind its code) now has the fix applied by the runner and is tried once more
+-- (scripts/gds/wedge-remedy.js). "Once" has to survive between runner ticks, so the reason
+-- the fix was applied for is kept on the intent. A retry that fails on the SAME reason is
+-- retired for a person instead of fixed again — never a loop.
+--
+-- remedied_reason: a reason code from scripts/gds/upgrade-outcome.js (fixed vocabulary,
+-- never builder text). NULL = no fix has been applied for this intent.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_intents ADD COLUMN IF NOT EXISTS remedied_reason text;
+
+COMMIT;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.31",
+  "version": "1.20.33",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.31",
+      "version": "1.20.33",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.31",
+  "version": "1.20.33",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8258,5 +8258,21 @@
       "id": "1004447",
       "text": "A software update that fails for a temporary reason now waits and tries again later — after 15 minutes, then an hour, then six hours — instead of hammering the same failing step three times in a row. Failures that retrying can"
     }
+  ],
+  "1.20.32": [
+    {
+      "id": "1004448",
+      "text": "When an update to a project gets stuck on one of three known problems (leftover file changes, a full disk, or a database that is behind), the system now fixes it by itself and tries again once. If that doesn't work, it stops a"
+    }
+  ],
+  "1.20.33": [
+    {
+      "id": "1004396",
+      "text": "The unattended runner no longer gets stuck retrying a task it isn't allowed to take: it moves on to the next one, and only waits when a stuck ship is blocking everyone, resuming by itself once that lands."
+    },
+    {
+      "id": "1004449",
+      "text": "When a project update fails in a way the system can't fix by itself, it now opens one blocker for a person and posts one message on Discord, instead of failing quietly. When a later update succeeds, the blocker closes by itsel"
+    }
   ]
 }

package/scripts/gds/autobongos-run.js

@@ -189,7 +189,12 @@ async function pickTask(goals, deps = {}) {
 
     const candidates = Array.from(byId.values()).filter((t) => !seq.TERMINAL.has(t.status));
     const { order } = seq.topoOrder(candidates);
-    const { next, skipped } = seq.pickNext(order, { rank, claimableIds });
+    // Tasks this process set aside after a refused claim (task 1004396) drop out
+    // AFTER ordering, so a dependent of one is still halted by its own unmet
+    // dependency rather than promoted by the task's absence.
+    const exclude = deps.exclude || null;
+    const open = exclude && exclude.size ? order.filter((t) => !exclude.has(String(t.id))) : order;
+    const { next, skipped } = seq.pickNext(open, { rank, claimableIds });
     if (next) return { task: next, goalId, skipped };
     for (const sk of skipped) allSkipped.push({ ...sk, goal_id: goalId });
   }
@@ -369,6 +374,75 @@ async function readFence(deps = {}) {
   return { raw, graderBypassed };
 }
 
+// ── what one process remembers between iterations (task 1004396) ────────────
+//
+// Owner ruling, 2026-09-30: a refused claim must not put the runner into waiting
+// by default. It sets THAT task aside and tries the next one. It waits only when
+// there is a block and nothing else it can claim.
+//
+// The two refusals are told apart by claim.js's exit code, because the message is
+// prose and the first cut of this read prose. The run that found this burned
+// ~30 attempts on task 1004254, whose refusal quoted "Your work changes the
+// tools…" — which reads like a per-task protected-path verdict and was in fact
+// the plain-words line of a QUEUE-WIDE gate about a different, stranded task.
+// Setting 1004254 aside would have moved the runner on to the next task, which
+// the same gate refuses too.
+//
+// QUEUE_GATED_EXIT is pinned against claim.js's own value in a test rather than
+// required from it: requiring the CLI would load its whole dependency graph into
+// a process that runs for weeks, to read one integer.
+const QUEUE_GATED_EXIT = 4;
+// How long a task refused ON ITS OWN is left alone. Not forever: most per-task
+// refusals clear (a dependency ships, a claim is released, a blocker resolves),
+// and a process that remembered them for its whole life would shelve work it can
+// do. Half an hour is several wakes at full speed, so a refused head of the queue
+// costs one attempt per half hour instead of one per wake.
+const CLAIM_SET_ASIDE_MS = 30 * 60 * 1000;
+// A bound on claim attempts in ONE pass, so a queue of refusals cannot turn one
+// iteration into dozens of worktree creations.
+const MAX_CLAIM_ATTEMPTS = 5;
+
+function newRunnerState() {
+  return { setAside: new Map(), queueGate: null };
+}
+const RUNNER_STATE = newRunnerState();
+
+// The stranded task ids a queue-gated refusal names ("  - task 777  Title"). An
+// empty list is a legal answer: the gate is still a gate, the runner simply has
+// nothing to poll and tries one claim per wake instead.
+function owedTaskIds(text) {
+  const ids = [];
+  const re = /^\s*-\s*task\s+(\d+)/gm;
+  let m;
+  while ((m = re.exec(String(text || ''))) !== null) ids.push(m[1]);
+  return ids;
+}
+
+// Does the gate still hold? Asked of the LEDGER, one read per stranded task, and
+// never by attempting a claim: a claim attempt per wake is the loop this replaces.
+// An unreadable task keeps the wait — guessing "cleared" would restart the
+// attempts on a read failure, the opposite of backing off.
+async function queueGateHolds(queueGate, deps = {}) {
+  if (!queueGate.owed.length) return false;
+  const api = deps.api && deps.api.tasks ? deps.api : await (require('./cli-lib').cliClient)();
+  for (const id of queueGate.owed) {
+    let r = null;
+    try { r = await api.tasks.getTasksId({ id: Number(id) }); } catch (_) { return true; }
+    if (!r || !r.ok || !r.data || !r.data.task) return true;
+    if (r.data.task.status === 'confirmed') return true;
+  }
+  return false;
+}
+
+function queueGatedRow(queueGate, now) {
+  const on = queueGate.owed.length ? queueGate.owed.map((id) => `task ${id}`).join(', ') : 'a stranded confirmed task';
+  return {
+    event: 'queue_gated', waiting_on: queueGate.owed,
+    waited_s: Math.max(0, Math.round((now - queueGate.since) / 1000)),
+    reason: `every claim is refused until ${on} lands — waiting, not claiming (${queueGate.reason})`,
+  };
+}
+
 async function iteration(opts, deps = {}) {
   const runCmd = deps.run || run;
   const spawnWork = deps.spawnWorker || spawnWorker;
@@ -430,53 +504,89 @@ async function iteration(opts, deps = {}) {
     }
   }
 
-  // 2. Pick — from the ALLOWLISTED goals, never from what the command line asked
-  // for. gate.goals is already the intersection.
-  const picked = await pick(gate.goals, deps.pickDeps || {});
-  if (picked.error) return log({ event: 'pick_failed', reason: picked.error });
-  if (picked.none) {
-    return log({
-      event: 'nothing_claimable', goals: gate.goals,
-      // Carried so the cadence can tell an EMPTY queue from one where every task
-      // halts — the reasons are the matrix's own codes, safe to print.
-      skipped: (picked.skipped || []).map((sk) => ({ id: sk.id, goal_id: sk.goal_id, reasons: (sk.reasons || []).map((r) => r.code) })),
-    });
-  }
-  const task = picked.task;
-
-  // 2b. The per-TASK half of the fence. sequence.js's halt matrix already refuses
-  // a protected-path task, and this re-asks anyway — not from distrust of the
-  // matrix, but because the matrix is a shared component with its own callers and
-  // the fence must not be a property of whoever happens to be picking. A gate that
-  // only holds while a collaborator keeps calling it is not a gate.
-  //
-  // Both halves read the task's DECLARED touches[], which is a claim, not a fact —
-  // see the header of modules/autonomy/fence.js for why that is acceptable as the
-  // OUTER of three layers and would not be as the only one.
-  const taskGate = fence.decideTask({
-    task, goals: gate.goals, protectedHits: matchProtected(task.touches || []),
-  });
-  if (!taskGate.go) {
-    return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: task.id, goal_id: picked.goalId, globs: taskGate.globs || [] });
+  // 1c. A QUEUE-WIDE gate from an earlier pass (task 1004396). While the
+  // stranded task it named is still `confirmed`, every claim would be refused, so
+  // none is attempted. The wait wakes early when main moves (waitOrJump), which is
+  // exactly what the strand landing does.
+  const state = deps.state || RUNNER_STATE;
+  const now = deps.now ? deps.now() : Date.now();
+  if (state.queueGate) {
+    if (await queueGateHolds(state.queueGate, deps)) return log(queueGatedRow(state.queueGate, now));
+    log({ event: 'queue_gate_cleared', waited_on: state.queueGate.owed, waited_s: Math.max(0, Math.round((now - state.queueGate.since) / 1000)) });
+    state.queueGate = null;
   }
+  for (const [id, until] of state.setAside) if (until <= now) state.setAside.delete(id);
+
+  // 2–4, up to MAX_CLAIM_ATTEMPTS times: pick, fence, tree, claim. A task refused
+  // on its own is set aside and the NEXT one is tried in the same pass.
+  let task = null; let picked = null; let wtName = null; let wtPath = null;
+  let lastRefusal = null;
+  for (let attempt = 0; attempt < MAX_CLAIM_ATTEMPTS && !task; attempt++) {
+    const exclude = new Set(state.setAside.keys());
+    // 2. Pick — from the ALLOWLISTED goals, never from what the command line asked
+    // for. gate.goals is already the intersection.
+    const got = await pick(gate.goals, { ...(deps.pickDeps || {}), exclude });
+    if (got.error) return log({ event: 'pick_failed', reason: got.error });
+    // A picker that hands back a set-aside task is treated as having none left:
+    // the exclusion is this function's contract, not the picker's courtesy.
+    if (got.none || exclude.has(String(got.task.id))) {
+      // Everything left was refused in THIS pass: return the last refusal, not
+      // "nothing claimable". Every claim failing at once is also what an outage
+      // looks like, and it must still reach the failure ladder (task 1004179).
+      if (lastRefusal) return lastRefusal;
+      return log({
+        event: 'nothing_claimable', goals: gate.goals,
+        // Carried so the cadence can tell an EMPTY queue from one where every task
+        // halts — the reasons are the matrix's own codes, safe to print.
+        skipped: (got.skipped || []).map((sk) => ({ id: sk.id, goal_id: sk.goal_id, reasons: (sk.reasons || []).map((r) => r.code) })),
+        set_aside: Array.from(state.setAside, ([id, until]) => ({ id, until: new Date(until).toISOString() })),
+      });
+    }
+    const candidate = got.task;
+
+    // 2b. The per-TASK half of the fence. sequence.js's halt matrix already refuses
+    // a protected-path task, and this re-asks anyway — not from distrust of the
+    // matrix, but because the matrix is a shared component with its own callers and
+    // the fence must not be a property of whoever happens to be picking. A gate that
+    // only holds while a collaborator keeps calling it is not a gate.
+    //
+    // Both halves read the task's DECLARED touches[], which is a claim, not a fact —
+    // see the header of modules/autonomy/fence.js for why that is acceptable as the
+    // OUTER of three layers and would not be as the only one.
+    const taskGate = fence.decideTask({
+      task: candidate, goals: gate.goals, protectedHits: matchProtected(candidate.touches || []),
+    });
+    if (!taskGate.go) {
+      return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: candidate.id, goal_id: got.goalId, globs: taskGate.globs || [] });
+    }
 
-  if (opts.dryRun) return log({ event: 'dry_run', task_id: task.id, title: task.title, goal_id: picked.goalId });
+    if (opts.dryRun) return log({ event: 'dry_run', task_id: candidate.id, title: candidate.title, goal_id: got.goalId });
 
-  // 3. The task's own working tree.
-  const wtName = deps.worktreeName ? deps.worktreeName(task.id) : worktreeName(task.id);
-  const made = await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'add', wtName, '--base', 'origin/main']);
-  if (!made.ok) {
-    return log({ event: 'worktree_failed', task_id: task.id, worktree: wtName, reason: failureReason(made, 'worktree.js') });
-  }
-  const wtPath = path.join(REPO_ROOT, '.claude', 'worktrees', wtName);
-
-  // 4. Claim FROM that tree, so claim.js records it as the claim's tree and the
-  // ship lock later agrees with where the work actually is.
-  const claimed = await runCmd(process.execPath, [path.join(REPO_ROOT, 'scripts', 'gds', 'claim.js'), String(task.id)], { cwd: wtPath });
-  if (!claimed.ok) {
-    await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'remove', wtName]);
-    return log({ event: 'claim_failed', task_id: task.id, worktree: wtName, reason: failureReason(claimed, 'claim.js') });
+    // 3. The task's own working tree.
+    const name = deps.worktreeName ? deps.worktreeName(candidate.id) : worktreeName(candidate.id);
+    const made = await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'add', name, '--base', 'origin/main']);
+    if (!made.ok) {
+      return log({ event: 'worktree_failed', task_id: candidate.id, worktree: name, reason: failureReason(made, 'worktree.js') });
+    }
+    const treePath = path.join(REPO_ROOT, '.claude', 'worktrees', name);
+
+    // 4. Claim FROM that tree, so claim.js records it as the claim's tree and the
+    // ship lock later agrees with where the work actually is.
+    const claimed = await runCmd(process.execPath, [path.join(REPO_ROOT, 'scripts', 'gds', 'claim.js'), String(candidate.id)], { cwd: treePath });
+    if (!claimed.ok) {
+      await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'remove', name]);
+      const reason = failureReason(claimed, 'claim.js');
+      if (claimed.code === QUEUE_GATED_EXIT) {
+        state.queueGate = { owed: owedTaskIds(`${claimed.stderr || ''}\n${claimed.stdout || ''}`), since: now, reason };
+        return log({ ...queueGatedRow(state.queueGate, now), task_id: candidate.id, worktree: name });
+      }
+      state.setAside.set(String(candidate.id), now + CLAIM_SET_ASIDE_MS);
+      lastRefusal = log({ event: 'claim_failed', task_id: candidate.id, worktree: name, reason, set_aside_s: CLAIM_SET_ASIDE_MS / 1000 });
+      continue;
+    }
+    task = candidate; picked = got; wtName = name; wtPath = treePath;
   }
+  if (!task) return lastRefusal;
 
   // 5. Work, in that tree.
   const started = Date.now();
@@ -975,4 +1085,5 @@ module.exports = {
   worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, countWorkedSince, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
   isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT, failureReason,
+  newRunnerState, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
 };

package/scripts/gds/claim.js

@@ -282,6 +282,14 @@ function claimErrorInfo(r) {
 // control characters that repaint a terminal, and a runaway one can bury the
 // guidance it was meant to add. Clip to one line, strip C0/C1 controls, cap length.
 const MAX_LISTED_TASKS = 20;
+
+// QUEUE_GATED_EXIT — the one refusal that is about the QUEUE, not the task
+// (task 1004396). REBASE_REQUIRED refuses every claim until a stranded confirmed
+// task lands, so an unattended caller that reads it as "this task is refused"
+// sets aside task after task for a fault none of them has. Every other refusal
+// keeps exit 1. The autobongos runner is the consumer and pins the same value
+// in a test.
+const QUEUE_GATED_EXIT = 4;
 function clip(s, max = 160) {
   if (s == null) return '';
   // eslint-disable-next-line no-control-regex
@@ -370,7 +378,7 @@ function claimFailureGuidance({ code, message, d }, r, taskId, ctx) {
       if (t.reason) lines.push(`      flagged: ${clip(t.reason)}`);
     }
     lines.push(`  ${clip(d.hint, 600) || 'Clear it with /strand-fix N, or rebase the branch and re-ship — or /builder-release it to give up on one.'}`);
-    return { lines, exit: 1 };
+    return { lines, exit: QUEUE_GATED_EXIT };
   }
   if (code === 'ALREADY_CLAIMED') {
     lines.push(`Task #${taskId} was just claimed by another session. Try a different task.`);
@@ -771,4 +779,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote };
+module.exports = { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote, QUEUE_GATED_EXIT };