@bongos/core 1.20.32 → 1.20.33

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.32",
-  "core_contract": "1.20.32",
-  "source_commit": "22743b01c499a1cc3bd285e9b25d6efe937aa8a7",
+  "core_version": "1.20.33",
+  "core_contract": "1.20.33",
+  "source_commit": "9b3842cb58220f06a93271aaf4d5c78088cf4374",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T21:45:12.402Z",
+  "built_at": "2026-09-30T22:01:27.383Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 562,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2669,
+    "functional_verbatim": 2671,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3257,
-  "tree_sha256": "7de0ec4831b06324127256eef3791a481ef07b33654cd0ca8b2cc058ec0e14ef",
+  "file_count": 3259,
+  "tree_sha256": "aed626c2d3ddceedaf350fb3e2b40ada409404d6f830499bb790de6dec0f03d6",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "bd97221b57256af19ec7b09b897cce082e54fca07e69500ccf485feba106317f"
+      "sha256": "62c1b89b8efed5d249b25f70db5bfb238cb9240c748122406d74fdc718e8b903"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3057,7 +3057,7 @@
     {
       "path": "docs/recipes/upgrading-the-core.md",
       "mode": "0000644",
-      "sha256": "6d44cfdcd7fa92d3b6c6514af69356d6e986d5443219251cd091685918e4e1f2"
+      "sha256": "81df5ffa3f55b075b284c51790fd1fea78ae7cab6af46460fcbf648987f7eb11"
     },
     {
       "path": "docs/recipes/windows-builders.md",
@@ -4077,7 +4077,7 @@
     {
       "path": "modules/autonomy/cadence.js",
       "mode": "0000644",
-      "sha256": "8c482afe460f9a9a8315b549c8e48c35e42dc05ce76e708baa24133046917af0"
+      "sha256": "24e717247143b6fae013c344d36f8b74dc3e4a228396dcfff39c383c2a762e6c"
     },
     {
       "path": "modules/autonomy/db.js",
@@ -4087,7 +4087,7 @@
     {
       "path": "modules/autonomy/digest.js",
       "mode": "0000644",
-      "sha256": "cfe22a887e5a69cf314a318f7b410c81f91cfba65f7643605e9f3ac1ebef8022"
+      "sha256": "f40114fde91ae3453ed58cd4c37d0ce4b292ae1a84b3faa6af62c8f2e500a33c"
     },
     {
       "path": "modules/autonomy/fence.js",
@@ -8992,12 +8992,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "cd508994cbd9d44ef721787e0eb7c803bfeda98459587d53ba726a36cff2581e"
+      "sha256": "faabe741a65a2f632b26900d4d5aeac7e489263d0140c9d8633a1edf9761b8a9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "5c53762b7665282aeca491b037cb2c02ee8c6def6c00018262596235d02bbb64"
+      "sha256": "de12fffa22b571c06d6757c17cc153ef9a3867bc44893d572141bf989b80c185"
     },
     {
       "path": "public-docs/index.html",
@@ -9017,7 +9017,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "1f7d261d95f2fbaf1d0e438e9c3ad7f13773c5b56d349263815d5be03ebab401"
+      "sha256": "695627258a4d47ae703472c86e7fb573ed751e6e2d351e47441c9ff29be824e5"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9177,7 +9177,7 @@
     {
       "path": "scripts/gds/autobongos-run.js",
       "mode": "0000644",
-      "sha256": "c8e6967fe75be8573e65c1fd73caec6912aeb75648dfdb3c82a04cd7bc7f6a6d"
+      "sha256": "667d8acc1ca0b709a61aebabd0ab79171873d66c32b42dcff2e86829adc2cae0"
     },
     {
       "path": "scripts/gds/autobongos-service.cmd",
@@ -9312,7 +9312,7 @@
     {
       "path": "scripts/gds/claim.js",
       "mode": "0000644",
-      "sha256": "78a7e407218051892c1aa0934474084deec94768fdd28fe2c3fa447fe48905fd"
+      "sha256": "77c5d63df2ba881c11e184f11e7972527bac310d856a82d0d7cd234de514665c"
     },
     {
       "path": "scripts/gds/classify-discipline.js",
@@ -9864,6 +9864,11 @@
       "mode": "0000644",
       "sha256": "2bb8d87422e2b24db1ea9fa0c51556b09a7bea99da5af7ad3798c3b386809f4b"
     },
+    {
+      "path": "scripts/gds/move-escalation.js",
+      "mode": "0000644",
+      "sha256": "de4251cf593b77a9dee3590de55319127b0e84d3bb9560ce7f07ee3f4628a23e"
+    },
     {
       "path": "scripts/gds/newcomer-floor.config.json",
       "mode": "0000644",
@@ -10037,7 +10042,7 @@
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "dd972cc62ed8282af5f1239a3b728761fb06a414120cac8a39b38838e8301f7d"
+      "sha256": "a014e09f61a19cf16380ae35d5ab93661b65e3fd037d7fddc0fe5ab046a6e699"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -11152,7 +11157,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a1f03380a933a2c9fdcd63f55f0152bf7d36101135d171c729f7cd79c9ef0ec4"
+      "sha256": "0969a3b47823d6b24c9eaaeb777a69c2e6d20688908bb1995dd5893cd5ae6cf2"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11597,7 +11602,7 @@
     {
       "path": "tests/autobongos_cadence.mjs",
       "mode": "0000644",
-      "sha256": "98f86c0f7cb84ecfe955f74a066326d82e8af1008c17d0a28c0ad40042f876b8"
+      "sha256": "d6afd12b3d2da5e77f832e8206defb676840b340d6e7a5f064fc2bb96a7c2ffb"
     },
     {
       "path": "tests/autobongos_fence.mjs",
@@ -11612,7 +11617,7 @@
     {
       "path": "tests/autobongos_loop.mjs",
       "mode": "0000644",
-      "sha256": "e14d2c211c28ebada8e915d0d336989e74410afb68924d9b89dc8efd666457c8"
+      "sha256": "2d2017585d61ee15f217bd6eaae26025732ef099dbcfebd26f3729790b8c9078"
     },
     {
       "path": "tests/autobongos_service_ps1.mjs",
@@ -11632,7 +11637,7 @@
     {
       "path": "tests/autonomy_digest.mjs",
       "mode": "0000644",
-      "sha256": "633ede3096916c1d5571def211fabac9ae934f48723d182c54f2fe27c2ead105"
+      "sha256": "928a8a0461adab72037a03d184966e7c1e20838e72421b0ed93c6ce5b8c84520"
     },
     {
       "path": "tests/autonomy_gate.mjs",
@@ -11837,7 +11842,7 @@
     {
       "path": "tests/claim_error_surface.mjs",
       "mode": "0000644",
-      "sha256": "ad5b5b24942ff31930bb1c718e9a4ac7f8934dfe5d016225b6f7a3911ae50d36"
+      "sha256": "7678a98254284a541684292b3615bd02729003dfddbdd9d7b24bd895f63fb908"
     },
     {
       "path": "tests/claim_from_task_and_home.mjs",
@@ -11912,7 +11917,7 @@
     {
       "path": "tests/cli_exit_no_abort.mjs",
       "mode": "0000644",
-      "sha256": "39b63a76b153426f486240e4c57d4fafb2b5b130fb9853c800d20d9f4e5acdde"
+      "sha256": "bce64eee77c2fb5af0fdab2a1c4b7d59cd1465817724ca7065572ba466a16fe5"
     },
     {
       "path": "tests/cli_lib_formatters.mjs",
@@ -14224,6 +14229,11 @@
       "mode": "0000644",
       "sha256": "ee165bd5e817b909be4299014646d3c8b5e34bf00854491ea42cc5afc663fdc3"
     },
+    {
+      "path": "tests/move_escalation.mjs",
+      "mode": "0000644",
+      "sha256": "0406212bd27e4b878b27414625071b646e4e023af1694f8fc2449fdc61be243c"
+    },
     {
       "path": "tests/my_projects_surface.mjs",
       "mode": "0000644",
@@ -14467,7 +14477,7 @@
     {
       "path": "tests/plain_cards.mjs",
       "mode": "0000644",
-      "sha256": "ccf7558194db8894811399aba8ec548cbb4a74b474ff6fd534d496bf98cf516f"
+      "sha256": "731956f3836cd73878668d0d2707f18eaec64ed70495ce1beaf5410d3fb9af8a"
     },
     {
       "path": "tests/planning_session_skill.mjs",

package/docs/module-api-changelog.md

@@ -2721,5 +2721,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.30 with no explicit bump. run 36779142919. (task 1002620)
   1.20.32 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.31 with no explicit bump. run 36781343271. (task 1002620)
+  1.20.33 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.32 with no explicit bump. run 36783021915. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/recipes/upgrading-the-core.md

@@ -180,6 +180,7 @@ running a go-live.
 ## Gotchas
 
 - **The Deploy door fixes three known snags by itself, once** (task 1004448, `scripts/gds/wedge-remedy.js`). When a core move through `/deploy` fails on a **dirty tree** (it commits the tracked changes inside the project), a **full disk** (it prunes that project's own nightly dumps down to the newest 7) or a **database behind its code** (it migrates that database with its own `PGDATABASE` before the code moves), the runner applies the fix, records a `core-upgrade-remedy` event on the project, and tries the move once more on the next tick. If the retry fails for the same reason, or the fix itself fails, the move is retired as `unknown` (`remedy_did_not_hold` / `remedy_failed`) for a person — never a second fix. The manual fixes below still apply to the unattended nightly sweep, which does not go through the door.
+- **A Deploy-door move nobody can fix files a blocker and posts to Discord — once** (task 1004449, `scripts/gds/move-escalation.js`). A move retired as `unknown` (including `remedy_did_not_hold`, `remedy_failed` and a failed rollback) files one blocker (`source=provisioning`, `source_ref=core-move:<instance id>:<intent id>`) with the reason and what the move reported, and posts one notice to `#ship-news` that names the project only if it is public. The next core move on that project that lands closes the blocker by itself and posts an all-clear. Refusals the owner can act on (`needs_decision`) are shown on the deploy page instead, not filed.
 - **`--registry` needs no credential at all** (task 1003878). `@bongos/core` is **public** on npm (task 1003872), so `bongos upgrade --registry` resolves it from the default registry like any other dependency — no token, no login, and no instance `.npmrc`. An install failure on this path is therefore a *real* failure (network, registry outage, or a version that was never published), never a missing credential.
   *History, so the symptom is recognisable on an old instance:* the core used to publish private, and the instance `.npmrc` read `_authToken=<redacted> npm gives that per-project key precedence, so with the env var unset it expanded EMPTY and **masked a perfectly valid literal token in `~/.npmrc`** — npm went anonymous, the private core 404'd, and the error blamed a credential the box actually held. Task 1002754 worked around it by resolving the token in-process; task 1003878 deleted the whole mechanism along with the `.npmrc` that caused it. An instance still carrying a committed `.npmrc` from a pre-1003878 scaffold can safely delete it.
 - **A green `publish` run is not evidence of a publish.** The publish-on-merge lane succeeds on its no-op paths too (cascade terminator, armed-gate). Read the run's **job summary**, which now states the verdict explicitly: `PUBLISHED @bongos/core@<v>` vs `NO-OP — nothing was published this run`.

package/modules/autonomy/cadence.js

@@ -178,6 +178,15 @@ function classifyEvent(row = {}) {
 
   if (event === 'verify_halt') return { class: 'transient', detail: 'the ledger could not be read back after a worker' };
 
+  if (event === 'queue_gated') {
+    // A stranded ship refuses EVERY claim (task 1004396). That is somebody's
+    // unlanded work, not this machine breaking, so it is quiet: escalating would
+    // slow the runner for a fault it cannot fix. The wait already wakes early when
+    // main moves, and a strand landing is a merge to main.
+    const on = Array.isArray(row.waiting_on) && row.waiting_on.length ? row.waiting_on.map((id) => `task ${id}`).join(', ') : 'a stranded task';
+    return { class: 'quiet', detail: `waiting for ${on} to land — every claim is refused until then` };
+  }
+
   if (event === 'pick_failed' || event === 'worktree_failed' || event === 'claim_failed') {
     return {
       class: looksSystemic(reason) ? 'systemic' : 'transient',

package/modules/autonomy/digest.js

@@ -173,7 +173,9 @@ function buildDigest(rows = [], { gauge = null, nowEpochS = null, sinceMs = null
     }
   }
 
-  const held = all.filter((r) => r.event === 'hold').map((r) => ({ reason: r.reason || null, sleepUntil: r.sleep_until ?? null }));
+  // A queue gate (task 1004396) is a hold too: the runner chose not to claim, and
+  // the reason names the stranded task it is waiting on.
+  const held = all.filter((r) => r.event === 'hold' || r.event === 'queue_gated').map((r) => ({ reason: r.reason || null, sleepUntil: r.sleep_until ?? null }));
 
   // 3. WHAT EACH WORKER DECIDED that its spec did not determine — grouped by task,
   // because the SHAPE of this list is the signal. One task with six decisions is a
@@ -211,7 +213,8 @@ function buildDigest(rows = [], { gauge = null, nowEpochS = null, sinceMs = null
   // How the runner spent the night, so "nothing shipped" can be told apart from
   // "nothing ran".
   const KNOWN = new Set(['worked', 'fenced', 'hold', 'nothing_claimable', 'dry_run',
-    'pick_failed', 'worktree_failed', 'claim_failed', 'verify_halt', 'cadence', 'boot_reconcile']);
+    'pick_failed', 'worktree_failed', 'claim_failed', 'verify_halt', 'cadence', 'boot_reconcile',
+    'queue_gated', 'queue_gate_cleared']);
   const byEvent = {};
   let unrecognised = 0;
   for (const r of all) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.32",
+  "version": "1.20.33",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.32",
+      "version": "1.20.33",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.32",
+  "version": "1.20.33",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8264,5 +8264,15 @@
       "id": "1004448",
       "text": "When an update to a project gets stuck on one of three known problems (leftover file changes, a full disk, or a database that is behind), the system now fixes it by itself and tries again once. If that doesn't work, it stops a"
     }
+  ],
+  "1.20.33": [
+    {
+      "id": "1004396",
+      "text": "The unattended runner no longer gets stuck retrying a task it isn't allowed to take: it moves on to the next one, and only waits when a stuck ship is blocking everyone, resuming by itself once that lands."
+    },
+    {
+      "id": "1004449",
+      "text": "When a project update fails in a way the system can't fix by itself, it now opens one blocker for a person and posts one message on Discord, instead of failing quietly. When a later update succeeds, the blocker closes by itsel"
+    }
   ]
 }

package/scripts/gds/autobongos-run.js

@@ -189,7 +189,12 @@ async function pickTask(goals, deps = {}) {
 
     const candidates = Array.from(byId.values()).filter((t) => !seq.TERMINAL.has(t.status));
     const { order } = seq.topoOrder(candidates);
-    const { next, skipped } = seq.pickNext(order, { rank, claimableIds });
+    // Tasks this process set aside after a refused claim (task 1004396) drop out
+    // AFTER ordering, so a dependent of one is still halted by its own unmet
+    // dependency rather than promoted by the task's absence.
+    const exclude = deps.exclude || null;
+    const open = exclude && exclude.size ? order.filter((t) => !exclude.has(String(t.id))) : order;
+    const { next, skipped } = seq.pickNext(open, { rank, claimableIds });
     if (next) return { task: next, goalId, skipped };
     for (const sk of skipped) allSkipped.push({ ...sk, goal_id: goalId });
   }
@@ -369,6 +374,75 @@ async function readFence(deps = {}) {
   return { raw, graderBypassed };
 }
 
+// ── what one process remembers between iterations (task 1004396) ────────────
+//
+// Owner ruling, 2026-09-30: a refused claim must not put the runner into waiting
+// by default. It sets THAT task aside and tries the next one. It waits only when
+// there is a block and nothing else it can claim.
+//
+// The two refusals are told apart by claim.js's exit code, because the message is
+// prose and the first cut of this read prose. The run that found this burned
+// ~30 attempts on task 1004254, whose refusal quoted "Your work changes the
+// tools…" — which reads like a per-task protected-path verdict and was in fact
+// the plain-words line of a QUEUE-WIDE gate about a different, stranded task.
+// Setting 1004254 aside would have moved the runner on to the next task, which
+// the same gate refuses too.
+//
+// QUEUE_GATED_EXIT is pinned against claim.js's own value in a test rather than
+// required from it: requiring the CLI would load its whole dependency graph into
+// a process that runs for weeks, to read one integer.
+const QUEUE_GATED_EXIT = 4;
+// How long a task refused ON ITS OWN is left alone. Not forever: most per-task
+// refusals clear (a dependency ships, a claim is released, a blocker resolves),
+// and a process that remembered them for its whole life would shelve work it can
+// do. Half an hour is several wakes at full speed, so a refused head of the queue
+// costs one attempt per half hour instead of one per wake.
+const CLAIM_SET_ASIDE_MS = 30 * 60 * 1000;
+// A bound on claim attempts in ONE pass, so a queue of refusals cannot turn one
+// iteration into dozens of worktree creations.
+const MAX_CLAIM_ATTEMPTS = 5;
+
+function newRunnerState() {
+  return { setAside: new Map(), queueGate: null };
+}
+const RUNNER_STATE = newRunnerState();
+
+// The stranded task ids a queue-gated refusal names ("  - task 777  Title"). An
+// empty list is a legal answer: the gate is still a gate, the runner simply has
+// nothing to poll and tries one claim per wake instead.
+function owedTaskIds(text) {
+  const ids = [];
+  const re = /^\s*-\s*task\s+(\d+)/gm;
+  let m;
+  while ((m = re.exec(String(text || ''))) !== null) ids.push(m[1]);
+  return ids;
+}
+
+// Does the gate still hold? Asked of the LEDGER, one read per stranded task, and
+// never by attempting a claim: a claim attempt per wake is the loop this replaces.
+// An unreadable task keeps the wait — guessing "cleared" would restart the
+// attempts on a read failure, the opposite of backing off.
+async function queueGateHolds(queueGate, deps = {}) {
+  if (!queueGate.owed.length) return false;
+  const api = deps.api && deps.api.tasks ? deps.api : await (require('./cli-lib').cliClient)();
+  for (const id of queueGate.owed) {
+    let r = null;
+    try { r = await api.tasks.getTasksId({ id: Number(id) }); } catch (_) { return true; }
+    if (!r || !r.ok || !r.data || !r.data.task) return true;
+    if (r.data.task.status === 'confirmed') return true;
+  }
+  return false;
+}
+
+function queueGatedRow(queueGate, now) {
+  const on = queueGate.owed.length ? queueGate.owed.map((id) => `task ${id}`).join(', ') : 'a stranded confirmed task';
+  return {
+    event: 'queue_gated', waiting_on: queueGate.owed,
+    waited_s: Math.max(0, Math.round((now - queueGate.since) / 1000)),
+    reason: `every claim is refused until ${on} lands — waiting, not claiming (${queueGate.reason})`,
+  };
+}
+
 async function iteration(opts, deps = {}) {
   const runCmd = deps.run || run;
   const spawnWork = deps.spawnWorker || spawnWorker;
@@ -430,53 +504,89 @@ async function iteration(opts, deps = {}) {
     }
   }
 
-  // 2. Pick — from the ALLOWLISTED goals, never from what the command line asked
-  // for. gate.goals is already the intersection.
-  const picked = await pick(gate.goals, deps.pickDeps || {});
-  if (picked.error) return log({ event: 'pick_failed', reason: picked.error });
-  if (picked.none) {
-    return log({
-      event: 'nothing_claimable', goals: gate.goals,
-      // Carried so the cadence can tell an EMPTY queue from one where every task
-      // halts — the reasons are the matrix's own codes, safe to print.
-      skipped: (picked.skipped || []).map((sk) => ({ id: sk.id, goal_id: sk.goal_id, reasons: (sk.reasons || []).map((r) => r.code) })),
-    });
-  }
-  const task = picked.task;
-
-  // 2b. The per-TASK half of the fence. sequence.js's halt matrix already refuses
-  // a protected-path task, and this re-asks anyway — not from distrust of the
-  // matrix, but because the matrix is a shared component with its own callers and
-  // the fence must not be a property of whoever happens to be picking. A gate that
-  // only holds while a collaborator keeps calling it is not a gate.
-  //
-  // Both halves read the task's DECLARED touches[], which is a claim, not a fact —
-  // see the header of modules/autonomy/fence.js for why that is acceptable as the
-  // OUTER of three layers and would not be as the only one.
-  const taskGate = fence.decideTask({
-    task, goals: gate.goals, protectedHits: matchProtected(task.touches || []),
-  });
-  if (!taskGate.go) {
-    return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: task.id, goal_id: picked.goalId, globs: taskGate.globs || [] });
+  // 1c. A QUEUE-WIDE gate from an earlier pass (task 1004396). While the
+  // stranded task it named is still `confirmed`, every claim would be refused, so
+  // none is attempted. The wait wakes early when main moves (waitOrJump), which is
+  // exactly what the strand landing does.
+  const state = deps.state || RUNNER_STATE;
+  const now = deps.now ? deps.now() : Date.now();
+  if (state.queueGate) {
+    if (await queueGateHolds(state.queueGate, deps)) return log(queueGatedRow(state.queueGate, now));
+    log({ event: 'queue_gate_cleared', waited_on: state.queueGate.owed, waited_s: Math.max(0, Math.round((now - state.queueGate.since) / 1000)) });
+    state.queueGate = null;
   }
+  for (const [id, until] of state.setAside) if (until <= now) state.setAside.delete(id);
+
+  // 2–4, up to MAX_CLAIM_ATTEMPTS times: pick, fence, tree, claim. A task refused
+  // on its own is set aside and the NEXT one is tried in the same pass.
+  let task = null; let picked = null; let wtName = null; let wtPath = null;
+  let lastRefusal = null;
+  for (let attempt = 0; attempt < MAX_CLAIM_ATTEMPTS && !task; attempt++) {
+    const exclude = new Set(state.setAside.keys());
+    // 2. Pick — from the ALLOWLISTED goals, never from what the command line asked
+    // for. gate.goals is already the intersection.
+    const got = await pick(gate.goals, { ...(deps.pickDeps || {}), exclude });
+    if (got.error) return log({ event: 'pick_failed', reason: got.error });
+    // A picker that hands back a set-aside task is treated as having none left:
+    // the exclusion is this function's contract, not the picker's courtesy.
+    if (got.none || exclude.has(String(got.task.id))) {
+      // Everything left was refused in THIS pass: return the last refusal, not
+      // "nothing claimable". Every claim failing at once is also what an outage
+      // looks like, and it must still reach the failure ladder (task 1004179).
+      if (lastRefusal) return lastRefusal;
+      return log({
+        event: 'nothing_claimable', goals: gate.goals,
+        // Carried so the cadence can tell an EMPTY queue from one where every task
+        // halts — the reasons are the matrix's own codes, safe to print.
+        skipped: (got.skipped || []).map((sk) => ({ id: sk.id, goal_id: sk.goal_id, reasons: (sk.reasons || []).map((r) => r.code) })),
+        set_aside: Array.from(state.setAside, ([id, until]) => ({ id, until: new Date(until).toISOString() })),
+      });
+    }
+    const candidate = got.task;
+
+    // 2b. The per-TASK half of the fence. sequence.js's halt matrix already refuses
+    // a protected-path task, and this re-asks anyway — not from distrust of the
+    // matrix, but because the matrix is a shared component with its own callers and
+    // the fence must not be a property of whoever happens to be picking. A gate that
+    // only holds while a collaborator keeps calling it is not a gate.
+    //
+    // Both halves read the task's DECLARED touches[], which is a claim, not a fact —
+    // see the header of modules/autonomy/fence.js for why that is acceptable as the
+    // OUTER of three layers and would not be as the only one.
+    const taskGate = fence.decideTask({
+      task: candidate, goals: gate.goals, protectedHits: matchProtected(candidate.touches || []),
+    });
+    if (!taskGate.go) {
+      return log({ event: 'fenced', code: taskGate.code, reason: taskGate.reason, task_id: candidate.id, goal_id: got.goalId, globs: taskGate.globs || [] });
+    }
 
-  if (opts.dryRun) return log({ event: 'dry_run', task_id: task.id, title: task.title, goal_id: picked.goalId });
+    if (opts.dryRun) return log({ event: 'dry_run', task_id: candidate.id, title: candidate.title, goal_id: got.goalId });
 
-  // 3. The task's own working tree.
-  const wtName = deps.worktreeName ? deps.worktreeName(task.id) : worktreeName(task.id);
-  const made = await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'add', wtName, '--base', 'origin/main']);
-  if (!made.ok) {
-    return log({ event: 'worktree_failed', task_id: task.id, worktree: wtName, reason: failureReason(made, 'worktree.js') });
-  }
-  const wtPath = path.join(REPO_ROOT, '.claude', 'worktrees', wtName);
-
-  // 4. Claim FROM that tree, so claim.js records it as the claim's tree and the
-  // ship lock later agrees with where the work actually is.
-  const claimed = await runCmd(process.execPath, [path.join(REPO_ROOT, 'scripts', 'gds', 'claim.js'), String(task.id)], { cwd: wtPath });
-  if (!claimed.ok) {
-    await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'remove', wtName]);
-    return log({ event: 'claim_failed', task_id: task.id, worktree: wtName, reason: failureReason(claimed, 'claim.js') });
+    // 3. The task's own working tree.
+    const name = deps.worktreeName ? deps.worktreeName(candidate.id) : worktreeName(candidate.id);
+    const made = await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'add', name, '--base', 'origin/main']);
+    if (!made.ok) {
+      return log({ event: 'worktree_failed', task_id: candidate.id, worktree: name, reason: failureReason(made, 'worktree.js') });
+    }
+    const treePath = path.join(REPO_ROOT, '.claude', 'worktrees', name);
+
+    // 4. Claim FROM that tree, so claim.js records it as the claim's tree and the
+    // ship lock later agrees with where the work actually is.
+    const claimed = await runCmd(process.execPath, [path.join(REPO_ROOT, 'scripts', 'gds', 'claim.js'), String(candidate.id)], { cwd: treePath });
+    if (!claimed.ok) {
+      await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'remove', name]);
+      const reason = failureReason(claimed, 'claim.js');
+      if (claimed.code === QUEUE_GATED_EXIT) {
+        state.queueGate = { owed: owedTaskIds(`${claimed.stderr || ''}\n${claimed.stdout || ''}`), since: now, reason };
+        return log({ ...queueGatedRow(state.queueGate, now), task_id: candidate.id, worktree: name });
+      }
+      state.setAside.set(String(candidate.id), now + CLAIM_SET_ASIDE_MS);
+      lastRefusal = log({ event: 'claim_failed', task_id: candidate.id, worktree: name, reason, set_aside_s: CLAIM_SET_ASIDE_MS / 1000 });
+      continue;
+    }
+    task = candidate; picked = got; wtName = name; wtPath = treePath;
   }
+  if (!task) return lastRefusal;
 
   // 5. Work, in that tree.
   const started = Date.now();
@@ -975,4 +1085,5 @@ module.exports = {
   worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, countWorkedSince, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
   isRunnerTree, RUNNER_TREE_RE, postHeartbeat, RUNNER_STARTED_AT, failureReason,
+  newRunnerState, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
 };

package/scripts/gds/claim.js

@@ -282,6 +282,14 @@ function claimErrorInfo(r) {
 // control characters that repaint a terminal, and a runaway one can bury the
 // guidance it was meant to add. Clip to one line, strip C0/C1 controls, cap length.
 const MAX_LISTED_TASKS = 20;
+
+// QUEUE_GATED_EXIT — the one refusal that is about the QUEUE, not the task
+// (task 1004396). REBASE_REQUIRED refuses every claim until a stranded confirmed
+// task lands, so an unattended caller that reads it as "this task is refused"
+// sets aside task after task for a fault none of them has. Every other refusal
+// keeps exit 1. The autobongos runner is the consumer and pins the same value
+// in a test.
+const QUEUE_GATED_EXIT = 4;
 function clip(s, max = 160) {
   if (s == null) return '';
   // eslint-disable-next-line no-control-regex
@@ -370,7 +378,7 @@ function claimFailureGuidance({ code, message, d }, r, taskId, ctx) {
       if (t.reason) lines.push(`      flagged: ${clip(t.reason)}`);
     }
     lines.push(`  ${clip(d.hint, 600) || 'Clear it with /strand-fix N, or rebase the branch and re-ship — or /builder-release it to give up on one.'}`);
-    return { lines, exit: 1 };
+    return { lines, exit: QUEUE_GATED_EXIT };
   }
   if (code === 'ALREADY_CLAIMED') {
     lines.push(`Task #${taskId} was just claimed by another session. Try a different task.`);
@@ -771,4 +779,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote };
+module.exports = { formatClaimFailure, claimErrorInfo, goalMembershipOfferPlan, materializeModeSkills, printRoleLine, worktreeDetectionNote, QUEUE_GATED_EXIT };

package/scripts/gds/move-escalation.js

@@ -0,0 +1,141 @@
+'use strict';
+//
+// scripts/gds/move-escalation.js — a core move nobody can heal reaches a person: one blocker
+// and one Discord notice per failed move, closed by itself when a later move lands (task
+// 1004449, goal 1000090 deploy self-heal).
+//
+// WHY. After task 1004448 a failed /deploy move ends one of three ways: it waits and retries
+// (transient), it is fixed and retried (known_wedge), or it is retired. A retired
+// needs_decision move is the owner's own rule refusing it, and the deploy page says so. But a
+// move retired as `unknown` — an unlisted failure, a fix that did not hold, and every
+// rollback that FAILED (the project may be down) — only wrote a line on the intent, which
+// nobody reads until they open the page. That is exactly the failure that needs a person.
+//
+// EDGE-TRIGGERED, WITHOUT NEW STATE. The blocker's (source, source_ref) is unique, and
+// source_ref names the INTENT: `core-move:<instance id>:<intent id>`. An intent retires once,
+// so a failed move files one blocker however many retries led up to it, and a re-run of the
+// same retire files nothing. The Discord notice is posted only when the insert actually
+// created the row, so it is exactly as edge-triggered as the blocker.
+//
+// CLOSED BY SUCCESS. A later core move on the same project that lands resolves every open
+// blocker this file filed for that project, with a note saying which move fixed it, and
+// posts one all-clear. A person can still resolve one by hand; this never reopens it.
+//
+// The Discord copy names a project only when it is public on the platform's map (the rule
+// liveness-notify.js keeps), and never carries upgrade output — that stays in the blocker,
+// inside the trust boundary. Writes go through the runner's own db handle (the hub
+// database, where the blockers table lives), not modules/ideas/blockers.js's shared pool,
+// which this CLI process never opens; the INSERT is that file's createBlocker, verbatim.
+
+const { execFile } = require('child_process');
+const { REPO_ROOT } = require('./provision-config.js');
+
+const BLOCKER_SOURCE = 'provisioning';
+const REF_PREFIX = 'core-move';
+const DETAIL_MAX = 1500;
+
+/** Does this retired move need a person? PURE. */
+function needsPerson({ intent, failure, terminal }) {
+  if (!intent || intent.action !== 'core-upgrade') return false;
+  return !!terminal || !!(failure && (failure.class === 'unknown' || failure.reason === 'rollback_failed'));
+}
+
+function sourceRef(inst, intent) { return `${REF_PREFIX}:${inst.id}:${intent.id}`; }
+
+function projectName(inst, provisioning) {
+  try { return provisioning.effectiveSettings(inst).visibility === 'public' ? inst.slug : null; } catch { return null; }
+}
+
+/** The blocker a failed move files. PURE. */
+function blockerFor({ inst, intent, failure, error }) {
+  const reason = (failure && failure.reason) || 'unknown';
+  const down = reason === 'rollback_failed';
+  const to = intent.target_version || '(no target)';
+  const detail = String(error || '').slice(0, DETAIL_MAX).replace(/```/g, "'''");
+  return {
+    title: down
+      ? `${inst.slug}: the core move to ${to} failed AND its rollback did not finish — the project may be down`
+      : `${inst.slug}: the core move to ${to} failed and the runner cannot fix it`,
+    bodyMd: [
+      `**Project:** ${inst.slug} (instance ${inst.id}) · **target:** ${to} · **reason:** \`${reason}\` · **move:** intent ${intent.id}`,
+      '',
+      down
+        ? 'The move changed the project, failed, and the automatic rollback also failed. It may be down or on a half-installed core. Check it before anything else.'
+        : 'The runner retired this move: it is not a known snag it can fix, or its one automatic fix did not work. Nothing is being retried.',
+      '',
+      'What the move reported:',
+      '```',
+      detail || '(nothing)',
+      '```',
+      '',
+      'This closes by itself when a later core move on this project succeeds.',
+    ].join('\n'),
+    source: BLOCKER_SOURCE,
+    sourceRef: sourceRef(inst, intent),
+  };
+}
+
+/** The owner-facing Discord line. `name` null → described, never identified. PURE. */
+function noticeText({ kind, name, to, down }) {
+  const who = name ? `**${name}**` : 'A private project';
+  if (kind === 'fixed') return `✅ ${who} took its core update${to ? ` to ${to}` : ''}; the earlier failed update is closed.`;
+  return down
+    ? `🚨 ${who}: a core update failed and could not be undone. The project may be down. A blocker is open with the details.`
+    : `⚠️ ${who}: a core update${to ? ` to ${to}` : ''} failed in a way the platform cannot fix by itself. A blocker is open with the details. Nothing is being retried.`;
+}
+
+// Fire-and-forget, the liveness-notify.js postNotice shape: CHAT_DRY_RUN=1 short-circuits and
+// a Discord hiccup never stalls the drain.
+function postNotice(text, { log = console.log } = {}) {
+  if (!text) return;
+  if (process.env.CHAT_DRY_RUN === '1') { log(`[core-move] [broadcast dry-run] would post: ${text}`); return; }
+  try {
+    execFile('node', ['scripts/discord/post.js', text], { cwd: REPO_ROOT, timeout: 10_000 }, (err) => {
+      if (err) log(`[core-move] notice broadcast failed (non-blocking): ${err.message}`);
+    });
+  } catch (e) { log(`[core-move] notice broadcast failed (non-blocking): ${(e && e.message) || e}`); }
+}
+
+/** After a move is retired: file its blocker and notice, once. Never throws. */
+async function afterRetire({ intent, inst, result, deps }) {
+  const failure = result && result.failure;
+  if (!deps.apply || !needsPerson({ intent, failure, terminal: result && result.terminal })) return { filed: false };
+  const b = blockerFor({ inst, intent, failure, error: result.error });
+  try {
+    const { rows } = await deps.db.query(
+      `INSERT INTO blockers (title, body_md, source, source_ref)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (source, source_ref) WHERE source IS NOT NULL AND source_ref IS NOT NULL
+         DO NOTHING
+       RETURNING id`, [b.title, b.bodyMd, b.source, b.sourceRef]);
+    if (!rows || !rows[0]) return { filed: false };
+    const down = (failure && failure.reason) === 'rollback_failed';
+    (deps.postNotice || postNotice)(noticeText({ kind: 'failed', name: projectName(inst, deps.provisioning), to: intent.target_version, down }), { log: deps.log });
+    (deps.log || (() => {}))(`  ⚑ filed blocker ${rows[0].id} for ${inst.slug}'s failed move to ${intent.target_version}`);
+    return { filed: true, blockerId: rows[0].id };
+  } catch (e) {
+    (deps.log || (() => {}))(`  ⚠ could not file a blocker for ${inst.slug}'s failed move: ${(e && e.message) || e}`);
+    return { filed: false };
+  }
+}
+
+/** After a move LANDS: close every open blocker this file filed for the project. Never throws. */
+async function afterSuccess({ intent, inst, result, deps }) {
+  if (!deps.apply || !intent || intent.action !== 'core-upgrade' || !result || result.ok === false || result.noop) return { closed: 0 };
+  const to = result.served || intent.target_version;
+  try {
+    const { rows } = await deps.db.query(
+      `UPDATE blockers SET status = 'resolved', resolved_at = now(), resolution_note = $3
+        WHERE status = 'open' AND source = $1 AND source_ref LIKE $2
+        RETURNING id`,
+      [BLOCKER_SOURCE, `${REF_PREFIX}:${inst.id}:%`, `closed automatically: a later core move to ${to} succeeded (intent ${intent.id})`]);
+    const n = (rows || []).length;
+    if (n) (deps.postNotice || postNotice)(noticeText({ kind: 'fixed', name: projectName(inst, deps.provisioning), to }), { log: deps.log });
+    return { closed: n };
+  } catch (e) {
+    (deps.log || (() => {}))(`  ⚠ could not close ${inst.slug}'s core-move blockers: ${(e && e.message) || e}`);
+    return { closed: 0 };
+  }
+}
+
+module.exports = { BLOCKER_SOURCE, REF_PREFIX, needsPerson, sourceRef, blockerFor, noticeText, postNotice, afterRetire, afterSuccess };

package/scripts/gds/provision.js

@@ -1209,12 +1209,13 @@ async function cmdRunIntents(deps) {
           // can say why the work stopped.
           await provisioning.setInstanceStatus(db, intent.instance_id, inst.status, { error_note: result.error || 'op failed', error_note_action: intent.action }).catch(() => {});
           if (result.failure) await recordFailureClass(db, intent.id, result.failure); // WHAT KIND of failure, beside the sentence (task 1004446)
+          await require('./move-escalation.js').afterRetire({ intent, inst, result, deps }); // nobody can heal it: one blocker + one notice per move (task 1004449)
         } else {
           await db.query(`UPDATE provisioning_intents SET state='pending', last_error=$2, not_before = now() + ($3 * interval '1 millisecond'), updated_at=now() WHERE id=$1`, [intent.id, result.error || 'op failed', next.delayMs]);
           if (result.failure) await recordFailureClass(db, intent.id, result.failure);
         }
         errors++;
-      } else { await provisioning.resolveIntent(db, intent.id, 'done', (result && result.doneNote) || null); ok++; } // done WITH a note: it landed, and this is what it could not finish (task 1004065)
+      } else { await provisioning.resolveIntent(db, intent.id, 'done', (result && result.doneNote) || null); ok++; await require('./move-escalation.js').afterSuccess({ intent, inst, result, deps }); } // done WITH a note: it landed, and this is what it could not finish (task 1004065)
     } catch (e) {
       await provisioning.resolveIntent(db, intent.id, 'error', e.message).catch(() => {});
       // Surface the failure on the instance too, so a stuck instance is visible.

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.32'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.33'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/autobongos_cadence.mjs

@@ -40,6 +40,15 @@ const walk = (classes, cfg) => {
 
 // ── classification ──────────────────────────────────────────────────────────────
 
+test('a queue-wide gate is a wait, not a failure (task 1004396)', () => {
+  // The strand behind it is somebody's unlanded ship, not this machine breaking.
+  // Escalating it would slow the runner down for a fault it cannot fix, and the
+  // wait already wakes early when main moves, which is what the strand landing does.
+  const seen = classifyEvent({ event: 'queue_gated', waiting_on: ['777'], reason: 'x' });
+  assert.equal(seen.class, 'quiet');
+  assert.match(seen.detail, /777/);
+});
+
 test('a worked task counts as progress only when the LEDGER agreed', () => {
   assert.equal(classifyEvent({ event: 'worked', verified: true }).class, 'progress');
   // A worker's claim the ledger never saw is not progress; counting it would hold

package/tests/autobongos_loop.mjs

@@ -237,6 +237,12 @@ test('an unreadable claimable feed does not halt everything', async () => {
   assert.equal(got.task.id, 9001, 'the not_claimable reason stays quiet when the feed cannot be read');
 });
 
+test('pickTask passes over a task the runner has set aside (task 1004396)', async () => {
+  const api = fakeApi({ tasks: [ready({ id: 9001 }), ready({ id: 9002 })], claimable: [{ id: 9001 }, { id: 9002 }] });
+  const got = await runner.pickTask([1000119], { api, rank: 'archon', exclude: new Set(['9001']) });
+  assert.equal(got.task.id, 9002, 'a refused task must not stay at the head of the order');
+});
+
 test('a goal whose tasks cannot be read is reported, not silently skipped', async () => {
   const api = fakeApi({ tasks: [], claimable: [] });
   api.tasks.getTasks = async () => { throw new Error('boom'); };
@@ -273,7 +279,11 @@ function harness(over = {}) {
     // The LEDGER, faked. iteration() now reads the task back from Bongos after
     // every worker (task 1003903) instead of believing the worker's own verdict,
     // so a test that does not say what the ledger holds is not describing a run.
-    api: {},
+    api: over.api || {},
+    // Per-test runner memory (task 1004396): refused tasks and a queue gate
+    // outlive one iteration, so a shared module-level copy would leak between tests.
+    state: over.state || runner.newRunnerState(),
+    now: over.now,
     verifyDeps: {
       task: over.ledger !== undefined ? over.ledger : { id: 4242, status: 'shipped', updated_at: new Date().toISOString() },
       probeArtifact: over.probeArtifact || (async () => ({ checked: true, onMain: true, sha: 'a'.repeat(40), subject: 'x (task 4242)' })),
@@ -422,6 +432,137 @@ test('failureReason: stdout is used when stderr is empty, whitespace is collapse
   assert.equal(runner.failureReason({ code: 1, stderr: 'a'.repeat(400) }, 'x').length, 400);
 });
 
+// ── task 1004396: a refusal is not a reason to stop, unless it refuses everything ──
+//
+// Owner ruling (2026-09-30): a refused claim must not put the runner into waiting
+// by default. It sets that task aside and tries the next one. It waits only when
+// there is a block AND nothing else it can claim — which is exactly the shape of
+// the queue-wide gate (a stranded confirmed task refuses EVERY claim).
+
+const taskA = { ...aTask, id: 4242 };
+const taskB = { ...aTask, id: 4343, title: 'The next thing' };
+// A picker that honours the exclusion set, the way the real pickTask now does.
+const pickAorB = async (_goals, pd = {}) => {
+  const ex = pd.exclude || new Set();
+  for (const t of [taskA, taskB]) if (!ex.has(String(t.id))) return { task: t, goalId: 1000119, skipped: [] };
+  return { none: true, skipped: [] };
+};
+const scriptOf = (args) => String(args[0]).split(/[\\/]/).pop();
+const gatedCard = [
+  'Your queue is gated — 1 confirmed task(s) are waiting on your rebase:',
+  '  - task 777  A stranded thing',
+  '      flagged: strand:branch_modifies_executed_code',
+].join(String.fromCharCode(10));
+
+test('a task refused on its own is set aside and the NEXT task is worked in the same pass', async () => {
+  const claims = [];
+  const h = harness({
+    pickTask: pickAorB,
+    ledger: { id: 4343, status: 'shipped', updated_at: new Date().toISOString() },
+    run: async (bin, args) => {
+      if (scriptOf(args) === 'claim.js') {
+        claims.push(args[1]);
+        return args[1] === '4242' ? { ok: false, code: 1, stdout: '', stderr: 'DEPS_NOT_SHIPPED' } : { ok: true, code: 0, stdout: '', stderr: '' };
+      }
+      return { ok: true, code: 0, stdout: '', stderr: '' };
+    },
+  });
+  const row = await runner.iteration(opts, h.deps);
+  assert.deepEqual(claims, ['4242', '4343'], 'the refusal must not end the pass');
+  assert.equal(row.event, 'worked');
+  assert.equal(row.task_id, 4343);
+  const refused = h.rows.find((r) => r.event === 'claim_failed');
+  assert.equal(refused.task_id, 4242, 'the refusal is still logged, with its reason');
+  assert.ok(refused.set_aside_s > 0, 'and says the task is set aside');
+});
+
+test('a set-aside task is not re-tried on the next wake, and comes back once the set-aside expires', async () => {
+  let t = 1_000_000;
+  const state = runner.newRunnerState();
+  const claims = [];
+  const mk = () => harness({
+    state, now: () => t, pickTask: pickAorB,
+    run: async (bin, args) => {
+      if (scriptOf(args) === 'claim.js') { claims.push(args[1]); return { ok: false, code: 1, stdout: '', stderr: 'nope' }; }
+      return { ok: true, code: 0, stdout: '', stderr: '' };
+    },
+  });
+  await runner.iteration(opts, mk().deps);
+  assert.deepEqual(claims, ['4242', '4343']);
+  const second = await runner.iteration(opts, mk().deps);
+  assert.deepEqual(claims, ['4242', '4343'], 'no claim is re-attempted while both are set aside');
+  assert.equal(second.event, 'nothing_claimable');
+  assert.deepEqual(second.set_aside.map((s) => s.id).sort(), ['4242', '4343']);
+  t += runner.CLAIM_SET_ASIDE_MS + 1;
+  await runner.iteration(opts, mk().deps);
+  assert.deepEqual(claims.slice(2), ['4242', '4343'], 'after the set-aside they are tried again');
+});
+
+test('when EVERY candidate is refused, the last failure is returned so a real outage still escalates', async () => {
+  const h = harness({
+    pickTask: pickAorB,
+    run: async (bin, args) => (scriptOf(args) === 'claim.js'
+      ? { ok: false, code: 1, stdout: '', stderr: 'fetch failed' }
+      : { ok: true, code: 0, stdout: '', stderr: '' }),
+  });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.event, 'claim_failed', 'returning "nothing claimable" here would hide a network outage as idle');
+  assert.equal(h.rows.filter((r) => r.event === 'claim_failed').length, 2);
+});
+
+test('a queue-wide gate WAITS, names the stranded task, and makes no claim until it lands', async () => {
+  const state = runner.newRunnerState();
+  let status = 'confirmed';
+  let gated = true;
+  const claims = [];
+  const api = { tasks: { getTasksId: async ({ id }) => ({ ok: true, data: { task: { id, status } } }) } };
+  const mk = () => harness({
+    state, api, pickTask: pickAorB,
+    run: async (bin, args) => {
+      if (scriptOf(args) === 'claim.js') {
+        claims.push(args[1]);
+        return gated ? { ok: false, code: runner.QUEUE_GATED_EXIT, stdout: '', stderr: gatedCard } : { ok: true, code: 0, stdout: '', stderr: '' };
+      }
+      return { ok: true, code: 0, stdout: '', stderr: '' };
+    },
+  });
+
+  const first = await runner.iteration(opts, mk().deps);
+  assert.equal(first.event, 'queue_gated');
+  assert.deepEqual(first.waiting_on, ['777'], 'the wait names what it is waiting on');
+  assert.deepEqual(claims, ['4242'], 'a gate refuses every claim, so trying the next task is pointless');
+
+  const second = await runner.iteration(opts, mk().deps);
+  assert.equal(second.event, 'queue_gated');
+  assert.deepEqual(claims, ['4242'], 'no claim is attempted while the strand is still confirmed');
+
+  status = 'shipped'; gated = false;
+  const third = await runner.iteration(opts, mk().deps);
+  assert.equal(third.event, 'worked', 'once the strand lands the runner resumes by itself');
+  assert.deepEqual(claims, ['4242', '4242']);
+  assert.equal(state.queueGate, null, 'the gate is forgotten');
+});
+
+test('a gate whose stranded task cannot be read back keeps waiting rather than guessing', async () => {
+  const state = runner.newRunnerState();
+  state.queueGate = { owed: ['777'], since: Date.now(), reason: 'x' };
+  let claimed = false;
+  const h = harness({
+    state, pickTask: pickAorB,
+    api: { tasks: { getTasksId: async () => ({ ok: false, status: 502 }) } },
+    run: async (bin, args) => { if (scriptOf(args) === 'claim.js') claimed = true; return { ok: true, code: 0, stdout: '', stderr: '' }; },
+  });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.event, 'queue_gated');
+  assert.equal(claimed, false);
+});
+
+test('the runner and claim.js agree on the queue-gated exit code', () => {
+  const claim = require('../scripts/gds/claim.js');
+  assert.equal(runner.QUEUE_GATED_EXIT, claim.QUEUE_GATED_EXIT);
+  assert.notEqual(runner.QUEUE_GATED_EXIT, 1, 'it must differ from the generic refusal, or the runner cannot tell them apart');
+});
+
 test('a worker that cannot finish frees the claim; one that really shipped does not', async () => {
   // Which of these happens is now decided by the LEDGER, not by the worker's own
   // verdict: a stuck worker leaves the task still `active`, a finished one leaves

package/tests/autonomy_digest.mjs

@@ -97,6 +97,16 @@ test('shipped is the LEDGER’s answer, never the worker’s', () => {
   assert.deepEqual(d.onHold.ranButDidNotShip.map((r) => r.shape), ['still_held', 'shipped_no_artifact']);
 });
 
+test('a queue-gate wait is a hold that names the stranded task, not an unrecognised event (task 1004396)', () => {
+  const d = buildDigest([
+    { at: at(0), event: 'queue_gated', waiting_on: ['777'], reason: 'every claim is refused until task 777 lands — waiting, not claiming (x)' },
+    { at: at(5), event: 'queue_gate_cleared', waited_on: ['777'], waited_s: 300 },
+  ], { nowEpochS: NOW_S });
+  assert.equal(d.runner.unrecognised, 0);
+  assert.equal(d.onHold.held.length, 1);
+  assert.match(d.onHold.held[0].reason, /task 777/);
+});
+
 test('an unworkable queue is reported as a queue problem, not as breakage', () => {
   const d = buildDigest([{ at: at(0), event: 'nothing_claimable', skipped: [{ id: 9, reasons: ['needs_migration'] }] }], { nowEpochS: NOW_S });
   assert.equal(d.onHold.unworkable.length, 1);

package/tests/claim_error_surface.mjs

@@ -231,6 +231,13 @@ t('REBASE_REQUIRED: names the owed tasks and relays the server hint', () => {
     'must not fall through to the bare code echo');
 });
 
+t('REBASE_REQUIRED exits with its OWN code, so an unattended caller can tell a queue gate from a task refusal (task 1004396)', () => {
+  const { QUEUE_GATED_EXIT } = require('../scripts/gds/claim.js');
+  assert.equal(formatClaimFailure(envelope('REBASE_REQUIRED', {}), 5).exit, QUEUE_GATED_EXIT);
+  assert.notEqual(QUEUE_GATED_EXIT, 1);
+  assert.equal(formatClaimFailure(envelope('ALREADY_CLAIMED', {}), 5).exit, 1, 'a per-task refusal keeps exit 1');
+});
+
 t('REBASE_REQUIRED: still guides when the server sends no hint and no task list', () => {
   const out = text(formatClaimFailure(envelope('REBASE_REQUIRED', {}), 5));
   assert.match(out, /gated/i, 'must say the queue is gated');

package/tests/cli_exit_no_abort.mjs

@@ -348,7 +348,12 @@ test('land-watch.js exits 0 after a REAL request — the teardown that aborted 3
 // throwaway session, so no real API is touched and the developer's own config is
 // never read or written. `--here` because CI may check out the MAIN checkout,
 // where the worktree guard would refuse at exit 2 before any request is made.
-test('claim.js exits 1 without aborting on a REFUSED claim — measured 3/3 aborting before', async () => {
+// The stub refuses with REBASE_REQUIRED, the queue-wide gate, which exits with its
+// own code since task 1004396 (QUEUE_GATED_EXIT) so an unattended caller can tell a
+// gate from a task refusal. The abort this guards against shows as 127 either way.
+const { QUEUE_GATED_EXIT } = createRequire(import.meta.url)('../scripts/gds/claim.js');
+
+test('claim.js exits with its refusal code without aborting on a REFUSED claim — measured 3/3 aborting before', async () => {
   const { proc, port } = await startStub({ claimStatus: 409 });
   try {
     const home = makeHome({ apiBase: `http://127.0.0.1:${port}` });
@@ -361,7 +366,7 @@ test('claim.js exits 1 without aborting on a REFUSED claim — measured 3/3 abor
       });
       assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — draining left a handle armed`);
       assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively:\n${r.stderr}`);
-      assert.equal(r.status, 1, `a refused claim must exit 1, got ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+      assert.equal(r.status, QUEUE_GATED_EXIT, `a queue-gated claim must exit ${QUEUE_GATED_EXIT}, got ${r.status} (127 = the abort); stderr: ${r.stderr}`);
       // End-to-end proof that the new REBASE_REQUIRED rendering reaches a terminal,
       // not just the unit test: the stub refuses with that exact envelope.
       //

package/tests/move_escalation.mjs

@@ -0,0 +1,191 @@
+// tests/move_escalation.mjs — a core move nobody can heal files ONE blocker and ONE notice,
+// and a later move that lands closes it (task 1004449, goal 1000090 deploy self-heal).
+//
+// WHAT IS AT RISK. Two opposite failures: a person never hears about a move that left a
+// project down, or hears about it on every runner tick until they mute the channel. The
+// blockers table here is a fake that enforces the real (source, source_ref) uniqueness, and
+// the drain loop is the real one, so "one per failed move" is measured across retries and
+// re-runs rather than assumed.
+//
+// Run:  node tests/move_escalation.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+process.env.PROVISION_APP_USER = process.env.PROVISION_APP_USER || 'lars'; // appUser() refuses a Windows account name
+const require = createRequire(import.meta.url);
+const E = require('../scripts/gds/move-escalation.js');
+const P = require('../scripts/gds/provision.js');
+
+let passed = 0;
+let failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+const inst = (over = {}) => ({ id: 7, slug: 'cloudbongos', db_name: 'cloudbongos', port: 3002, status: 'active', hosting_shape: 'control-plane', owner_builder_id: 1, ...over });
+const unknownFail = { ok: false, error: 'core upgrade to 1.20.31 failed and was rolled back: health check failed after restart', failure: { class: 'unknown', reason: 'health' } };
+
+// A blockers table with the real partial unique index on (source, source_ref).
+function blockersTable() {
+  const rows = []; let next = 500;
+  const query = async (sql, params) => {
+    if (/INSERT INTO blockers/.test(sql)) {
+      const [title, body_md, source, source_ref] = params;
+      if (rows.some((r) => r.source === source && r.source_ref === source_ref)) return { rows: [] };
+      const r = { id: next++, title, body_md, source, source_ref, status: 'open' }; rows.push(r); return { rows: [{ id: r.id }] };
+    }
+    if (/UPDATE blockers/.test(sql)) {
+      const [source, like, note] = params; const prefix = like.replace(/%$/, '');
+      const hit = rows.filter((r) => r.status === 'open' && r.source === source && r.source_ref.startsWith(prefix));
+      for (const r of hit) { r.status = 'resolved'; r.resolution_note = note; }
+      return { rows: hit.map((r) => ({ id: r.id })) };
+    }
+    return { rows: [] };
+  };
+  return { rows, query };
+}
+
+console.log('\nwho needs a person (needsPerson):');
+
+await t('unknown and rollback_failed escalate; every other class does not', () => {
+  const i = { action: 'core-upgrade' };
+  assert.equal(E.needsPerson({ intent: i, failure: { class: 'unknown', reason: 'health' } }), true);
+  assert.equal(E.needsPerson({ intent: i, failure: { class: 'unknown', reason: 'rollback_failed' }, terminal: true }), true);
+  assert.equal(E.needsPerson({ intent: i, failure: { class: 'unknown', reason: 'remedy_did_not_hold' } }), true, 'a fix that did not hold (task 1004448)');
+  for (const c of ['transient', 'known_wedge', 'needs_decision']) assert.equal(E.needsPerson({ intent: i, failure: { class: c, reason: 'x' } }), false, c);
+  assert.equal(E.needsPerson({ intent: { action: 'restart' }, failure: { class: 'unknown', reason: 'x' } }), false, 'core moves only');
+});
+
+console.log('\nwhat is said (blockerFor, noticeText):');
+
+await t('the blocker names project, target, reason and what the move reported', () => {
+  const b = E.blockerFor({ inst: inst(), intent: { id: 11, target_version: '1.20.31' }, failure: unknownFail.failure, error: unknownFail.error });
+  assert.equal(b.source, 'provisioning');
+  assert.equal(b.sourceRef, 'core-move:7:11');
+  assert.match(b.title, /cloudbongos: the core move to 1\.20\.31 failed/);
+  assert.match(b.bodyMd, /`health`/);
+  assert.match(b.bodyMd, /health check failed after restart/);
+  assert.match(b.bodyMd, /closes by itself/);
+});
+
+await t('a failed rollback says the project may be down', () => {
+  const b = E.blockerFor({ inst: inst(), intent: { id: 11, target_version: '1.20.31' }, failure: { class: 'unknown', reason: 'rollback_failed' }, error: 'x' });
+  assert.match(b.title, /may be down/);
+  assert.match(E.noticeText({ kind: 'failed', name: 'x', down: true }), /may be down/);
+});
+
+await t('reported output cannot break out of its code block', () => {
+  const b = E.blockerFor({ inst: inst(), intent: { id: 1, target_version: '1' }, failure: unknownFail.failure, error: 'a```\n# injected' });
+  assert.equal((b.bodyMd.match(/```/g) || []).length, 2);
+});
+
+await t('Discord names only a PUBLIC project, and never carries the upgrade output', () => {
+  assert.match(E.noticeText({ kind: 'failed', name: null, to: '1.20.31' }), /^⚠️ A private project/);
+  assert.match(E.noticeText({ kind: 'failed', name: 'mercury', to: '1.20.31' }), /\*\*mercury\*\*/);
+  assert.doesNotMatch(E.noticeText({ kind: 'failed', name: 'm', to: '1' }), /health/);
+});
+
+console.log('\nonce per failed move, closed by success (afterRetire / afterSuccess):');
+
+function deps(table, { visibility = 'private' } = {}) {
+  const posts = [];
+  return { posts, d: { apply: true, log: () => {}, db: { query: table.query }, postNotice: (text) => posts.push(text), provisioning: { effectiveSettings: () => ({ visibility }) } } };
+}
+
+await t('a retired unknown move files one blocker and one notice', async () => {
+  const table = blockersTable(); const { posts, d } = deps(table);
+  const r = await E.afterRetire({ intent: { id: 11, action: 'core-upgrade', target_version: '1.20.31' }, inst: inst(), result: unknownFail, deps: d });
+  assert.equal(r.filed, true);
+  assert.equal(table.rows.length, 1);
+  assert.equal(posts.length, 1);
+});
+
+await t('the same move retiring again files nothing and posts nothing', async () => {
+  const table = blockersTable(); const { posts, d } = deps(table);
+  const i = { id: 11, action: 'core-upgrade', target_version: '1.20.31' };
+  await E.afterRetire({ intent: i, inst: inst(), result: unknownFail, deps: d });
+  const again = await E.afterRetire({ intent: i, inst: inst(), result: unknownFail, deps: d });
+  assert.equal(again.filed, false);
+  assert.equal(table.rows.length, 1);
+  assert.equal(posts.length, 1, 'edge-triggered: the notice follows the insert');
+});
+
+await t('a later move that lands closes this project\'s blockers — and only this project\'s', async () => {
+  const table = blockersTable(); const { posts, d } = deps(table, { visibility: 'public' });
+  await E.afterRetire({ intent: { id: 11, action: 'core-upgrade', target_version: '1.20.31' }, inst: inst(), result: unknownFail, deps: d });
+  await E.afterRetire({ intent: { id: 12, action: 'core-upgrade', target_version: '1.20.31' }, inst: inst({ id: 70, slug: 'other' }), result: unknownFail, deps: d });
+  const r = await E.afterSuccess({ intent: { id: 13, action: 'core-upgrade', target_version: '1.20.32' }, inst: inst(), result: { ok: true, served: '1.20.32' }, deps: d });
+  assert.equal(r.closed, 1);
+  assert.deepEqual(table.rows.map((x) => x.status), ['resolved', 'open'], 'instance 70 is not instance 7 — a LIKE prefix must not over-match');
+  assert.match(table.rows[0].resolution_note, /later core move to 1\.20\.32 succeeded \(intent 13\)/);
+  assert.match(posts[posts.length - 1], /^✅ \*\*cloudbongos\*\* took its core update to 1\.20\.32/);
+});
+
+await t('a no-op or a failed result closes nothing; nothing open posts no all-clear', async () => {
+  const table = blockersTable(); const { posts, d } = deps(table);
+  await E.afterRetire({ intent: { id: 11, action: 'core-upgrade', target_version: '1' }, inst: inst(), result: unknownFail, deps: d });
+  assert.equal((await E.afterSuccess({ intent: { id: 13, action: 'core-upgrade' }, inst: inst(), result: { ok: true, noop: true }, deps: d })).closed, 0);
+  assert.equal((await E.afterSuccess({ intent: { id: 13, action: 'core-upgrade' }, inst: inst(), result: { ok: false }, deps: d })).closed, 0);
+  const empty = blockersTable(); const e2 = deps(empty);
+  await E.afterSuccess({ intent: { id: 13, action: 'core-upgrade' }, inst: inst(), result: { ok: true, served: '1' }, deps: e2.d });
+  assert.equal(e2.posts.length, 0);
+});
+
+await t('a database error never throws into the drain', async () => {
+  const { d } = deps({ query: async () => { throw new Error('boom'); } });
+  assert.deepEqual(await E.afterRetire({ intent: { id: 1, action: 'core-upgrade' }, inst: inst(), result: unknownFail, deps: d }), { filed: false });
+  assert.deepEqual(await E.afterSuccess({ intent: { id: 1, action: 'core-upgrade' }, inst: inst(), result: { ok: true, served: '1' }, deps: d }), { closed: 0 });
+});
+
+console.log('\nthe drain loop, end to end:');
+
+// One move that fails `health` (rolled back, unknown), then — a later, separate move — lands.
+async function drain({ table, row, upgradeFails }) {
+  const posts = []; const resolved = [];
+  const deps = {
+    apply: true, privileged: false, log: () => {}, sleep: async () => {},
+    postNotice: (text) => posts.push(text),
+    db: { query: async (sql, params) => {
+      if (/blockers/.test(sql)) return table.query(sql, params);
+      if (/SET state='pending'/.test(sql)) { row.state = 'pending'; row.not_before = new Date(Date.now() + params[params.length - 1]); }
+      return { rows: [] };
+    } },
+    provisioning: {
+      claimNextIntent: async () => { if (row.state !== 'pending' || (row.not_before && row.not_before > new Date())) return null; row.state = 'running'; row.attempts += 1; return { ...row }; },
+      getInstanceById: async () => inst(),
+      resolveIntent: async (_db, id, state) => { resolved.push(state); row.state = state; },
+      setInstanceStatus: async () => {}, recordEvent: async () => {}, clearErrorNote: async () => {},
+      effectiveSettings: () => ({ visibility: 'private' }),
+      claimNextOAuthManifest: async () => null, resolveOAuthManifest: async () => {},
+    },
+    exec: (cmd) => {
+      if (/upgrade\.js/.test(cmd) && upgradeFails) { const e = new Error('Command failed'); e.stderr = '✖ health check failed after restart\nBONGOS_UPGRADE_OUTCOME {"stage":"rolled_back","reason":"health"}\n'; throw e; }
+      return { ok: true, stdout: /\/version/.test(cmd) ? JSON.stringify({ coreVersion: upgradeFails ? '1.20.30' : row.target_version, schemaPending: 0 }) : '' };
+    },
+    writeFile: () => ({ ok: true }),
+    readInstalledCoreVersion: () => '1.20.30', selfInstanceRoot: () => '/srv/cb',
+    updateChannel: { DEFAULT_CHANNEL: 'patch', normalizeChannel: (c) => c || 'patch', channelAllows: () => true, listAvailableVersions: () => ({ ok: true, versions: ['1.20.30', '1.20.31', '1.20.32'] }) },
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'z' }), checkCaddyWiring: () => null,
+  };
+  await P.cmdRunIntents(deps);
+  return { posts, resolved };
+}
+
+await t('a move that fails unknown files ONE blocker; a later move that lands closes it', async () => {
+  const table = blockersTable();
+  const first = await drain({ table, upgradeFails: true, row: { id: 11, instance_id: 7, action: 'core-upgrade', target_version: '1.20.31', attempts: 0, state: 'pending' } });
+  assert.deepEqual(first.resolved, ['error'], 'retired at once — unknown is not retried');
+  assert.equal(table.rows.length, 1);
+  assert.equal(table.rows[0].source_ref, 'core-move:7:11');
+  assert.equal(first.posts.length, 1);
+  const later = await drain({ table, upgradeFails: false, row: { id: 12, instance_id: 7, action: 'core-upgrade', target_version: '1.20.32', attempts: 0, state: 'pending' } });
+  assert.deepEqual(later.resolved, ['done']);
+  assert.equal(table.rows[0].status, 'resolved');
+  assert.equal(later.posts.length, 1);
+  assert.match(later.posts[0], /^✅ A private project took its core update to 1\.20\.32/);
+});
+
+console.log(`\nmove_escalation: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/plain_cards.mjs

@@ -18,7 +18,7 @@ import * as shipLand from '../scripts/gds/ship-land.js';
 
 const require = createRequire(import.meta.url);
 const { JARGON_TERMS } = require('../modules/sessions/accessibility.js');
-const { formatClaimFailure } = require('../scripts/gds/claim.js');
+const { formatClaimFailure, QUEUE_GATED_EXIT } = require('../scripts/gds/claim.js');
 const { formatGradeOutcome } = require('../scripts/gds/ship-grade-steps.js');
 
 let passed = 0;
@@ -130,7 +130,7 @@ test('a card interpolates nothing — it is static text, so it adds no injection
 test('a refused claim prints the engineer text first and the card after it', () => {
   const r = { status: 409, data: { error: { code: 'REBASE_REQUIRED', message: 'x', details: { rebaseTasks: [{ id: 7, reason: 'strand:pr_not_landed' }] } } } };
   const { lines, exit } = formatClaimFailure(r, 42);
-  assert.equal(exit, 1);
+  assert.equal(exit, QUEUE_GATED_EXIT, 'the queue-wide gate keeps its own exit code (task 1004396)');
   assert.match(lines[0], /queue is gated/);
   const at = lines.findIndex((l) => l.includes(PLAIN_MARKER));
   assert.ok(at > 0, 'card follows the existing guidance');