@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/autobongos-verify.js

@@ -1,618 +1,7 @@
 #!/usr/bin/env node
+// scripts/gds/autobongos-verify.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/autobongos-verify.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-// scripts/gds/autobongos-verify.js — read completion back from the LEDGER, never
-// from the session that claims it (task 1003903; ADR 0307 §4).
-//
-// THE CONFUSION THIS EXISTS TO END. A session exiting is not a task shipping,
-// and this project's worst incidents are all that one confusion wearing
-// different clothes: task 1002483 sat at `completed` for three days carrying 651
-// lines of tested work on a branch nobody had pushed; task 1002459 sat at
-// `confirmed` for four days with no artifact on any branch at all; a ship once
-// "timed out" after its merge had already landed. Every one of them was found by
-// accident, because a strand emits no signal of its own.
-//
-// The headless envelope makes it worse rather than better. A worker that stopped
-// dead needing a decision returns `subtype: "success"` — structurally identical
-// to one that finished the job. So the worker's `shipped` is a CLAIM, which is
-// why autobongos-loop.js names it `claims_shipped`, and this file is the half
-// that turns a claim into a fact or into a filed blocker.
-//
-// THE VOCABULARY IS BORROWED, NOT INVENTED. strand-watch.js (task 1003163)
-// already named the three mid-ship shapes — `unprovable`, `unlanded`,
-// `ungraded` — and /strand-fix routes on those names. Calling the same condition
-// something else here would give one situation two names and split the remedies,
-// so classifyStrand() is called directly. What changes is the THRESHOLD: the
-// board sweep waits an hour (a slow CI queue is not a strand), while here the
-// session that was supposed to finish the job has already exited, so waiting
-// cannot change the verdict. The thresholds are zeroed deliberately, and this
-// file is strictly stricter than the board check — never quieter.
-//
-// Usage (normally called by autobongos-run.js, but runnable by hand):
-//   node scripts/gds/autobongos-verify.js 1003902           # verify, report, change nothing
-//   node scripts/gds/autobongos-verify.js 1003902 --act     # also release + file the blocker
-//   node scripts/gds/autobongos-verify.js 1003902 --json
-//
-// Exit codes: 0 verified shipped · 1 not shipped (a shape is named) · 2 undetermined.
-
-const path = require('node:path');
-const { execFile } = require('node:child_process');
-
-const { classifyStrand, WATCHED } = require('./strand-watch.js');
-const { postWithAsk } = require('./ask.js');
-
-// failureReason — what a failed child process said, fit for one run-log field
-// (task 1004180).
-//
-// Two defects this replaces, both seen live. `(stderr || stdout).slice(-400)`
-// logged reason:"" when a child failed with nothing on either stream — which
-// reads as "the cause was captured and it was nothing". And it kept only the
-// TAIL, so a long refusal card lost its first line, the one that says WHY, and
-// the log began mid-word ("ot look for a way round it."). So: prefer stderr,
-// else stdout; collapse whitespace so a multi-line card reads as one line; keep
-// the HEAD plus a short tail with a marked cut; and when there is no text at all,
-// say which program exited with which code rather than saying nothing.
-function failureReason(res, what, max = 400) {
-  const flat = (s) => String(s || '').replace(/\s+/g, ' ').trim();
-  const text = flat(res && res.stderr) || flat(res && res.stdout);
-  if (!text) {
-    const code = res && res.code !== undefined && res.code !== null ? res.code : '?';
-    return `${what} exited ${code} with no output`;
-  }
-  if (text.length <= max) return text;
-  const cut = ' … ';
-  const tail = Math.floor((max - cut.length) / 3);
-  const head = max - cut.length - tail;
-  return text.slice(0, head) + cut + text.slice(text.length - tail);
-}
-
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-
-// Statuses a claim can still be sitting in when the worker is already gone.
-// `active` is the live one; the others are listed because a future rename must
-// fail loudly here rather than silently reclassify a held claim as untouched.
-const HELD_STATUSES = new Set(['active', 'claimed', 'in_progress']);
-
-// LAND_GRACE_MS — how long a SHIPPED task may have nothing on main before that
-// is an owner's problem (task 1004538).
-//
-// The one place this file deliberately waits. Everywhere else the session that
-// was meant to finish the job has exited, so waiting cannot change the verdict.
-// A shipped task is different: the ship is done, and what is outstanding is the
-// LAND, which runs on the server's own clock and can legitimately take hours on a
-// red main. Task 1004513 was flagged at 22:24Z and its merge landed ~11 hours
-// later; the owner got a false alarm (blocker 1000185). A day covers that with
-// room to spare, and a genuinely codeless ship is already credited, so a day's
-// delay in saying so costs nothing. AUTOBONGOS_LAND_GRACE_HOURS overrides it.
-const LAND_GRACE_MS = (() => {
-  const h = Number(process.env.AUTOBONGOS_LAND_GRACE_HOURS);
-  return Number.isFinite(h) && h > 0 ? h * 3600_000 : 24 * 3600_000;
-})();
-
-// When the ship happened, from the LEDGER — never from this process, so a runner
-// restart cannot reset the clock. `shipped_at` first: `updated_at` moves on any
-// touch. Null when neither parses, which classifyLedger reads as "no grace".
-function shippedAtMs(task) {
-  for (const k of ['shipped_at', 'updated_at']) {
-    const t = Date.parse(task && task[k]);
-    if (Number.isFinite(t)) return t;
-  }
-  return null;
-}
-
-// ---------------------------------------------------------------------------
-// The pure half
-// ---------------------------------------------------------------------------
-
-// classifyLedger — what the ledger says happened, in one word.
-//
-// `artifact` is the result of probeArtifact() or null for "not probed". The
-// distinction is load-bearing: `checked: false` means we could not look (no
-// network, a detached checkout), and NOT LOOKING IS NOT EVIDENCE OF ABSENCE. A
-// failed probe must never manufacture a missing artifact.
-//
-// Every shape carries what to DO, because the caller must not re-derive it:
-//   releaseClaim — the task is still held by a session that no longer exists.
-//   fileBlocker  — a human has to look at this.
-//   linkBlocker  — link the blocker to the task, which parks it at `blocked` and
-//                  takes it out of claimable_tasks. Only meaningful once the task
-//                  is back at `ready` (LINK_BLOCKABLE_STATUSES in
-//                  modules/ideas/blockers.js is exactly ['ready']), which is why
-//                  the caller releases BEFORE it links.
-//   halt         — the run stops here rather than picking another task.
-function classifyLedger({ task, artifact = null, nowMs = Date.now(), landGraceMs = LAND_GRACE_MS } = {}) {
-  const none = { releaseClaim: false, fileBlocker: false, linkBlocker: false, halt: false };
-
-  if (!task) {
-    // Cannot read the ledger => cannot verify anything => touch nothing. Releasing
-    // a claim on a guess is how work gets stranded, and this is the one branch
-    // where the honest move is to stop and let a person look.
-    return {
-      ...none, verified: false, shape: 'undetermined', status: null, halt: true,
-      reason: 'the task could not be read back from Bongos, so nothing about it is known',
-      remedy: 'check the instance is reachable, then re-run the verify by hand',
-    };
-  }
-
-  const status = String(task.status || '');
-
-  if (status === 'shipped') {
-    if (artifact && artifact.checked && !artifact.onMain) {
-      // Not yet is not never (task 1004538). Inside the grace window this is a
-      // land still in flight: nothing is filed, and the runner re-probes it on
-      // later iterations (recheckLands). With no readable clock the grace cannot
-      // be measured, so it falls through to the strict verdict below.
-      const shippedAt = shippedAtMs(task);
-      if (shippedAt !== null && nowMs - shippedAt < landGraceMs) {
-        const hours = Math.round(landGraceMs / 3600_000);
-        return {
-          ...none, verified: false, shape: 'pending_land', status, pendingLand: true,
-          reason: 'shipped, but main does not carry a commit naming it yet — the land can take hours on a red main',
-          remedy: `nothing yet: the runner re-checks main on later iterations and files a blocker only if it is still missing ${hours}h after the ship`,
-        };
-      }
-      // The flip happened with nothing behind it — tasks 1002459 and 1002792,
-      // both credited, neither carrying a line of code on any branch. The task is
-      // NOT released and NOT linked: it is shipped, credits are paid, and parking
-      // it would help nobody. The blocker is the whole point — a person has to
-      // decide whether the work was codeless (legitimate: a DB-only change, work
-      // on another checkout) or simply never done.
-      return {
-        ...none, verified: false, shape: 'shipped_no_artifact', status, fileBlocker: true,
-        reason: 'the ledger says shipped but no commit on main names this task',
-        remedy: 'confirm the work was codeless, or redo it — do not try to deploy what is not there',
-      };
-    }
-    return {
-      ...none, verified: true, shape: 'shipped', status,
-      reason: artifact && artifact.checked
-        ? `shipped, and main carries ${artifact.sha ? artifact.sha.slice(0, 8) : 'a commit'} naming it`
-        : 'shipped',
-      remedy: null,
-    };
-  }
-
-  if (status === 'abandoned') {
-    // Terminal, but not a delivery. An unattended worker deciding to cut a task
-    // is a judgement call it was never given, so it stops the run.
-    return {
-      ...none, verified: false, shape: 'abandoned', status, fileBlocker: true, halt: true,
-      reason: 'the task was abandoned, not shipped — a cut is a decision a worker does not get to make',
-      remedy: 'decide whether the cut was right; re-open the task if it was not',
-    };
-  }
-
-  if (WATCHED.includes(status)) {
-    // The three shapes strand-watch already names. Thresholds zeroed: the board
-    // sweep is allowed to wait, this is not (see the header).
-    const strand = classifyStrand(task, { nowMs, confirmedStaleMs: -1, completedStaleMs: -1 });
-    // classifyStrand fails QUIET on an unparseable updated_at — right for a line
-    // injected into every session, wrong here, where quiet means the loop calls a
-    // strand a success. The status alone decides the shape when the date will not
-    // parse; `unprovable` is the only shape that needs a field to be sure of.
-    const shape = strand ? strand.shape : (status === 'confirmed' ? 'unlanded' : 'ungraded');
-    const remedy = strand ? strand.remedy : (status === 'confirmed'
-      ? '/merge-mode is the documented manual fallback'
-      : '/grade-recover diagnoses which of the three shapes parked it');
-    return {
-      ...none, verified: false, shape, status, fileBlocker: true,
-      reason: {
-        unprovable: 'the reconciler probed this, could not prove a land, and gave up — it will never self-heal',
-        unlanded: 'the grade passed and the land never finished',
-        ungraded: 'the grade parked this; it is not waiting on a land',
-      }[shape],
-      strandReason: strand ? strand.reason : null,
-      remedy,
-    };
-  }
-
-  if (HELD_STATUSES.has(status)) {
-    // The worker is gone and the claim is not. This is the one shape that
-    // actually needs the claim released — and the only one where the link can
-    // then park the task, because release returns it to `ready`.
-    return {
-      ...none, verified: false, shape: 'still_held', status,
-      releaseClaim: true, fileBlocker: true, linkBlocker: true,
-      reason: `the worker exited with the task still at '${status}' — the claim outlived the session holding it`,
-      remedy: 'read the worker output in the run log; the tree may hold committed work',
-    };
-  }
-
-  if (status === 'blocked') {
-    // Already out of the pool with a blocker on it. Filing a second one would
-    // just be noise, and the loop will skip it on the next pick either way.
-    return {
-      ...none, verified: false, shape: 'blocked', status,
-      reason: 'the task is blocked — it is already out of the claimable pool',
-      remedy: 'resolve the blocker that is on it',
-    };
-  }
-
-  // `ready`, `backlog`, or anything a future migration adds. The worker either
-  // released the claim itself or never took it. Still not shipped, so it still
-  // gets a blocker: a task a worker could not finish will be picked straight back
-  // up next iteration otherwise, and fail the same way, for the whole window.
-  return {
-    ...none, verified: false, shape: 'not_started', status, fileBlocker: true, linkBlocker: true,
-    reason: `the worker returned with the task back at '${status}' — no work was recorded against it`,
-    remedy: 'read the worker output in the run log before re-queueing it',
-  };
-}
-
-// blockerFor — the row a shape becomes. Pure, so the wording is testable.
-//
-// `source_ref` is the DEDUPE KEY: POST /blockers has ON CONFLICT (source,
-// source_ref) DO NOTHING, so a second failure of the SAME shape on the SAME task
-// is skipped rather than piling up a column of identical blockers. The shape is
-// part of the key on purpose — a task that fails a DIFFERENT way is a different
-// fact and deserves to be said out loud.
-function blockerFor(v, { taskId, taskTitle = null, worker = null } = {}) {
-  const lines = [
-    `Autobongos verified task ${taskId} against the ledger after its worker exited, and it is not shipped.`,
-    '',
-    `**Ledger status:** \`${v.status || 'unreadable'}\`  ·  **shape:** \`${v.shape}\``,
-    `**What that means:** ${v.reason}`,
-  ];
-  if (v.strandReason) lines.push(`**Reconciler recorded:** \`${v.strandReason}\``);
-  if (worker && worker.outcome) {
-    lines.push('', `**What the worker reported:** \`${worker.outcome}\`${worker.reason ? ` — ${String(worker.reason).slice(0, 400)}` : ''}`);
-  }
-  if (v.remedy) lines.push('', `**Next:** ${v.remedy}`);
-  lines.push('', 'Filed by `scripts/gds/autobongos-verify.js`. The supervisor reads completion from Bongos, never from the session — a session exiting is not a task shipping (ADR 0307 §4).');
-
-  return {
-    title: `Autobongos: task ${taskId} came back ${v.shape}${taskTitle ? ` — ${String(taskTitle).slice(0, 120)}` : ''}`.slice(0, 200),
-    body_md: lines.join('\n'),
-    source: 'autobongos',
-    source_ref: `task-${taskId}-${v.shape}`,
-    ask: blockerAsk(v, { taskId }),
-  };
-}
-
-// The card a person answers (task 1004704): the shape as one decidable question.
-// fileBlocker sends it beside the row and files without it if it is refused.
-function blockerAsk(v, { taskId }) {
-  const shape = String((v && v.shape) || 'unfinished').replace(/_/g, ' ');
-  return {
-    question: `Requeue task ${taskId}, which came back ${shape}?`,
-    options: [
-      { key: 'requeue', label: 'Requeue it', result: 'The blocker closes and a runner may pick it up again.', act: 'go ahead' },
-      { key: 'keep', label: 'Keep it out', result: 'It stays out of the pool until someone looks.', act: 'not now' },
-    ],
-    recommend: { key: 'keep', why: 'Read the run log first; a second run may fail the same way.' },
-    waits_on: 'lead:automation',
-    if_nobody_answers: 'The task stays out of the pool.',
-  };
-}
-
-// ---------------------------------------------------------------------------
-// The I/O half
-// ---------------------------------------------------------------------------
-
-const runGit = (args, cwd) => new Promise((resolve) => {
-  execFile('git', args, { cwd, maxBuffer: 4 * 1024 * 1024 },
-    (err, stdout, stderr) => resolve({ ok: !err, stdout: stdout || '', stderr: stderr || '' }));
-});
-
-// probeArtifact — is there ANY trace of this task on main?
-//
-// Deliberately weak and deliberately cheap. It answers "is there a trace", not
-// "which commit is it": a body mention counts, because the question being asked
-// is the 1002459 question — was anything at all produced.
-//
-// WHAT COUNTS AS NAMING THE TASK (task 1004538). `(task N)` alone was too
-// narrow: the commits PR 1456 landed for task 1004513 never wrote it — the merge
-// subject names the ship BRANCH (`…/autobongos-1004513-978953`, or
-// `…/task-1004440` for a hand ship). So the old probe said "no artifact" even
-// after the land. Now git narrows by the bare id (fixed string, cheap) and
-// namesTask() makes the exact call in JS, never matching the prefix of a longer
-// id. The SUBJECT may name it as `task N` / `task-N` / `autobongos-N-`; the BODY
-// only as `(task N)`, because bodies routinely DISCUSS other tasks ("task 1004513
-// was flagged…" is in this very file's commit), and a mention is not an artifact.
-//
-// A probe that could not run returns `checked: false`, which classifyLedger
-// treats as no evidence either way.
-function namesTask(subject, body, id) {
-  const inSubject = new RegExp(`(?:\\btask[\\s-]+|\\bautobongos-)${id}(?!\\d)`, 'i');
-  const inBody = new RegExp(`\\(task ${id}\\)`, 'i');
-  return inSubject.test(String(subject || '')) || inBody.test(String(body || ''));
-}
-
-// `fetch: false` skips the fetch and reads the FETCH_HEAD a caller has just
-// fetched itself — recheckLands fetches once per pass, not once per task.
-async function probeArtifact(taskId, { git = runGit, cwd = REPO_ROOT, fetch = true } = {}) {
-  const id = String(taskId);
-  if (!/^\d{1,19}$/.test(id)) return { checked: false, reason: 'task id is not a plain number' };
-
-  if (fetch) {
-    const fetched = await git(['fetch', '-q', 'origin', 'main'], cwd);
-    if (!fetched.ok) {
-      return { checked: false, reason: `git fetch failed: ${(fetched.stderr || '').trim().slice(-200)}` };
-    }
-  }
-  // %x1f between fields, %x1e after each commit: a body may hold any text.
-  const log = await git(['log', 'FETCH_HEAD', '--max-count=50', '--format=%H%x1f%s%x1f%b%x1e', '-F', `--grep=${id}`], cwd);
-  if (!log.ok) return { checked: false, reason: `git log failed: ${(log.stderr || '').trim().slice(-200)}` };
-
-  for (const rec of log.stdout.split('\x1e')) {
-    const [sha, subject, body] = rec.replace(/^\s+/, '').split('\x1f');
-    if (!sha || !sha.trim()) continue;
-    if (namesTask(subject, body, id)) {
-      return { checked: true, onMain: true, sha: sha.trim(), subject: subject || null };
-    }
-  }
-  return { checked: true, onMain: false, sha: null, subject: null };
-}
-
-// fetchTask returns the row or null, and says WHY on a null. The reason is the
-// only thing a person reading the run log afterwards has to go on — "undetermined"
-// alone cannot tell an expired session from an unreachable instance.
-async function fetchTask(api, taskId) {
-  try {
-    const r = await api.tasks.getTasksId({ id: Number(taskId) });
-    if (!r || !r.ok) return { task: null, error: `GET /tasks/${taskId} → ${r ? r.status : 'no response'}` };
-    const task = r.data && r.data.task;
-    return task ? { task } : { task: null, error: `GET /tasks/${taskId} returned no task` };
-  } catch (e) { return { task: null, error: e && e.message ? e.message : String(e) }; }
-}
-
-// fileBlocker — create the row, then link it to the task.
-//
-// The two steps are separate calls and the SECOND one is what actually takes the
-// task out of the pool: POST /blockers only creates a row, and claimable_tasks
-// excludes a task through `task_blockers`, not through the blockers table. A
-// blocker filed and never linked is a note nobody reads.
-//
-// The link is rank-gated (metic+, `blocker.review`), while filing is open to any
-// builder. A runner below that rank still gets the blocker written down; the
-// result says the link did not happen rather than pretending it did.
-async function fileBlocker(api, row, { taskId, link }) {
-  let created = null;
-  try {
-    const { ask, ...body } = row;
-    const r = await postWithAsk((b) => api.blockers.postBlockers({ body: b }), body, ask);
-    if (!r || !r.ok) return { filed: false, reason: `POST /blockers → ${r ? r.status : 'no response'}`, linked: false };
-    if (r.data && r.data.skipped) return { filed: false, duplicate: true, reason: 'this task already carries a blocker of this shape', linked: false };
-    created = r.data && r.data.blocker;
-  } catch (e) { return { filed: false, reason: e && e.message ? e.message : String(e), linked: false }; }
-
-  if (!created || !created.id) return { filed: false, reason: 'POST /blockers returned no blocker', linked: false };
-  if (!link) return { filed: true, blockerId: created.id, linked: false };
-
-  try {
-    const r = await api.blockers.postBlockersIdLink({ id: Number(created.id), body: { task_id: Number(taskId) } });
-    // `blocked` is the server saying whether the task actually MOVED. It answers
-    // false when the task was not at `ready` — a dead link loop went unnoticed for
-    // six weeks on exactly that (task 1002559), so it is reported, not discarded.
-    return { filed: true, blockerId: created.id, linked: !!(r && r.ok), parked: !!(r && r.ok && r.data && r.data.blocked) };
-  } catch (e) { return { filed: true, blockerId: created.id, linked: false, reason: e && e.message ? e.message : String(e) }; }
-}
-
-// verifyShip — the whole step, in the order the order matters.
-//
-// RELEASE BEFORE LINK, always. linkBlockerToTask() parks the task only when it is
-// at `ready`; releasing is what puts it there. Link first and the row is written,
-// the task is not parked, and the release then hands it back to the pool — the
-// loop picks the same doomed task up next iteration and burns the window on it.
-async function verifyShip({ taskId, taskTitle = null, worker = null }, deps = {}) {
-  const api = deps.api || await (require('./cli-lib').cliClient)();
-  const probe = deps.probeArtifact || probeArtifact;
-  const release = deps.release || null;
-  const file = deps.fileBlocker || fileBlocker;
-  const act = deps.act !== false;
-
-  let task = deps.task;
-  let readError = null;
-  if (task === undefined) ({ task, error: readError } = await fetchTask(api, taskId));
-
-  // The artifact probe only earns its network round-trip when the ledger claims
-  // success. Every other shape is already not-shipped; what is on main cannot
-  // change that.
-  let artifact = null;
-  if (task && String(task.status) === 'shipped') {
-    artifact = await probe(taskId, { cwd: deps.cwd || REPO_ROOT });
-  }
-
-  const v = classifyLedger({ task, artifact, nowMs: deps.nowMs || Date.now(), ...(deps.landGraceMs ? { landGraceMs: deps.landGraceMs } : {}) });
-  const out = { ...v, task_id: String(taskId), artifact, released: false, blocker: null };
-  if (readError) out.read_error = readError;
-  if (!act) return out;
-
-  if (v.releaseClaim) {
-    // A caller that forgot to hand over a release function must not read as "no
-    // release was needed". Silently skipping the one write that unlocks a task is
-    // precisely the class of failure this whole step exists to catch.
-    if (!release) out.release_error = 'no release function was given to verifyShip — the claim is still held';
-    else {
-      const r = await release(taskId, `autobongos: ${v.shape} — ${String(v.reason || '').slice(0, 180)}`);
-      out.released = !!(r && r.ok);
-      if (!out.released) out.release_error = failureReason(r, 'release.js', 300);
-    }
-  }
-
-  if (v.fileBlocker) {
-    out.blocker = await file(api, blockerFor(v, { taskId, taskTitle: taskTitle || (task && task.title), worker }), {
-      taskId,
-      // Linking is only worth attempting where it can park the task. A shipped or
-      // mid-ship task is not claimable anyway, so a link there writes a row that
-      // changes nothing and muddies the blocker board.
-      link: v.linkBlocker && (out.released || String(v.status) === 'ready'),
-    });
-  }
-
-  return out;
-}
-
-// ---------------------------------------------------------------------------
-// Pending lands, across iterations and restarts (task 1004538)
-// ---------------------------------------------------------------------------
-
-// pendingLandIds — which tasks are still waiting on a land, from the run log.
-//
-// The run log is append-only JSONL on disk, so this survives a restart; nothing
-// lives only in memory. The LATEST verdict per task wins: a `worked` or
-// `land_recheck` row whose ledger_shape is `pending_land` keeps it on the list,
-// anything later (shipped, shipped_no_artifact, …) takes it off. The grace clock
-// itself is not here — it is the ledger's `shipped_at`, re-read on every check.
-function pendingLandIds(rows) {
-  const latest = new Map();
-  for (const r of rows || []) {
-    if (!r || typeof r !== 'object' || !r.task_id || !r.ledger_shape) continue;
-    if (r.event !== 'worked' && r.event !== 'land_recheck') continue;
-    latest.set(String(r.task_id), r.ledger_shape);
-  }
-  return Array.from(latest).filter(([, shape]) => shape === 'pending_land').map(([id]) => id);
-}
-
-const NO_ARTIFACT_REF = /^task-(\d{1,19})-shipped_no_artifact$/;
-
-// openNoArtifactBlockers — every open blocker this file filed as
-// `shipped_no_artifact`, read from the DATABASE (so a blocker filed by a
-// previous process, or before this code existed, is still found).
-//
-// GET /blockers lists OPEN blockers only (listOpenBlockers) — the owner's
-// to-do list, normally tens of rows — so one or two pages is the real cost; the
-// route has no source filter, hence the client-side match. Paged by the route's
-// own `page.total`. MAX_PAGES is a runaway guard, and hitting it is reported, not
-// silently treated as "looked everywhere".
-const BLOCKER_PAGE = 200;
-const MAX_BLOCKER_PAGES = 25;
-async function openNoArtifactBlockers(api) {
-  const out = [];
-  for (let page = 0; ; page++) {
-    if (page >= MAX_BLOCKER_PAGES) {
-      throw new Error(`more than ${MAX_BLOCKER_PAGES * BLOCKER_PAGE} open blockers — stopped paging; the ones past that were not checked`);
-    }
-    const offset = page * BLOCKER_PAGE;
-    const r = await api.blockers.getBlockers({ query: { limit: BLOCKER_PAGE, offset } });
-    if (!r || !r.ok) throw new Error(`GET /blockers → ${r ? r.status : 'no response'}`);
-    const rows = (r.data && r.data.blockers) || [];
-    for (const b of rows) {
-      const m = b && b.source === 'autobongos' && NO_ARTIFACT_REF.exec(String(b.source_ref || ''));
-      if (m && (!b.status || b.status === 'open')) out.push({ id: String(b.id), taskId: m[1] });
-    }
-    const total = r.data && r.data.page && Number(r.data.page.total);
-    if (!rows.length || (Number.isFinite(total) ? offset + rows.length >= total : rows.length < BLOCKER_PAGE)) break;
-  }
-  return out;
-}
-
-// recheckLands — one pass, run by the runner once per loop.
-//
-//   1. Every pending land is verified again. Inside the grace window it stays
-//      `pending_land` and nothing is filed; past it, verifyShip files the
-//      `shipped_no_artifact` blocker exactly as before. Shipped tasks are never
-//      released, so no release function is passed.
-//   2. Every OPEN `shipped_no_artifact` blocker is re-probed, and resolved with
-//      a note once main carries the commit — the false alarm closes itself.
-//      Only a probe that actually ran and found the commit resolves anything.
-//
-// I/O per pass: at most ONE `git fetch` (only when there is something to probe),
-// one `git log` per distinct task id, and the blocker list only when
-// `sweepBlockers` is not false — the runner sweeps hourly, not every loop.
-//
-// Never throws: a pass that fails is reported in `errors` and retried next loop.
-async function recheckLands({ pendingIds = [], sweepBlockers = true } = {}, deps = {}) {
-  const api = deps.api || await (require('./cli-lib').cliClient)();
-  const cwd = deps.cwd || REPO_ROOT;
-  const git = deps.git || runGit;
-  const out = { rechecked: [], resolved: [], errors: [] };
-
-  let open = [];
-  if (sweepBlockers) {
-    try { open = await openNoArtifactBlockers(api); }
-    catch (e) { out.errors.push(`blocker list: ${e && e.message ? e.message : String(e)}`); }
-  }
-
-  // One fetch for the whole pass; every probe then reads the same FETCH_HEAD.
-  // An injected probe owns its own I/O, so none is done for it.
-  let fetchFailed = null;
-  if (!deps.probeArtifact && (pendingIds.length || open.length)) {
-    const f = await git(['fetch', '-q', 'origin', 'main'], cwd);
-    if (!f.ok) fetchFailed = `git fetch failed: ${(f.stderr || '').trim().slice(-200)}`;
-  }
-  const rawProbe = deps.probeArtifact || ((id) => (fetchFailed
-    ? { checked: false, reason: fetchFailed }
-    : probeArtifact(id, { git, cwd, fetch: false })));
-  const memo = new Map();
-  const probe = (id) => {
-    if (!memo.has(String(id))) {
-      memo.set(String(id), (async () => rawProbe(id, { cwd }))()
-        .catch((e) => ({ checked: false, reason: e && e.message ? e.message : String(e) })));
-    }
-    return memo.get(String(id));
-  };
-
-  for (const id of pendingIds) {
-    try {
-      const v = await verifyShip({ taskId: id }, {
-        api, cwd, probeArtifact: (tid) => probe(tid),
-        ...(deps.fileBlocker ? { fileBlocker: deps.fileBlocker } : {}),
-        ...(deps.nowMs ? { nowMs: deps.nowMs } : {}),
-        ...(deps.landGraceMs ? { landGraceMs: deps.landGraceMs } : {}),
-      });
-      out.rechecked.push({
-        task_id: String(id), ledger_status: v.status, ledger_shape: v.shape, verified: !!v.verified,
-        ledger_reason: v.reason || null,
-        blocker_id: v.blocker && v.blocker.blockerId ? v.blocker.blockerId : null,
-      });
-    } catch (e) { out.errors.push(`task ${id}: ${e && e.message ? e.message : String(e)}`); }
-  }
-
-  for (const b of open) {
-    const a = await probe(b.taskId);
-    if (!a || !a.checked || !a.onMain) continue;
-    const sha = a.sha ? String(a.sha).slice(0, 9) : 'a commit';
-    const note = `Auto-resolved by autobongos-verify.js (task 1004538): main now carries ${sha}${a.subject ? ` ("${String(a.subject).slice(0, 120)}")` : ''}, which names task ${b.taskId}. The land was slow, not missing.`;
-    try {
-      const r = await api.blockers.postBlockersIdResolve({ id: Number(b.id), body: { resolution_note: note } });
-      if (r && r.ok) out.resolved.push({ blocker_id: b.id, task_id: b.taskId, sha });
-      else out.errors.push(`resolve blocker ${b.id} → ${r ? r.status : 'no response'}`);
-    } catch (e) { out.errors.push(`resolve blocker ${b.id}: ${e && e.message ? e.message : String(e)}`); }
-  }
-  return out;
-}
-
-// ---------------------------------------------------------------------------
-// CLI
-// ---------------------------------------------------------------------------
-
-async function main(argv) {
-  const taskId = argv.find((a) => /^\d+$/.test(a));
-  if (!taskId) {
-    console.error('usage: node scripts/gds/autobongos-verify.js <task-id> [--act] [--json]');
-    return 2;
-  }
-  const act = argv.includes('--act');
-  const release = async (id, reason) => new Promise((resolve) => {
-    execFile(process.execPath, [path.join(REPO_ROOT, 'scripts', 'gds', 'release.js'), String(id), '--reason', reason],
-      { cwd: REPO_ROOT }, (err, stdout, stderr) => resolve({ ok: !err, stdout: stdout || '', stderr: stderr || '' }));
-  });
-
-  const out = await verifyShip({ taskId }, { act, release });
-  if (argv.includes('--json')) { console.log(JSON.stringify(out, null, 2)); }
-  else {
-    console.log('');
-    console.log(`  task ${taskId}  ledger says: ${out.status || 'unreadable'}  →  ${out.shape}`);
-    console.log(`  ${out.reason}`);
-    if (out.remedy) console.log(`  next: ${out.remedy}`);
-    if (out.artifact && out.artifact.checked === false) console.log(`  (artifact not probed: ${out.artifact.reason})`);
-    if (out.released) console.log('  claim released');
-    if (out.blocker) console.log(`  blocker: ${out.blocker.filed ? `#${out.blocker.blockerId}${out.blocker.parked ? ' (task parked at blocked)' : out.blocker.linked ? ' (linked)' : ' (not linked)'}` : `not filed — ${out.blocker.reason}`}`);
-    if (!act && (out.releaseClaim || out.fileBlocker)) console.log('  (read-only — pass --act to release and file)');
-    console.log('');
-  }
-  return out.shape === 'undetermined' ? 2 : (out.verified ? 0 : 1);
-}
-
-if (require.main === module) {
-  main(process.argv.slice(2)).then((c) => process.exit(c)).catch((e) => {
-    console.error(`autobongos-verify: ${e && e.message ? e.message : e}`);
-    process.exit(2);
-  });
-}
-
-module.exports = {
-  classifyLedger, blockerFor, blockerAsk, probeArtifact, fileBlocker, verifyShip, failureReason,
-  LAND_GRACE_MS, namesTask, pendingLandIds, recheckLands,
-};
+require('../bongos/forwarder.js').forward(module, 'autobongos-verify.js');