@bongos/core 1.21.4 → 1.21.6

package/scripts/gds/autobongos-grade-cap.js

@@ -0,0 +1,187 @@
+'use strict';
+
+// scripts/gds/autobongos-grade-cap.js — the grade cap for ONE autonomous run
+// (task 1004536).
+//
+// THE RULE (owner, 2026-10-02): a task that fails the grade twice goes to the
+// owner instead of being retried. In one worker run a task gets its first grade
+// plus at most ONE re-grade. Evidence for why: grader-refusal loops were 48% of
+// all Autobongos spend for zero ships — task 1004512 cost $63.81 over three grade
+// rounds, task 1003564 $13.74. The worker prompt already said "return
+// cannot_complete if the grader refuses", and the worker ignored it. A prompt
+// line is not a limit.
+//
+// WHERE IT IS ENFORCED — one boundary, one courtesy:
+//   1. THE BOUNDARY is the supervisor (autobongos-run.js), and its count comes
+//      from the SERVER: every graded round is POSTed to /tasks/:id/grade and
+//      appended to `grade_attempts` (an append-only table the worker has no write
+//      path to). The supervisor notes the newest attempt before spawning, counts
+//      the rounds after it (roundsFromAttempts), kills a worker still running
+//      once two graded FAILs exist, and ends the run as needs_human whatever the
+//      worker's verdict says. Nothing on the worker's machine — env, files —
+//      feeds this count, so a worker cannot erase it. (A round the worker never
+//      POSTs cannot advance the task either, so it is not a way around the cap.)
+//   2. THE COURTESY is ship.js refusing to START a third grade (checkGradeCap at
+//      its entry, before any flag is read). The worker's own process holds that
+//      check's inputs — a run ledger named in env — so it is NOT the boundary; a
+//      worker could clear the variable. It exists because it is free and it stops
+//      an honest-but-stubborn worker before a third panel is paid for, rather
+//      than up to one supervisor poll later.
+//
+// The local ledger is ACTIVE ONLY when AUTOBONGOS_GRADE_LEDGER is set, which only
+// the supervisor does. A human running ship.js by hand is never capped.
+//
+// A GRADER OUTAGE DOES NOT COUNT. `signals.panel_outcome === 'unavailable'` means
+// the panel could not run (#943) — no findings, nothing to fix, not a quality
+// verdict. Counting it would hand a task to the owner because the grader was down.
+
+const fs = require('fs');
+const path = require('path');
+
+const LEDGER_ENV = 'AUTOBONGOS_GRADE_LEDGER';
+// The first grade + ONE re-grade. Not configurable on purpose: a cap the worker
+// could raise through env would be a cap it could talk its way past.
+const GRADE_CAP = 2;
+// ship.js's exit code for a capped run. Distinct from 1 (generic) and 2 (usage /
+// refused input) so a supervisor or a test can tell the cap from any other stop.
+const REFUSED_EXIT = 6;
+
+function ledgerPathFromEnv(env = process.env) {
+  const p = env[LEDGER_ENV];
+  return p && String(p).trim() ? String(p).trim() : null;
+}
+
+// isOutage — the grader never ran. Mirrors the #943 test the ship card and
+// ship-grade-steps use (signals.panel_outcome === 'unavailable').
+function isOutage(grade) {
+  return !!(grade && grade.signals && grade.signals.panel_outcome === 'unavailable');
+}
+
+// readLedger — every row, oldest first. A missing or unreadable file is an empty
+// ledger; a malformed line is skipped rather than fatal.
+function readLedger(file) {
+  if (!file) return [];
+  let raw = '';
+  try { raw = fs.readFileSync(file, 'utf8'); } catch (_) { return []; }
+  const rows = [];
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try { rows.push(JSON.parse(line)); } catch (_) { /* skip a torn line */ }
+  }
+  return rows;
+}
+
+// gradeCapState — pure over ledger rows: how many GRADED rounds (outages
+// excluded) this task has had in the run, and whether the cap is reached.
+function gradeCapState(rows, taskId) {
+  const mine = (rows || []).filter((r) => r && String(r.task_id) === String(taskId));
+  const graded = mine.filter((r) => !r.outage);
+  const fails = graded.filter((r) => r.passed !== true);
+  const passed = graded.some((r) => r.passed === true);
+  return {
+    graded: graded.length,
+    fails: fails.length,
+    outages: mine.length - graded.length,
+    passed,
+    capped: graded.length >= GRADE_CAP,
+    // The run should be handed to the owner: the cap is reached and none passed.
+    exhausted: !passed && fails.length >= GRADE_CAP,
+  };
+}
+
+// checkGradeCap — may ship.js start a grade for this task? `{ ok: true }` when no
+// ledger is in play (a human ship) or the cap has room.
+function checkGradeCap({ taskId, env = process.env } = {}) {
+  const file = ledgerPathFromEnv(env);
+  if (!file) return { ok: true, active: false };
+  const state = gradeCapState(readLedger(file), taskId);
+  // `exhausted`, not `capped`: a task whose second round PASSED still needs
+  // ship.js to resume its merge leg, and that must not be refused.
+  if (!state.exhausted) return { ok: true, active: true, state };
+  return {
+    ok: false, active: true, state,
+    lines: [
+      `Ship refused: task ${taskId} has already been graded ${state.graded} time(s) in this autonomous run — the cap is the first grade plus ONE re-grade (task 1004536).`,
+      'A task that fails the grade twice goes to the owner instead of being retried.',
+      'Stop now and return cannot_complete, quoting the grader\'s findings — the supervisor files the blocker.',
+      '(A GRADER UNAVAILABLE outcome is an outage and was not counted.)',
+    ],
+  };
+}
+
+// recordGradeOutcome — append one graded round. Best-effort: a write failure
+// must never fail the ship that just graded.
+function recordGradeOutcome({ taskId, grade, env = process.env, now = () => new Date().toISOString() } = {}) {
+  const file = ledgerPathFromEnv(env);
+  if (!file || !grade) return false;
+  const row = {
+    task_id: Number(taskId),
+    at: now(),
+    passed: grade.passed === true,
+    outage: isOutage(grade),
+    score: grade.score ?? null,
+  };
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, `${JSON.stringify(row)}\n`);
+    return true;
+  } catch (_) { return false; }
+}
+
+// ── the server's count (the boundary) ───────────────────────────────────────────
+//
+// `GET /tasks/:id?include=grade,grade_attempts` serves each recorded round as
+// { attempted_at, passed, workers: [{ kind, verdict, error, severities }] }.
+// The grader's own outage test (#943, grader.js) is "every GATING worker failed
+// to run"; the Narc is advisory (#481), so it is left out of that test the same
+// way. A round with no gating workers listed is not called an outage — it is
+// counted, because an unknown shape must not silently buy another round.
+const ADVISORY_KINDS = new Set(['narc']);
+function attemptIsOutage(attempt) {
+  const ws = Array.isArray(attempt && attempt.workers) ? attempt.workers : [];
+  const gating = ws.filter((w) => w && !ADVISORY_KINDS.has(w.kind));
+  return gating.length > 0 && gating.every((w) => w.error != null && w.error !== '');
+}
+
+// newestAttemptAt — the baseline, read BEFORE the worker starts. Rounds are
+// counted by being newer than this server timestamp, so the supervisor's own
+// clock never enters the comparison.
+function newestAttemptAt(attempts) {
+  let newest = null;
+  for (const a of attempts || []) {
+    const t = Date.parse(a && a.attempted_at);
+    if (Number.isFinite(t) && (newest === null || t > newest)) newest = t;
+  }
+  return newest;
+}
+
+// roundsFromAttempts — the server's rounds after the baseline, in ledger-row
+// shape so gradeCapState reads both sources the same way.
+function roundsFromAttempts(attempts, taskId, afterMs = null) {
+  const out = [];
+  for (const a of attempts || []) {
+    const t = Date.parse(a && a.attempted_at);
+    if (!Number.isFinite(t) || (afterMs !== null && t <= afterMs)) continue;
+    out.push({ task_id: Number(taskId), at: a.attempted_at, passed: a.passed === true, outage: attemptIsOutage(a) });
+  }
+  return out;
+}
+
+// readServerAttempts — the task's recorded rounds, or null when unreadable. Null
+// is "unknown", never "zero": the caller falls back to the local ledger.
+async function readServerAttempts(api, taskId) {
+  try {
+    if (!api || !api.tasks || typeof api.tasks.getTasksId !== 'function') return null;
+    const r = await api.tasks.getTasksId({ id: Number(taskId), query: { include: 'grade,grade_attempts' } });
+    if (!r || !r.ok || !r.data) return null;
+    const grade = r.data.grade;
+    if (!grade) return [];                       // never graded: a real zero
+    return Array.isArray(grade.attempts) ? grade.attempts : null;
+  } catch (_) { return null; }
+}
+
+module.exports = {
+  LEDGER_ENV, GRADE_CAP, REFUSED_EXIT,
+  ledgerPathFromEnv, isOutage, readLedger, gradeCapState, checkGradeCap, recordGradeOutcome,
+  attemptIsOutage, newestAttemptAt, roundsFromAttempts, readServerAttempts,
+};

package/scripts/gds/autobongos-loop.js

@@ -103,6 +103,10 @@ function buildWorkerPrompt({ task, packPath = 'docs/packs/engineer.md' } = {}) {
     '',
     'Ship it yourself when the work is done and verified: `node scripts/gds/ship.js <id> --no-surprise --notes \"...\" --summary \"...\"`. Do NOT pass --skip-grade and do not force any gate; if the grader or the merge refuses, that is the system protecting main — return cannot_complete and say so.',
     '',
+    // task 1004536: stated here so the worker does not waste a session trying —
+    // but ship.js and the supervisor enforce it, because this line alone was ignored.
+    'GRADE CAP: this run gets the first grade plus at most ONE re-grade (`node scripts/gds/ship.js <id> --regrade`). If the grade fails twice, STOP: do not fix and re-grade again — return cannot_complete with the grader\'s findings quoted, and the task goes to the owner. ship.js refuses a third grade in this run and the supervisor ends it. A "GRADER UNAVAILABLE" outcome is an outage, not a fail, and does not count toward the two.',
+    '',
     'When you are done, return the structured verdict. `undetermined_decisions` must list every choice you made that the spec did not settle — retry counts, naming, error shapes, anything a reviewer would want to have been asked about. An empty list is a claim that the spec determined everything; do not make it lightly.',
   ].join('\n');
 }

package/scripts/gds/autobongos-run.js

@@ -42,7 +42,8 @@ const gauge = require('./autonomy-gauge.js');
 const {
   buildWorkerArgs, buildWorkerPrompt, classifyRun, usageLimitHit, DEFAULT_MODEL, DEFAULT_WORKER_TIMEOUT_MS,
 } = require('./autobongos-loop.js');
-const { verifyShip, failureReason } = require('./autobongos-verify.js');
+const { verifyShip, failureReason, recheckLands, pendingLandIds } = require('./autobongos-verify.js');
+const gradeCap = require('./autobongos-grade-cap.js');
 const fence = require('../../modules/autonomy/fence.js');
 // The ADR 0043 protected-path registry, reused rather than re-derived. scripts/
 // sits outside the kernel boundary, so this direct core require is allowed here
@@ -51,6 +52,7 @@ const fence = require('../../modules/autonomy/fence.js');
 const { matchProtected } = require('../../src/bongos/permission-path-check');
 const { resolveEnv, envPrefix, LEGACY_ENV_PREFIXES } = require('../../src/instance-config');
 const cadence = require('../../modules/autonomy/cadence.js');
+const configIdle = require('../../modules/autonomy/config-idle.js');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
@@ -106,6 +108,58 @@ function record(entry) {
   return row;
 }
 
+// readRunLogRows — the run log back as rows, newest last. Only the TAIL is read
+// (a log that runs for weeks must not be slurped whole every loop), and a line
+// that will not parse — the half-written last line of a kill -9 — is skipped.
+function readRunLogRows(p = logPath(), maxBytes = 4 * 1024 * 1024) {
+  let text = '';
+  try {
+    const size = fs.statSync(p).size;
+    const fd = fs.openSync(p, 'r');
+    try {
+      const len = Math.min(size, maxBytes);
+      const buf = Buffer.alloc(len);
+      fs.readSync(fd, buf, 0, len, size - len);
+      text = buf.toString('utf8');
+    } finally { fs.closeSync(fd); }
+  } catch (_) { return []; }
+  const rows = [];
+  for (const line of text.split('\n')) {
+    if (!line.trim()) continue;
+    try { rows.push(JSON.parse(line)); } catch (_) { /* partial line */ }
+  }
+  return rows;
+}
+
+// recheckPendingLands — once per loop (task 1004538). Which tasks are waiting on
+// a land comes from the run log on disk and when they shipped comes from the
+// ledger, so a restart loses neither. Open `shipped_no_artifact` blockers are read
+// from the database and resolved once main carries the commit. Every outcome is a
+// row, so the next pass reads it back.
+//
+// The blocker sweep runs at most once per LAND_SWEEP_MS per process (and at once
+// after a restart): a false alarm closing within the hour is plenty, and the
+// open-blocker list need not be read on every loop. Pending lands are re-probed
+// every loop — and cost nothing when there are none.
+const LAND_SWEEP_MS = 60 * 60 * 1000;
+async function recheckPendingLands(deps = {}) {
+  const log = deps.record || record;
+  const st = deps.state || RUNNER_STATE;
+  const now = deps.now ? deps.now() : Date.now();
+  const sweepBlockers = !st.landSweepAt || now - st.landSweepAt >= LAND_SWEEP_MS;
+  const ids = pendingLandIds(readRunLogRows());
+  if (!ids.length && !sweepBlockers) return { rechecked: [], resolved: [], errors: [] };
+  const out = await recheckLands({ pendingIds: ids, sweepBlockers }, { ...(deps.api ? { api: deps.api } : {}), ...(deps.landDeps || {}) });
+  if (sweepBlockers) st.landSweepAt = now;
+  for (const r of out.rechecked) log({ event: 'land_recheck', ...r });
+  for (const r of out.resolved) {
+    log({ event: 'land_blocker_resolved', task_id: r.task_id, blocker_id: r.blocker_id, sha: r.sha,
+      reason: `main now carries ${r.sha} naming task ${r.task_id} — the no-artifact blocker was a slow land, resolved` });
+  }
+  if (out.errors.length) log({ event: 'land_recheck_failed', errors: out.errors.slice(0, 10) });
+  return out;
+}
+
 // pickedFrom — the row fields that say where a pick came from (task 1004453).
 // `priority` is true only when the fence named a priority goal AND this pick came
 // from it, so "the priority goal ran dry and the runner moved on" reads as
@@ -246,9 +300,41 @@ function resolveWorkerBin(env = process.env, platform = process.platform) {
   return { bin: 'claude', shell: true };
 }
 
+// gradeLedgerPath — the run's LOCAL ledger (task 1004536): the file ship.js reads
+// to refuse a third grade early. A fresh file per run, under the instance config
+// dir, never inside the task's tree. It is the courtesy half of the cap — see the
+// header of autobongos-grade-cap.js; the boundary is the server count below.
+const GRADE_CAP_WATCH_MS = 30_000;
+function gradeLedgerPath(taskId) {
+  const id = Number(taskId);
+  if (!Number.isSafeInteger(id) || id <= 0) throw new Error(`gradeLedgerPath: task id must be a positive integer, got ${taskId}`);
+  const name = path.join('autobongos-grades', `${id}-${Date.now()}-${crypto.randomBytes(3).toString('hex')}.jsonl`);
+  try { return require('../../src/instance-config.js').configPath(name); }
+  catch (_) { return path.join(os.tmpdir(), name); }
+}
+
+// gradeCapReader — how the supervisor counts this run's graded rounds.
+//
+// The SERVER's grade_attempts is the count that matters: the worker has no write
+// path to it, so clearing an env var or deleting a file cannot reset it. The
+// baseline is the newest attempt recorded BEFORE the worker starts; only rounds
+// after it belong to this run. When the server cannot be read, the local ledger
+// is the fallback — and either source showing the cap exhausted is enough.
+async function gradeCapReader({ api, taskId, ledger }) {
+  const before = await gradeCap.readServerAttempts(api, taskId);
+  const afterMs = before ? gradeCap.newestAttemptAt(before) : null;
+  return async function read() {
+    const local = gradeCap.gradeCapState(gradeCap.readLedger(ledger), taskId);
+    const attempts = before ? await gradeCap.readServerAttempts(api, taskId) : null;
+    if (!attempts) return { ...local, source: 'local' };
+    const server = gradeCap.gradeCapState(gradeCap.roundsFromAttempts(attempts, taskId, afterMs), taskId);
+    return server.exhausted || !local.exhausted ? { ...server, source: 'server' } : { ...local, source: 'local' };
+  };
+}
+
 // spawnWorker — one headless session, bounded by WALL CLOCK, in the task's own
 // working tree.
-async function spawnWorker({ task, model, timeoutMs, cwd, deps = {} }) {
+async function spawnWorker({ task, model, timeoutMs, cwd, gradeLedger = null, capCheck = null, deps = {} }) {
   const spawnFn = deps.spawn || spawn;
   const sessionId = deps.sessionId || crypto.randomUUID();   // pinned, so the session can be resumed
   const { bin, shell: workerShell } = deps.resolveBin ? deps.resolveBin() : resolveWorkerBin();
@@ -267,22 +353,42 @@ async function spawnWorker({ task, model, timeoutMs, cwd, deps = {} }) {
         stdio: ['pipe', 'pipe', 'pipe'],
         shell: workerShell,
         windowsHide: true,
-        env: workerEnv(),
+        // The run's local grade ledger (task 1004536): ship.js appends each graded
+        // round to it and refuses a third early. The worker can see this variable,
+        // so it is the courtesy half only — capCheck below is the boundary.
+        env: workerEnv(process.env, gradeLedger ? { [gradeCap.LEDGER_ENV]: gradeLedger } : {}),
       });
     } catch (e) { return resolve({ spawnError: e.message }); }
 
-    let stdout = ''; let stderr = ''; let timedOut = false; let truncated = false;
+    let stdout = ''; let stderr = ''; let timedOut = false; let truncated = false; let gradeCapped = false;
     const cap = (cur, d) => {
       if (cur.length >= MAX_WORKER_OUTPUT) { truncated = true; return cur; }
       return cur + String(d).slice(0, MAX_WORKER_OUTPUT - cur.length);
     };
     const timer = setTimeout(() => { timedOut = true; try { child.kill('SIGKILL'); } catch (_) {} }, timeoutMs);
+    // task 1004536: once the second graded FAIL is recorded the run is over — the
+    // task goes to the owner. capCheck reads the SERVER's grade_attempts (see
+    // gradeCapReader), so a worker that cleared the ledger env or deleted the file
+    // is still stopped. One read at a time: a slow API must not stack polls.
+    let capBusy = false;
+    const capWatch = capCheck ? setInterval(async () => {
+      if (capBusy || gradeCapped) return;
+      capBusy = true;
+      try {
+        if ((await capCheck()).exhausted) {
+          gradeCapped = true; clearInterval(capWatch);
+          try { child.kill('SIGKILL'); } catch (_) {}
+        }
+      } catch (_) { /* an unreadable count is retried next tick; the post-run read still decides */ }
+      capBusy = false;
+    }, deps.capWatchMs || GRADE_CAP_WATCH_MS) : null;
+    const stopWatch = () => { if (capWatch) clearInterval(capWatch); };
     child.stdout.on('data', (d) => { stdout = cap(stdout, d); });
     child.stderr.on('data', (d) => { stderr = cap(stderr, d); });
-    child.on('error', (e) => { clearTimeout(timer); resolve({ spawnError: e.message, sessionId }); });
+    child.on('error', (e) => { clearTimeout(timer); stopWatch(); resolve({ spawnError: e.message, sessionId }); });
     child.on('close', (code) => {
-      clearTimeout(timer);
-      resolve({ envelope: stdout, exitCode: code, timedOut, truncated, sessionId, stderr: stderr.slice(-2000) });
+      clearTimeout(timer); stopWatch();
+      resolve({ envelope: stdout, exitCode: code, timedOut, truncated, gradeCapped, sessionId, stderr: stderr.slice(-2000) });
     });
     child.stdin.end(prompt);
   });
@@ -368,7 +474,7 @@ const MAX_CLAIM_ATTEMPTS = 5;
 const LIMIT_UNKNOWN_RESET_MS = 30 * 60 * 1000;
 
 function newRunnerState() {
-  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null, mainHead: null };
+  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null, mainHead: null, landSweepAt: null };
 }
 const RUNNER_STATE = newRunnerState();
 
@@ -543,8 +649,24 @@ async function iteration(opts, deps = {}) {
 
   // 5. Work, in that tree.
   const started = Date.now();
-  const res = await spawnWork({ task, model: opts.model, timeoutMs: opts.timeoutMs, cwd: wtPath, deps });
-  const verdict = classifyRun(res);
+  const gradeLedger = deps.gradeLedgerPath ? deps.gradeLedgerPath(task.id) : gradeLedgerPath(task.id);
+  // Same client rule as verifyShip below: an injected api is used as given.
+  let capApi = deps.api || null;
+  if (!capApi) { try { capApi = await (require('./cli-lib').cliClient)(); } catch (_) { capApi = null; } }
+  const capCheck = await gradeCapReader({ api: capApi, taskId: task.id, ledger: gradeLedger });
+  const res = await spawnWork({ task, model: opts.model, timeoutMs: opts.timeoutMs, cwd: wtPath, gradeLedger, capCheck, deps });
+  let verdict = classifyRun(res);
+  // 5b. THE GRADE CAP (task 1004536). The owner's rule — a task that fails the
+  // grade twice goes to the owner — read from the run's ledger, not from the
+  // worker's verdict: the worker was told this in its prompt and kept re-grading.
+  const grades = await capCheck();
+  try { fs.rmSync(gradeLedger, { force: true }); } catch (_) {}   // its counts travel in the run-log row
+  if (grades && grades.exhausted) {
+    verdict = {
+      ...verdict, outcome: 'needs_human', releaseClaim: true,
+      reason: `the grade failed ${grades.fails} times in this run — handed to the owner instead of re-graded again (task 1004536)`,
+    };
+  }
   // Cut off by the usage limit? Recorded here so the NEXT iteration sleeps to the
   // reset instead of spawning a worker that will be cut off the same way.
   const limit = verdict.outcome === 'claims_shipped' ? null : usageLimitHit({ envelope: res.envelope, stderr: res.stderr });
@@ -580,6 +702,7 @@ async function iteration(opts, deps = {}) {
     outcome: verdict.outcome, reason: verdict.reason,
     session_id: res.sessionId || null, duration_s: Math.round((Date.now() - started) / 1000),
     cost_usd: verdict.costUsd ?? null,
+    ...(grades && (grades.graded || grades.outages) ? { grade_rounds: grades.graded, grade_outages: grades.outages, grade_cap_reached: grades.exhausted, grade_count_source: grades.source } : {}),
     output_truncated: !!res.truncated,
     ...(limit ? { usage_limit: { reset_at: limit.resetAt } } : {}),
     undetermined_decisions: verdict.verdict ? verdict.verdict.undetermined_decisions : null,
@@ -1054,7 +1177,14 @@ async function forever(opts, deps = {}) {
   // down the thing it watches is strictly worse than a gap in the log, and the gap
   // reports itself anyway: the hall reads the AGE of the last check-in, so a
   // failed beat shows up as silence, which is the signal.
-  const beat = async (fields) => {
+  // How long this runner has been idle on a setting the owner can fix (task
+  // 1004539). Past that setting's grace, every beat that is not about a task says
+  // `config_idle:<code>` instead of "waiting", so the hall shows the fix rather
+  // than "alive" for ten hours. Any row that is not that refusal ends the stretch.
+  let idle = null;
+  const clock = () => (deps.now ? deps.now() : Date.now());
+  const beat = async (rawFields) => {
+    const fields = configIdle.markBeat(rawFields, idle, clock());
     // The runner state is passed, not defaulted: the file names `disk_head` from
     // it (task 1004406), and an injected state must reach the beat that reports it.
     try { beatFile(Date.now(), deps.state || RUNNER_STATE); } catch (_) { /* a runner that cannot write its file still runs */ }
@@ -1081,6 +1211,15 @@ async function forever(opts, deps = {}) {
     // Every loop, so a crash leaves a heartbeat that goes stale on its own — the
     // runner never has to notice it is dying for its death to become visible.
     await beat({ mode: state.mode, consecutive_failures: state.consecutiveFailures, last_event: 'loop' });
+    // Slow lands (task 1004538): re-probe shipped tasks still waiting on main, and
+    // close no-artifact blockers whose commit has since landed. Armed only by
+    // main() (or an injected stub), like refreshInPlace, so no test harness that
+    // predates it can fall through to the network. It can never stop the loop.
+    if (opts.recheckLands || deps.recheckLands) {
+      try { await (deps.recheckLands || recheckPendingLands)(deps); } catch (e) {
+        log({ event: 'land_recheck_failed', errors: [e && e.message ? e.message : String(e)] });
+      }
+    }
     // In `probing` the runner takes exactly ONE task and only after its wait, so
     // a broken window costs a handful of cheap requests rather than a night of
     // failing spawns. `maxTasks` still bounds a full-speed burst.
@@ -1090,6 +1229,7 @@ async function forever(opts, deps = {}) {
     for (let i = 0; i < budget; i++) {
       row = await iterate(opts, deps);
       emit(row);
+      idle = configIdle.trackIdle(idle, row, clock());
       // Carry the task id so the hall can tell "quiet because it is building
       // task 1234" from "quiet because it is dead". A worker may hold the loop for
       // ninety minutes, and without this every honest hour of work looks like a
@@ -1161,7 +1301,7 @@ async function main(argv) {
   // it lived on the machine being fenced; the database owns that now, and an empty
   // `--goal` means "every allowlisted goal" rather than "anything claimable". The
   // refusal did not disappear — it moved somewhere the runner host cannot edit.
-  if (opts.forever) return forever({ ...opts, refreshInPlace: true });
+  if (opts.forever) return forever({ ...opts, refreshInPlace: true, recheckLands: true });
 
   // The one-shot path, kept for an operator running a single task by hand. It
   // still reconciles first: a leftover claim is a leftover claim whoever is
@@ -1186,8 +1326,9 @@ if (require.main === module) {
 
 module.exports = {
   readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, resolveWorkerBin,
-  worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
+  worktreeName, readFence, gradeLedgerPath, gradeCapReader, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
   isRunnerTree, RUNNER_TREE_RE, postHeartbeat, claudeAccountLabel, RUNNER_STARTED_AT, failureReason,
   newRunnerState, loadedFiles, supervisorTouched, refreshCheckout, LIMIT_UNKNOWN_RESET_MS, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
+  readRunLogRows, recheckPendingLands, LAND_SWEEP_MS,
 };