@bongos/core 1.21.4 → 1.21.6

package/scripts/gds/autobongos-verify.js

@@ -72,6 +72,33 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // fail loudly here rather than silently reclassify a held claim as untouched.
 const HELD_STATUSES = new Set(['active', 'claimed', 'in_progress']);
 
+// LAND_GRACE_MS — how long a SHIPPED task may have nothing on main before that
+// is an owner's problem (task 1004538).
+//
+// The one place this file deliberately waits. Everywhere else the session that
+// was meant to finish the job has exited, so waiting cannot change the verdict.
+// A shipped task is different: the ship is done, and what is outstanding is the
+// LAND, which runs on the server's own clock and can legitimately take hours on a
+// red main. Task 1004513 was flagged at 22:24Z and its merge landed ~11 hours
+// later; the owner got a false alarm (blocker 1000185). A day covers that with
+// room to spare, and a genuinely codeless ship is already credited, so a day's
+// delay in saying so costs nothing. AUTOBONGOS_LAND_GRACE_HOURS overrides it.
+const LAND_GRACE_MS = (() => {
+  const h = Number(process.env.AUTOBONGOS_LAND_GRACE_HOURS);
+  return Number.isFinite(h) && h > 0 ? h * 3600_000 : 24 * 3600_000;
+})();
+
+// When the ship happened, from the LEDGER — never from this process, so a runner
+// restart cannot reset the clock. `shipped_at` first: `updated_at` moves on any
+// touch. Null when neither parses, which classifyLedger reads as "no grace".
+function shippedAtMs(task) {
+  for (const k of ['shipped_at', 'updated_at']) {
+    const t = Date.parse(task && task[k]);
+    if (Number.isFinite(t)) return t;
+  }
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // The pure half
 // ---------------------------------------------------------------------------
@@ -92,7 +119,7 @@ const HELD_STATUSES = new Set(['active', 'claimed', 'in_progress']);
 //                  modules/ideas/blockers.js is exactly ['ready']), which is why
 //                  the caller releases BEFORE it links.
 //   halt         — the run stops here rather than picking another task.
-function classifyLedger({ task, artifact = null, nowMs = Date.now() } = {}) {
+function classifyLedger({ task, artifact = null, nowMs = Date.now(), landGraceMs = LAND_GRACE_MS } = {}) {
   const none = { releaseClaim: false, fileBlocker: false, linkBlocker: false, halt: false };
 
   if (!task) {
@@ -110,6 +137,19 @@ function classifyLedger({ task, artifact = null, nowMs = Date.now() } = {}) {
 
   if (status === 'shipped') {
     if (artifact && artifact.checked && !artifact.onMain) {
+      // Not yet is not never (task 1004538). Inside the grace window this is a
+      // land still in flight: nothing is filed, and the runner re-probes it on
+      // later iterations (recheckLands). With no readable clock the grace cannot
+      // be measured, so it falls through to the strict verdict below.
+      const shippedAt = shippedAtMs(task);
+      if (shippedAt !== null && nowMs - shippedAt < landGraceMs) {
+        const hours = Math.round(landGraceMs / 3600_000);
+        return {
+          ...none, verified: false, shape: 'pending_land', status, pendingLand: true,
+          reason: 'shipped, but main does not carry a commit naming it yet — the land can take hours on a red main',
+          remedy: `nothing yet: the runner re-checks main on later iterations and files a blocker only if it is still missing ${hours}h after the ship`,
+        };
+      }
       // The flip happened with nothing behind it — tasks 1002459 and 1002792,
       // both credited, neither carrying a line of code on any branch. The task is
       // NOT released and NOT linked: it is shipped, credits are paid, and parking
@@ -240,26 +280,50 @@ const runGit = (args, cwd) => new Promise((resolve) => {
 //
 // Deliberately weak and deliberately cheap. It answers "is there a trace", not
 // "which commit is it": a body mention counts, because the question being asked
-// is the 1002459 question — was anything at all produced. The fixed-string grep
-// is against `(task N)`, the convention every ship commit follows.
+// is the 1002459 question — was anything at all produced.
+//
+// WHAT COUNTS AS NAMING THE TASK (task 1004538). `(task N)` alone was too
+// narrow: the commits PR 1456 landed for task 1004513 never wrote it — the merge
+// subject names the ship BRANCH (`…/autobongos-1004513-978953`, or
+// `…/task-1004440` for a hand ship). So the old probe said "no artifact" even
+// after the land. Now git narrows by the bare id (fixed string, cheap) and
+// namesTask() makes the exact call in JS, never matching the prefix of a longer
+// id. The SUBJECT may name it as `task N` / `task-N` / `autobongos-N-`; the BODY
+// only as `(task N)`, because bodies routinely DISCUSS other tasks ("task 1004513
+// was flagged…" is in this very file's commit), and a mention is not an artifact.
 //
 // A probe that could not run returns `checked: false`, which classifyLedger
 // treats as no evidence either way.
-async function probeArtifact(taskId, { git = runGit, cwd = REPO_ROOT } = {}) {
+function namesTask(subject, body, id) {
+  const inSubject = new RegExp(`(?:\\btask[\\s-]+|\\bautobongos-)${id}(?!\\d)`, 'i');
+  const inBody = new RegExp(`\\(task ${id}\\)`, 'i');
+  return inSubject.test(String(subject || '')) || inBody.test(String(body || ''));
+}
+
+// `fetch: false` skips the fetch and reads the FETCH_HEAD a caller has just
+// fetched itself — recheckLands fetches once per pass, not once per task.
+async function probeArtifact(taskId, { git = runGit, cwd = REPO_ROOT, fetch = true } = {}) {
   const id = String(taskId);
   if (!/^\d{1,19}$/.test(id)) return { checked: false, reason: 'task id is not a plain number' };
 
-  const fetched = await git(['fetch', '-q', 'origin', 'main'], cwd);
-  if (!fetched.ok) {
-    return { checked: false, reason: `git fetch failed: ${(fetched.stderr || '').trim().slice(-200)}` };
+  if (fetch) {
+    const fetched = await git(['fetch', '-q', 'origin', 'main'], cwd);
+    if (!fetched.ok) {
+      return { checked: false, reason: `git fetch failed: ${(fetched.stderr || '').trim().slice(-200)}` };
+    }
   }
-  const log = await git(['log', 'FETCH_HEAD', '--max-count=5', '--format=%H %s', '-F', `--grep=(task ${id})`], cwd);
+  // %x1f between fields, %x1e after each commit: a body may hold any text.
+  const log = await git(['log', 'FETCH_HEAD', '--max-count=50', '--format=%H%x1f%s%x1f%b%x1e', '-F', `--grep=${id}`], cwd);
   if (!log.ok) return { checked: false, reason: `git log failed: ${(log.stderr || '').trim().slice(-200)}` };
 
-  const first = log.stdout.split('\n').find((l) => l.trim());
-  if (!first) return { checked: true, onMain: false, sha: null, subject: null };
-  const sp = first.indexOf(' ');
-  return { checked: true, onMain: true, sha: first.slice(0, sp < 0 ? first.length : sp), subject: sp < 0 ? null : first.slice(sp + 1) };
+  for (const rec of log.stdout.split('\x1e')) {
+    const [sha, subject, body] = rec.replace(/^\s+/, '').split('\x1f');
+    if (!sha || !sha.trim()) continue;
+    if (namesTask(subject, body, id)) {
+      return { checked: true, onMain: true, sha: sha.trim(), subject: subject || null };
+    }
+  }
+  return { checked: true, onMain: false, sha: null, subject: null };
 }
 
 // fetchTask returns the row or null, and says WHY on a null. The reason is the
@@ -330,7 +394,7 @@ async function verifyShip({ taskId, taskTitle = null, worker = null }, deps = {}
     artifact = await probe(taskId, { cwd: deps.cwd || REPO_ROOT });
   }
 
-  const v = classifyLedger({ task, artifact, nowMs: deps.nowMs || Date.now() });
+  const v = classifyLedger({ task, artifact, nowMs: deps.nowMs || Date.now(), ...(deps.landGraceMs ? { landGraceMs: deps.landGraceMs } : {}) });
   const out = { ...v, task_id: String(taskId), artifact, released: false, blocker: null };
   if (readError) out.read_error = readError;
   if (!act) return out;
@@ -360,6 +424,136 @@ async function verifyShip({ taskId, taskTitle = null, worker = null }, deps = {}
   return out;
 }
 
+// ---------------------------------------------------------------------------
+// Pending lands, across iterations and restarts (task 1004538)
+// ---------------------------------------------------------------------------
+
+// pendingLandIds — which tasks are still waiting on a land, from the run log.
+//
+// The run log is append-only JSONL on disk, so this survives a restart; nothing
+// lives only in memory. The LATEST verdict per task wins: a `worked` or
+// `land_recheck` row whose ledger_shape is `pending_land` keeps it on the list,
+// anything later (shipped, shipped_no_artifact, …) takes it off. The grace clock
+// itself is not here — it is the ledger's `shipped_at`, re-read on every check.
+function pendingLandIds(rows) {
+  const latest = new Map();
+  for (const r of rows || []) {
+    if (!r || typeof r !== 'object' || !r.task_id || !r.ledger_shape) continue;
+    if (r.event !== 'worked' && r.event !== 'land_recheck') continue;
+    latest.set(String(r.task_id), r.ledger_shape);
+  }
+  return Array.from(latest).filter(([, shape]) => shape === 'pending_land').map(([id]) => id);
+}
+
+const NO_ARTIFACT_REF = /^task-(\d{1,19})-shipped_no_artifact$/;
+
+// openNoArtifactBlockers — every open blocker this file filed as
+// `shipped_no_artifact`, read from the DATABASE (so a blocker filed by a
+// previous process, or before this code existed, is still found).
+//
+// GET /blockers lists OPEN blockers only (listOpenBlockers) — the owner's
+// to-do list, normally tens of rows — so one or two pages is the real cost; the
+// route has no source filter, hence the client-side match. Paged by the route's
+// own `page.total`. MAX_PAGES is a runaway guard, and hitting it is reported, not
+// silently treated as "looked everywhere".
+const BLOCKER_PAGE = 200;
+const MAX_BLOCKER_PAGES = 25;
+async function openNoArtifactBlockers(api) {
+  const out = [];
+  for (let page = 0; ; page++) {
+    if (page >= MAX_BLOCKER_PAGES) {
+      throw new Error(`more than ${MAX_BLOCKER_PAGES * BLOCKER_PAGE} open blockers — stopped paging; the ones past that were not checked`);
+    }
+    const offset = page * BLOCKER_PAGE;
+    const r = await api.blockers.getBlockers({ query: { limit: BLOCKER_PAGE, offset } });
+    if (!r || !r.ok) throw new Error(`GET /blockers → ${r ? r.status : 'no response'}`);
+    const rows = (r.data && r.data.blockers) || [];
+    for (const b of rows) {
+      const m = b && b.source === 'autobongos' && NO_ARTIFACT_REF.exec(String(b.source_ref || ''));
+      if (m && (!b.status || b.status === 'open')) out.push({ id: String(b.id), taskId: m[1] });
+    }
+    const total = r.data && r.data.page && Number(r.data.page.total);
+    if (!rows.length || (Number.isFinite(total) ? offset + rows.length >= total : rows.length < BLOCKER_PAGE)) break;
+  }
+  return out;
+}
+
+// recheckLands — one pass, run by the runner once per loop.
+//
+//   1. Every pending land is verified again. Inside the grace window it stays
+//      `pending_land` and nothing is filed; past it, verifyShip files the
+//      `shipped_no_artifact` blocker exactly as before. Shipped tasks are never
+//      released, so no release function is passed.
+//   2. Every OPEN `shipped_no_artifact` blocker is re-probed, and resolved with
+//      a note once main carries the commit — the false alarm closes itself.
+//      Only a probe that actually ran and found the commit resolves anything.
+//
+// I/O per pass: at most ONE `git fetch` (only when there is something to probe),
+// one `git log` per distinct task id, and the blocker list only when
+// `sweepBlockers` is not false — the runner sweeps hourly, not every loop.
+//
+// Never throws: a pass that fails is reported in `errors` and retried next loop.
+async function recheckLands({ pendingIds = [], sweepBlockers = true } = {}, deps = {}) {
+  const api = deps.api || await (require('./cli-lib').cliClient)();
+  const cwd = deps.cwd || REPO_ROOT;
+  const git = deps.git || runGit;
+  const out = { rechecked: [], resolved: [], errors: [] };
+
+  let open = [];
+  if (sweepBlockers) {
+    try { open = await openNoArtifactBlockers(api); }
+    catch (e) { out.errors.push(`blocker list: ${e && e.message ? e.message : String(e)}`); }
+  }
+
+  // One fetch for the whole pass; every probe then reads the same FETCH_HEAD.
+  // An injected probe owns its own I/O, so none is done for it.
+  let fetchFailed = null;
+  if (!deps.probeArtifact && (pendingIds.length || open.length)) {
+    const f = await git(['fetch', '-q', 'origin', 'main'], cwd);
+    if (!f.ok) fetchFailed = `git fetch failed: ${(f.stderr || '').trim().slice(-200)}`;
+  }
+  const rawProbe = deps.probeArtifact || ((id) => (fetchFailed
+    ? { checked: false, reason: fetchFailed }
+    : probeArtifact(id, { git, cwd, fetch: false })));
+  const memo = new Map();
+  const probe = (id) => {
+    if (!memo.has(String(id))) {
+      memo.set(String(id), (async () => rawProbe(id, { cwd }))()
+        .catch((e) => ({ checked: false, reason: e && e.message ? e.message : String(e) })));
+    }
+    return memo.get(String(id));
+  };
+
+  for (const id of pendingIds) {
+    try {
+      const v = await verifyShip({ taskId: id }, {
+        api, cwd, probeArtifact: (tid) => probe(tid),
+        ...(deps.fileBlocker ? { fileBlocker: deps.fileBlocker } : {}),
+        ...(deps.nowMs ? { nowMs: deps.nowMs } : {}),
+        ...(deps.landGraceMs ? { landGraceMs: deps.landGraceMs } : {}),
+      });
+      out.rechecked.push({
+        task_id: String(id), ledger_status: v.status, ledger_shape: v.shape, verified: !!v.verified,
+        ledger_reason: v.reason || null,
+        blocker_id: v.blocker && v.blocker.blockerId ? v.blocker.blockerId : null,
+      });
+    } catch (e) { out.errors.push(`task ${id}: ${e && e.message ? e.message : String(e)}`); }
+  }
+
+  for (const b of open) {
+    const a = await probe(b.taskId);
+    if (!a || !a.checked || !a.onMain) continue;
+    const sha = a.sha ? String(a.sha).slice(0, 9) : 'a commit';
+    const note = `Auto-resolved by autobongos-verify.js (task 1004538): main now carries ${sha}${a.subject ? ` ("${String(a.subject).slice(0, 120)}")` : ''}, which names task ${b.taskId}. The land was slow, not missing.`;
+    try {
+      const r = await api.blockers.postBlockersIdResolve({ id: Number(b.id), body: { resolution_note: note } });
+      if (r && r.ok) out.resolved.push({ blocker_id: b.id, task_id: b.taskId, sha });
+      else out.errors.push(`resolve blocker ${b.id} → ${r ? r.status : 'no response'}`);
+    } catch (e) { out.errors.push(`resolve blocker ${b.id}: ${e && e.message ? e.message : String(e)}`); }
+  }
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // CLI
 // ---------------------------------------------------------------------------
@@ -399,4 +593,7 @@ if (require.main === module) {
   });
 }
 
-module.exports = { classifyLedger, blockerFor, probeArtifact, fileBlocker, verifyShip, failureReason };
+module.exports = {
+  classifyLedger, blockerFor, probeArtifact, fileBlocker, verifyShip, failureReason,
+  LAND_GRACE_MS, namesTask, pendingLandIds, recheckLands,
+};

package/scripts/gds/provision-core-upgrade.js

@@ -117,7 +117,7 @@ function parseSchemaPending(stdout) {
  * @param {string}   installed  the version running now
  * @param {string}   channel    this instance's update channel
  */
-function targetFault(to, available, installed, channel, channelAllows) {
+function targetFault(to, available, installed, channel, channelAllows, compare) {
   if (!Array.isArray(available) || available.length === 0) {
     return `could not read the published core versions from the registry — nothing was changed; the release may still be publishing (a tag is minted before the publish completes)`;
   }
@@ -136,6 +136,18 @@ function targetFault(to, available, installed, channel, channelAllows) {
   if (!installed) {
     return `could not read the core version installed at this instance — nothing was changed. An upgrade that cannot say where it is starting from cannot be bounded by the '${channel}' channel.`;
   }
+  // A TARGET THE BOX HAS ALREADY REACHED IS NOT A CHANNEL QUESTION (task 1004534).
+  // channelAllows answers "may an unattended jump go here" and says no to anything not
+  // strictly newer, so on 2026-10-01 a press for 1.20.73, landed a minute earlier by the
+  // sweep, was reported as "outside this project's 'minor' update channel … across a major
+  // version or onto a prerelease" — false on every count, and it put a "your call" card on
+  // /deploy for a project that was simply up to date. Already there: no fault, so the
+  // caller's already-serving no-op answers it. Already past it: say that, in words that
+  // classify as a downgrade, never as the update rule.
+  if (installed === to) return null;
+  if (compare && compare(to, installed) < 0) {
+    return `core ${to} is older than the core this project already runs (it already runs core ${installed}) — nothing was changed. A move never goes back to an older core on its own.`;
+  }
   if (channelAllows && !channelAllows(installed, to, channel)) {
     return `core ${to} is outside this project's '${channel}' update channel — nothing was changed. ${channelNextStep(channel)}`;
   }
@@ -276,7 +288,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   const channel = instanceChannel(inst, channelMod);
   const listed = offeredVersions(channelMod, inst, instanceDir);
   const available = (listed && listed.versions) || [];
-  const fault = targetFault(to, available, installed, channel, channelMod.channelAllows);
+  const fault = targetFault(to, available, installed, channel, channelMod.channelAllows, channelMod.compareSemver);
   if (fault) return failed(outcome.runnerReason(fault), fault);
   if (installed && installed === to) {
     // `bongos upgrade` would no-op on this too, but saying so here keeps a re-drained

package/scripts/gds/provision-repo.js

@@ -19,6 +19,7 @@ const { CONFIG, REPO_ROOT, coreVersionSafe, provisionerBotEmail, provisionerBotN
 // upgrade.js can reach these three without pulling provision*.js into the merge
 // resolver's executed closure; re-exported below so every existing caller is unchanged.
 const { instanceRepoRemote, parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo-auth.js');
+const { CORE_PKG, compareSemver, isStable } = require('./update-channel.js');
 
 function dbName(inst) { return inst.db_name || inst.slug; }
 
@@ -500,8 +501,49 @@ function coreCheckoutHasGit({ repoRoot = REPO_ROOT, fsImpl = fs } = {}) {
   return fsImpl.existsSync(path.join(repoRoot, '.git'));
 }
 
+// The core version THIS control plane runs — what the ladder below would vend: the
+// pinned tarball's version, else the registry-installed package's, else the checkout's
+// CORE_VERSION. fs reads only → dry-run safe.
+function runningCoreVersion({ instanceRoot, coreV }) {
+  const pinned = installedCoreTarball({ instanceRoot });
+  if (pinned) return require('./upgrade').versionFromTgzPath(path.basename(pinned)) || coreV;
+  const packSrc = installedCorePackDir({ instanceRoot });
+  return packSrc ? packSrc.version : coreV;
+}
+
+// Which core a hosted project is given (task 1004299, ADR 0361 D5). PURE. Since merges
+// publish as candidates, the platform hall runs ahead of the registry's `latest` label by
+// design — and the ladder below vends whatever the hall runs, so every new project would
+// be born on a version nobody released. When the hall is AHEAD of the release, the project
+// gets the release instead. Equal (or the hall behind it, which a release can't normally
+// produce) → the running core, byte-exact, as before.
+//
+// No readable label → the running core, deliberately (fail-open). Until candidates are
+// armed the running core IS the release; vendoring is the path that works with no
+// registry at all (ADR 0292); and refusing project creation over a registry blip is worse
+// for the person creating it than a newer-than-released core in the rare outage window.
+function projectCoreDecision({ running, released }) {
+  if (!released || !isStable(released)) return { version: running, source: 'running', reason: 'no readable released (latest) label — using the core this hall runs' };
+  if (compareSemver(running, released) > 0) return { version: released, source: 'released', reason: `this hall runs ${running}, ahead of the release` };
+  return { version: running, source: 'running', reason: `this hall runs the released core ${released}` };
+}
+
+// The I/O half: read the `latest` label through the injected exec (so a dry run and the
+// test harness's stub exec never touch the network), then decide. `npm view` is fine
+// here — provisioning is a runner script, not a request handler (ADR 0293's objection).
+function projectCoreTarget({ instanceRoot, coreV, exec, log, tag = '[core]' }) {
+  const running = runningCoreVersion({ instanceRoot, coreV });
+  const res = exec(`npm view ${CORE_PKG} dist-tags.latest`, { allowFail: true });
+  const label = String((res && res.ok !== false && res.stdout) || '').trim();
+  const decision = projectCoreDecision({ running, released: label || null });
+  log(`  ${tag} ${decision.source === 'released' ? `giving the project the RELEASED core ${decision.version}` : `giving the project core ${decision.version}`} — ${decision.reason} (task 1004299)`);
+  return decision;
+}
+
 // Resolve a vendorable @bongos/core tarball — the four-rung ladder, freshest-correct
-// first, shared by the fresh scaffold and the re-provision pin refresh (task 1003050):
+// first, shared by the fresh scaffold and the re-provision pin refresh (task 1003050).
+// A `target` from projectCoreTarget with source 'released' short-circuits it: the
+// project gets the released version packed from the registry, not this hall's core.
 //   1. a `file:`-pinned control plane reuses its own pinned tarball (task 1002275 —
 //      rebuilding via package-core.js aborts with an EMPTY core set when this runner
 //      IS a consumer instance, leaving new repos empty);
@@ -516,7 +558,16 @@ function coreCheckoutHasGit({ repoRoot = REPO_ROOT, fsImpl = fs } = {}) {
 //      rung 3's reproducible build is the better answer for the identical file set.
 // Returns { tgz, packDest } — packDest (set only on rung 2) is a temp dir the CALLER
 // must `rm -rf` once the tarball has been vendored.
-function resolveVendorableCoreTarball({ instanceRoot, repoRoot = REPO_ROOT, exec, log, coreV, tag = '[core]' }) {
+function resolveVendorableCoreTarball({ instanceRoot, repoRoot = REPO_ROOT, exec, log, coreV, tag = '[core]', target = null }) {
+  if (target && target.source === 'released') {
+    // target.version passed isStable (digits and dots only), so it is shell-safe.
+    const v = target.version;
+    const packDest = path.join(os.tmpdir(), `bongos-core-released-${v}`);
+    log(`  ${tag} packing the released core ${v} from the registry — not the candidate this hall runs (task 1004299)`);
+    exec(`mkdir -p ${packDest}`);
+    exec(`npm pack ${CORE_PKG}@${v} --pack-destination ${packDest}`);
+    return { tgz: path.join(packDest, `bongos-core-${v}.tgz`), packDest };
+  }
   const pinned = installedCoreTarball({ instanceRoot });
   if (pinned) {
     log(`  ${tag} reusing the pinned core tarball this control plane runs (${path.basename(pinned)}) — no source rebuild (task 1002275)`);
@@ -629,9 +680,12 @@ async function scaffoldStandaloneRepo(inst, deps) {
     throw new Error('cannot resolve the core version (src/module-api CORE_VERSION) — run the scaffold from the control-plane checkout.');
   }
   const remote = instanceRepoRemote(repo);
+  // The released core, not this hall's candidate (task 1004299).
+  const target = projectCoreTarget({ instanceRoot: deps.instanceRoot, coreV, exec, log, tag: '[scaffold] core:' });
+  const pinV = target.version;
   log(mode === 'adopt'
-    ? `  [scaffold] ${repo.owner}/${repo.name} → ${root} (ADOPT: clone → layer additively → pin core ${coreV} → commit → fast-forward push)`
-    : `  [scaffold] ${repo.owner}/${repo.name} → ${root} (clone → materialize → pin core ${coreV} → commit → push)`);
+    ? `  [scaffold] ${repo.owner}/${repo.name} → ${root} (ADOPT: clone → layer additively → pin core ${pinV} → commit → fast-forward push)`
+    : `  [scaffold] ${repo.owner}/${repo.name} → ${root} (clone → materialize → pin core ${pinV} → commit → push)`);
 
   // Owner login = the founding firstAdmin. Best-effort; the spec falls back to the repo owner.
   const ownerLogin = await ownerLoginOf(inst, db);
@@ -743,7 +797,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     // Vendored tarball — resolveVendorableCoreTarball's four-rung ladder (shared
     // with the re-provision pin refresh, task 1003050).
     const { tgz, packDest } = resolveVendorableCoreTarball({
-      instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:',
+      instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[scaffold] core install:', target,
     });
     exec(`node scripts/gds/init.js --from ${specPath} --dir ${root} --no-seed ${modeFlags} --vendor-core ${tgz}`);
     // init --vendor-core COPIED the tarball into the child's vendor/ — the temp pack dir is spent.
@@ -775,8 +829,8 @@ async function scaffoldStandaloneRepo(inst, deps) {
     exec(`git -C ${root} config user.email "${provisionerBotEmail()}"`);
     exec(`git -C ${root} add -A`);
     const commitMsg = mode === 'adopt'
-      ? `chore: adopt Cloud Bongos onto ${inst.slug} on a pinned @bongos/core ${coreV} (provision.js, ADR 0121)`
-      : `chore: scaffold ${inst.slug} on a pinned @bongos/core ${coreV} (provision.js, ADR 0108)`;
+      ? `chore: adopt Cloud Bongos onto ${inst.slug} on a pinned @bongos/core ${pinV} (provision.js, ADR 0121)`
+      : `chore: scaffold ${inst.slug} on a pinned @bongos/core ${pinV} (provision.js, ADR 0108)`;
     exec(`git -C ${root} commit -m "${commitMsg}"`, { allowFail: true });
 
     // Push. NO --force on either path, ever (see the function header): the ADR 0155 `repo`
@@ -1078,16 +1132,23 @@ async function refreshStandaloneCorePin(inst, deps) {
   let pkg = null;
   try { pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')); } catch { /* unreadable → skip below */ }
   const pinnedDep = pkg && ((pkg.dependencies || {})['@bongos/core'] || (pkg.devDependencies || {})['@bongos/core']);
-  const plan = planCorePinRefresh({ pinnedDep, coreVersion: coreV });
-  if (plan.action === 'skip') { log(`  [core-pin] ${plan.reason}`); return plan; }
-  if (plan.action === 'current') { log(`  [core-pin] committed pin already matches the running core (${coreV})`); return plan; }
-  log(`  [core-pin] committed pin ${safeVersionLabel(plan.pinned)} trails this control plane's core ${coreV} — refreshing so the next repo-driven deploy cannot roll the instance back (task 1003050)`);
+  if (!/^file:/.test(String(pinnedDep || '').trim())) {
+    const plan = planCorePinRefresh({ pinnedDep, coreVersion: coreV });
+    log(`  [core-pin] ${plan.reason}`); return plan;
+  }
+  // Heal toward the core a project is GIVEN — the release when this hall runs ahead of it —
+  // or the pin a brand-new project was just born on is bumped straight back to the
+  // candidate in the same provisioning run (task 1004299).
+  const target = projectCoreTarget({ instanceRoot: deps.instanceRoot, coreV, exec, log, tag: '[core-pin]' });
+  const plan = planCorePinRefresh({ pinnedDep, coreVersion: target.version });
+  if (plan.action === 'current') { log(`  [core-pin] committed pin already matches the core this project is given (${target.version})`); return plan; }
+  log(`  [core-pin] committed pin ${safeVersionLabel(plan.pinned)} differs from the core this project is given (${target.version}) — refreshing so the next repo-driven deploy cannot roll the instance back (task 1003050)`);
 
   const { tgz, packDest } = resolveVendorableCoreTarball({
-    instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[core-pin]',
+    instanceRoot: deps.instanceRoot, exec, log, coreV, tag: '[core-pin]', target,
   });
   try {
-    const targetVersion = upgrade.versionFromTgzPath(path.basename(tgz)) || coreV;
+    const targetVersion = upgrade.versionFromTgzPath(path.basename(tgz)) || target.version;
     const vendorRel = upgrade.vendorTarball({ instanceDir: root, fromTgz: tgz, targetVersion });
     // Prune superseded vendored tarballs (+ manifests) so the repo carries exactly ONE
     // core. fs.rmSync, NOT exec — a filename comes off the instance's own (lower-trust)
@@ -1176,6 +1237,9 @@ module.exports = {
   refreshStandaloneCorePin,
   resolveOwnerGithubToken,
   resolveVendorableCoreTarball,
+  projectCoreDecision,
+  projectCoreTarget,
+  runningCoreVersion,
   safeVersionLabel,
   scaffoldStandaloneRepo,
   seedFirstVersionCmd,

package/scripts/gds/ship-flow.js

@@ -31,6 +31,9 @@ const tweakHold = require('../../modules/lifecycle/page-tweak-hold.js');
 const { evaluateRegradeEligibility, evaluateResumeAction, resumeMerge, shouldConfirmWithoutGrade } = require('./ship-resume.js');
 const { fileNoArtifactEscalation, noArtifactRefusalLines } = require('./ship-escalation.js');
 const { noteServerReward } = require('./ship-state.js');
+// task 1004536: each graded round lands in the autonomous run's ledger (inert
+// without one), so ship.js can refuse a third grade at its entry point.
+const { recordGradeOutcome } = require('./autobongos-grade-cap.js');
 
 // ---------- Main flow ----------
 
@@ -695,6 +698,7 @@ async function shipMain() {
     }
 
     const g = gradePost.data.grade;
+    recordGradeOutcome({ taskId, grade: g });
     gradeObj = g;
     gradePassed = g.passed;
     advanceToMerge = gradePost.data.advanceToMerge;
@@ -1101,6 +1105,7 @@ async function regradeMain() {
   }
 
   const g = gradePost.data.grade;
+  recordGradeOutcome({ taskId, grade: g });
   const postGradeStatus = gradePost.data.taskStatus;
   printGradeOutcome(g, taskId);
   printCreditsAndAchievements({

package/scripts/gds/ship-preflight-steps.js

@@ -82,7 +82,8 @@ const TOOLING_PATHSPECS = Object.freeze([
   'scripts/gds/ship*.js',           // ship.js + every ship-*.js carved out of it
   'scripts/gds/smoke-gds.js',
   'scripts/gds/cli-lib.js',
-  'modules/grading/grader*',        // grader.js, grader-*.js, grader-rubric.json, grader-workers/
+  'scripts/gds/autobongos-grade-cap.js', // ship.js's entry refuses a capped run with it (task 1004536)
+  'modules/grading/grader*',       // grader.js, grader-*.js, grader-rubric.json, grader-workers/
   'modules/grading/grade-engine.js', // grader.js requires it (task 1002839)
 ]);
 

package/scripts/gds/ship.js

@@ -348,6 +348,16 @@ if (require.main === module) {
     console.log(require('./ship-deploy-target.js').resolveDeployMode());
     process.exit(0);
   }
+  // task 1004536: the autonomous-run grade cap — the first grade plus ONE
+  // re-grade. Checked HERE, before either flow and before any flag is read, so
+  // --regrade, a plain re-ship that resumes the grade, and --skip-grade are all
+  // refused alike. Inert unless the Autobongos supervisor set the run's ledger.
+  const { checkGradeCap, REFUSED_EXIT } = require('./autobongos-grade-cap.js');
+  const gradeCap = checkGradeCap({ taskId: Number(process.argv[2]) });
+  if (!gradeCap.ok) {
+    for (const line of gradeCap.lines) console.error(line);
+    process.exit(REFUSED_EXIT);
+  }
   // #678: --regrade re-grades a grade-failed `completed` task (no claim needed).
   // Dispatched here so it owns its own arg-parsing + session bootstrap.
   const main = process.argv.slice(2).includes('--regrade') ? regradeMain : shipMain;

package/scripts/gds/update-sweep.js

@@ -103,6 +103,9 @@ function git(dir, args, run = spawnSync) {
   return { ok, stdout: (r && r.stdout) || '', stderr: (r && r.stderr) || '', status: r ? r.status : null };
 }
 
+// The sweep's own materialize preview — the fallback for an instance core that predates it.
+function ownWillRewrite() { return require('./claude-materialize.js').materializeWillRewrite; }
+
 // The instance-relative paths THIS upgrade writes into the instance's own tree — the provenance
 // answer pinState's third bucket is sorted by.
 //
@@ -118,11 +121,21 @@ function git(dir, args, run = spawnSync) {
 //     It is the same function upgrade.js's own clean-tree pre-flight waives dirt by, so the lane and
 //     the bump it spawns agree on what "this upgrade rewrote" means.
 //
-// FAIL-SOFT, and the direction is deliberate. An instance whose core predates either export, or whose
-// materialize throws, yields nothing here: every dirty path stays in `other` and the guard is exactly
-// as strict as it was before this function existed. The failure mode is "still wedged", never
-// "committed a stranger's work".
-function laneGeneratedPaths(instDir, { resolveFrom = coreModulePathFrom, load = require } = {}) {
+// A CORE TOO OLD TO ANSWER (task 1004519). materializeWillRewrite shipped in 1.19.933, and the
+// wedge it exists for is exactly the one that strands an instance on an OLDER core: hoodify-finance
+// took one bump to 1.19.871, which materialized 33 skills and committed nothing, and its core then
+// could not say those files were its own — so the set came back empty and every sweep halted on
+// them, forever. When the instance's core ships claude-materialize.js but not the preview, the
+// preview is asked of the sweep's OWN copy instead, run over the instance's INSTALLED core. That is
+// still provenance, not a glob: the file set is walked off that core's .claude/, the very files its
+// own upgrade materializes. And the sweep's copy is no longer the stale one the paragraph above
+// warns about — it runs from the platform's installed core (task 1004307), always the newest here.
+//
+// FAIL-SOFT, and the direction is deliberate. An instance whose core ships no materialize at all,
+// whose installed core has no .claude/skills to walk, or whose materialize throws, yields nothing
+// here: every dirty path stays in `other` and the guard is exactly as strict as it was before this
+// function existed. The failure mode is "still wedged", never "committed a stranger's work".
+function laneGeneratedPaths(instDir, { resolveFrom = coreModulePathFrom, load = require, own = ownWillRewrite } = {}) {
   const out = new Set();
   try {
     const p = resolveFrom(instDir, 'scripts/gds/upgrade.js');
@@ -130,13 +143,16 @@ function laneGeneratedPaths(instDir, { resolveFrom = coreModulePathFrom, load =
   } catch (_) { /* an older core, or one that will not load here — stay strict */ }
   try {
     const p = resolveFrom(instDir, 'scripts/gds/claude-materialize.js');
-    const willRewrite = p && load(p).materializeWillRewrite;
-    if (willRewrite) {
+    if (p) {
       // coreRoot is derived from where the module RESOLVED (<core>/scripts/gds/x.js → <core>), not
       // from a package-name guess: an instance may carry the core under any of its published names,
       // and in the monolith layout the core root IS the instance root (where materialize no-ops).
       const coreRoot = path.resolve(path.dirname(p), '..', '..');
-      for (const f of willRewrite({ instanceDir: instDir, coreRoot }, () => {}) || []) out.add(f);
+      const theirs = load(p).materializeWillRewrite;
+      // Only fall back where there is a real .claude/ to walk — an empty source still "writes" the
+      // provenance manifest, and that is a guess, not an answer.
+      const willRewrite = theirs || (fs.existsSync(path.join(coreRoot, '.claude', 'skills')) ? own() : null);
+      if (willRewrite) for (const f of willRewrite({ instanceDir: instDir, coreRoot }, () => {}) || []) out.add(f);
     }
   } catch (_) { /* same — a set we could not derive is an empty one, never a guessed one */ }
   return [...out];

package/scripts/gds/upgrade-outcome.js

@@ -136,6 +136,7 @@ function runnerReason(text) {
   if (/^could not read the published core versions/.test(s)) return 'registry_unreadable';
   if (/is not published yet/.test(s)) return 'not_published';
   if (/could not read the core version installed/.test(s)) return 'installed_unreadable';
+  if (/is older than the core this project already runs/.test(s)) return 'downgrade';
   if (/update channel/.test(s)) return 'outside_channel';
   return 'unknown';
 }