@bongos/core 1.21.5 → 1.21.6

package/modules/platform-identity/routes/sso.js

@@ -580,6 +580,9 @@ module.exports = function ssoRoutes() {
       // here, like disciplines: the shape is checked and hard-capped in
       // upsertActivity, next to the data, so no route can forget it.
       recent_ships: {},
+      // Each craft's own counts (task 1004440): untyped here for the same reason,
+      // shaped and capped in upsertActivity (craft-rollup.js sanitizeCrafts).
+      crafts: {},
     })) return;
     const b = req.body || {};
     try {
@@ -617,6 +620,7 @@ module.exports = function ssoRoutes() {
         rank: b.rank || null,
         disciplines: Array.isArray(b.disciplines) ? b.disciplines : [],
         recentShips: b.recent_ships,
+        crafts: b.crafts,
         // The AUTHENTICATED client's registered origin — the bound every pushed
         // ship link must fall inside (task 1002803). Taken from the client row,
         // never from the body, for the same reason client_id is.

package/modules/platform-identity/tests/platform-identity.mjs

@@ -602,7 +602,7 @@ await ta('upsertActivity upserts per (client_id, github_id) with the talent snap
   // an empty list when the sender reported none, never NULL. Its own cap,
   // shape and link bound are covered by tests/hub_recent_ships.mjs. The last param
   // is the report's as-of stamp (task 1004268): null when the sender gave none.
-  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]', null]);
+  assert.deepEqual(c.params, ['c1', 42, 100, 5, 3, 'metic', ['engineer'], '[]', null, '{}']);
 });
 
 await ta('upsertActivity sanitizes third-party self-report (ADR 0171 D7): off-ladder rank → null, disciplines validated + capped', async () => {

package/modules/provisioning/core-upgrade.js

@@ -250,14 +250,22 @@ function makeCoreUpgradeHandler({ provisioning, pool, parseId, validateOrRespond
  * and not asking it is what keeps the one comparison in the system (the runner's channel
  * resolution) the only one that can be wrong.
  *
- * An unknown `recommended` — the registry could not be read — leaves a failure STANDING.
- * Not knowing what is on offer is not evidence that the box recovered, and the direction
- * to fail in is showing an old failure, never hiding a live one.
+ * An UNREAD registry — `registryRead` false, the snapshot's `available` empty — leaves a
+ * failure STANDING. Not knowing what is on offer is not evidence that the box recovered,
+ * and the direction to fail in is showing an old failure, never hiding a live one. A
+ * registry that answered with nothing on offer is different: the box is current, and a
+ * failure about some other version is history (task 1004534).
  */
-function lastMoveSuperseded(target, served, recommended) {
+function lastMoveSuperseded(target, served, recommended, registryRead = false) {
   if (!target) return false;
   if (served && String(served) === String(target)) return true;
-  return !!(recommended && String(recommended) !== String(target));
+  if (recommended) return String(recommended) !== String(target);
+  // NOTHING ON OFFER FROM A REGISTRY THAT ANSWERED is an up-to-date box, not an unknown
+  // (task 1004534). The snapshot stores an empty `available` when the registry could not
+  // be read, so only that case leaves the failure standing. On 2026-10-02 cloudbongos
+  // served 1.21.5 with nothing newer in its rule, and a day-old failure about 1.20.73
+  // still led its /deploy page because a null recommendation was read as "unknown".
+  return !!(registryRead && served);
 }
 
 /**
@@ -371,7 +379,7 @@ function previewFromSnapshot(inst, snap, openIntent, lastMove) {
       // already moved past (task 1004172 — lastMoveSuperseded says why at length). The
       // CLIENT must not work this out: the page's standing rule is that it compares no
       // versions, and this is a version question wearing a different hat.
-      superseded: lastMoveSuperseded(lastMove.target_version, served, recommended),
+      superseded: lastMoveSuperseded(lastMove.target_version, served, recommended, available.length > 0),
       // Truncated because it reaches a DOM and upgrade.js's refusals can carry a whole
       // `git status` (the dirty-tree one lists every file). Never set on a DONE move:
       // a done row's last_error is the note below, and a move that worked is not an error.
@@ -468,6 +476,25 @@ function updateChannelOf(inst) {
   return UPDATE_CHANNELS.includes(c) ? c : DEFAULT_UPDATE_CHANNEL;
 }
 
+/**
+ * THIS hall's own update rule — the control-plane row's — for the offers the core makes
+ * outside /deploy: Settings → Software update and the hall's update banner (task 1004535).
+ * Those live in the core, which cannot read a module's table, so this is handed to them
+ * through the `provisioning.selfUpdateChannel` seam. Before it they asked with the platform
+ * default (patch) while the runner and the sweep followed the stored rule (minor on
+ * cloudbongos), so a step-up release would have read "up to date" there as it installed.
+ * null — no row, an unknown value, a failed read — means "use the default"; never throws.
+ */
+async function selfUpdateChannel(db) {
+  try {
+    const { rows } = await db.query("SELECT update_channel FROM provisioning_instances WHERE hosting_shape = 'control-plane' LIMIT 1");
+    const c = rows[0] && rows[0].update_channel;
+    return UPDATE_CHANNELS.includes(c) ? c : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * POST /provisioning/instances/:id/update-channel — set how far this project's core
  * may move (task 1004445). Body: { channel: 'pinned' | 'patch' | 'minor' }.
@@ -518,5 +545,5 @@ function makeUpdateChannelHandler({ provisioning, pool, parseId, validateOrRespo
   };
 }
 
-module.exports = { UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/module.json

@@ -35,7 +35,8 @@
     "provisioning.instanceState",
     "provisioning.projectPlanets",
     "provisioning.projectOwnedBy",
-    "provisioning.projectPublishIdentity"
+    "provisioning.projectPublishIdentity",
+    "provisioning.selfUpdateChannel"
   ],
   "consumes": []
 }

package/modules/provisioning/seams.js

@@ -6,6 +6,7 @@
 const api = require('../../src/module-api');
 const { pool } = api;
 const provisioning = require('./provisioning');
+const { selfUpdateChannel } = require('./core-upgrade');
 
 // The `provisioning.projectPublishIdentity` port (task 1003578, ADR 0247 D4): the name and
 // description the publish gate judges, for the control-plane project a hub catalog row was
@@ -49,6 +50,7 @@ function registerProvisioningSeams() {
   api.registerProvider('provisioning.projectPlanets', (hosts) => provisioning.planetChoicesForHosts(pool, hosts));
   api.registerProvider('provisioning.projectOwnedBy', (target) => provisioning.projectOwnedBy(pool, target));
   api.registerProvider('provisioning.projectPublishIdentity', (target) => projectPublishIdentity(pool, target));
+  api.registerProvider('provisioning.selfUpdateChannel', () => selfUpdateChannel(pool));
 }
 
 module.exports = { registerProvisioningSeams, projectPublishIdentity };

package/modules/public-landing/public/projects.states.json

@@ -41,6 +41,7 @@
     "in-new-terms-refused": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["click","#termsAck"],["wait",200]],"expect":{"visible":["#panel-fork"],"hidden":["#panel-what"],"attr":[["#wizStart","disabled",""],["#wizDemo","disabled",""]]}},
     "in-new-fork-demo": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizDemo"],["wait",300]],"expect":{"visible":["#panel-fork","#demoSetup","#demoFitVerdict","#demoInvites","#wizBack"],"hidden":["#forkIntro"],"attr":[["#wizDemo","aria-expanded","true"]]}},
     "in-new-demo-what": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizDemo"],["wait",300],["fill","#demoIdea","A voting app for movie night"],["click","#demoStart"],["wait",400]],"expect":{"visible":["#panel-what","#demoTag"],"hidden":["#panel-fork"],"text":[["#wizEyebrow","New demo"]]}},
+    "in-new-demo-review-address": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizDemo"],["wait",300],["fill","#demoIdea","A voting app for movie night"],["click","#demoStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-what button[type=submit]"],["wait",700],["click","#reviewRows .setRow[data-row=\"address\"] [data-row-chg]"],["wait",300],["fill","#f-slug","mercury"],["wait",900]],"expect":{"visible":["#panel-review","#reviewRows .setRow[data-row=\"address\"] .opts","#f-slug","#addrConfirm","#f-noaddr"],"hidden":["#panel-checks"],"attr":[["#reviewGo","disabled",""]],"text":[["#wizEyebrow","New demo"]]}},
     "in-new-what": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400]],"expect":{"visible":["#panel-what","#newName","#typeCards","#f-desc","#wizBack"],"hidden":["#panel-fork","#demoTag"],"attr":[["#wizRoom","data-screen","what"]]}},
     "in-new-name-prefilled": {"auth":true,"url":"/projects?view=new&name=Mercury","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400]],"expect":{"visible":["#panel-what","#newName"]}},
     "in-new-checks": {"auth":true,"url":"/projects?view=new","actions":[["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#panel-what button[type=submit]"],["wait",400]],"expect":{"visible":["#panel-checks","#physCountry","#physIntent"],"hidden":["#physAges","#physForms","#checksStop"],"attr":[["#wizRoom","data-screen","checks"]]}},

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.5",
+  "version": "1.21.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.5",
+      "version": "1.21.6",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.5",
+  "version": "1.21.6",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8730,5 +8730,63 @@
       "id": "1004439",
       "text": "The builders' Discord feed now announces artist and ideator moments, not only shipped tasks. When the board ratifies an idea, or a Full Idea passes its completeness check, the feed posts one line naming the person, with a link"
     }
+  ],
+  "1.21.6": [
+    {
+      "id": "1004524",
+      "text": "The governor now has a home: a small animated city at /builders/city, drawn exactly like the prototype. The nine civic buildings stand round the plaza, and every open goal is a district with a building for each of its tasks: f"
+    },
+    {
+      "id": "1004542",
+      "text": "Releases are unblocked. Three database tests had stopped passing since the hub-profile change, because they built their test database without its new column, and that held up every new release. They now include it."
+    },
+    {
+      "id": "1004541",
+      "text": "Builders can now choose their main role in Settings. Under their roles they pick which one leads their profile and their leaderboard entry, or let their work decide. Unticking a role that was their main one hands the choice ba"
+    },
+    {
+      "id": "1004507",
+      "text": "Every new project, demos included, now asks the founder to confirm its web address before anything is set up. The suggested address is only a suggestion until they confirm or change it."
+    },
+    {
+      "id": "1004538",
+      "text": "Autobongos no longer raises a false \"shipped but no code\" alarm when a merge is just slow. It waits up to a day, keeps re-checking, and closes the alarm by itself once the code lands. The stale alarm about task 1004513 is now"
+    },
+    {
+      "id": "1004539",
+      "text": "Autobongos now tells you when it is idle because of a setting you can fix, like no goals picked, instead of showing \"alive\" for hours. After a short grace, the Gate page and Settings show a warning with the fix, and Discord ge"
+    },
+    {
+      "id": "1004536",
+      "text": "Autobongos now stops after a task fails the grade twice in one run and hands it to the owner instead of paying for more grade rounds. Grader outages don't count toward the two."
+    },
+    {
+      "id": "1004535",
+      "text": "The Software update page in Settings and the update banner at the top of the hall now go by the update rule each project chose on /deploy. They no longer fall back to the platform default, so they can no longer say \"up to date"
+    },
+    {
+      "id": "1004534",
+      "text": "The deploy page no longer tells an up-to-date project that an update is \"waiting on your decision\". An update that had already happened was being reported as blocked by the update rule; it now counts as done, and an old failur"
+    },
+    {
+      "id": "1004520",
+      "text": "The nightly update check no longer trips over test4, a deleted test project, so its skip count now only shows real projects."
+    },
+    {
+      "id": "1004299",
+      "text": "New projects now start on the version the owner released, not on whatever unreleased version the Bongos hall happens to be running."
+    },
+    {
+      "id": "1004451",
+      "text": "cloudbongos.com now takes a step-up release on its own because of the update rule set on /deploy: on 1 Oct it moved from 1.20.83 to 1.21.1 unattended, under the \"minor\" rule, while the old roster file still said \"patch\"."
+    },
+    {
+      "id": "1004519",
+      "text": "hoodify-finance had been stuck on an old version since mid-September; the update lane now recognises the files its own last update left behind, so it can resume taking updates."
+    },
+    {
+      "id": "1004440",
+      "text": "A builder's profile on the Cloud Bongos hub now shows each craft's own work. An artist sees their approved pages, an ideator sees their filed, Full and board-ratified ideas, and the roles shown come from the work someone has a"
+    }
   ]
 }

package/scripts/gds/autobongos-grade-cap.js

@@ -0,0 +1,187 @@
+'use strict';
+
+// scripts/gds/autobongos-grade-cap.js — the grade cap for ONE autonomous run
+// (task 1004536).
+//
+// THE RULE (owner, 2026-10-02): a task that fails the grade twice goes to the
+// owner instead of being retried. In one worker run a task gets its first grade
+// plus at most ONE re-grade. Evidence for why: grader-refusal loops were 48% of
+// all Autobongos spend for zero ships — task 1004512 cost $63.81 over three grade
+// rounds, task 1003564 $13.74. The worker prompt already said "return
+// cannot_complete if the grader refuses", and the worker ignored it. A prompt
+// line is not a limit.
+//
+// WHERE IT IS ENFORCED — one boundary, one courtesy:
+//   1. THE BOUNDARY is the supervisor (autobongos-run.js), and its count comes
+//      from the SERVER: every graded round is POSTed to /tasks/:id/grade and
+//      appended to `grade_attempts` (an append-only table the worker has no write
+//      path to). The supervisor notes the newest attempt before spawning, counts
+//      the rounds after it (roundsFromAttempts), kills a worker still running
+//      once two graded FAILs exist, and ends the run as needs_human whatever the
+//      worker's verdict says. Nothing on the worker's machine — env, files —
+//      feeds this count, so a worker cannot erase it. (A round the worker never
+//      POSTs cannot advance the task either, so it is not a way around the cap.)
+//   2. THE COURTESY is ship.js refusing to START a third grade (checkGradeCap at
+//      its entry, before any flag is read). The worker's own process holds that
+//      check's inputs — a run ledger named in env — so it is NOT the boundary; a
+//      worker could clear the variable. It exists because it is free and it stops
+//      an honest-but-stubborn worker before a third panel is paid for, rather
+//      than up to one supervisor poll later.
+//
+// The local ledger is ACTIVE ONLY when AUTOBONGOS_GRADE_LEDGER is set, which only
+// the supervisor does. A human running ship.js by hand is never capped.
+//
+// A GRADER OUTAGE DOES NOT COUNT. `signals.panel_outcome === 'unavailable'` means
+// the panel could not run (#943) — no findings, nothing to fix, not a quality
+// verdict. Counting it would hand a task to the owner because the grader was down.
+
+const fs = require('fs');
+const path = require('path');
+
+const LEDGER_ENV = 'AUTOBONGOS_GRADE_LEDGER';
+// The first grade + ONE re-grade. Not configurable on purpose: a cap the worker
+// could raise through env would be a cap it could talk its way past.
+const GRADE_CAP = 2;
+// ship.js's exit code for a capped run. Distinct from 1 (generic) and 2 (usage /
+// refused input) so a supervisor or a test can tell the cap from any other stop.
+const REFUSED_EXIT = 6;
+
+function ledgerPathFromEnv(env = process.env) {
+  const p = env[LEDGER_ENV];
+  return p && String(p).trim() ? String(p).trim() : null;
+}
+
+// isOutage — the grader never ran. Mirrors the #943 test the ship card and
+// ship-grade-steps use (signals.panel_outcome === 'unavailable').
+function isOutage(grade) {
+  return !!(grade && grade.signals && grade.signals.panel_outcome === 'unavailable');
+}
+
+// readLedger — every row, oldest first. A missing or unreadable file is an empty
+// ledger; a malformed line is skipped rather than fatal.
+function readLedger(file) {
+  if (!file) return [];
+  let raw = '';
+  try { raw = fs.readFileSync(file, 'utf8'); } catch (_) { return []; }
+  const rows = [];
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    try { rows.push(JSON.parse(line)); } catch (_) { /* skip a torn line */ }
+  }
+  return rows;
+}
+
+// gradeCapState — pure over ledger rows: how many GRADED rounds (outages
+// excluded) this task has had in the run, and whether the cap is reached.
+function gradeCapState(rows, taskId) {
+  const mine = (rows || []).filter((r) => r && String(r.task_id) === String(taskId));
+  const graded = mine.filter((r) => !r.outage);
+  const fails = graded.filter((r) => r.passed !== true);
+  const passed = graded.some((r) => r.passed === true);
+  return {
+    graded: graded.length,
+    fails: fails.length,
+    outages: mine.length - graded.length,
+    passed,
+    capped: graded.length >= GRADE_CAP,
+    // The run should be handed to the owner: the cap is reached and none passed.
+    exhausted: !passed && fails.length >= GRADE_CAP,
+  };
+}
+
+// checkGradeCap — may ship.js start a grade for this task? `{ ok: true }` when no
+// ledger is in play (a human ship) or the cap has room.
+function checkGradeCap({ taskId, env = process.env } = {}) {
+  const file = ledgerPathFromEnv(env);
+  if (!file) return { ok: true, active: false };
+  const state = gradeCapState(readLedger(file), taskId);
+  // `exhausted`, not `capped`: a task whose second round PASSED still needs
+  // ship.js to resume its merge leg, and that must not be refused.
+  if (!state.exhausted) return { ok: true, active: true, state };
+  return {
+    ok: false, active: true, state,
+    lines: [
+      `Ship refused: task ${taskId} has already been graded ${state.graded} time(s) in this autonomous run — the cap is the first grade plus ONE re-grade (task 1004536).`,
+      'A task that fails the grade twice goes to the owner instead of being retried.',
+      'Stop now and return cannot_complete, quoting the grader\'s findings — the supervisor files the blocker.',
+      '(A GRADER UNAVAILABLE outcome is an outage and was not counted.)',
+    ],
+  };
+}
+
+// recordGradeOutcome — append one graded round. Best-effort: a write failure
+// must never fail the ship that just graded.
+function recordGradeOutcome({ taskId, grade, env = process.env, now = () => new Date().toISOString() } = {}) {
+  const file = ledgerPathFromEnv(env);
+  if (!file || !grade) return false;
+  const row = {
+    task_id: Number(taskId),
+    at: now(),
+    passed: grade.passed === true,
+    outage: isOutage(grade),
+    score: grade.score ?? null,
+  };
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.appendFileSync(file, `${JSON.stringify(row)}\n`);
+    return true;
+  } catch (_) { return false; }
+}
+
+// ── the server's count (the boundary) ───────────────────────────────────────────
+//
+// `GET /tasks/:id?include=grade,grade_attempts` serves each recorded round as
+// { attempted_at, passed, workers: [{ kind, verdict, error, severities }] }.
+// The grader's own outage test (#943, grader.js) is "every GATING worker failed
+// to run"; the Narc is advisory (#481), so it is left out of that test the same
+// way. A round with no gating workers listed is not called an outage — it is
+// counted, because an unknown shape must not silently buy another round.
+const ADVISORY_KINDS = new Set(['narc']);
+function attemptIsOutage(attempt) {
+  const ws = Array.isArray(attempt && attempt.workers) ? attempt.workers : [];
+  const gating = ws.filter((w) => w && !ADVISORY_KINDS.has(w.kind));
+  return gating.length > 0 && gating.every((w) => w.error != null && w.error !== '');
+}
+
+// newestAttemptAt — the baseline, read BEFORE the worker starts. Rounds are
+// counted by being newer than this server timestamp, so the supervisor's own
+// clock never enters the comparison.
+function newestAttemptAt(attempts) {
+  let newest = null;
+  for (const a of attempts || []) {
+    const t = Date.parse(a && a.attempted_at);
+    if (Number.isFinite(t) && (newest === null || t > newest)) newest = t;
+  }
+  return newest;
+}
+
+// roundsFromAttempts — the server's rounds after the baseline, in ledger-row
+// shape so gradeCapState reads both sources the same way.
+function roundsFromAttempts(attempts, taskId, afterMs = null) {
+  const out = [];
+  for (const a of attempts || []) {
+    const t = Date.parse(a && a.attempted_at);
+    if (!Number.isFinite(t) || (afterMs !== null && t <= afterMs)) continue;
+    out.push({ task_id: Number(taskId), at: a.attempted_at, passed: a.passed === true, outage: attemptIsOutage(a) });
+  }
+  return out;
+}
+
+// readServerAttempts — the task's recorded rounds, or null when unreadable. Null
+// is "unknown", never "zero": the caller falls back to the local ledger.
+async function readServerAttempts(api, taskId) {
+  try {
+    if (!api || !api.tasks || typeof api.tasks.getTasksId !== 'function') return null;
+    const r = await api.tasks.getTasksId({ id: Number(taskId), query: { include: 'grade,grade_attempts' } });
+    if (!r || !r.ok || !r.data) return null;
+    const grade = r.data.grade;
+    if (!grade) return [];                       // never graded: a real zero
+    return Array.isArray(grade.attempts) ? grade.attempts : null;
+  } catch (_) { return null; }
+}
+
+module.exports = {
+  LEDGER_ENV, GRADE_CAP, REFUSED_EXIT,
+  ledgerPathFromEnv, isOutage, readLedger, gradeCapState, checkGradeCap, recordGradeOutcome,
+  attemptIsOutage, newestAttemptAt, roundsFromAttempts, readServerAttempts,
+};

package/scripts/gds/autobongos-loop.js

@@ -103,6 +103,10 @@ function buildWorkerPrompt({ task, packPath = 'docs/packs/engineer.md' } = {}) {
     '',
     'Ship it yourself when the work is done and verified: `node scripts/gds/ship.js <id> --no-surprise --notes \"...\" --summary \"...\"`. Do NOT pass --skip-grade and do not force any gate; if the grader or the merge refuses, that is the system protecting main — return cannot_complete and say so.',
     '',
+    // task 1004536: stated here so the worker does not waste a session trying —
+    // but ship.js and the supervisor enforce it, because this line alone was ignored.
+    'GRADE CAP: this run gets the first grade plus at most ONE re-grade (`node scripts/gds/ship.js <id> --regrade`). If the grade fails twice, STOP: do not fix and re-grade again — return cannot_complete with the grader\'s findings quoted, and the task goes to the owner. ship.js refuses a third grade in this run and the supervisor ends it. A "GRADER UNAVAILABLE" outcome is an outage, not a fail, and does not count toward the two.',
+    '',
     'When you are done, return the structured verdict. `undetermined_decisions` must list every choice you made that the spec did not settle — retry counts, naming, error shapes, anything a reviewer would want to have been asked about. An empty list is a claim that the spec determined everything; do not make it lightly.',
   ].join('\n');
 }