@bongos/core 1.21.5 → 1.21.6

package/scripts/gds/autobongos-run.js

@@ -42,7 +42,8 @@ const gauge = require('./autonomy-gauge.js');
 const {
   buildWorkerArgs, buildWorkerPrompt, classifyRun, usageLimitHit, DEFAULT_MODEL, DEFAULT_WORKER_TIMEOUT_MS,
 } = require('./autobongos-loop.js');
-const { verifyShip, failureReason } = require('./autobongos-verify.js');
+const { verifyShip, failureReason, recheckLands, pendingLandIds } = require('./autobongos-verify.js');
+const gradeCap = require('./autobongos-grade-cap.js');
 const fence = require('../../modules/autonomy/fence.js');
 // The ADR 0043 protected-path registry, reused rather than re-derived. scripts/
 // sits outside the kernel boundary, so this direct core require is allowed here
@@ -51,6 +52,7 @@ const fence = require('../../modules/autonomy/fence.js');
 const { matchProtected } = require('../../src/bongos/permission-path-check');
 const { resolveEnv, envPrefix, LEGACY_ENV_PREFIXES } = require('../../src/instance-config');
 const cadence = require('../../modules/autonomy/cadence.js');
+const configIdle = require('../../modules/autonomy/config-idle.js');
 
 const REPO_ROOT = path.resolve(__dirname, '..', '..');
 
@@ -106,6 +108,58 @@ function record(entry) {
   return row;
 }
 
+// readRunLogRows — the run log back as rows, newest last. Only the TAIL is read
+// (a log that runs for weeks must not be slurped whole every loop), and a line
+// that will not parse — the half-written last line of a kill -9 — is skipped.
+function readRunLogRows(p = logPath(), maxBytes = 4 * 1024 * 1024) {
+  let text = '';
+  try {
+    const size = fs.statSync(p).size;
+    const fd = fs.openSync(p, 'r');
+    try {
+      const len = Math.min(size, maxBytes);
+      const buf = Buffer.alloc(len);
+      fs.readSync(fd, buf, 0, len, size - len);
+      text = buf.toString('utf8');
+    } finally { fs.closeSync(fd); }
+  } catch (_) { return []; }
+  const rows = [];
+  for (const line of text.split('\n')) {
+    if (!line.trim()) continue;
+    try { rows.push(JSON.parse(line)); } catch (_) { /* partial line */ }
+  }
+  return rows;
+}
+
+// recheckPendingLands — once per loop (task 1004538). Which tasks are waiting on
+// a land comes from the run log on disk and when they shipped comes from the
+// ledger, so a restart loses neither. Open `shipped_no_artifact` blockers are read
+// from the database and resolved once main carries the commit. Every outcome is a
+// row, so the next pass reads it back.
+//
+// The blocker sweep runs at most once per LAND_SWEEP_MS per process (and at once
+// after a restart): a false alarm closing within the hour is plenty, and the
+// open-blocker list need not be read on every loop. Pending lands are re-probed
+// every loop — and cost nothing when there are none.
+const LAND_SWEEP_MS = 60 * 60 * 1000;
+async function recheckPendingLands(deps = {}) {
+  const log = deps.record || record;
+  const st = deps.state || RUNNER_STATE;
+  const now = deps.now ? deps.now() : Date.now();
+  const sweepBlockers = !st.landSweepAt || now - st.landSweepAt >= LAND_SWEEP_MS;
+  const ids = pendingLandIds(readRunLogRows());
+  if (!ids.length && !sweepBlockers) return { rechecked: [], resolved: [], errors: [] };
+  const out = await recheckLands({ pendingIds: ids, sweepBlockers }, { ...(deps.api ? { api: deps.api } : {}), ...(deps.landDeps || {}) });
+  if (sweepBlockers) st.landSweepAt = now;
+  for (const r of out.rechecked) log({ event: 'land_recheck', ...r });
+  for (const r of out.resolved) {
+    log({ event: 'land_blocker_resolved', task_id: r.task_id, blocker_id: r.blocker_id, sha: r.sha,
+      reason: `main now carries ${r.sha} naming task ${r.task_id} — the no-artifact blocker was a slow land, resolved` });
+  }
+  if (out.errors.length) log({ event: 'land_recheck_failed', errors: out.errors.slice(0, 10) });
+  return out;
+}
+
 // pickedFrom — the row fields that say where a pick came from (task 1004453).
 // `priority` is true only when the fence named a priority goal AND this pick came
 // from it, so "the priority goal ran dry and the runner moved on" reads as
@@ -246,9 +300,41 @@ function resolveWorkerBin(env = process.env, platform = process.platform) {
   return { bin: 'claude', shell: true };
 }
 
+// gradeLedgerPath — the run's LOCAL ledger (task 1004536): the file ship.js reads
+// to refuse a third grade early. A fresh file per run, under the instance config
+// dir, never inside the task's tree. It is the courtesy half of the cap — see the
+// header of autobongos-grade-cap.js; the boundary is the server count below.
+const GRADE_CAP_WATCH_MS = 30_000;
+function gradeLedgerPath(taskId) {
+  const id = Number(taskId);
+  if (!Number.isSafeInteger(id) || id <= 0) throw new Error(`gradeLedgerPath: task id must be a positive integer, got ${taskId}`);
+  const name = path.join('autobongos-grades', `${id}-${Date.now()}-${crypto.randomBytes(3).toString('hex')}.jsonl`);
+  try { return require('../../src/instance-config.js').configPath(name); }
+  catch (_) { return path.join(os.tmpdir(), name); }
+}
+
+// gradeCapReader — how the supervisor counts this run's graded rounds.
+//
+// The SERVER's grade_attempts is the count that matters: the worker has no write
+// path to it, so clearing an env var or deleting a file cannot reset it. The
+// baseline is the newest attempt recorded BEFORE the worker starts; only rounds
+// after it belong to this run. When the server cannot be read, the local ledger
+// is the fallback — and either source showing the cap exhausted is enough.
+async function gradeCapReader({ api, taskId, ledger }) {
+  const before = await gradeCap.readServerAttempts(api, taskId);
+  const afterMs = before ? gradeCap.newestAttemptAt(before) : null;
+  return async function read() {
+    const local = gradeCap.gradeCapState(gradeCap.readLedger(ledger), taskId);
+    const attempts = before ? await gradeCap.readServerAttempts(api, taskId) : null;
+    if (!attempts) return { ...local, source: 'local' };
+    const server = gradeCap.gradeCapState(gradeCap.roundsFromAttempts(attempts, taskId, afterMs), taskId);
+    return server.exhausted || !local.exhausted ? { ...server, source: 'server' } : { ...local, source: 'local' };
+  };
+}
+
 // spawnWorker — one headless session, bounded by WALL CLOCK, in the task's own
 // working tree.
-async function spawnWorker({ task, model, timeoutMs, cwd, deps = {} }) {
+async function spawnWorker({ task, model, timeoutMs, cwd, gradeLedger = null, capCheck = null, deps = {} }) {
   const spawnFn = deps.spawn || spawn;
   const sessionId = deps.sessionId || crypto.randomUUID();   // pinned, so the session can be resumed
   const { bin, shell: workerShell } = deps.resolveBin ? deps.resolveBin() : resolveWorkerBin();
@@ -267,22 +353,42 @@ async function spawnWorker({ task, model, timeoutMs, cwd, deps = {} }) {
         stdio: ['pipe', 'pipe', 'pipe'],
         shell: workerShell,
         windowsHide: true,
-        env: workerEnv(),
+        // The run's local grade ledger (task 1004536): ship.js appends each graded
+        // round to it and refuses a third early. The worker can see this variable,
+        // so it is the courtesy half only — capCheck below is the boundary.
+        env: workerEnv(process.env, gradeLedger ? { [gradeCap.LEDGER_ENV]: gradeLedger } : {}),
       });
     } catch (e) { return resolve({ spawnError: e.message }); }
 
-    let stdout = ''; let stderr = ''; let timedOut = false; let truncated = false;
+    let stdout = ''; let stderr = ''; let timedOut = false; let truncated = false; let gradeCapped = false;
     const cap = (cur, d) => {
       if (cur.length >= MAX_WORKER_OUTPUT) { truncated = true; return cur; }
       return cur + String(d).slice(0, MAX_WORKER_OUTPUT - cur.length);
     };
     const timer = setTimeout(() => { timedOut = true; try { child.kill('SIGKILL'); } catch (_) {} }, timeoutMs);
+    // task 1004536: once the second graded FAIL is recorded the run is over — the
+    // task goes to the owner. capCheck reads the SERVER's grade_attempts (see
+    // gradeCapReader), so a worker that cleared the ledger env or deleted the file
+    // is still stopped. One read at a time: a slow API must not stack polls.
+    let capBusy = false;
+    const capWatch = capCheck ? setInterval(async () => {
+      if (capBusy || gradeCapped) return;
+      capBusy = true;
+      try {
+        if ((await capCheck()).exhausted) {
+          gradeCapped = true; clearInterval(capWatch);
+          try { child.kill('SIGKILL'); } catch (_) {}
+        }
+      } catch (_) { /* an unreadable count is retried next tick; the post-run read still decides */ }
+      capBusy = false;
+    }, deps.capWatchMs || GRADE_CAP_WATCH_MS) : null;
+    const stopWatch = () => { if (capWatch) clearInterval(capWatch); };
     child.stdout.on('data', (d) => { stdout = cap(stdout, d); });
     child.stderr.on('data', (d) => { stderr = cap(stderr, d); });
-    child.on('error', (e) => { clearTimeout(timer); resolve({ spawnError: e.message, sessionId }); });
+    child.on('error', (e) => { clearTimeout(timer); stopWatch(); resolve({ spawnError: e.message, sessionId }); });
     child.on('close', (code) => {
-      clearTimeout(timer);
-      resolve({ envelope: stdout, exitCode: code, timedOut, truncated, sessionId, stderr: stderr.slice(-2000) });
+      clearTimeout(timer); stopWatch();
+      resolve({ envelope: stdout, exitCode: code, timedOut, truncated, gradeCapped, sessionId, stderr: stderr.slice(-2000) });
     });
     child.stdin.end(prompt);
   });
@@ -368,7 +474,7 @@ const MAX_CLAIM_ATTEMPTS = 5;
 const LIMIT_UNKNOWN_RESET_MS = 30 * 60 * 1000;
 
 function newRunnerState() {
-  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null, mainHead: null };
+  return { setAside: new Map(), queueGate: null, limitUntil: null, diskHead: null, mainHead: null, landSweepAt: null };
 }
 const RUNNER_STATE = newRunnerState();
 
@@ -543,8 +649,24 @@ async function iteration(opts, deps = {}) {
 
   // 5. Work, in that tree.
   const started = Date.now();
-  const res = await spawnWork({ task, model: opts.model, timeoutMs: opts.timeoutMs, cwd: wtPath, deps });
-  const verdict = classifyRun(res);
+  const gradeLedger = deps.gradeLedgerPath ? deps.gradeLedgerPath(task.id) : gradeLedgerPath(task.id);
+  // Same client rule as verifyShip below: an injected api is used as given.
+  let capApi = deps.api || null;
+  if (!capApi) { try { capApi = await (require('./cli-lib').cliClient)(); } catch (_) { capApi = null; } }
+  const capCheck = await gradeCapReader({ api: capApi, taskId: task.id, ledger: gradeLedger });
+  const res = await spawnWork({ task, model: opts.model, timeoutMs: opts.timeoutMs, cwd: wtPath, gradeLedger, capCheck, deps });
+  let verdict = classifyRun(res);
+  // 5b. THE GRADE CAP (task 1004536). The owner's rule — a task that fails the
+  // grade twice goes to the owner — read from the run's ledger, not from the
+  // worker's verdict: the worker was told this in its prompt and kept re-grading.
+  const grades = await capCheck();
+  try { fs.rmSync(gradeLedger, { force: true }); } catch (_) {}   // its counts travel in the run-log row
+  if (grades && grades.exhausted) {
+    verdict = {
+      ...verdict, outcome: 'needs_human', releaseClaim: true,
+      reason: `the grade failed ${grades.fails} times in this run — handed to the owner instead of re-graded again (task 1004536)`,
+    };
+  }
   // Cut off by the usage limit? Recorded here so the NEXT iteration sleeps to the
   // reset instead of spawning a worker that will be cut off the same way.
   const limit = verdict.outcome === 'claims_shipped' ? null : usageLimitHit({ envelope: res.envelope, stderr: res.stderr });
@@ -580,6 +702,7 @@ async function iteration(opts, deps = {}) {
     outcome: verdict.outcome, reason: verdict.reason,
     session_id: res.sessionId || null, duration_s: Math.round((Date.now() - started) / 1000),
     cost_usd: verdict.costUsd ?? null,
+    ...(grades && (grades.graded || grades.outages) ? { grade_rounds: grades.graded, grade_outages: grades.outages, grade_cap_reached: grades.exhausted, grade_count_source: grades.source } : {}),
     output_truncated: !!res.truncated,
     ...(limit ? { usage_limit: { reset_at: limit.resetAt } } : {}),
     undetermined_decisions: verdict.verdict ? verdict.verdict.undetermined_decisions : null,
@@ -1054,7 +1177,14 @@ async function forever(opts, deps = {}) {
   // down the thing it watches is strictly worse than a gap in the log, and the gap
   // reports itself anyway: the hall reads the AGE of the last check-in, so a
   // failed beat shows up as silence, which is the signal.
-  const beat = async (fields) => {
+  // How long this runner has been idle on a setting the owner can fix (task
+  // 1004539). Past that setting's grace, every beat that is not about a task says
+  // `config_idle:<code>` instead of "waiting", so the hall shows the fix rather
+  // than "alive" for ten hours. Any row that is not that refusal ends the stretch.
+  let idle = null;
+  const clock = () => (deps.now ? deps.now() : Date.now());
+  const beat = async (rawFields) => {
+    const fields = configIdle.markBeat(rawFields, idle, clock());
     // The runner state is passed, not defaulted: the file names `disk_head` from
     // it (task 1004406), and an injected state must reach the beat that reports it.
     try { beatFile(Date.now(), deps.state || RUNNER_STATE); } catch (_) { /* a runner that cannot write its file still runs */ }
@@ -1081,6 +1211,15 @@ async function forever(opts, deps = {}) {
     // Every loop, so a crash leaves a heartbeat that goes stale on its own — the
     // runner never has to notice it is dying for its death to become visible.
     await beat({ mode: state.mode, consecutive_failures: state.consecutiveFailures, last_event: 'loop' });
+    // Slow lands (task 1004538): re-probe shipped tasks still waiting on main, and
+    // close no-artifact blockers whose commit has since landed. Armed only by
+    // main() (or an injected stub), like refreshInPlace, so no test harness that
+    // predates it can fall through to the network. It can never stop the loop.
+    if (opts.recheckLands || deps.recheckLands) {
+      try { await (deps.recheckLands || recheckPendingLands)(deps); } catch (e) {
+        log({ event: 'land_recheck_failed', errors: [e && e.message ? e.message : String(e)] });
+      }
+    }
     // In `probing` the runner takes exactly ONE task and only after its wait, so
     // a broken window costs a handful of cheap requests rather than a night of
     // failing spawns. `maxTasks` still bounds a full-speed burst.
@@ -1090,6 +1229,7 @@ async function forever(opts, deps = {}) {
     for (let i = 0; i < budget; i++) {
       row = await iterate(opts, deps);
       emit(row);
+      idle = configIdle.trackIdle(idle, row, clock());
       // Carry the task id so the hall can tell "quiet because it is building
       // task 1234" from "quiet because it is dead". A worker may hold the loop for
       // ninety minutes, and without this every honest hour of work looks like a
@@ -1161,7 +1301,7 @@ async function main(argv) {
   // it lived on the machine being fenced; the database owns that now, and an empty
   // `--goal` means "every allowlisted goal" rather than "anything claimable". The
   // refusal did not disappear — it moved somewhere the runner host cannot edit.
-  if (opts.forever) return forever({ ...opts, refreshInPlace: true });
+  if (opts.forever) return forever({ ...opts, refreshInPlace: true, recheckLands: true });
 
   // The one-shot path, kept for an operator running a single task by hand. It
   // still reconciles first: a leftover claim is a leftover claim whoever is
@@ -1186,8 +1326,9 @@ if (require.main === module) {
 
 module.exports = {
   readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, resolveWorkerBin,
-  worktreeName, readFence, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
+  worktreeName, readFence, gradeLedgerPath, gradeCapReader, reconcileLeftoverClaims, pollSignals, waitOrJump, forever, CLAIM_PREFIX, codeDrifted, loadedHead, UPGRADE_EXIT_CODE, MIN_UPTIME_BEFORE_UPGRADE_MS,
   heartbeatPath, writeHeartbeat, readHeartbeat, pidAlive, anotherRunnerIsAlive, HEARTBEAT_STALE_MS,
   isRunnerTree, RUNNER_TREE_RE, postHeartbeat, claudeAccountLabel, RUNNER_STARTED_AT, failureReason,
   newRunnerState, loadedFiles, supervisorTouched, refreshCheckout, LIMIT_UNKNOWN_RESET_MS, QUEUE_GATED_EXIT, CLAIM_SET_ASIDE_MS, MAX_CLAIM_ATTEMPTS, owedTaskIds,
+  readRunLogRows, recheckPendingLands, LAND_SWEEP_MS,
 };

package/scripts/gds/autobongos-verify.js

@@ -72,6 +72,33 @@ const REPO_ROOT = path.resolve(__dirname, '..', '..');
 // fail loudly here rather than silently reclassify a held claim as untouched.
 const HELD_STATUSES = new Set(['active', 'claimed', 'in_progress']);
 
+// LAND_GRACE_MS — how long a SHIPPED task may have nothing on main before that
+// is an owner's problem (task 1004538).
+//
+// The one place this file deliberately waits. Everywhere else the session that
+// was meant to finish the job has exited, so waiting cannot change the verdict.
+// A shipped task is different: the ship is done, and what is outstanding is the
+// LAND, which runs on the server's own clock and can legitimately take hours on a
+// red main. Task 1004513 was flagged at 22:24Z and its merge landed ~11 hours
+// later; the owner got a false alarm (blocker 1000185). A day covers that with
+// room to spare, and a genuinely codeless ship is already credited, so a day's
+// delay in saying so costs nothing. AUTOBONGOS_LAND_GRACE_HOURS overrides it.
+const LAND_GRACE_MS = (() => {
+  const h = Number(process.env.AUTOBONGOS_LAND_GRACE_HOURS);
+  return Number.isFinite(h) && h > 0 ? h * 3600_000 : 24 * 3600_000;
+})();
+
+// When the ship happened, from the LEDGER — never from this process, so a runner
+// restart cannot reset the clock. `shipped_at` first: `updated_at` moves on any
+// touch. Null when neither parses, which classifyLedger reads as "no grace".
+function shippedAtMs(task) {
+  for (const k of ['shipped_at', 'updated_at']) {
+    const t = Date.parse(task && task[k]);
+    if (Number.isFinite(t)) return t;
+  }
+  return null;
+}
+
 // ---------------------------------------------------------------------------
 // The pure half
 // ---------------------------------------------------------------------------
@@ -92,7 +119,7 @@ const HELD_STATUSES = new Set(['active', 'claimed', 'in_progress']);
 //                  modules/ideas/blockers.js is exactly ['ready']), which is why
 //                  the caller releases BEFORE it links.
 //   halt         — the run stops here rather than picking another task.
-function classifyLedger({ task, artifact = null, nowMs = Date.now() } = {}) {
+function classifyLedger({ task, artifact = null, nowMs = Date.now(), landGraceMs = LAND_GRACE_MS } = {}) {
   const none = { releaseClaim: false, fileBlocker: false, linkBlocker: false, halt: false };
 
   if (!task) {
@@ -110,6 +137,19 @@ function classifyLedger({ task, artifact = null, nowMs = Date.now() } = {}) {
 
   if (status === 'shipped') {
     if (artifact && artifact.checked && !artifact.onMain) {
+      // Not yet is not never (task 1004538). Inside the grace window this is a
+      // land still in flight: nothing is filed, and the runner re-probes it on
+      // later iterations (recheckLands). With no readable clock the grace cannot
+      // be measured, so it falls through to the strict verdict below.
+      const shippedAt = shippedAtMs(task);
+      if (shippedAt !== null && nowMs - shippedAt < landGraceMs) {
+        const hours = Math.round(landGraceMs / 3600_000);
+        return {
+          ...none, verified: false, shape: 'pending_land', status, pendingLand: true,
+          reason: 'shipped, but main does not carry a commit naming it yet — the land can take hours on a red main',
+          remedy: `nothing yet: the runner re-checks main on later iterations and files a blocker only if it is still missing ${hours}h after the ship`,
+        };
+      }
       // The flip happened with nothing behind it — tasks 1002459 and 1002792,
       // both credited, neither carrying a line of code on any branch. The task is
       // NOT released and NOT linked: it is shipped, credits are paid, and parking
@@ -240,26 +280,50 @@ const runGit = (args, cwd) => new Promise((resolve) => {
 //
 // Deliberately weak and deliberately cheap. It answers "is there a trace", not
 // "which commit is it": a body mention counts, because the question being asked
-// is the 1002459 question — was anything at all produced. The fixed-string grep
-// is against `(task N)`, the convention every ship commit follows.
+// is the 1002459 question — was anything at all produced.
+//
+// WHAT COUNTS AS NAMING THE TASK (task 1004538). `(task N)` alone was too
+// narrow: the commits PR 1456 landed for task 1004513 never wrote it — the merge
+// subject names the ship BRANCH (`…/autobongos-1004513-978953`, or
+// `…/task-1004440` for a hand ship). So the old probe said "no artifact" even
+// after the land. Now git narrows by the bare id (fixed string, cheap) and
+// namesTask() makes the exact call in JS, never matching the prefix of a longer
+// id. The SUBJECT may name it as `task N` / `task-N` / `autobongos-N-`; the BODY
+// only as `(task N)`, because bodies routinely DISCUSS other tasks ("task 1004513
+// was flagged…" is in this very file's commit), and a mention is not an artifact.
 //
 // A probe that could not run returns `checked: false`, which classifyLedger
 // treats as no evidence either way.
-async function probeArtifact(taskId, { git = runGit, cwd = REPO_ROOT } = {}) {
+function namesTask(subject, body, id) {
+  const inSubject = new RegExp(`(?:\\btask[\\s-]+|\\bautobongos-)${id}(?!\\d)`, 'i');
+  const inBody = new RegExp(`\\(task ${id}\\)`, 'i');
+  return inSubject.test(String(subject || '')) || inBody.test(String(body || ''));
+}
+
+// `fetch: false` skips the fetch and reads the FETCH_HEAD a caller has just
+// fetched itself — recheckLands fetches once per pass, not once per task.
+async function probeArtifact(taskId, { git = runGit, cwd = REPO_ROOT, fetch = true } = {}) {
   const id = String(taskId);
   if (!/^\d{1,19}$/.test(id)) return { checked: false, reason: 'task id is not a plain number' };
 
-  const fetched = await git(['fetch', '-q', 'origin', 'main'], cwd);
-  if (!fetched.ok) {
-    return { checked: false, reason: `git fetch failed: ${(fetched.stderr || '').trim().slice(-200)}` };
+  if (fetch) {
+    const fetched = await git(['fetch', '-q', 'origin', 'main'], cwd);
+    if (!fetched.ok) {
+      return { checked: false, reason: `git fetch failed: ${(fetched.stderr || '').trim().slice(-200)}` };
+    }
   }
-  const log = await git(['log', 'FETCH_HEAD', '--max-count=5', '--format=%H %s', '-F', `--grep=(task ${id})`], cwd);
+  // %x1f between fields, %x1e after each commit: a body may hold any text.
+  const log = await git(['log', 'FETCH_HEAD', '--max-count=50', '--format=%H%x1f%s%x1f%b%x1e', '-F', `--grep=${id}`], cwd);
   if (!log.ok) return { checked: false, reason: `git log failed: ${(log.stderr || '').trim().slice(-200)}` };
 
-  const first = log.stdout.split('\n').find((l) => l.trim());
-  if (!first) return { checked: true, onMain: false, sha: null, subject: null };
-  const sp = first.indexOf(' ');
-  return { checked: true, onMain: true, sha: first.slice(0, sp < 0 ? first.length : sp), subject: sp < 0 ? null : first.slice(sp + 1) };
+  for (const rec of log.stdout.split('\x1e')) {
+    const [sha, subject, body] = rec.replace(/^\s+/, '').split('\x1f');
+    if (!sha || !sha.trim()) continue;
+    if (namesTask(subject, body, id)) {
+      return { checked: true, onMain: true, sha: sha.trim(), subject: subject || null };
+    }
+  }
+  return { checked: true, onMain: false, sha: null, subject: null };
 }
 
 // fetchTask returns the row or null, and says WHY on a null. The reason is the
@@ -330,7 +394,7 @@ async function verifyShip({ taskId, taskTitle = null, worker = null }, deps = {}
     artifact = await probe(taskId, { cwd: deps.cwd || REPO_ROOT });
   }
 
-  const v = classifyLedger({ task, artifact, nowMs: deps.nowMs || Date.now() });
+  const v = classifyLedger({ task, artifact, nowMs: deps.nowMs || Date.now(), ...(deps.landGraceMs ? { landGraceMs: deps.landGraceMs } : {}) });
   const out = { ...v, task_id: String(taskId), artifact, released: false, blocker: null };
   if (readError) out.read_error = readError;
   if (!act) return out;
@@ -360,6 +424,136 @@ async function verifyShip({ taskId, taskTitle = null, worker = null }, deps = {}
   return out;
 }
 
+// ---------------------------------------------------------------------------
+// Pending lands, across iterations and restarts (task 1004538)
+// ---------------------------------------------------------------------------
+
+// pendingLandIds — which tasks are still waiting on a land, from the run log.
+//
+// The run log is append-only JSONL on disk, so this survives a restart; nothing
+// lives only in memory. The LATEST verdict per task wins: a `worked` or
+// `land_recheck` row whose ledger_shape is `pending_land` keeps it on the list,
+// anything later (shipped, shipped_no_artifact, …) takes it off. The grace clock
+// itself is not here — it is the ledger's `shipped_at`, re-read on every check.
+function pendingLandIds(rows) {
+  const latest = new Map();
+  for (const r of rows || []) {
+    if (!r || typeof r !== 'object' || !r.task_id || !r.ledger_shape) continue;
+    if (r.event !== 'worked' && r.event !== 'land_recheck') continue;
+    latest.set(String(r.task_id), r.ledger_shape);
+  }
+  return Array.from(latest).filter(([, shape]) => shape === 'pending_land').map(([id]) => id);
+}
+
+const NO_ARTIFACT_REF = /^task-(\d{1,19})-shipped_no_artifact$/;
+
+// openNoArtifactBlockers — every open blocker this file filed as
+// `shipped_no_artifact`, read from the DATABASE (so a blocker filed by a
+// previous process, or before this code existed, is still found).
+//
+// GET /blockers lists OPEN blockers only (listOpenBlockers) — the owner's
+// to-do list, normally tens of rows — so one or two pages is the real cost; the
+// route has no source filter, hence the client-side match. Paged by the route's
+// own `page.total`. MAX_PAGES is a runaway guard, and hitting it is reported, not
+// silently treated as "looked everywhere".
+const BLOCKER_PAGE = 200;
+const MAX_BLOCKER_PAGES = 25;
+async function openNoArtifactBlockers(api) {
+  const out = [];
+  for (let page = 0; ; page++) {
+    if (page >= MAX_BLOCKER_PAGES) {
+      throw new Error(`more than ${MAX_BLOCKER_PAGES * BLOCKER_PAGE} open blockers — stopped paging; the ones past that were not checked`);
+    }
+    const offset = page * BLOCKER_PAGE;
+    const r = await api.blockers.getBlockers({ query: { limit: BLOCKER_PAGE, offset } });
+    if (!r || !r.ok) throw new Error(`GET /blockers → ${r ? r.status : 'no response'}`);
+    const rows = (r.data && r.data.blockers) || [];
+    for (const b of rows) {
+      const m = b && b.source === 'autobongos' && NO_ARTIFACT_REF.exec(String(b.source_ref || ''));
+      if (m && (!b.status || b.status === 'open')) out.push({ id: String(b.id), taskId: m[1] });
+    }
+    const total = r.data && r.data.page && Number(r.data.page.total);
+    if (!rows.length || (Number.isFinite(total) ? offset + rows.length >= total : rows.length < BLOCKER_PAGE)) break;
+  }
+  return out;
+}
+
+// recheckLands — one pass, run by the runner once per loop.
+//
+//   1. Every pending land is verified again. Inside the grace window it stays
+//      `pending_land` and nothing is filed; past it, verifyShip files the
+//      `shipped_no_artifact` blocker exactly as before. Shipped tasks are never
+//      released, so no release function is passed.
+//   2. Every OPEN `shipped_no_artifact` blocker is re-probed, and resolved with
+//      a note once main carries the commit — the false alarm closes itself.
+//      Only a probe that actually ran and found the commit resolves anything.
+//
+// I/O per pass: at most ONE `git fetch` (only when there is something to probe),
+// one `git log` per distinct task id, and the blocker list only when
+// `sweepBlockers` is not false — the runner sweeps hourly, not every loop.
+//
+// Never throws: a pass that fails is reported in `errors` and retried next loop.
+async function recheckLands({ pendingIds = [], sweepBlockers = true } = {}, deps = {}) {
+  const api = deps.api || await (require('./cli-lib').cliClient)();
+  const cwd = deps.cwd || REPO_ROOT;
+  const git = deps.git || runGit;
+  const out = { rechecked: [], resolved: [], errors: [] };
+
+  let open = [];
+  if (sweepBlockers) {
+    try { open = await openNoArtifactBlockers(api); }
+    catch (e) { out.errors.push(`blocker list: ${e && e.message ? e.message : String(e)}`); }
+  }
+
+  // One fetch for the whole pass; every probe then reads the same FETCH_HEAD.
+  // An injected probe owns its own I/O, so none is done for it.
+  let fetchFailed = null;
+  if (!deps.probeArtifact && (pendingIds.length || open.length)) {
+    const f = await git(['fetch', '-q', 'origin', 'main'], cwd);
+    if (!f.ok) fetchFailed = `git fetch failed: ${(f.stderr || '').trim().slice(-200)}`;
+  }
+  const rawProbe = deps.probeArtifact || ((id) => (fetchFailed
+    ? { checked: false, reason: fetchFailed }
+    : probeArtifact(id, { git, cwd, fetch: false })));
+  const memo = new Map();
+  const probe = (id) => {
+    if (!memo.has(String(id))) {
+      memo.set(String(id), (async () => rawProbe(id, { cwd }))()
+        .catch((e) => ({ checked: false, reason: e && e.message ? e.message : String(e) })));
+    }
+    return memo.get(String(id));
+  };
+
+  for (const id of pendingIds) {
+    try {
+      const v = await verifyShip({ taskId: id }, {
+        api, cwd, probeArtifact: (tid) => probe(tid),
+        ...(deps.fileBlocker ? { fileBlocker: deps.fileBlocker } : {}),
+        ...(deps.nowMs ? { nowMs: deps.nowMs } : {}),
+        ...(deps.landGraceMs ? { landGraceMs: deps.landGraceMs } : {}),
+      });
+      out.rechecked.push({
+        task_id: String(id), ledger_status: v.status, ledger_shape: v.shape, verified: !!v.verified,
+        ledger_reason: v.reason || null,
+        blocker_id: v.blocker && v.blocker.blockerId ? v.blocker.blockerId : null,
+      });
+    } catch (e) { out.errors.push(`task ${id}: ${e && e.message ? e.message : String(e)}`); }
+  }
+
+  for (const b of open) {
+    const a = await probe(b.taskId);
+    if (!a || !a.checked || !a.onMain) continue;
+    const sha = a.sha ? String(a.sha).slice(0, 9) : 'a commit';
+    const note = `Auto-resolved by autobongos-verify.js (task 1004538): main now carries ${sha}${a.subject ? ` ("${String(a.subject).slice(0, 120)}")` : ''}, which names task ${b.taskId}. The land was slow, not missing.`;
+    try {
+      const r = await api.blockers.postBlockersIdResolve({ id: Number(b.id), body: { resolution_note: note } });
+      if (r && r.ok) out.resolved.push({ blocker_id: b.id, task_id: b.taskId, sha });
+      else out.errors.push(`resolve blocker ${b.id} → ${r ? r.status : 'no response'}`);
+    } catch (e) { out.errors.push(`resolve blocker ${b.id}: ${e && e.message ? e.message : String(e)}`); }
+  }
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // CLI
 // ---------------------------------------------------------------------------
@@ -399,4 +593,7 @@ if (require.main === module) {
   });
 }
 
-module.exports = { classifyLedger, blockerFor, probeArtifact, fileBlocker, verifyShip, failureReason };
+module.exports = {
+  classifyLedger, blockerFor, probeArtifact, fileBlocker, verifyShip, failureReason,
+  LAND_GRACE_MS, namesTask, pendingLandIds, recheckLands,
+};

package/scripts/gds/provision-core-upgrade.js

@@ -117,7 +117,7 @@ function parseSchemaPending(stdout) {
  * @param {string}   installed  the version running now
  * @param {string}   channel    this instance's update channel
  */
-function targetFault(to, available, installed, channel, channelAllows) {
+function targetFault(to, available, installed, channel, channelAllows, compare) {
   if (!Array.isArray(available) || available.length === 0) {
     return `could not read the published core versions from the registry — nothing was changed; the release may still be publishing (a tag is minted before the publish completes)`;
   }
@@ -136,6 +136,18 @@ function targetFault(to, available, installed, channel, channelAllows) {
   if (!installed) {
     return `could not read the core version installed at this instance — nothing was changed. An upgrade that cannot say where it is starting from cannot be bounded by the '${channel}' channel.`;
   }
+  // A TARGET THE BOX HAS ALREADY REACHED IS NOT A CHANNEL QUESTION (task 1004534).
+  // channelAllows answers "may an unattended jump go here" and says no to anything not
+  // strictly newer, so on 2026-10-01 a press for 1.20.73, landed a minute earlier by the
+  // sweep, was reported as "outside this project's 'minor' update channel … across a major
+  // version or onto a prerelease" — false on every count, and it put a "your call" card on
+  // /deploy for a project that was simply up to date. Already there: no fault, so the
+  // caller's already-serving no-op answers it. Already past it: say that, in words that
+  // classify as a downgrade, never as the update rule.
+  if (installed === to) return null;
+  if (compare && compare(to, installed) < 0) {
+    return `core ${to} is older than the core this project already runs (it already runs core ${installed}) — nothing was changed. A move never goes back to an older core on its own.`;
+  }
   if (channelAllows && !channelAllows(installed, to, channel)) {
     return `core ${to} is outside this project's '${channel}' update channel — nothing was changed. ${channelNextStep(channel)}`;
   }
@@ -276,7 +288,7 @@ async function coreUpgradeInstance(inst, deps, intent) {
   const channel = instanceChannel(inst, channelMod);
   const listed = offeredVersions(channelMod, inst, instanceDir);
   const available = (listed && listed.versions) || [];
-  const fault = targetFault(to, available, installed, channel, channelMod.channelAllows);
+  const fault = targetFault(to, available, installed, channel, channelMod.channelAllows, channelMod.compareSemver);
   if (fault) return failed(outcome.runnerReason(fault), fault);
   if (installed && installed === to) {
     // `bongos upgrade` would no-op on this too, but saying so here keeps a re-drained