@bongos/core 1.21.5 → 1.21.7

package/src/bongos/auth-admission.js

@@ -132,6 +132,69 @@ async function recentShipsForRollup(builderId) {
   }));
 }
 
+// Each craft by its own work, for the hub's profile tiles (task 1004440 /
+// WA6.RP10, goal 1000095). Until now the rollup said "Roles" from the declared
+// preference alone and counted only shipped tasks, so an artist or an ideator who
+// had done real work read on the hub as an engineer with nothing shipped.
+//
+// A craft is EARNED when this builder holds credits in it — the same rule the
+// local profile uses to show a role (src/bongos/role-stats.js, task 1004433),
+// read through the same ports. This is a kernel file, so it reads those ports
+// by key rather than importing role-stats (ADR 0091 §1). For each earned craft it
+// sends that craft's headline counts; an unearned craft sends nothing at all.
+// Counts and sums only: no idea title, no page wording, no task list.
+//
+// `disciplines` becomes the earned crafts, in the builder's preferred order;
+// with nothing earned (or no economy module to ask) it falls back to the declared
+// preference, exactly as before. A port that cannot be asked leaves its numbers
+// null ("could not ask"), never 0. Never throws: a failed read drops its craft's
+// numbers, not the report.
+const ROLLUP_CRAFTS = Object.freeze(['engineer', 'artist', 'ideator']);
+const countOrNull = (v) => (Number.isInteger(v) && v >= 0 ? v : null);
+async function readCraftRollup(builderId, { shipped = 0, preferred = [] } = {}) {
+  const fallback = { counts: null, disciplines: Array.isArray(preferred) ? preferred : [] };
+  try {
+    const reward = seams.resolveOptional('reward');
+    const byCraftMap = reward && typeof reward.creditsByCraft === 'function'
+      ? await reward.creditsByCraft([builderId]) : null;
+    const byCraft = byCraftMap ? byCraftMap.get(String(builderId)) : null;
+    if (!byCraft) return fallback;
+    const prefCrafts = fallback.disciplines
+      .map((d) => (typeof reward.craftForPreference === 'function' ? reward.craftForPreference(d) : d))
+      .filter((c) => ROLLUP_CRAFTS.includes(c));
+    const earned = [...prefCrafts, ...ROLLUP_CRAFTS]
+      .filter((c, i, a) => a.indexOf(c) === i && Number(byCraft[c]) > 0);
+    if (!earned.length) return fallback;
+    const ask = async (port) => {
+      const fn = seams.resolveOptional(port);
+      if (typeof fn !== 'function') return null;
+      try { return (await fn(builderId)) || null; } catch { return null; }
+    };
+    const [artist, ideator] = await Promise.all([
+      earned.includes('artist') ? ask('copy-desk.artistStats') : null,
+      earned.includes('ideator') ? ask('ideas.ideatorStats') : null,
+    ]);
+    const credits = (c) => countOrNull(Math.round(Number(byCraft[c])));
+    const counts = {};
+    if (earned.includes('engineer')) counts.engineer = { shipped: countOrNull(shipped), credits: credits('engineer') };
+    if (earned.includes('artist')) {
+      counts.artist = { pages_approved: countOrNull(artist && artist.pages_approved), credits: credits('artist') };
+    }
+    if (earned.includes('ideator')) {
+      counts.ideator = {
+        filed: countOrNull(ideator && ideator.filed),
+        full_ideas: countOrNull(ideator && ideator.full_ideas),
+        ratified: countOrNull(ideator && ideator.ratified),
+        credits: credits('ideator'),
+      };
+    }
+    return { counts, disciplines: earned };
+  } catch (err) {
+    log.info('[auth] craft rollup read failed (non-blocking):', err.message);
+    return fallback;
+  }
+}
+
 // Best-effort cross-project activity rollup to the hub (ADR 0141 §4): report this
 // builder's descriptive talent snapshot (credits, ships, karma, rank, disciplines,
 // and since task 1002803 their last few shipped works) for the cross-project
@@ -162,26 +225,45 @@ async function reportActivityRollup({ builderId, githubId = null }) {
     const row = b.rows[0];
     const ghId = githubId ?? row.github_id;
     if (!/^\d+$/.test(String(ghId ?? ''))) return;
-    const shipped = await pool.query('SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1', [builderId]);
+    // SHIPPED works only (task 1004440): a count with no status filter also
+    // counted work that was handed back after shipping. The same predicate as the
+    // instance's own profile (lifecycle countShippedTasksForBuilder).
+    const shipped = await pool.query(
+      `SELECT count(*)::int AS n FROM tasks WHERE shipped_by = $1 AND status = 'shipped'`,
+      [builderId],
+    );
+    const shippedCount = shipped.rows[0] ? shipped.rows[0].n : 0;
     const recentShips = await recentShipsForRollup(builderId);
-    await fetch(`${idp.origin}/api/bongos/sso/activity/rollup`, {
+    const craft = await readCraftRollup(builderId, { shipped: shippedCount, preferred: row.preferred_disciplines });
+    const body = {
+      client_id: idp.clientId,
+      client_secret: idp.clientSecret,
+      github_id: ghId,
+      credits: Number(row.total_credits) || 0,
+      tasks_shipped: shippedCount,
+      karma: Number(row.karma) || 0,
+      rank: row.rank || null,
+      disciplines: craft.disciplines,
+      recent_ships: recentShips,
+    };
+    if (craft.counts) body.crafts = craft.counts;
+    const send = (payload) => fetch(`${idp.origin}/api/bongos/sso/activity/rollup`, {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent(),
         'Bongos-Report-As-Of': asOf,
       },
-      body: JSON.stringify({
-        client_id: idp.clientId,
-        client_secret: idp.clientSecret,
-        github_id: ghId,
-        credits: Number(row.total_credits) || 0,
-        tasks_shipped: shipped.rows[0] ? shipped.rows[0].n : 0,
-        karma: Number(row.karma) || 0,
-        rank: row.rank || null,
-        disciplines: Array.isArray(row.preferred_disciplines) ? row.preferred_disciplines : [],
-        recent_ships: recentShips,
-      }),
+      body: JSON.stringify(payload),
     });
+    const res = await send(body);
+    // A hub older than `crafts` validates the body strictly and refuses the
+    // unknown field with a 400, which would lose the whole report. So a refused
+    // report that carried crafts goes again once without them: the totals still
+    // land, and the craft numbers arrive once that hub upgrades.
+    if (body.crafts && res && res.status === 400) {
+      const { crafts: _unsent, ...older } = body;
+      await send(older);
+    }
   } catch (err) {
     log.info('[auth] hub activity rollup failed (non-blocking):', err.message);
   }

package/src/bongos/db-kernel.js

@@ -55,7 +55,7 @@ async function getBuilderById(id) {
   // AFTER INSERT triggers on credit_log + karma_log respectively.
   const { rows } = await pool.query(
     `SELECT id, github_id, github_login, display_name, avatar_url, total_credits, karma, created_at, rank,
-            status, deactivated_at, reactivated_at, deactivated_reason, preferred_disciplines, system_role,
+            status, deactivated_at, reactivated_at, deactivated_reason, preferred_disciplines, main_discipline, system_role,
             anthropic_email, anthropic_user_id, monthly_budget_usd
        FROM builders WHERE id = $1`,
     [id]

package/src/bongos/routes/core-update.js

@@ -129,7 +129,27 @@ function contributeCoreUpdateToDocket(read = readCoreUpdate) {
   });
 }
 
+// This hall's own update rule, from the provisioning module when it runs (task 1004535):
+// the rule set on /deploy, which the runner and the sweep already follow (ADR 0357: the
+// /deploy row beats the sweep's roster file, which lives in the box's own checkout and is
+// not this server's to read). No module, no row, or a failed read → null, and the readers
+// fall back to the platform default exactly as before.
+function storedSelfChannel() {
+  const read = seams.resolveOptional('provisioning.selfUpdateChannel');
+  return typeof read === 'function' ? read() : null;
+}
+
+// { channel, source } — WHICH rule the answer was computed under, so the page can say so:
+// 'deploy' (the project's stored rule) or 'default' (none could be read). Never throws.
+async function resolveChannel(selfChannel) {
+  let channel = null;
+  try { channel = (await selfChannel()) || null; } catch { channel = null; }
+  return { channel, source: channel ? 'deploy' : 'default' };
+}
+
 function buildCoreUpdateRouter({
+  coreUpdate = readCoreUpdate,
+  selfChannel = storedSelfChannel,
   upgrades = readCoreUpgrades,
   softwareUpdate = readSoftwareUpdate,
   canUpdate = holdsCorePin,
@@ -155,7 +175,8 @@ function buildCoreUpdateRouter({
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
       // No `deploy_url` any more (task 1004296): the banner on a hall without a door of its
       // own links to Settings → Software update, and the hand-off lives on GET /software-update.
-      res.json({ ok: true, update: await readCoreUpdate({ running }) });
+      const { channel, source } = await resolveChannel(selfChannel);
+      res.json({ ok: true, update: { ...(await coreUpdate({ running, channel })), channel_source: source } });
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
@@ -186,7 +207,11 @@ function buildCoreUpdateRouter({
     asyncHandler('GET /software-update', async (req, res) => {
       let running = null;
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-      const [update, can] = await Promise.all([softwareUpdate({ running }), canUpdate(req)]);
+      // canUpdate does not depend on the rule, so it runs beside the rule read, not after it.
+      const [update, can] = await Promise.all([
+        resolveChannel(selfChannel).then(async ({ channel, source }) => ({ ...(await softwareUpdate({ running, channel })), channel_source: source })),
+        canUpdate(req),
+      ]);
       res.json({ ok: true, update, door: updateDoor(doorInputs()), can_update: can === true });
     }, { errorCode: 'software_update_failed', message: false }),
   );

package/src/bongos/serve-internal.js

@@ -941,6 +941,16 @@ function mountInternalSurfaces(app) {
   // statically, and a comment in that gap drops the regex out of the map, which
   // makes the page test as UNGATED while looking gated here. Prose goes above.
   const BOARD_ROOM_PAGE_RE = /^\/builders\/board-room(?:\.html)?\/?$/;
+  // /city — the Governor City's home (task 1004524, goal 1000125). Gated on the
+  // `board.vote.cast` atom, like the Board Room, because that is the atom its one
+  // governed read (GET /government/docket) checks: the page's reach equals the
+  // right to read what it draws, so no holder is refused a city they could read
+  // and no one else is served its shell. Its two goal reads are requireBuilder,
+  // a wider floor.
+  //
+  // NB as at PROJECT_SETTINGS_PAGE_RE: nothing between the `=` and the literal
+  // (tests/hall_page_gate_map.mjs parses this file statically). Prose goes above.
+  const CITY_PAGE_RE = /^\/builders\/city(?:\.html)?\/?$/;
   // /deploy — the owner's deploy door (task 1003159, ADR 0293). Gated on the
   // `core.pin.move` atom, the same key its preview and its move both check, so the
   // shell's reach equals the right to press the button. Archon-floor and system:true,
@@ -1023,6 +1033,10 @@ function mountInternalSurfaces(app) {
     if (BOARD_ROOM_PAGE_RE.test(norm)) {
       return gdsAuth.requireBoardVotePage(req, res, next);
     }
+    // task 1004524: the Governor City, on the docket's own atom (see CITY_PAGE_RE).
+    if (CITY_PAGE_RE.test(norm)) {
+      return gdsAuth.requireBoardVotePage(req, res, next);
+    }
     // ADR 0293: the deploy door, on the same atom its two routes check.
     if (DEPLOY_PAGE_RE.test(norm)) {
       return gdsAuth.requireCorePinPage(req, res, next);

package/src/bongos/software-update.js

@@ -18,8 +18,9 @@
 //
 // THE CHANNEL RULE IS NOT RESTATED HERE, as in core-update.js: `resolveChannelTarget` is the
 // upgrade runner's own function, so this never offers a version the runner would refuse.
-// No channel is passed, exactly as the banner passes none: an instance does not store its
-// own channel, and the runner's default is what it would get.
+// The channel is the project's own update rule when the route can read it (the rule set on
+// /deploy, via the provisioning.selfUpdateChannel seam — task 1004535), else the runner's
+// default. The banner (core-update.js) is handed the same rule, so the two cannot disagree.
 //
 // A READING, NEVER A GUESS. `reading` is 'ok' only when the registry answered; "up to date"
 // is `offered: null` on an ok reading and nothing else. Notes that could not be read say so,

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.7'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/activity_rollup_order_db.mjs

@@ -74,7 +74,9 @@ const same = (actual, expected, msg) => { assert.deepEqual(actual, expected, msg
 
 try {
   for (const f of ['platform_identity_005_builder_activity.sql', 'platform_identity_012_recent_ships.sql',
-    'platform_identity_022_activity_snapshots.sql', 'platform_identity_026_activity_reported_as_of.sql']) {
+    'platform_identity_022_activity_snapshots.sql', 'platform_identity_026_activity_reported_as_of.sql',
+    // upsertActivity also writes crafts (029, task 1004440): 42703 without it.
+    'platform_identity_029_activity_crafts.sql']) {
     await q(migrationSql(f));
   }
   await q(migrationSql('platform_identity_026_activity_reported_as_of.sql')); // idempotent: replays cleanly

package/tests/activity_snapshots_db.mjs

@@ -99,6 +99,8 @@ try {
   await q(migrationSql('platform_identity_022_activity_snapshots.sql'));
   // upsertActivity also writes reported_as_of (task 1004268) — same reason as 012 above.
   await q(migrationSql('platform_identity_026_activity_reported_as_of.sql'));
+  // ...and each craft's counts (029, task 1004440), same reason again.
+  await q(migrationSql('platform_identity_029_activity_crafts.sql'));
   await cleanup();
 
   // 1 — the writer snapshots the LIVE row, and only when it changed.

package/tests/autobongos_grade_cap.mjs

@@ -0,0 +1,125 @@
+// tests/autobongos_grade_cap.mjs — the grade cap for one autonomous run (task 1004536).
+//
+// Owner rule, 2026-10-02: a task that fails the grade twice goes to the owner
+// instead of being retried — the first grade plus at most ONE re-grade per
+// worker run. The worker prompt already asked for this and was ignored (task
+// 1004512 spent $63.81 over three rounds), so the cap is enforced in ship.js,
+// where the panel spend happens, and read back by the supervisor.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const cap = require('../scripts/gds/autobongos-grade-cap.js');
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const fail = { passed: false, score: 5.6, signals: { panel_outcome: 'fail' } };
+const pass = { passed: true, score: 8.1, signals: { panel_outcome: 'pass' } };
+const outage = { passed: false, score: 0, signals: { panel_outcome: 'unavailable' } };
+
+function tmpLedger() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'grade-cap-'));
+  return path.join(dir, 'run.jsonl');
+}
+function ledgerWith(grades, taskId = 4242) {
+  const file = tmpLedger();
+  const env = { [cap.LEDGER_ENV]: file };
+  for (const g of grades) assert.equal(cap.recordGradeOutcome({ taskId, grade: g, env }), true);
+  return { file, env };
+}
+
+test('the cap is the first grade plus ONE re-grade', () => {
+  assert.equal(cap.GRADE_CAP, 2);
+});
+
+test('one failed grade leaves room for exactly one re-grade', () => {
+  const { env } = ledgerWith([fail]);
+  assert.equal(cap.checkGradeCap({ taskId: 4242, env }).ok, true);
+});
+
+test('a third grade attempt after two FAILs is refused, and says to hand it to the owner', () => {
+  const { env } = ledgerWith([fail, fail]);
+  const r = cap.checkGradeCap({ taskId: 4242, env });
+  assert.equal(r.ok, false);
+  assert.equal(r.state.exhausted, true);
+  assert.match(r.lines.join('\n'), /cannot_complete/);
+});
+
+test('a grader-UNAVAILABLE outcome does not count toward the two', () => {
+  const { env, file } = ledgerWith([fail, outage, outage]);
+  const r = cap.checkGradeCap({ taskId: 4242, env });
+  assert.equal(r.ok, true, 'an outage is not a quality verdict — the panel never ran');
+  const s = cap.gradeCapState(cap.readLedger(file), 4242);
+  assert.equal(s.graded, 1);
+  assert.equal(s.outages, 2);
+  assert.equal(s.exhausted, false);
+});
+
+test('a second round that PASSED is not refused — its merge leg still has to run', () => {
+  const { env } = ledgerWith([fail, pass]);
+  assert.equal(cap.checkGradeCap({ taskId: 4242, env }).ok, true);
+});
+
+test('rounds are counted per task, and a human ship (no ledger) is never capped', () => {
+  const { env } = ledgerWith([fail, fail], 1111);
+  assert.equal(cap.checkGradeCap({ taskId: 4242, env }).ok, true, 'another task\'s fails are not this one\'s');
+  assert.deepEqual(cap.checkGradeCap({ taskId: 4242, env: {} }), { ok: true, active: false });
+  assert.equal(cap.recordGradeOutcome({ taskId: 4242, grade: fail, env: {} }), false, 'nothing is written without a ledger');
+});
+
+test('a torn or missing ledger reads as empty rather than throwing', () => {
+  assert.deepEqual(cap.readLedger(path.join(os.tmpdir(), 'no-such-ledger-1004536.jsonl')), []);
+  const file = tmpLedger();
+  fs.writeFileSync(file, '{"task_id":4242,"passed":false,"outage":false}\n{"task_id":42');
+  assert.equal(cap.readLedger(file).length, 1);
+});
+
+test('server attempts: an outage is every GATING worker erroring; the advisory narc does not decide it', () => {
+  const w = (kind, error) => ({ kind, verdict: error ? null : 'fail', error, severities: [] });
+  assert.equal(cap.attemptIsOutage({ workers: [w('narc', null), w('quality', 'X'), w('hacker', 'X'), w('efficiency', 'X')] }), true);
+  assert.equal(cap.attemptIsOutage({ workers: [w('narc', 'X'), w('quality', null), w('hacker', 'X'), w('efficiency', 'X')] }), false, 'one gating worker ran: a real verdict');
+  assert.equal(cap.attemptIsOutage({ workers: [] }), false, 'an unknown shape is counted, never a free round');
+});
+
+test('server attempts: only rounds newer than the pre-run baseline belong to this run', () => {
+  const attempts = [
+    { attempted_at: '2026-10-01T00:00:00Z', passed: false, workers: [] },
+    { attempted_at: '2026-10-02T00:00:00Z', passed: false, workers: [] },
+  ];
+  const baseline = cap.newestAttemptAt(attempts.slice(0, 1));
+  const rows = cap.roundsFromAttempts(attempts, 4242, baseline);
+  assert.equal(rows.length, 1);
+  assert.equal(cap.newestAttemptAt([]), null);
+  assert.equal(cap.roundsFromAttempts(attempts, 4242, null).length, 2);
+});
+
+test('readServerAttempts: unreadable is null (unknown), never graded is [] (a real zero)', async () => {
+  assert.equal(await cap.readServerAttempts({}, 4242), null);
+  assert.equal(await cap.readServerAttempts({ tasks: { getTasksId: async () => ({ ok: false, status: 502 }) } }, 4242), null);
+  assert.deepEqual(await cap.readServerAttempts({ tasks: { getTasksId: async () => ({ ok: true, data: { task: {}, grade: null } }) } }, 4242), []);
+});
+
+// The early refusal (the courtesy half): ship.js, with any flag. It must refuse BEFORE a
+// session is loaded or a panel started — the panel spend is what the cap saves.
+for (const flags of [['--regrade'], [], ['--skip-grade']]) {
+  test(`ship.js ${flags.join(' ') || '(plain re-ship)'} refuses a third grade in an autonomous run`, () => {
+    const { env } = ledgerWith([fail, fail]);
+    const home = fs.mkdtempSync(path.join(os.tmpdir(), 'grade-cap-home-'));
+    const res = spawnSync(process.execPath, [path.join(REPO, 'scripts', 'gds', 'ship.js'), '4242', ...flags], {
+      cwd: REPO,
+      encoding: 'utf8',
+      timeout: 30000,
+      // No session and a dead API base: if the refusal did NOT fire first, the
+      // run fails some other way and the assertions below say so.
+      env: { ...process.env, ...env, HOME: home, USERPROFILE: home, XDG_CONFIG_HOME: home, BONGOS_API_BASE: 'http://127.0.0.1:9' },
+    });
+    assert.equal(res.status, cap.REFUSED_EXIT, `expected the cap's exit code; stderr:\n${res.stderr}`);
+    assert.match(res.stderr, /graded 2 time\(s\) in this autonomous run/);
+  });
+}

package/tests/autobongos_loop.mjs

@@ -619,9 +619,22 @@ test('a mid-ship strand is named in the run log and blocked, but not released',
   }
 });
 
-test('a ship with no artifact on main is recorded as unverified', async () => {
+test('a fresh ship with nothing on main yet is pending_land: unverified, no blocker (task 1004538)', async () => {
+  // The harness ledger shipped just now — well inside the land grace window.
   const h = harness({ probeArtifact: async () => ({ checked: true, onMain: false, sha: null, subject: null }) });
   const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.ledger_shape, 'pending_land', 'the run log row is what the next loop re-probes from');
+  assert.equal(row.verified, false);
+  assert.deepEqual(h.blockers, [], 'a slow land is not an owner problem yet');
+});
+
+test('a ship with no artifact on main is recorded as unverified', async () => {
+  const h = harness({
+    probeArtifact: async () => ({ checked: true, onMain: false, sha: null, subject: null }),
+    // Shipped two days ago: past the land grace window.
+    ledger: { id: 4242, status: 'shipped', shipped_at: new Date(Date.now() - 48 * 3600_000).toISOString() },
+  });
+  const row = await runner.iteration(opts, h.deps);
   assert.equal(row.ledger_status, 'shipped');
   assert.equal(row.ledger_shape, 'shipped_no_artifact');
   assert.equal(row.verified, false);
@@ -1379,3 +1392,219 @@ test('the server heartbeat carries the goal the current task came from', async (
   assert.ok(b, 'the beat after a worked row must name its task');
   assert.equal(b.working_goal_id, 1000090);
 });
+
+// ── the grade cap (task 1004536) ────────────────────────────────────────────────
+// Owner rule: a task that fails the grade twice goes to the owner. The prompt
+// asked for it and was ignored (task 1004512: $63.81 over three rounds), so the
+// supervisor reads the run's grade ledger itself.
+const gradeCapLib = require('../scripts/gds/autobongos-grade-cap.js');
+const fakeGrade = (passed, outage = false) => ({ passed, score: passed ? 8 : 5, signals: { panel_outcome: outage ? 'unavailable' : (passed ? 'pass' : 'fail') } });
+function ledgerHarness(grades, { ledgerStatus = 'completed' } = {}) {
+  const file = join(mkdtempSync(join(tmpdir(), 'abgcap-')), 'run.jsonl');
+  let handed = null;
+  const h = harness({
+    ledger: { id: 4242, status: ledgerStatus, updated_at: new Date().toISOString() },
+    spawnWorker: async (a) => {
+      handed = a.gradeLedger;
+      // What ship.js does inside the worker: one row per graded round.
+      for (const g of grades) gradeCapLib.recordGradeOutcome({ taskId: 4242, grade: g, env: { [gradeCapLib.LEDGER_ENV]: a.gradeLedger } });
+      // ...and the worker IGNORING its brief, claiming a ship anyway.
+      return { envelope: { is_error: false, result: '', structured_output: {
+        outcome: 'shipped', task_id: 4242, what_happened: 'fixed and re-graded', undetermined_decisions: [],
+      } }, exitCode: 0 };
+    },
+  });
+  h.deps.gradeLedgerPath = () => file;
+  return { h, file, handed: () => handed };
+}
+
+test('the brief states the grade cap: one re-grade, then cannot_complete; an outage does not count', () => {
+  const p = buildWorkerPrompt({ task: { id: 7, title: 't', description: 'd' } });
+  assert.match(p, /at most ONE re-grade/);
+  assert.match(p, /fails twice, STOP/);
+  assert.match(p, /GRADER UNAVAILABLE[^.]*does not count/);
+});
+
+test('two graded FAILs in one run end it as needs_human, whatever the worker claims', async () => {
+  const { h, file, handed } = ledgerHarness([fakeGrade(false), fakeGrade(false)]);
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(handed(), file, 'the supervisor picks the ledger and hands it to the worker');
+  assert.equal(row.outcome, 'needs_human', 'the worker said "shipped"; the ledger says the grade failed twice');
+  assert.match(row.reason, /failed 2 times/);
+  assert.equal(row.grade_rounds, 2);
+  assert.equal(row.grade_cap_reached, true);
+  assert.equal(h.blockers.length, 1, 'the owner gets a blocker — the existing needs_human path');
+  assert.throws(() => readFileSync(file), /ENOENT/, 'the per-run ledger is removed once read; its counts are in the row');
+});
+
+test('a grader outage between two rounds does not end the run', async () => {
+  const { h } = ledgerHarness([fakeGrade(false), fakeGrade(false, true), fakeGrade(true)], { ledgerStatus: 'shipped' });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.outcome, 'claims_shipped');
+  assert.equal(row.grade_rounds, 2);
+  assert.equal(row.grade_outages, 1);
+  assert.equal(row.grade_cap_reached, false);
+});
+
+// The grader's hacker finding on the first cut: the local ledger lives in the
+// worker's env and filesystem, so a worker can clear it. The supervisor's count
+// comes from the server's grade_attempts, which the worker cannot write.
+const attempt = (at, passed, { outage = false } = {}) => ({
+  attempted_at: at, passed,
+  workers: ['narc', 'quality', 'hacker', 'efficiency'].map((kind) => ({
+    kind, verdict: outage ? null : (passed ? 'pass' : 'fail'), error: outage && kind !== 'narc' ? 'SUBAGENT_SPAWN_FAILED' : null, severities: [],
+  })),
+});
+function serverApi(before, during) {
+  let calls = 0;
+  return { tasks: { getTasksId: async ({ query }) => {
+    assert.match(query.include, /grade_attempts/);
+    const attempts = calls++ === 0 ? before : during;
+    return { ok: true, status: 200, data: { task: { id: 4242 }, grade: { attempts } } };
+  } } };
+}
+
+test('a worker that clears the local ledger is still capped by the server count', async () => {
+  const old = attempt('2026-10-01T09:00:00.000Z', false);   // a PREVIOUS run's round — not this run's
+  const h = harness({
+    ledger: { id: 4242, status: 'completed', updated_at: new Date().toISOString() },
+    api: serverApi([old], [old, attempt('2026-10-02T10:00:00.000Z', false), attempt('2026-10-02T10:20:00.000Z', false)]),
+    // Records NOTHING locally — as if it ran ship.js with the ledger env cleared.
+    spawnWorker: async () => ({ envelope: { is_error: false, result: '', structured_output: {
+      outcome: 'shipped', task_id: 4242, what_happened: 'kept going', undetermined_decisions: [],
+    } }, exitCode: 0 }),
+  });
+  h.deps.gradeLedgerPath = () => join(mkdtempSync(join(tmpdir(), 'abgcap-')), 'run.jsonl');
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.outcome, 'needs_human');
+  assert.equal(row.grade_count_source, 'server');
+  assert.equal(row.grade_rounds, 2, 'the round from before this run started is not counted');
+  assert.equal(row.grade_cap_reached, true);
+});
+
+test('server rounds where every gating worker errored are outages, not fails', async () => {
+  const h = harness({
+    ledger: { id: 4242, status: 'completed', updated_at: new Date().toISOString() },
+    api: serverApi([], [attempt('2026-10-02T10:00:00.000Z', false), attempt('2026-10-02T10:05:00.000Z', false, { outage: true })]),
+  });
+  h.deps.gradeLedgerPath = () => join(mkdtempSync(join(tmpdir(), 'abgcap-')), 'run.jsonl');
+  const row = await runner.iteration(opts, h.deps);
+  assert.notEqual(row.outcome, 'needs_human');
+  assert.equal(row.grade_rounds, 1);
+  assert.equal(row.grade_outages, 1);
+  assert.equal(row.grade_cap_reached, false);
+});
+
+test('spawnWorker hands the ledger to the worker in env and stops it once the cap is reached', async () => {
+  const { EventEmitter } = await import('node:events');
+  const file = join(mkdtempSync(join(tmpdir(), 'abgcap-')), 'run.jsonl');
+  let env = null; let killed = false;
+  const spawn = (_bin, _args, o) => {
+    env = o.env;
+    const child = new EventEmitter();
+    child.stdout = new EventEmitter(); child.stderr = new EventEmitter();
+    child.stdin = { end: () => {
+      // The worker's ship.js records its second graded FAIL, then the worker keeps going.
+      for (const g of [fakeGrade(false), fakeGrade(false)]) gradeCapLib.recordGradeOutcome({ taskId: 4242, grade: g, env: o.env });
+    } };
+    child.kill = () => { killed = true; setImmediate(() => child.emit('close', null)); };
+    return child;
+  };
+  const capCheck = async () => gradeCapLib.gradeCapState(gradeCapLib.readLedger(file), 4242);
+  const res = await runner.spawnWorker({
+    task: aTask, model: 'm', timeoutMs: 60_000, cwd: process.cwd(), gradeLedger: file, capCheck,
+    deps: { spawn, resolveBin: () => ({ bin: 'claude', shell: false }), sessionId: 's', capWatchMs: 5 },
+  });
+  assert.equal(env[gradeCapLib.LEDGER_ENV], file);
+  assert.equal(killed, true, 'a worker past the cap is stopped, not left to keep paying for rounds');
+  assert.equal(res.gradeCapped, true);
+  assert.equal(res.timedOut, false);
+});
+
+// ── slow lands are re-checked every loop, across restarts (task 1004538) ──────
+
+test('forever re-checks pending lands once per loop, and a failing check never stops it', async () => {
+  let calls = 0;
+  const rows = [];
+  const code = await runner.forever({ goals: [], maxTasks: 1, maxLoops: 3 }, {
+    iteration: async () => ({ event: 'hold', reason: 'test' }),
+    reconcileLeftoverClaims: async () => ({ event: 'boot_reconcile', ok: true }),
+    waitOrJump: async () => ({ waited: 0, jumped: false }),
+    writeHeartbeat: () => true,
+    postHeartbeat: async () => true,
+    emit: () => {},
+    record: (r) => { rows.push(r); return r; },
+    codeDrifted: async () => false,
+    loadedHead: async () => null,
+    recheckLands: async () => { calls += 1; if (calls === 2) throw new Error('fetch failed'); return {}; },
+  });
+  assert.equal(code, 0);
+  assert.equal(calls, 3, 'every loop, not just at boot');
+  assert.ok(rows.some((r) => r.event === 'land_recheck_failed' && /fetch failed/.test(r.errors.join(' '))));
+});
+
+test('main() arms the land re-check for --forever', () => {
+  const src = readFileSync(new URL('../scripts/gds/autobongos-run.js', import.meta.url), 'utf8');
+  const line = src.split('\n').find((l) => l.includes('if (opts.forever) return forever('));
+  assert.match(line, /recheckLands: true/, 'without this the runner never re-probes a slow land');
+});
+
+test('a pending land survives a restart: the run log names it, the ledger clocks it, the blocker closes', async () => {
+  // A FRESH process: nothing in memory. Only the run log on disk says task 77
+  // was pending, and only the database says blocker 500 is open for task 78.
+  const dir = mkdtempSync(join(tmpdir(), 'autobongos-lands-'));
+  process.env.AUTOBONGOS_LOG_FILE = join(dir, 'runs.jsonl');
+  try {
+    writeFileSync(process.env.AUTOBONGOS_LOG_FILE, [
+      JSON.stringify({ event: 'worked', task_id: '77', ledger_shape: 'pending_land' }),
+      JSON.stringify({ event: 'worked', task_id: '76', ledger_shape: 'shipped' }),
+      '{"event":"worked","task_id":"75","ledger_sh',   // the half line a kill -9 leaves
+    ].join('\n'));
+    const recorded = [];
+    const resolved = [];
+    const probed = [];
+    const api = {
+      tasks: { getTasksId: async ({ id }) => ({ ok: true, data: { task: { id: String(id), status: 'shipped', shipped_at: new Date(Date.now() - 3600_000).toISOString() } } }) },
+      blockers: {
+        getBlockers: async () => ({ ok: true, data: { blockers: [{ id: '500', source: 'autobongos', source_ref: 'task-78-shipped_no_artifact', status: 'open' }] } }),
+        postBlockersIdResolve: async ({ id }) => { resolved.push(String(id)); return { ok: true, data: {} }; },
+      },
+    };
+    await runner.recheckPendingLands({
+      api,
+      state: runner.newRunnerState(),
+      record: (r) => { recorded.push(r); return r; },
+      landDeps: { probeArtifact: async (id) => { probed.push(String(id)); return { checked: true, onMain: true, sha: 'abc123def456', subject: `Merge from x/task-${id}` }; } },
+    });
+    assert.deepEqual(probed.sort(), ['77', '78'], 'only the pending task and the open blocker are probed');
+    const re = recorded.find((r) => r.event === 'land_recheck');
+    assert.equal(re.task_id, '77');
+    assert.equal(re.ledger_shape, 'shipped', 'the land arrived, so the next pass drops it from the pending list');
+    assert.deepEqual(resolved, ['500']);
+    assert.ok(recorded.some((r) => r.event === 'land_blocker_resolved' && r.blocker_id === '500'));
+  } finally { delete process.env.AUTOBONGOS_LOG_FILE; }
+});
+
+test('the blocker sweep runs at most hourly; with nothing pending, the loops between cost nothing', async () => {
+  const dir = mkdtempSync(join(tmpdir(), 'autobongos-sweep-'));
+  process.env.AUTOBONGOS_LOG_FILE = join(dir, 'runs.jsonl');   // empty: nothing pending
+  try {
+    let lists = 0;
+    let now = 1_000_000_000_000;
+    const deps = {
+      state: runner.newRunnerState(),
+      now: () => now,
+      record: (r) => r,
+      api: { tasks: {}, blockers: { getBlockers: async () => { lists += 1; return { ok: true, data: { blockers: [] } }; } } },
+      landDeps: { probeArtifact: async () => notOnMainRow },
+    };
+    const notOnMainRow = { checked: true, onMain: false, sha: null, subject: null };
+    await runner.recheckPendingLands(deps);
+    now += 5 * 60 * 1000;
+    await runner.recheckPendingLands(deps);
+    assert.equal(lists, 1, 'a second sweep five minutes later is wasted I/O');
+    now += runner.LAND_SWEEP_MS;
+    await runner.recheckPendingLands(deps);
+    assert.equal(lists, 2, 'an hour on, it sweeps again');
+  } finally { delete process.env.AUTOBONGOS_LOG_FILE; }
+});