@bongos/core 1.21.84 → 1.21.85

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.84",
-  "core_contract": "1.21.84",
-  "source_commit": "77cd95ff8cbddfb714a4927414a4d980720ac2ca",
+  "core_version": "1.21.85",
+  "core_contract": "1.21.85",
+  "source_commit": "8a47b19700478214f214b9df7bbfc4cd5ed93958",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T02:56:20.018Z",
+  "built_at": "2026-10-09T04:31:08.324Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 590,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 2996,
+    "functional_verbatim": 2997,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3615,
-  "tree_sha256": "e5d1d484866739a4ebb4545ddf68af311452e34b73ba4d6a81353e0497ca0ad3",
+  "file_count": 3616,
+  "tree_sha256": "22dc94ef353678e33bf64bb41ca709aa63dc8f29cc4bebcd10a09a84f2dc32c9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2862,7 +2862,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "295cb4db0fe62dc0ac7a45eda7008205e5d1ee79b593e2a240232ed1a7d2d8db"
+      "sha256": "cbcee180651b88158a4cc173e12c3f73ee842743bcaf9e13629d5ef96ee26e56"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7202,7 +7202,7 @@
     {
       "path": "modules/lifecycle/page-tweak-hold.js",
       "mode": "0000644",
-      "sha256": "3938cb60e74e910c57ef84384bfd0363c0700e0368dbea98ee880c7b9fe60aeb"
+      "sha256": "54703e1d2814402218057c65691e5fd1f11572eb9e667c1e0148ecb5cc9efe80"
     },
     {
       "path": "modules/lifecycle/page-tweak-reads.js",
@@ -7377,7 +7377,7 @@
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "4019166678703aee51179d0b92a5aaefa728a5f992b7b472703e61c1e55c30f7"
+      "sha256": "efd442d161d9b212d1e9aa4cad06aa428b1e4c74ac67d22658591ca7c28f2621"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7402,7 +7402,7 @@
     {
       "path": "modules/lifecycle/ship-card.js",
       "mode": "0000644",
-      "sha256": "1935e6f0a3fb9089c2aacd9bbdf1ff1296487065c8c5a25beaf96306d88a9f5b"
+      "sha256": "fc803defc468a0e625d82f305d00118ec77bb63d74d7b75b4d3ba03bdd16659d"
     },
     {
       "path": "modules/lifecycle/ship-files.js",
@@ -10097,12 +10097,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "24e60fc4fd189a4e9d735e54e99b84734ff1a656551665196974d9355cbedfc3"
+      "sha256": "2784cf3cf476fda15614a347da7e556824a63f50a49cbb74323ceeec704c4b8e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "4be21978dcd4470cf27cd34d9f788325adb8e1c1c57a437c6a3abdc94bda9448"
+      "sha256": "8fe03b497ac409587e5ded79331fb0ff035d19052cb7c575daf50f07fe8439ee"
     },
     {
       "path": "public-docs/index.html",
@@ -10122,7 +10122,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f214849f7282c7218740a89c5ad9e3e464bdf6913043eefd4d104e55f9439898"
+      "sha256": "24198ec47220ec2534ed8d6bf187965bf03d9044831ac3eaa50fd45ea141959d"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -11582,12 +11582,12 @@
     {
       "path": "scripts/gds/ship-finish.js",
       "mode": "0000644",
-      "sha256": "8635a70645640302d420974c85fce6578a4e6b26393aff57b3620808771d5b4c"
+      "sha256": "23856ecf2ed0224fcc69fa4e67413d2248462813896e3b832a20f3a2d0a886e6"
     },
     {
       "path": "scripts/gds/ship-flow.js",
       "mode": "0000644",
-      "sha256": "cdd4e7a24b0fd3418c911e331635483db16a18b6e0326401bc54806da83f8174"
+      "sha256": "d114ae690d86270db76770fc3531a5530d1ab64a031a2528368864f4b330ac56"
     },
     {
       "path": "scripts/gds/ship-git.js",
@@ -11597,7 +11597,7 @@
     {
       "path": "scripts/gds/ship-grade-steps.js",
       "mode": "0000644",
-      "sha256": "89025445be960efd1faedbea57dc6ffdef42bdd637e47409d42671eb3744ffd1"
+      "sha256": "4a0187643d8e0d74b0199f913c24fbd14acf035c27d6040d4ecdfcf905732398"
     },
     {
       "path": "scripts/gds/ship-grade.js",
@@ -11617,7 +11617,7 @@
     {
       "path": "scripts/gds/ship-land.js",
       "mode": "0000644",
-      "sha256": "1dc660f9eff1e93b53567cb3406ad6aa0bc80768e93ec905031a5e5d7d37dceb"
+      "sha256": "e518039d82343b5ff3bb21e1a6e0a5a8e0b9368d05b791be4910d76ea075378e"
     },
     {
       "path": "scripts/gds/ship-memory-sync.js",
@@ -12372,7 +12372,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "91e35f3a22e967483fc2c4a6390b61839c88d0cceae5acf54e5417315158f1d2"
+      "sha256": "901e1e5ef994837bd4ae48f226af1cd104c34a0dd993383c7980eca13bc61d2f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14874,6 +14874,11 @@
       "mode": "0000644",
       "sha256": "ca7fbfcca238b4ffed576ca1b3fca5d848f4d9d3eab8321353325d54ff505810"
     },
+    {
+      "path": "tests/held_tweak_reporting.mjs",
+      "mode": "0000644",
+      "sha256": "f58a95e019d9e5dd22c3fa2321734cbb7c323b356184198e7d3cb4507ee3d04a"
+    },
     {
       "path": "tests/help_requests.mjs",
       "mode": "0000644",
@@ -16027,7 +16032,7 @@
     {
       "path": "tests/page_tweak_hold.mjs",
       "mode": "0000644",
-      "sha256": "0ab837626d1d9f70f8dcc0037f9162dfbc596fa5b846820f2108bdd539126825"
+      "sha256": "c3c3b7d44baacd33d1b42db4609dcb8312d8ba46ac4dab38abc57371a4bde74b"
     },
     {
       "path": "tests/paintbrush.mjs",

package/docs/module-api-changelog.md

@@ -3000,5 +3000,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.82 with no explicit bump. run 37869654816. (task 1002620)
   1.21.84 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.83 with no explicit bump. run 37876887587. (task 1002620)
+  1.21.85 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.84 with no explicit bump. run 37884200093. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/page-tweak-hold.js

@@ -65,7 +65,19 @@ const HELD_NOT_ARMED = Object.freeze({
   reason: 'held for the artist (ADR 0341 D7): a page tweak lands only after its artist approves it',
 });
 
+// The closing sentence of the PR body a ship opens (task 1004379). The stock
+// text promised auto-merge, and a held round's PR is deliberately not armed, so
+// the reader of a held PR was told the opposite of what would happen. Both PR
+// writers (the server's publish route and ship.js's ci-land) end with this.
+const ARMED_PR_SENTENCE = 'Auto-merge is enabled — GitHub lands it once the required checks pass.';
+const HELD_PR_SENTENCE = 'Auto-merge is NOT enabled: this page tweak waits for its artist to approve it in the studio (ADR 0341 D7). It lands only after that approval.';
+function prMergeSentence(held) {
+  return held ? HELD_PR_SENTENCE : ARMED_PR_SENTENCE;
+}
+
 module.exports = {
+  HELD_PR_SENTENCE,
+  prMergeSentence,
   HELD_NOT_ARMED,
   HOLD_STATE,
   isPageTweak,

package/modules/lifecycle/routes/tasks.js

@@ -36,7 +36,7 @@ const { gradeQualityWhere } = require('../db-shared');
 const { helperJoinSql } = require('../page-tweak-artist'); // task 1004432: a page tweak's applier as a helper
 const auth = api;
 const db = require('../db');
-const pageTweakReads = require('../page-tweak-reads'); const { HELD_NOT_ARMED } = require('../page-tweak-hold'); // ADR 0341 D7 (tests stub the read)
+const pageTweakReads = require('../page-tweak-reads'); const { HELD_NOT_ARMED, prMergeSentence } = require('../page-tweak-hold'); // ADR 0341 D7 (tests stub the read)
 const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 // The orphan-task advisory (task 1002539) — pure, fail-open; see goal-advisory.js.
@@ -1176,12 +1176,13 @@ module.exports = function buildTasksRouter() {
       const builderLogin = await db.getLastClaimHolder(id)
         .then((h) => (h ? h.github_login : req.builder.github_login), () => null);
       const builderLine = prAssign.prBuilderLine(builderLogin);
+      const held = await pageTweakReads.heldForArtistFailClosed(id); // ADR 0341 D7: read before the body names it (task 1004379)
       const body =
         `Auto-opened by GDS server-mediated publish (ADR 0055) for task ${id}.` +
         `${builderLine ? ` ${builderLine}` : ''}\n\n` +
         `${deHashRefs(valueSummary) || '(no value summary)'}\n\n` +
         `Merging triggers .github/workflows/deploy-prod.yml -> ${branding().domains.publicOrigin}. ` +
-        `Auto-merge is enabled — GitHub lands it once the required checks pass.`;
+        prMergeSentence(held);
       const pr = await githubPush.openOrFindPullRequest({ branch, title, body });
       // Best-effort by contract (pr-assign.js never rejects); the catch is for a future
       // edit that forgets — an assignment must not be able to fail a pushed ship.
@@ -1191,7 +1192,7 @@ module.exports = function buildTasksRouter() {
       // builder nothing, and the commonest cause is a repo with allow_auto_merge OFF —
       // a permanent condition that reads exactly like a transient blip.
       // task 1004322 (ADR 0341 D7): a page tweak held for its artist is PUBLISHED, never armed.
-      const autoMergeResult = (await pageTweakReads.heldForArtistFailClosed(id)) ? HELD_NOT_ARMED : await githubPush.enableAutoMergeDetailed({ nodeId: pr.node_id });
+      const autoMergeResult = held ? HELD_NOT_ARMED : await githubPush.enableAutoMergeDetailed({ nodeId: pr.node_id });
       const autoMerge = autoMergeResult.ok;
       // task 1139 (ADR 0058): attest the author's trust tier on the pushed sha so the
       // gate-review check can auto-approve a Metic+ author's gate-surface PR with no

package/modules/lifecycle/ship-card.js

@@ -78,6 +78,15 @@ const STAGES = Object.freeze({
     headline: (id) => `Task #${id} grade failed`,
     at: 4, currentKind: 'failed',
   },
+  // task 1004379: a page tweak whose grade PASSED and that now waits for its
+  // artist (ADR 0341 D7). It sits at completed, which stageFor() would read as a
+  // failed grade, so the caller names this stage explicitly (ship-finish.js
+  // finishHeld). The grade is done; the confirm node is the artist's to take.
+  held: {
+    tone: 'info', icon: 'ti-palette', statusWord: 'Waiting for the artist',
+    headline: (id) => `Task #${id} passed — waiting for the artist`,
+    at: 4, currentKind: 'held',
+  },
 });
 
 // Map a post-grade task status to a ship-family card stage. (claimed/review are
@@ -139,6 +148,8 @@ const GRADE_FAILED = 'grade failed';
 // task 1002892: the confirm node's word when the grade did not RUN. Two words, so
 // the " → " joint logic that already keeps 'grade failed' intact covers it too.
 const NOT_GRADED = 'not graded';
+// task 1004379: the confirm node's word while a passed page tweak waits for its artist.
+const AWAITING_ARTIST = 'awaiting artist';
 
 // The journey, mapped: one entry per PIPELINE node, conjugated + classified by
 // position relative to the current node (`cfg.at`). Both renderers consume this
@@ -158,6 +169,7 @@ function trailSteps(cfg) {
       // cfg.trailWord is set only by the outage override in buildCardModel; every
       // other caller leaves it undefined and gets GRADE_FAILED exactly as before.
       if (cfg.currentKind === 'failed') return { word: cfg.trailWord || GRADE_FAILED, state: 'current', checked: false, bold: true };
+      if (cfg.currentKind === 'held') return { word: AWAITING_ARTIST, state: 'current', checked: false, bold: true };
       if (cfg.currentKind === 'done') return { word: f.done, state: 'current', checked: true, bold: true };
       return { word: f.active, state: 'current', checked: false, bold: true }; // 'active'
     }
@@ -219,6 +231,7 @@ const DISCIPLINE_SKILL = { ui: 'design' };
 function nextActionFor(stage, { taskId, discipline, sandboxUrl } = {}) {
   if (stage === 'shipped') return { kind: 'prompt', label: 'Start next task', cmd: '/builder-start' };
   if (stage === 'confirmed') return { kind: 'prompt', label: 'Land it', cmd: '/merge-mode' };
+  if (stage === 'held') return { kind: 'prompt', label: 'Start next task', cmd: '/builder-start' };
   if (stage === 'failed') return { kind: 'prompt', label: 'Fix & re-grade', cmd: `node scripts/gds/ship.js ${taskId} --regrade` };
   if (stage === 'review') return { kind: 'link', label: 'Open in sandbox', url: sandboxUrl || '' };
   if (stage === 'claimed') {
@@ -391,7 +404,9 @@ function buildCardModel(input = {}) {
     }
     // Credits
     let creditsText = null;
-    if (stage === 'failed') {
+    if (stage === 'held') {
+      creditsText = 'none yet — paid when the artist approves and it lands';
+    } else if (stage === 'failed') {
       creditsText = 'none — held at completed';
     } else if (credits.awarded != null) {
       const total = fmtInt(credits.total);
@@ -448,6 +463,8 @@ function buildCardModel(input = {}) {
         // states the automatic reality rather than implying a required command.
         deployText = 'landing automatically';
       }
+    } else if (stage === 'held') {
+      deployText = 'waiting for the artist to approve it in the studio';
     } else {
       deployText = 'not deployed';
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.84",
+  "version": "1.21.85",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.84",
+      "version": "1.21.85",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.84",
+  "version": "1.21.85",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9330,5 +9330,11 @@
       "id": "1004629",
       "text": "New projects now ask how finished work should ship: Auto (recommended) or Manual. The answer becomes the project's ship mode, which the owner can change later on the settings page."
     }
+  ],
+  "1.21.85": [
+    {
+      "id": "1004379",
+      "text": "A page tweak that passed its grade and is waiting for its artist no longer reports itself as a failed grade: the closing card, the PR description and the credits line now all say it passed and is waiting for the artist's appro"
+    }
   ]
 }

package/scripts/gds/ship-finish.js

@@ -244,7 +244,8 @@ async function finishHeld({ taskId, summary, postGradeStatus, card }, deps = {})
     console.error(`  Re-run to publish it again (the grade is not re-run): node scripts/gds/ship.js ${taskId}`);
   }
   const usage = await (deps.postShipSync || postShipSync)(taskId, 'confirmed');
-  await (deps.printCompletionCard || printCompletionCard)({ taskId, postGradeStatus, card, usage, land });
+  // task 1004379: name the stage — at 'completed' the card would otherwise read a failed grade.
+  await (deps.printCompletionCard || printCompletionCard)({ taskId, postGradeStatus, card, usage, land, stage: 'held' });
   return land;
 }
 
@@ -270,7 +271,7 @@ function diffstatFor(baseline) {
 // in-feed HTML to a temp file and prints an [otb-card-html] marker the
 // builder-ship skill picks up to render it in the chat feed. Every step is
 // best-effort — a summary card must NEVER fail or undo a completed ship.
-async function printCompletionCard({ taskId, postGradeStatus, card, usage, land = null }) {
+async function printCompletionCard({ taskId, postGradeStatus, card, usage, land = null, stage = undefined }) {
   if (!card) return;
   try {
     const shipCard = require('../../modules/lifecycle/ship-card');
@@ -329,6 +330,7 @@ async function printCompletionCard({ taskId, postGradeStatus, card, usage, land
     }
 
     const cardInputs = {
+      stage, // task 1004379: 'held' from finishHeld; undefined ⇒ derived from postGradeStatus
       postGradeStatus,
       taskId,
       title: card.title,

package/scripts/gds/ship-flow.js

@@ -722,7 +722,7 @@ async function shipMain() {
 
   printCreditsAndAchievements({
     postGradeStatus, credits, creditsRaw, creditsMultiplier, ideaBonusInfo,
-    justUnlocked: postGradeJustUnlocked,
+    justUnlocked: postGradeJustUnlocked, held,
   });
 
   // ---- Step 3: confirmed→shipped tail (merge + deploy → memory/session sync →
@@ -1107,6 +1107,7 @@ async function regradeMain() {
   const g = gradePost.data.grade;
   recordGradeOutcome({ taskId, grade: g });
   const postGradeStatus = gradePost.data.taskStatus;
+  const held = gradePost.data.held === true; // task 1004322: a page tweak's pass waits for its artist
   printGradeOutcome(g, taskId);
   printCreditsAndAchievements({
     postGradeStatus,
@@ -1115,13 +1116,14 @@ async function regradeMain() {
     creditsMultiplier: gradePost.data.creditsMultiplier ?? null,
     ideaBonusInfo: gradePost.data.ideaBonus ?? null,
     justUnlocked: gradePost.data.just_unlocked || [],
+    held, // task 1004379: a held pass is not 'grade not passed'
   });
 
   // On a pass the task is now confirmed — run the SAME confirmed→shipped tail as a
   // normal ship (finishShip, #1093/C9) so a re-grade lands identically.
   await finishShip({
     taskId, summary, advanceToMerge: gradePost.data.advanceToMerge, skipMerge, dbOnly,
-    held: gradePost.data.held === true, // task 1004322: a page tweak's pass waits for its artist
+    held,
     postGradeStatus,
     doneLine: g.passed ? 'Done — re-grade passed.' : 'Done — re-grade still failing; fix and try again.',
     // task 1270: completion card for the re-grade path too.

package/scripts/gds/ship-grade-steps.js

@@ -478,9 +478,14 @@ function printGradeOutcome(g, taskId) {
 
 // Print the credits line + multiplier breakdown + idea bonus + unlocked
 // achievements from a grade/confirm response.
-function printCreditsAndAchievements({ postGradeStatus, credits, creditsRaw, creditsMultiplier, ideaBonusInfo, justUnlocked }) {
+function printCreditsAndAchievements({ postGradeStatus, credits, creditsRaw, creditsMultiplier, ideaBonusInfo, justUnlocked, held = false }) {
   console.log('');
-  if (postGradeStatus === 'completed') {
+  if (held) {
+    // task 1004379: a page tweak's PASS waits at completed for its artist (ADR
+    // 0341 D7). Reading 'completed' as 'grade not passed' told the reader the
+    // opposite of what happened.
+    console.log(`Credits awarded: ${credits} (none yet — the grade passed; credits land when the artist approves and it merges)`);
+  } else if (postGradeStatus === 'completed') {
     console.log(`Credits awarded: ${credits} (none — task at completed, grade not passed)`);
   } else if (postGradeStatus === 'confirmed') {
     console.log(`Credits awarded: ${credits} (none yet — credits land when the task merges to main)`);

package/scripts/gds/ship-land.js

@@ -19,6 +19,7 @@ const { plainCardLines } = require('./plain-cards.js');
 // The server's own reader of a PR's check rollup (task 1003988), reused so the laptop
 // poll names a red PR exactly the way publish-status does (task 1003764). Dependency-free.
 const { readCheckRollup, UNIT_REPORT_CONTEXT } = require('../../modules/lifecycle/check-rollup.js');
+const { prMergeSentence } = require('../../modules/lifecycle/page-tweak-hold.js');
 
 // ---------- the land outcome (task 1002541, part 1) ----------
 //
@@ -927,8 +928,7 @@ async function ciLandLocal(taskId, branch, valueSummary, { hold = false } = {})
     `Auto-opened by ship.js (deploy mode: ci) for task ${taskId}.\n\n` +
     `${sanitizeGitHubRefs(valueSummary) || '(no value summary)'}\n\n` +
     `Merging this PR triggers .github/workflows/deploy-prod.yml to deploy to ` +
-    `${deployTargetNote}. Auto-merge is enabled — GitHub lands it once the ` +
-    `required checks pass.`;
+    `${deployTargetNote}. ${prMergeSentence(hold)}`; // task 1004379: a held round's PR says it waits
   if (!existing || existing.state === 'CLOSED' || existing.state === 'MERGED') {
     console.log('  ci-land: opening PR -> main...');
     if (!ghArgvOk(buildPrCreateArgv(branch, title, body))) {

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.84'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.85'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/held_tweak_reporting.mjs

@@ -0,0 +1,164 @@
+// tests/held_tweak_reporting.mjs — a held page tweak is reported as a PASS that
+// waits for its artist, never as a failed grade (task 1004379, ADR 0341 D7).
+//
+// WHY. The first live Tweak Mode rounds (1004345, 1004348) passed their grade and
+// held at completed for the artist, as designed — and then three surfaces told the
+// reader the opposite: the closing card said "grade failed" and offered --regrade,
+// the PR the server opened said "Auto-merge is enabled", and a passing --regrade
+// printed "Credits awarded: 0 (grade not passed)". Each case below drives the real
+// code a held round runs through:
+//   1. finishHeld hands the card a 'held' stage, and that card reads as a pass;
+//   2. the publish route's PR body names the hold (and an ordinary PR is unchanged);
+//   3. the credits line a passing (re-)grade prints on a held round says it passed.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { test, summary } = makeRunner();
+
+const shipCard = require('../modules/lifecycle/ship-card.js');
+const shipFinish = require('../scripts/gds/ship-finish.js');
+const shipLand = require('../scripts/gds/ship-land.js');
+const { printCreditsAndAchievements } = require('../scripts/gds/ship-grade-steps.js');
+
+const capture = async (fn) => {
+  const out = [];
+  const orig = console.log;
+  console.log = (...a) => out.push(a.join(' '));
+  try { await fn(); } finally { console.log = orig; }
+  return out.join('\n');
+};
+
+// ---- 1. the closing card --------------------------------------------------
+
+const twelveMinor = Array.from({ length: 12 }, (_, i) => ({ severity: 'minor', file: `f${i}`, summary: 'nit' }));
+
+await test('finishHeld names the held stage to the card, even though the task sits at completed', async () => {
+  let cardArgs = null;
+  await capture(() => shipFinish.finishHeld({ taskId: 5001, summary: 's', postGradeStatus: 'completed', card: { title: 't' } }, {
+    publishHeld: async () => shipLand.landHeld({ prUrl: 'https://github.com/o/r/pull/77' }),
+    postShipSync: async () => null,
+    printCompletionCard: async (a) => { cardArgs = a; },
+  }));
+  assert.equal(cardArgs.stage, 'held');
+  assert.equal(cardArgs.postGradeStatus, 'completed');
+});
+
+await test('a held pass prints a hold card: no "grade failed", no --regrade, a passing grade row', () => {
+  const model = shipCard.buildCardModel({
+    stage: 'held', postGradeStatus: 'completed', taskId: 5001, title: 't',
+    grade: { passed: true, issues: twelveMinor, panel: 4 },
+    credits: { awarded: 0 },
+  });
+  const text = shipCard.renderMonospaceCard(model);
+  const html = shipCard.renderCardHtml(model);
+  assert.equal(model.stage, 'held');
+  assert.match(model.cfg.headline(5001), /waiting for the artist/);
+  for (const out of [text, html]) {
+    assert.doesNotMatch(out, /grade failed/i, 'the card must not call a pass a failure');
+    assert.doesNotMatch(out, /Needs fixes/);
+    assert.doesNotMatch(out, /--regrade/);
+    assert.doesNotMatch(out, /fail · 12 issues/);
+    assert.match(out, /awaiting artist/);
+  }
+  const row = (k) => (model.rows.find((r) => r.k === k) || {}).v;
+  assert.match(row('Grade'), /^pass/);
+  assert.match(row('Deploy'), /artist/);
+  assert.match(row('Credits'), /artist approves/);
+  assert.equal(model.action.cmd, '/builder-start');
+});
+
+await test('an ordinary stop at completed (a real failed grade) still reads as a failed grade', () => {
+  const model = shipCard.buildCardModel({
+    postGradeStatus: 'completed', taskId: 5002, title: 't',
+    grade: { passed: false, issues: twelveMinor },
+  });
+  assert.equal(model.stage, 'failed');
+  assert.match(shipCard.renderMonospaceCard(model), /grade failed/);
+  assert.match(model.action.cmd, /--regrade/);
+});
+
+// ---- 2. the PR body -------------------------------------------------------
+
+const express = require('express');
+const api = require('../src/module-api.js');
+const db = require('../modules/lifecycle/db.js');
+const gp = require('../modules/lifecycle/github-push.js');
+const prAssign = require('../modules/lifecycle/pr-assign.js');
+const pageTweakReads = require('../modules/lifecycle/page-tweak-reads.js');
+const hold = require('../modules/lifecycle/page-tweak-hold.js');
+
+let heldNow = false;
+let prBody = null;
+api.requireBuilder = (req, res, next) => { req.builder = { id: 1, rank: 'archon', github_login: 'the-archon' }; next(); };
+db.getLastClaimHolder = async () => ({ builder_id: 5, github_login: 'some-builder' });
+db.setClaimPublishedSha = async () => {};
+gp.isConfigured = () => true;
+gp.pushBundle = async () => ({ head_sha: 'a'.repeat(40) });
+gp.openOrFindPullRequest = async ({ body }) => { prBody = body; return { number: 77, url: 'https://github.com/o/r/pull/77', node_id: 'N' }; };
+gp.enableAutoMergeDetailed = async () => ({ ok: true });
+gp.setCommitStatus = async () => true;
+prAssign.assignPullRequest = async () => ({ assigned: true });
+pageTweakReads.heldForArtistFailClosed = async () => heldNow;
+
+const app = express();
+app.use((req, res, next) => { res.fail = (code, status, extra) => res.status(typeof status === 'number' ? status : (status && status.status) || 500).json({ error: code, ...(extra || {}) }); next(); });
+app.use(require('../modules/lifecycle/routes/tasks.js')());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+const publish = async () => {
+  prBody = null;
+  const res = await fetch(`${base}/tasks/5001/publish-branch`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ branch: 'task-5001', head_sha: 'a'.repeat(40), bundle_b64: Buffer.from('b').toString('base64'), value_summary: 'Page tweak.' }),
+  });
+  return { status: res.status, body: await res.json() };
+};
+
+await test("a held round's PR body says it waits for the artist, and never promises auto-merge", async () => {
+  heldNow = true;
+  const r = await publish();
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(r.body.auto_merge, false);
+  assert.ok(prBody.endsWith(hold.HELD_PR_SENTENCE), prBody);
+  assert.match(prBody, /artist/);
+  assert.doesNotMatch(prBody, /Auto-merge is enabled/);
+});
+
+await test('every other PR body keeps the auto-merge sentence it always had', async () => {
+  heldNow = false;
+  const r = await publish();
+  assert.equal(r.status, 201);
+  assert.equal(r.body.auto_merge, true);
+  assert.match(prBody, /Auto-merge is enabled — GitHub lands it once the required checks pass\.$/);
+});
+server.close();
+
+// ---- 3. the credits line after a passing (re-)grade -----------------------
+
+await test('a passing grade on a held round prints a pass, not "grade not passed"', async () => {
+  const text = await capture(() => printCreditsAndAchievements({ postGradeStatus: 'completed', credits: 0, justUnlocked: [], held: true }));
+  assert.doesNotMatch(text, /grade not passed/);
+  assert.match(text, /grade passed/);
+  assert.match(text, /artist approves/);
+});
+
+await test('a real failed grade at completed still says the grade did not pass', async () => {
+  const text = await capture(() => printCreditsAndAchievements({ postGradeStatus: 'completed', credits: 0, justUnlocked: [] }));
+  assert.match(text, /grade not passed/);
+});
+
+await test('both grade paths (ship and --regrade) hand the hold to the credits line', () => {
+  const fs = require('node:fs');
+  const src = fs.readFileSync(new URL('../scripts/gds/ship-flow.js', import.meta.url), 'utf8');
+  const calls = src.split('printCreditsAndAchievements({').slice(1).map((c) => c.slice(0, c.indexOf('});')));
+  const withHold = calls.filter((c) => /\bheld\b/.test(c));
+  assert.equal(withHold.length, 2, 'the ship grade and the re-grade both pass held');
+});
+
+summary();

package/tests/page_tweak_hold.mjs

@@ -206,8 +206,7 @@ await test('finishShip routes a held pass away from mergeAndDeploy (the source s
   const mergeAt = body.indexOf('await mergeAndDeploy(');
   assert.ok(holdAt > 0 && mergeAt > holdAt, 'the hold is decided BEFORE any merge is attempted');
   const flow = fs.readFileSync(require.resolve('../scripts/gds/ship-flow.js'), 'utf8');
-  assert.equal((flow.match(/held = gradePost\.data\.held === true/g) || []).length, 1, 'shipMain reads the hold off the grade response');
-  assert.equal((flow.match(/held: gradePost\.data\.held === true/g) || []).length, 1, 'regradeMain does too');
+  assert.equal((flow.match(/\bheld = gradePost\.data\.held === true/g) || []).length, 2, 'shipMain and regradeMain both read the hold off the grade response');
   assert.match(flow, /tweakHold\.isHeldForArtist\(task, tRes\.data\.grade/, 'a re-run of a held task re-publishes instead of re-grading');
 });