@bongos/core 1.19.1081 → 1.20.1

package/modules/ideas/ratify.js

@@ -261,6 +261,18 @@ async function ratifyCriterionProposal(ideaId, ratifierId, { notesMd = '' } = {}
 // refused with TEMPLATE_HAS_NO_GOAL_SHAPE, naming the vintage; its author can
 // resubmit against the current questions, which is what the resubmit path is for.
 //
+// THE RATIFIER MAY WRITE IT INSTEAD (task 1004226, owner decision 2026-09-29).
+// The board's first ten passed Full Ideas were all base-v1, so the refusal above
+// stranded every one of them. The rule that makes it a refusal still holds:
+// nothing here DERIVES a criterion from a v1 answer. What changed is that the
+// person ratifying may state one in their own words (`success_criterion` on the
+// request). The goal description then carries all the author's answers as
+// written plus a line saying the done-when was written by the ratifier, so a
+// reader never mistakes it for the author's answer; the ratifier's identity is on
+// the audit row. It is ONLY for a template this table does not map: where the
+// author answered the success question, their answer is the criterion and a
+// ratifier's is refused rather than substituted for it.
+//
 // ADDING A VINTAGE MEANS ADDING AN ENTRY HERE. Nothing falls back — an unmapped
 // template refuses, rather than guessing at a key that happens to exist.
 const GOAL_SHAPE_BY_TEMPLATE = Object.freeze({
@@ -286,17 +298,24 @@ const GOAL_SHAPE_BY_TEMPLATE = Object.freeze({
 // answers in whatever order Postgres chose (templates.js' own header says so).
 // LABELS come from the declaration too, so a v1 row would render under v1
 // labels if a v1 shape were ever declared.
-function composeGoalFromFullIdea({ ideaId, templateKey, fieldValues } = {}) {
+function composeGoalFromFullIdea({ ideaId, templateKey, fieldValues, ratifierCriterionMd = null } = {}) {
   const template = templateFor(templateKey);
   if (!template) return { ok: false, reason: 'unknown_template', template_key: templateKey ?? null };
   const shape = Object.hasOwn(GOAL_SHAPE_BY_TEMPLATE, templateKey) ? GOAL_SHAPE_BY_TEMPLATE[templateKey] : null;
-  if (!shape) return { ok: false, reason: 'template_has_no_goal_shape', template_key: templateKey };
+  // A blank ratifier criterion is no criterion: it must not turn a refusal into
+  // a goal whose only gate is whitespace.
+  const ratifierMd = typeof ratifierCriterionMd === 'string' && ratifierCriterionMd.trim() !== ''
+    ? ratifierCriterionMd.trim() : null;
+  if (shape && ratifierMd) {
+    return { ok: false, reason: 'template_supplies_done_when', template_key: templateKey, field: shape.doneWhenField };
+  }
+  if (!shape && !ratifierMd) return { ok: false, reason: 'template_has_no_goal_shape', template_key: templateKey };
   if (!fieldValues || typeof fieldValues !== 'object' || Array.isArray(fieldValues)) {
     return { ok: false, reason: 'field_values_missing' };
   }
 
-  const doneWhen = fieldValues[shape.doneWhenField];
-  if (typeof doneWhen !== 'string' || doneWhen.trim() === '') {
+  const doneWhen = shape ? fieldValues[shape.doneWhenField] : ratifierMd;
+  if (shape && (typeof doneWhen !== 'string' || doneWhen.trim() === '')) {
     // A Full Idea cannot normally reach here with a blank required field —
     // validateFieldValues refuses that at capture. It is checked anyway because
     // the alternative is a goal whose only criterion is an empty string, which
@@ -322,11 +341,17 @@ function composeGoalFromFullIdea({ ideaId, templateKey, fieldValues } = {}) {
   // opening the goal learns, without asking anyone, that its scope is somebody's
   // thought and where to go and read it whole.
   const origin = `> Ratified from Full Idea [#${ideaId}](/idea/${ideaId}) — its five answers, as written.`;
+  // Said in the prose, because the criterion is not one of the answers above and
+  // a reader must not take it for the author's (task 1004226).
+  const byRatifier = shape ? [] : [
+    `> Its done-when criterion was written by the ratifier at ratification: this idea's questions (${templateKey}) did not ask what success looks like.`,
+  ];
   return {
     ok: true,
-    description: [origin, ...sections].join('\n\n'),
+    description: [origin, ...byRatifier, ...sections].join('\n\n'),
     criterionMd: doneWhen.trim(),
-    doneWhenField: shape.doneWhenField,
+    doneWhenField: shape ? shape.doneWhenField : null,
+    doneWhenFrom: shape ? shape.doneWhenField : 'ratifier',
   };
 }
 
@@ -353,7 +378,7 @@ function composeGoalFromFullIdea({ ideaId, templateKey, fieldValues } = {}) {
 // recommendation a decision, which is the one thing it is not.
 async function ratifyFullIdeaAsGoal(
   ideaId, ratifierId,
-  { targetVersion, scopeModules = [], admitReason = null, actorRank = null, notesMd = '' } = {}
+  { targetVersion, scopeModules = [], admitReason = null, actorRank = null, notesMd = '', ratifierCriterionMd = null } = {}
 ) {
   const id = Number(ideaId);
   if (!Number.isFinite(id)) throw { code: 'BAD_ID' };
@@ -409,6 +434,7 @@ async function ratifyFullIdeaAsGoal(
     // c. Compose. Pure, and its refusals are the caller's 400s.
     const composed = composeGoalFromFullIdea({
       ideaId: idea.id, templateKey: idea.template_key, fieldValues: idea.field_values,
+      ratifierCriterionMd,
     });
     if (!composed.ok) throw { code: 'CANNOT_COMPOSE_GOAL', reason: composed.reason, ...composed };
 
@@ -476,7 +502,9 @@ async function ratifyFullIdeaAsGoal(
       // Reported back so a caller can see what the author had recommended and
       // what the board did with it, without a second read. NULL stays NULL.
       recommendation_at_filing: idea.recommendation ?? null,
-      done_when_from: composed.doneWhenField,
+      // 'ratifier' when the person ratifying wrote it (task 1004226), else the
+      // template field the author answered.
+      done_when_from: composed.doneWhenFrom,
       proposer_id: idea.captured_by,
     };
   } catch (err) {

package/modules/ideas/routes/ratify-goal.js

@@ -110,6 +110,11 @@ module.exports = function buildRatifyGoalRouter() {
         // 'ok' is not a reason.
         admit_reason: { type: 'string', minLength: 8, maxLength: 500 },
         notes_md: { type: 'string', maxLength: LIMITS.NOTES },
+        // task 1004226: the success criterion, in the RATIFIER's words, for a
+        // Full Idea whose questions never asked what success looks like
+        // (base-v1). Refused for a template that did ask, so the author's own
+        // answer is never replaced. Absent or blank means none was written.
+        success_criterion: { type: 'string', maxLength: 2000 },
       })) return;
       const id = parseId(req, res, { code: 'bad_id' });
       if (id === null) return;
@@ -122,6 +127,7 @@ module.exports = function buildRatifyGoalRouter() {
           // (ADR 0016) — the port denies when it is absent.
           actorRank: req.builder.rank,
           notesMd: typeof req.body.notes_md === 'string' ? req.body.notes_md : '',
+          ratifierCriterionMd: typeof req.body.success_criterion === 'string' ? req.body.success_criterion : null,
         });
         res.status(201).json({ ok: true, ...result });
       } catch (err) {

package/modules/lifecycle/db-analytics.js

@@ -579,18 +579,60 @@ async function ecosystemAnalytics(days = 90, kind = null) {
 //               writes actually queryable through the API, not just via psql
 //               (ADR 0033 §1 / F4 finding).
 
-async function logGradeAttempt({ taskId, builderId, passed, score }, queryFn) {
+// workerVerdicts — one grade's per-worker signals slimmed to what the
+// correlation audit reads (task 1004292): kind, verdict, the error CODE and the
+// severities of the worker's issues. NO prose: no summary, file or stderr, which
+// task_grades keeps for the latest grade only. Pure; returns null when there is
+// nothing to keep (a non-panel grade), so the column stays NULL.
+const VERDICT_WORKER_CAP = 12;     // workers kept per attempt (a panel is ~4-6 plus pseudo-judges)
+const VERDICT_SEVERITY_CAP = 50;   // severities kept per worker
+const VERDICT_KIND_MAX = 40;
+const VERDICT_VERDICT_MAX = 20;
+const VERDICT_ERROR_MAX = 80;
+const VERDICT_SEVERITY_MAX = 20;
+const VERDICT_ROUNDS_MAX = 50;     // rounds served per task (the most recent)
+function workerVerdicts(workers) {
+  if (!Array.isArray(workers)) return null;
+  const out = [];
+  for (const w of workers) {
+    if (!w || typeof w !== 'object' || typeof w.kind !== 'string') continue;
+    out.push({
+      kind: w.kind.slice(0, VERDICT_KIND_MAX),
+      verdict: typeof w.verdict === 'string' ? w.verdict.slice(0, VERDICT_VERDICT_MAX) : null,
+      error: w.error == null ? null : String(w.error).slice(0, VERDICT_ERROR_MAX),
+      severities: (Array.isArray(w.issues) ? w.issues : [])
+        .map((i) => (i && typeof i.severity === 'string' ? i.severity.slice(0, VERDICT_SEVERITY_MAX) : null))
+        .filter(Boolean)
+        .slice(0, VERDICT_SEVERITY_CAP),
+    });
+    if (out.length >= VERDICT_WORKER_CAP) break;
+  }
+  return out.length ? out : null;
+}
+
+async function logGradeAttempt({ taskId, builderId, passed, score, workers }, queryFn) {
   const q = queryFn || ((text, params) => pool.query(text, params));
+  const base = [
+    Number(taskId),
+    builderId == null ? null : Number(builderId),
+    passed === true,
+    score == null ? null : Number(score),
+  ];
+  const verdicts = workerVerdicts(workers);
+  // task 1004292: the per-worker verdicts ride the same row, but a failure to
+  // write them (the column not yet migrated, a serialisation error) must never
+  // cost the row itself, so the plain insert is the fallback.
+  if (verdicts) {
+    try {
+      await q(
+        `INSERT INTO grade_attempts (task_id, builder_id, passed, score, worker_verdicts) VALUES ($1, $2, $3, $4, $5::jsonb)`,
+        [...base, JSON.stringify(verdicts)]
+      );
+      return true;
+    } catch (_err) { /* fall through to the plain insert below, which logs if it fails too */ }
+  }
   try {
-    await q(
-      `INSERT INTO grade_attempts (task_id, builder_id, passed, score) VALUES ($1, $2, $3, $4)`,
-      [
-        Number(taskId),
-        builderId == null ? null : Number(builderId),
-        passed === true,
-        score == null ? null : Number(score),
-      ]
-    );
+    await q(`INSERT INTO grade_attempts (task_id, builder_id, passed, score) VALUES ($1, $2, $3, $4)`, base);
     return true;
   } catch (err) {
     console.error('[gds] logGradeAttempt (non-blocking):', err && err.message ? err.message : err);
@@ -598,6 +640,30 @@ async function logGradeAttempt({ taskId, builderId, passed, score }, queryFn) {
   }
 }
 
+// gradeAttemptVerdicts — every recorded round of a task that kept its per-worker
+// verdicts, oldest first: [{ attempted_at, passed, workers }] (task 1004292).
+// Rounds made before the column existed are simply absent. Never throws: a read
+// failure (column not migrated yet) is an empty list, and the audit falls back
+// to the task's final grade.
+async function gradeAttemptVerdicts(taskId, queryFn) {
+  const q = queryFn || ((text, params) => pool.query(text, params));
+  try {
+    const { rows } = await q(
+      `SELECT attempted_at, passed, workers FROM (
+         SELECT id, attempted_at, passed, worker_verdicts AS workers
+           FROM grade_attempts
+          WHERE task_id = $1 AND worker_verdicts IS NOT NULL
+          ORDER BY attempted_at DESC, id DESC
+          LIMIT $2) recent
+        ORDER BY attempted_at ASC, id ASC`,
+      [Number(taskId), VERDICT_ROUNDS_MAX]
+    );
+    return rows;
+  } catch (_err) {
+    return []; // best-effort read: an unmigrated column means "no earlier rounds", not an error
+  }
+}
+
 // countGradeAttempts — how many times a task has been graded (re-grade thrash).
 
 async function countGradeAttempts(taskId, queryFn) {
@@ -777,6 +843,9 @@ module.exports = {
   gradeByBuilder,
   gradeTrendByDay,
   logGradeAttempt,
+  gradeAttemptVerdicts,
+  workerVerdicts,
+  VERDICT_LIMITS: { workers: VERDICT_WORKER_CAP, severities: VERDICT_SEVERITY_CAP, rounds: VERDICT_ROUNDS_MAX },
   mergeLeaseStatus,
   recentGradesForBuilder,
   recentShippedTasks,

package/modules/lifecycle/db-claims.js

@@ -22,6 +22,11 @@ const { touchesOverlap } = api.pathMatch;
 // un-testable except by counting.
 const { CLAIM_ANY, CLAIM_NEWCOMER } = require('./claim-eligibility.js');
 const { goalMembershipFailures } = require('./claim-feed.js');
+// ADR 0101 Part 1 (task 1001691) — the relevance/anti-hack judge's claim-time
+// friction gate. Same extraction shape as goalMembershipFailures: one decision,
+// called from all three claim surfaces below, so a flagged task can't be
+// claimed via the batch path as a bypass of the single-claim gate.
+const { relevanceFrictionFailures } = require('./db-relevance-flags.js');
 const { unsatisfiedDeps } = require('./db-deps-criteria.js');
 // depRefusalRow: the ONE shape a DEPS_NOT_SHIPPED refusal carries. All three
 // claim paths below use it — hand-building the object here is what made task
@@ -79,6 +84,21 @@ function claimUniqueViolationError(err) {
   return { code: 'ALREADY_CLAIMED' };
 }
 
+// isRebaseGateExempt — the one task the owed-rebase gate below never refuses
+// (task 1004370). When main's CI goes red for a reason outside every branch (an
+// npm advisory tripping the audit gate, 2026-09-29), no confirmed task can land,
+// so the gate shuts the queue of every builder holding one — including the claim
+// on the fix that would let them land. Releasing is no exit either: a confirmed
+// task has no open claim to release. So a P1 kind=infra task, the shape a
+// CI-unblock is filed in, passes the gate. Everything else stays gated, and the
+// owed rebases are still reported everywhere they were. Filing one takes
+// task.create, which is Metic-floored (catalog.js), so the door is as narrow as
+// the people who could already file the fix. A missing row is not exempt, so a
+// gated builder still meets REBASE_REQUIRED first, in the order it always was.
+function isRebaseGateExempt(task) {
+  return Boolean(task) && task.kind === 'infra' && Number(task.priority) === 1;
+}
+
 async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSessionId, enforceOverlap = false }) {
   const heldPermissions = await claimPermissionsFor(builderId); // BV1.R106 — before the tx opens
   const client = await pool.connect();
@@ -112,7 +132,9 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     // The GATING subset, not the surfacing one: a strand the builder cannot clear
     // stops blocking after a grace, while still being reported (task 1003294).
     const owedRebases = await gatingRebaseTasksForBuilder(builderId, client);
-    if (owedRebases.length > 0) {
+    if (owedRebases.length > 0 && !isRebaseGateExempt(
+      (await client.query(`SELECT kind, priority FROM tasks WHERE id = $1`, [taskId])).rows[0],
+    )) {
       throw {
         code: 'REBASE_REQUIRED',
         rebaseTasks: owedRebases.map((t) => ({ id: t.id, title: t.title, reason: t.needs_rebase_reason })),
@@ -213,6 +235,14 @@ async function claimTask({ taskId, builderId, worktreeName, headSha, creatorSess
     const goalRefusals = await goalMembershipFailures({ client, tasks: [task], builderId, builderRank });
     if (goalRefusals.length > 0) throw goalRefusals[0].refusal;
 
+    // task 1001691 / ADR 0101 Part 1: the relevance judge's "raise friction"
+    // gate — a high-confidence or repeat scope-gaming flag holds the claim
+    // open until a Metic reviews it (never permanently; either decision
+    // releases it). Same ladder position as goal membership: after rank +
+    // membership, before deps.
+    const relevanceRefusals = await relevanceFrictionFailures({ client, tasks: [task] });
+    if (relevanceRefusals.length > 0) throw relevanceRefusals[0].refusal;
+
     // The claim gate (ADR 0015, generalized in task 1516 / ADR 0086 §5): a task
     // can't be claimed while any dependency is un-done — its OWN edges plus those
     // inherited from its goal/criteria, where "done" = task shipped | criterion
@@ -593,6 +623,15 @@ async function claimTasksBatch({ taskIds, builderId, worktreePrefix, creatorSess
       failures.push({ task_id: f.task_id, reason: code, ...rest });
     }
 
+    // task 1001691 / ADR 0101 Part 1: the SAME extracted relevance-friction
+    // gate as claimTask — kept in sync for the same reason goal membership is
+    // (see claim-feed.js's header): the batch path owns the repo's only other
+    // INSERT INTO claims, so an inline-only gate would be bypassable via batch.
+    for (const f of await relevanceFrictionFailures({ client, tasks: taskRows })) {
+      const { code, ...rest } = f.refusal;
+      failures.push({ task_id: f.task_id, reason: code, ...rest });
+    }
+
     // Per-task dependency check (ADR 0015, generalized task 1516). An EXTERNAL dep
     // (not in this batch) must already be done; a batch-internal dep isn't done yet
     // at claim time but doesn't block — the batch is worked serially. "Internal"
@@ -939,6 +978,13 @@ async function validateClaimBatch({ taskIds, builderId }) {
     push(f.task_id, { reason: code, ...rest });
   }
 
+  // task 1001691 / ADR 0101 Part 1: relevance-friction, kept in sync with
+  // claimTask + claimTasksBatch (see db-relevance-flags.js).
+  for (const f of await relevanceFrictionFailures({ client: pool, tasks: taskRows })) {
+    const { code, ...rest } = f.refusal;
+    push(f.task_id, { reason: code, ...rest });
+  }
+
   // Dependencies — external to the batch only (a batch-internal dep is fine;
   // the batch is worked serially, same rule as claimTasksBatch).
   const batchIdSet = new Set(uniqIds);
@@ -1006,6 +1052,7 @@ module.exports = {
   claimTask,
   claimTasksBatch,
   claimUniqueViolationError,
+  isRebaseGateExempt,
   releaseClaimsBatch,
   validateClaimBatch,
 };

package/modules/lifecycle/db-deps-criteria.js

@@ -147,28 +147,72 @@ async function findDependencyCycle(taskId, depTaskId, executor = pool) {
 }
 
 
-async function addTaskDependency(taskId, depTaskId) {
-  if (taskId === depTaskId) {
-    throw { code: 'SELF_DEP' };
-  }
-  // Confirm both tasks exist
-  const { rows: existing } = await pool.query(
-    `SELECT id FROM tasks WHERE id = ANY($1::bigint[])`,
-    [[taskId, depTaskId]]
-  );
-  if (existing.length !== 2) {
-    throw { code: 'TASK_NOT_FOUND' };
-  }
-  const cyclePath = await findDependencyCycle(taskId, depTaskId);
-  if (cyclePath) {
-    throw { code: 'CYCLE', path: cyclePath };
-  }
-  await pool.query(
-    `INSERT INTO dependencies (from_kind, from_id, to_kind, to_id)
-     VALUES ('task', $1, 'task', $2)
-     ON CONFLICT DO NOTHING`,
-    [taskId, depTaskId]
-  );
+// ---- every dependency-graph WRITE is one locked transaction (task 1004191) ----
+// The edge writers used to run their existence check, cycle check and INSERT as
+// separate statements on the bare pool. Two findings from the task 1000379 audit
+// followed from that, both verified real on 2026-09-29:
+//   - partial writes (63/81): POST /tasks/:id/dependencies looped addTaskDependency
+//     per id, so a cycle on the 3rd id left the 1st and 2nd committed;
+//   - TOCTOU (75): the cycle walk and the INSERT ran on different connections, so
+//     concurrent A->B and B->A could both pass the walk and commit a cycle.
+// Now each writer opens ONE transaction, takes ONE advisory lock that serializes
+// every graph write (the graph is small and written rarely, by Metic+ only), and
+// runs existence + cycle + insert on that client. Under READ COMMITTED each
+// statement after the lock sees every write that committed before the lock was
+// granted, so the walk always sees the other writer's edge.
+const DEP_GRAPH_LOCK = 'dependencies/graph-write';
+
+async function lockDependencyGraph(client) {
+  await client.query('SELECT pg_advisory_xact_lock(hashtext($1))', [DEP_GRAPH_LOCK]);
+}
+
+// Coerce + validate a list of ids. Throws BAD_ID (a 400) instead of letting a
+// non-numeric id reach Postgres as a bigint cast error (a 500 — finding 64).
+function toDepIds(list) {
+  const ids = list.map(Number);
+  if (ids.some((n) => !Number.isSafeInteger(n) || n <= 0)) throw { code: 'BAD_ID' };
+  return [...new Set(ids)];
+}
+
+// There is no FK on dependencies (the target table varies by kind), so an unknown
+// id would be written as an orphan edge that blocks its task forever (fail-closed).
+// Refuse it up front and name what was missing.
+async function assertTasksExist(client, ids) {
+  const { rows } = await client.query(`SELECT id FROM tasks WHERE id = ANY($1::bigint[])`, [ids]);
+  const found = new Set(rows.map((r) => Number(r.id)));
+  const missing = ids.filter((id) => !found.has(id));
+  if (missing.length > 0) throw { code: 'TASK_NOT_FOUND', missing };
+}
+
+const txOpts = (opts) => (opts && opts.pool ? { pool: opts.pool } : undefined);
+
+// Add task->task edges from taskId to every id in depTaskIds, all or nothing.
+// Throws BAD_ID, SELF_DEP, TASK_NOT_FOUND ({missing}) or CYCLE ({path}); on any
+// throw nothing is written. Returns the unique dep ids. `opts.pool` is a test seam.
+async function addTaskDependencies(taskId, depTaskIds, opts) {
+  const [id] = toDepIds([taskId]);
+  const deps = toDepIds(depTaskIds);
+  if (deps.includes(id)) throw { code: 'SELF_DEP' };
+  return withTx(async (client) => {
+    await lockDependencyGraph(client);
+    await assertTasksExist(client, [id, ...deps]);
+    for (const dep of deps) {
+      const cyclePath = await findDependencyCycle(id, dep, client);
+      if (cyclePath) throw { code: 'CYCLE', path: cyclePath };
+      await client.query(
+        `INSERT INTO dependencies (from_kind, from_id, to_kind, to_id)
+         VALUES ('task', $1, 'task', $2)
+         ON CONFLICT DO NOTHING`,
+        [id, dep]
+      );
+    }
+    return deps;
+  }, txOpts(opts));
+}
+
+// Single-edge form (routes/goals.js). Same transaction; historical return shape.
+async function addTaskDependency(taskId, depTaskId, opts) {
+  await addTaskDependencies(taskId, [depTaskId], opts);
   return { task_id: taskId, depends_on_task_id: depTaskId };
 }
 
@@ -187,34 +231,39 @@ async function removeTaskDependency(taskId, depTaskId) {
 // Validates no cycles among the new set in one transaction. Order of the
 // list doesn't matter.
 
-async function setTaskDependencies(taskId, depTaskIds) {
-  const unique = [...new Set(depTaskIds.map(Number))];
-  if (unique.includes(Number(taskId))) {
+async function setTaskDependencies(taskId, depTaskIds, opts) {
+  const [id] = toDepIds([taskId]);
+  const unique = toDepIds(depTaskIds);
+  if (unique.includes(id)) {
     throw { code: 'SELF_DEP' };
   }
   return withTx(async (client) => {
+    // task 1004191: serialize against every other graph write (finding 75), and
+    // 404 an unknown task or dep id instead of writing orphan edges (finding 64).
+    await lockDependencyGraph(client);
+    await assertTasksExist(client, [id, ...unique]);
     // Replace only this task's task->task edges; leave any task->goal/criterion
     // edges (created via the generic /dependencies endpoint) untouched.
     await client.query(
       `DELETE FROM dependencies WHERE from_kind = 'task' AND from_id = $1 AND to_kind = 'task'`,
-      [taskId]
+      [id]
     );
     for (const dep of unique) {
       // Re-check cycle for each insert (using the same txn connection so the
       // previous inserts in this txn are visible). Reuses findDependencyCycle
       // with the txn client as executor — task 1087, C3.
-      const cyclePath = await findDependencyCycle(taskId, dep, client);
+      const cyclePath = await findDependencyCycle(id, dep, client);
       if (cyclePath) {
         throw { code: 'CYCLE', path: cyclePath };
       }
       await client.query(
         `INSERT INTO dependencies (from_kind, from_id, to_kind, to_id)
          VALUES ('task', $1, 'task', $2)`,
-        [taskId, dep]
+        [id, dep]
       );
     }
     return unique;
-  });
+  }, txOpts(opts));
 }
 
 // ---------------------------------------------------------------------------
@@ -240,19 +289,23 @@ async function dependencyNodeExists(kind, id, executor = pool) {
 // Add a polymorphic edge "from is blocked until to is done". Throws BAD_KIND,
 // SELF_DEP, NODE_NOT_FOUND, or CYCLE (with the offending kind:id path).
 
-async function addDependency(fromKind, fromId, toKind, toId) {
+async function addDependency(fromKind, fromId, toKind, toId, opts) {
   if (!DEP_KINDS.includes(fromKind) || !DEP_KINDS.includes(toKind)) throw { code: 'BAD_KIND' };
   if (fromKind === toKind && Number(fromId) === Number(toId)) throw { code: 'SELF_DEP' };
-  if (!(await dependencyNodeExists(fromKind, fromId)) || !(await dependencyNodeExists(toKind, toId))) {
-    throw { code: 'NODE_NOT_FOUND' };
-  }
-  const cyclePath = await findCycle(fromKind, fromId, toKind, toId);
-  if (cyclePath) throw { code: 'CYCLE', path: cyclePath };
-  await pool.query(
-    `INSERT INTO dependencies (from_kind, from_id, to_kind, to_id)
-     VALUES ($1, $2, $3, $4) ON CONFLICT DO NOTHING`,
-    [fromKind, fromId, toKind, toId]
-  );
+  // task 1004191 (finding 75): one locked transaction, same as the task writers.
+  await withTx(async (client) => {
+    await lockDependencyGraph(client);
+    if (!(await dependencyNodeExists(fromKind, fromId, client)) || !(await dependencyNodeExists(toKind, toId, client))) {
+      throw { code: 'NODE_NOT_FOUND' };
+    }
+    const cyclePath = await findCycle(fromKind, fromId, toKind, toId, client);
+    if (cyclePath) throw { code: 'CYCLE', path: cyclePath };
+    await client.query(
+      `INSERT INTO dependencies (from_kind, from_id, to_kind, to_id)
+       VALUES ($1, $2, $3, $4) ON CONFLICT DO NOTHING`,
+      [fromKind, fromId, toKind, toId]
+    );
+  }, txOpts(opts));
   return { from_kind: fromKind, from_id: Number(fromId), to_kind: toKind, to_id: Number(toId) };
 }
 
@@ -488,6 +541,7 @@ async function unsatisfiedDeps(taskId, client = pool) {
 module.exports = {
   addDependency,
   addTaskCriterion,
+  addTaskDependencies,
   addTaskDependency,
   attachTaskDepSummaries,
   countTasksWithoutCriterionLink,

package/modules/lifecycle/db-goals.js

@@ -43,8 +43,11 @@ const { autoCloseVersionsForGoals } = require('./version-autoclose.js');
 // the close count's exemption, and the hall, which should not render the one goal
 // nobody chose as though a person had scoped it. Additive: every consumer selects
 // this list, so nothing had to be found and changed.
+// `working_area` (task 1004057, migration core_260) is the ADR 0264 area number
+// as data, NULL for every other goal. It is NOT sort_order and NOT the id — both
+// look like it on a payload and neither is.
 const GOAL_COLS =
-  'id, version_id, title, subtitle, description, scope_modules, status, visibility, accepting_requests, created_by, succeeded_by_goal_id, sort_order, category_id, is_maintenance, created_at, updated_at';
+  'id, version_id, title, subtitle, description, scope_modules, status, visibility, accepting_requests, created_by, succeeded_by_goal_id, sort_order, category_id, is_maintenance, working_area, created_at, updated_at';
 
 // Shared column list for a goal_membership_requests row (task 1951 / ADR 0112) —
 // the invite / join-request queue behind private goals. Every helper below shapes

package/modules/lifecycle/db-grade.js

@@ -260,7 +260,15 @@ async function applyGrade({ taskId, builderId, gradeResult, committedFiles = nul
   // re-grade thrash is countable (task_grades is upsert-unique). Post-commit +
   // best-effort: logGradeAttempt uses a pooled connection and swallows its own
   // errors, so it can never roll back or block the grade that just committed.
-  await logGradeAttempt({ taskId, builderId, passed: gradeResult.passed, score: gradeResult.score });
+  // task 1004292: the per-worker verdicts (kind, verdict, error code, issue
+  // severities; no prose) ride the same row so an earlier round survives the
+  // re-grade that overwrites task_grades. Best-effort inside logGradeAttempt.
+  // `deps.attemptQuery` is the test-only seam (NODE_ENV==='test'), like deps.pool.
+  const attemptQuery = (deps.attemptQuery && process.env.NODE_ENV === 'test') ? deps.attemptQuery : undefined;
+  await logGradeAttempt({
+    taskId, builderId, passed: gradeResult.passed, score: gradeResult.score,
+    workers: gradeResult.signals && gradeResult.signals.workers,
+  }, attemptQuery);
 
   return result;
 }