@bongos/core 1.19.374 → 1.19.376

package/src/module-api.js

@@ -1178,8 +1178,22 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.372 with no explicit bump. run 32906118616. (task 1002620)
 //   1.19.374 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.373 with no explicit bump. run 32906477349. (task 1002620)
+//   (next carrier) — joinabilityMode re-exported (task 1003044, goal 1000058; ADR 0194).
+//         The project's membership door — open / apply / invite_only — is enforced by
+//         the admission machinery: the two sign-in flows self-enrol only on 'open', and
+//         the onboarding module's public POST /access-requests must refuse an invite-only
+//         project with the SAME decision (SR-19: one gate, no drift), so the reader moves
+//         onto the doorway beside branding. Additive — a MINOR by the 1.19.0 precedent,
+//         but a hand-bumped version cannot pass the publish lane's LIVE test
+//         (tests/bump_version.mjs: HEAD's version must be one the lane's own carrier
+//         commits announced), so it rides the next CI patch; the contradiction with
+//         ADR 0161 §2 is filed as an idea from task 1003044.
+//   1.19.375 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.374 with no explicit bump. run 32909701598. (task 1002620)
+//   1.19.376 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.375 with no explicit bump. run 32910331206. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.374'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.376'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -1357,6 +1371,13 @@ module.exports = {
   //     hardcodes, instance strings).
   branding: branding.branding,
   clientBranding: branding.clientBranding,
+  // joinabilityMode() — the project's effective membership door: 'open' |
+  //     'apply' | 'invite_only' (task 1003044; ADR 0194). Read here, never
+  //     re-derived from branding().project by a module: the legacy
+  //     open-enrolment flag and the fail-closed default live in this one
+  //     reader, and the sign-in flows and the public access-request route
+  //     must answer with the same door (SR-19).
+  joinabilityMode: auth.joinabilityMode,
   // userAgent — the instance's HTTP User-Agent string (branding-derived). The
   // carved lifecycle module's github-push.js stamps every GitHub API request with
   // it instead of reaching into src/branding.js directly (BV1.R86).

package/tests/access_requests_invite.mjs

@@ -0,0 +1,165 @@
+// tests/access_requests_invite.mjs — the admission routes against a scripted
+// pool (task 1003044). The Archon's invite is the security-critical write on an
+// invite-only project — it is the only thing that admits anyone — so every
+// branch is pinned: already a member, an invite already standing, a pending
+// request resolved in place, a fresh row, a bad username, a DB failure. Plus
+// the public POST's three doors against the same router: apply reaches the
+// queries, invite_only and open refuse before any.
+//
+// The doorway is stubbed in require.cache BEFORE the route loads (the route
+// destructures pool/validators at require time — the web_admission_status
+// pattern): the session gates admit a fixed Archon, the pool replays a script
+// of results and records every query, and joinabilityMode is a switch.
+//
+// Run:  node --test tests/access_requests_invite.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+
+let calls = [];
+let script = [];
+let mode = 'apply';
+const pool = {
+  async query(sql, params) {
+    calls.push({ sql, params });
+    if (!script.length) throw new Error(`unscripted query: ${sql.trim().slice(0, 40)}`);
+    const next = script.shift();
+    if (next instanceof Error) throw next;
+    return next;
+  },
+};
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool,
+  joinabilityMode: () => mode,
+  requireBuilder: (req, _res, next) => { req.builder = { id: 42, github_login: 'archon' }; next(); },
+  requirePermission: () => (_req, _res, next) => next(),
+};
+
+const buildAccessRequestsRouter = require('../modules/onboarding/routes/access-requests.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/gds', buildAccessRequestsRouter());
+
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+function post(pathname, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: pathname, method: 'POST',
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, json: data ? JSON.parse(data) : null }));
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+const reset = (m, s) => { mode = m; script = s; calls = []; };
+const none = { rows: [] };
+const one = (row = {}) => ({ rows: [row] });
+
+// ── POST /access-requests/invite ─────────────────────────────────────────────
+
+test('invite: already a member → 409, nothing written', async () => {
+  reset('invite_only', [one()]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'already_member');
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].sql, /FROM builders/);
+});
+
+test('invite: an invite already standing → 200 already_invited, nothing written', async () => {
+  reset('invite_only', [none, one()]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.already_invited, true);
+  assert.equal(calls.length, 2);
+  assert.match(calls[1].sql, /status = 'invited'/);
+});
+
+test('invite: a pending request is resolved in place — the same row the sign-in gate reads', async () => {
+  reset('invite_only', [none, none, one({ id: 7, github_login: 'Octocat', status: 'invited' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: '@Octocat ' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.request.status, 'invited');
+  assert.equal(calls.length, 3, 'no insert after a successful resolve');
+  assert.match(calls[2].sql, /UPDATE access_requests/);
+  assert.match(calls[2].sql, /SET status = 'invited'/);
+  assert.match(calls[2].sql, /WHERE lower\(github_login\) = lower\(\$2\) AND status = 'pending'/);
+  assert.deepEqual(calls[2].params, [42, 'Octocat'], 'resolved by the Archon; the login is trimmed and un-@ed, case kept for lower()');
+});
+
+test('invite: no request at all → a fresh invited row, 201', async () => {
+  reset('invite_only', [none, none, none, one({ id: 8, github_login: 'octocat', status: 'invited' })]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 201);
+  assert.equal(r.json.request.status, 'invited');
+  assert.match(calls[3].sql, /INSERT INTO access_requests/);
+  assert.match(calls[3].sql, /'invited'/);
+  assert.deepEqual(calls[3].params, ['octocat', 42]);
+});
+
+test('invite: a bad username → 400 before any query', async () => {
+  reset('invite_only', []);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'not a login!' });
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'bad_github_login');
+  assert.equal(calls.length, 0);
+});
+
+test('invite: a DB failure → 500 invite_failed, no internals in the message', async () => {
+  reset('invite_only', [new Error('connection refused')]);
+  const r = await post('/api/gds/access-requests/invite', { github_login: 'octocat' });
+  assert.equal(r.status, 500);
+  assert.equal(r.json.error.code, 'invite_failed');
+  assert.doesNotMatch(r.json.error.message, /connection refused/);
+});
+
+// ── the public POST's three doors ────────────────────────────────────────────
+
+test('public POST on apply: the door is open — the request is filed', async () => {
+  reset('apply', [none, none, one({ id: 9, github_login: 'octocat', status: 'pending' })]);
+  const r = await post('/api/gds/access-requests', { github_login: 'octocat' });
+  assert.equal(r.status, 201);
+  assert.equal(r.json.request.status, 'pending');
+  assert.equal(calls.length, 3);
+});
+
+test('public POST on invite_only: refused before any query — nothing about the applicant is consulted', async () => {
+  reset('invite_only', []);
+  const r = await post('/api/gds/access-requests', { github_login: 'octocat' });
+  assert.equal(r.status, 403);
+  assert.equal(r.json.error.code, 'invite_only');
+  assert.equal(calls.length, 0);
+});
+
+test('public POST on open: "no request needed", before any query', async () => {
+  reset('open', []);
+  const r = await post('/api/gds/access-requests', { github_login: 'octocat' });
+  assert.equal(r.status, 409);
+  assert.equal(r.json.error.code, 'open_enrollment');
+  assert.equal(calls.length, 0);
+});

package/tests/auth_admission_gate.mjs

@@ -72,6 +72,48 @@ t("'0' / '' / 'yes' do NOT enable open enrollment", () => {
   }
 });
 
+// task 1003044: the decision is the project's joinability (branding().project,
+// 'apply' on this repo's pack). The legacy flag still opens an APPLY project —
+// a self-hosted instance that set it keeps its open door across the upgrade.
+// The open / invite_only packs are booted in tests/joinability_*.mjs.
+console.log('\njoinabilityMode — the door the flag now opens (task 1003044):');
+
+t('joinabilityMode is exported, and the default pack runs as apply', () => {
+  assert.equal(typeof auth.joinabilityMode, 'function');
+  withOpenEnrollmentEnv(undefined, () => assert.equal(auth.joinabilityMode(), 'apply'));
+});
+
+t('the legacy flag turns an apply project into an open one — and nothing else does', () => {
+  withOpenEnrollmentEnv('true', () => assert.equal(auth.joinabilityMode(), 'open'));
+  withOpenEnrollmentEnv('yes', () => assert.equal(auth.joinabilityMode(), 'apply'));
+});
+
+// the reader is injectable (the pack is memoized): the edges the boots can't reach
+t('an absent value is apply, and the legacy flag opens exactly that', () => {
+  withOpenEnrollmentEnv(undefined, () => assert.equal(auth.joinabilityMode(() => ({})), 'apply'));
+  withOpenEnrollmentEnv('1', () => assert.equal(auth.joinabilityMode(() => ({ project: {} })), 'open'));
+  withOpenEnrollmentEnv('1', () => assert.equal(auth.joinabilityMode(() => ({ project: { joinability: 'apply' } })), 'open'));
+});
+
+t('a value this core cannot read fails CLOSED — invite-only, never the wider door, flag or no flag', () => {
+  withOpenEnrollmentEnv('1', () => {
+    for (const bad of ['invite-only', 'Open', 'OPEN', 'apply ', 'gated', 42]) {
+      assert.equal(auth.joinabilityMode(() => ({ project: { joinability: bad } })), 'invite_only', JSON.stringify(bad));
+    }
+  });
+});
+
+t('an unreadable pack fails CLOSED', () => {
+  withOpenEnrollmentEnv('1', () => {
+    assert.equal(auth.joinabilityMode(() => { throw new Error('pack unreadable'); }), 'invite_only');
+  });
+});
+
+t('an explicit invite_only is never reopened by the legacy flag; an explicit open needs no flag', () => {
+  withOpenEnrollmentEnv('1', () => assert.equal(auth.joinabilityMode(() => ({ project: { joinability: 'invite_only' } })), 'invite_only'));
+  withOpenEnrollmentEnv(undefined, () => assert.equal(auth.joinabilityMode(() => ({ project: { joinability: 'open' } })), 'open'));
+});
+
 console.log('\nfirstTimeAdmissionBlocked — the shared decision both flows make:');
 
 t('first-timer WITHOUT invite, open enrollment OFF → BLOCKED', () => {

package/tests/goal_sort_staleness.mjs

@@ -0,0 +1,286 @@
+// tests/goal_sort_staleness.mjs — find your own work, and see what is rotting
+// (task 1003278, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// Three halves. (1) The shared vocabulary: ONE activity clock and ONE staleness
+// predicate in task-lib.js, consumed by both tiers — pinned by executing them.
+// (2) Attribution: tasks.created_by is stamped from the authenticated request on
+// every human create-vector and NEVER backfilled or body-supplied. (3) THE SCALE
+// CHECK, which the criterion makes the acceptance test ("~1,357 tasks on
+// BONGOS-V1 alone. A view that does not survive that number is not a solution"):
+// the board's filter+sort pipeline is EXECUTED over a synthetic corpus of that
+// size and measured, not asserted about.
+//
+// Run:  node tests/goal_sort_staleness.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const taskLib = require(path.join(ROOT, 'modules/hall-ui/public/task-lib.js'));
+const WORK_SRC = read('modules/hall-ui/public/work.js');
+const RENDER_SRC = read('modules/hall-ui/public/goals-render.js');
+const GOALS_LIB_SRC = read('modules/hall-ui/public/goals-lib.js');
+const MIGRATION = read('migrations/core_227_task_created_by.sql');
+const DB_TASKS = read('modules/lifecycle/db-tasks.js');
+
+const { test, summary } = makeRunner();
+const DAY = 24 * 60 * 60 * 1000;
+
+// ---- the shared vocabulary --------------------------------------------------
+
+await test('one activity clock: updated_at ∨ shipped_at, whichever is later', () => {
+  const { taskActivityMs, msOf } = taskLib;
+  const t = { updated_at: '2026-08-01T00:00:00Z', shipped_at: '2026-08-20T00:00:00Z' };
+  assert.equal(taskActivityMs(t), msOf('2026-08-20T00:00:00Z'),
+    'shipped_at folded in — a ship path can stamp it without touching updated_at (task 1002965)');
+  assert.equal(taskActivityMs({}), 0, 'no readable timestamp reads as epoch — the stalest possible');
+});
+
+await test('isStale: past the bucket is stale, inside it is not, and undated rows are STALE', () => {
+  const { isStale } = taskLib;
+  const now = Date.parse('2026-08-25T00:00:00Z');
+  const at = (daysAgo) => now - daysAgo * DAY;
+  assert.equal(isStale(at(31), '30', now), true);
+  assert.equal(isStale(at(29), '30', now), false);
+  assert.equal(isStale(at(29), '14', now), true);
+  assert.equal(isStale(at(5), '', now), true, "'' = no filter — everything passes");
+  assert.equal(isStale(0, '60', now), true,
+    'a row nobody can date is exactly what a rot-hunt must not hide');
+});
+
+await test('goals-lib DELEGATES to task-lib — one definition, not a synced pair', () => {
+  assert.match(GOALS_LIB_SRC, /const \{ msOf, taskActivityMs \} = window\.OTBTaskLib;/,
+    'the private copies were removed; a drift here would mean two meanings of "touched"');
+  assert.equal(/Date\.parse/.test(GOALS_LIB_SRC), false, 'no residual private clock');
+});
+
+await test('both tiers offer the SAME staleness buckets', () => {
+  assert.match(WORK_SRC, /\{ id: 'f-stale', label: 'Age', options: STALE_CHOICES \}/);
+  assert.match(read('modules/hall-ui/public/goals-page.js'), /\{ id: 'f-goal-stale', label: 'Age', options: window\.OTBTaskLib\.STALE_CHOICES \}/);
+});
+
+await test("the goals page's stale FILTER and its 'recently active' SORT read one clock", () => {
+  const body = RENDER_SRC.slice(RENDER_SRC.indexOf('function filteredGoals'));
+  assert.match(body.slice(0, 2400), /isStale\(goalActivityMs\(g\), staleDays\)/,
+    'the filter reads goalActivityMs — the same function the active/stale sorts compare on');
+});
+
+// ---- attribution ------------------------------------------------------------
+
+await test('created_by comes from the AUTHENTICATED request, never the body', () => {
+  // task-write-routes stamps req.builder.id; the body validator must NOT accept a
+  // created_by key — who created a task is a fact about the caller, not an input.
+  const routes = read('modules/lifecycle/routes/task-write-routes.js');
+  assert.match(routes, /createdBy: req\.builder\.id/);
+  assert.equal(/created_by: \{/.test(routes), false, 'not a validatable body field');
+});
+
+await test('the goal-authored and idea-route vectors attribute too', () => {
+  assert.match(read('modules/lifecycle/routes/goals.js'), /createdBy: req\.builder\.id/);
+  assert.match(read('modules/ideas/inbox.js'), /createdBy: capturedBy \?\? null/,
+    'routing an idea attributes the task to the person whose idea it was');
+});
+
+await test('history is never backfilled — a guessed attribution is a confident lie', () => {
+  assert.match(MIGRATION, /ADD COLUMN IF NOT EXISTS created_by bigint REFERENCES builders\(id\)/);
+  assert.equal(/UPDATE tasks\s+SET created_by/i.test(MIGRATION), false,
+    'NULL = created before attribution existed; the goals.created_by convention');
+});
+
+await test('the t.* views are rebuilt WITH the column — the core_190 lesson', () => {
+  // A Postgres view pins `SELECT t.*` at CREATE time; without the rebuild the
+  // Creator filter would read undefined off the claim feed for every row — the
+  // exact silent bug core_190 existed to repair.
+  assert.match(MIGRATION, /DROP VIEW IF EXISTS claimable_tasks;/);
+  assert.match(MIGRATION, /DROP VIEW IF EXISTS tasks_session_fit;/);
+});
+
+await test('createTask appends createdBy at the end of the bind list (the goals convention)', () => {
+  assert.match(DB_TASKS, /goal_id, created_by, promoted_at\)/,
+    'new columns go on the end so pinned bind orders survive');
+});
+
+// ---- the mixed option form is supported, not a latent render bug ------------
+
+await test('a filter control may mix string and {value,label} options — the kit normalises', () => {
+  // Raised in review as "will likely fail to render". It does not: hall-kit.js
+  // declares `options?: [{value,label}|string]` and normalises through optVal /
+  // optLabel, and the pre-existing f-discipline and f-goal-status controls have
+  // always used the mixed form. Pinned here so the question is settled in code.
+  const kit = read('modules/hall-ui/public/hall-kit.js');
+  assert.match(kit, /function optVal\(o\) \{ return typeof o === 'string' \? o : o\.value; \}/);
+  assert.match(kit, /function optLabel\(o\) \{ return typeof o === 'string' \? o : o\.label; \}/);
+  assert.match(WORK_SRC, /id: 'f-discipline',[\s\S]{0,200}'engineer', 'artist', 'ideator', 'ui', 'unclassified'/,
+    'the mixed form predates this task on the very same board');
+});
+
+// ---- the payload, which is where the scale actually bit ---------------------
+
+await test('the Goals page no longer downloads the version to count it', () => {
+  // MEASURED on the real corpus, 2026-08-25: GET /tasks?version=BONGOS-V1&include=deps
+  // returned 5,229,455 bytes for ~1,400 tasks to produce ~40 counter objects.
+  // GET /goals/rollups returns one small row per goal instead.
+  const page = read('modules/hall-ui/public/goals-page.js');
+  const body = page.slice(page.indexOf('async function loadRollups'), page.indexOf('/* ---------------- list view'));
+  assert.match(body, /getJSON\(`\$\{API\}\/goals\/rollups\?version=/);
+  assert.equal(/tasks\?version=/.test(body), false,
+    'not even as a fallback — a fallback that quietly re-downloads 5 MB is the bug wearing a safety belt');
+});
+
+await test('the Backlog read is BOUNDED — it was SELECT * FROM tasks WHERE status=backlog', () => {
+  assert.match(WORK_SRC, /const BACKLOG_LIMIT = \d+;/);
+  assert.match(WORK_SRC, /tasks\?status=backlog&limit=\$\{BACKLOG_LIMIT\}/);
+});
+
+await test('the server offers the axes, so a board can ask a narrow question', () => {
+  const routes = read('modules/lifecycle/routes/tasks.js');
+  for (const p of ['created_by', 'stale_days', 'limit', 'offset']) {
+    assert.ok(routes.includes(p), `GET /tasks must accept ${p}`);
+  }
+  assert.match(routes, /limit must be a positive integer up to 1000/,
+    'an uncapped limit would be the whole-table read this axis exists to stop');
+});
+
+await test("'none' selects the unattributed server-side, not a missing filter", () => {
+  const dbTasks = read('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /if \(createdBy === 'none'\) \{\s*\n\s*where\.push\('created_by IS NULL'\);/);
+});
+
+await test('the SQL rollup buckets MIRROR goals-lib readinessOf exactly', () => {
+  // A divergence here shows a person different numbers depending on which
+  // surface they opened, which is the opposite of what this goal is for.
+  const rollup = read('modules/lifecycle/goal-rollup.js');
+  const lib = GOALS_LIB_SRC;
+  // done + cut vocabularies
+  assert.match(rollup, /const DONE_STATUSES = \['shipped', 'confirmed', 'completed'\]/);
+  assert.match(lib, /DONE_STATUSES = new Set\(\['completed', 'confirmed', 'shipped'\]\)/);
+  assert.match(rollup, /const CUT_STATUSES = \['abandoned', 'dropped'\]/);
+  assert.match(lib, /CUT_STATUSES = new Set\(\['abandoned', 'dropped'\]\)/);
+  // blocked = backlog with >=1 unshipped dependency, both sides
+  assert.match(rollup, /WHEN s\.status = 'backlog' AND s\.has_unshipped_dep THEN 'blocked'/);
+  assert.match(lib, /s === 'backlog' && \(t\.blocked_by \|\| \[\]\)\.some\(\(d\) => !d\.satisfied\)/);
+  // cut is excluded from the total on both sides (migration 017's rule)
+  assert.match(rollup, /FILTER \(WHERE b\.bucket <> 'cut'\)::int\s+AS total/);
+  assert.match(read('modules/hall-ui/public/goals-page.js'), /total: row\.total \|\| 0/);
+});
+
+await test('the rollup activity clock is the SAME max(updated_at, shipped_at)', () => {
+  const rollup = read('modules/lifecycle/goal-rollup.js');
+  assert.match(rollup, /GREATEST\(COALESCE\(t\.updated_at, 'epoch'::timestamptz\),\s*\n?\s*COALESCE\(t\.shipped_at, 'epoch'::timestamptz\)\)/);
+  assert.match(read('modules/lifecycle/db-tasks.js'), /GREATEST\(COALESCE\(updated_at, 'epoch'::timestamptz\), COALESCE\(shipped_at, 'epoch'::timestamptz\)\)/,
+    "the server's stale_days filter reads the same clock as the rollup and the clients");
+});
+
+// ---- the board asks the SERVER the narrow question --------------------------
+
+await test('Creator and Age are sent to the server, on BOTH board feeds', () => {
+  assert.match(WORK_SRC, /function serverFilterQuery\(\)/);
+  assert.match(WORK_SRC, /tasks\/claimable\$\{serverFilterQuery\(\)\}/,
+    'the claimable feed narrows at the source, not in the browser');
+  assert.match(WORK_SRC, /tasks\?status=backlog&limit=\$\{BACKLOG_LIMIT\}\$\{q\}/,
+    'and so does the backlog read');
+  const routes = read('modules/lifecycle/routes/tasks.js');
+  const claimable = routes.slice(routes.indexOf("router.get('/tasks/claimable'"));
+  assert.match(claimable.slice(0, 2500), /createdBy: claimCreatedBy \?\? null/);
+  assert.match(claimable.slice(0, 2500), /staleDays: claimStaleDays \?\? null/);
+});
+
+await test('a server-side filter change RE-FETCHES; every other filter stays instant', () => {
+  // makeFilterBar hands onChange every value, not the changed id (hall-kit.js),
+  // so the decision is made by comparing the server-facing query — which is the
+  // direct question anyway, and means a control absent from that query can never
+  // cost a round-trip.
+  assert.match(WORK_SRC, /let lastServerFilterQuery = '';/);
+  assert.match(WORK_SRC, /if \(q !== lastServerFilterQuery\) \{[\s\S]{0,200}refreshLive\(\);\s*\n\s*loadBacklog\(\);/);
+  const kit = read('modules/hall-ui/public/hall-kit.js');
+  assert.match(kit, /if \(onChange\) onChange\(values\(\)\);/,
+    'the contract this decision depends on — if it ever hands the changed id instead, revisit');
+});
+
+await test('one staleness rule, four expressions, none of them drifting', () => {
+  const clock = /GREATEST\(COALESCE\((?:v\.|t\.)?updated_at, 'epoch'::timestamptz\),\s*\n?\s*COALESCE\((?:v\.|t\.)?shipped_at, 'epoch'::timestamptz\)\)/;
+  const dbTasks = read('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, clock, 'listTasks');
+  assert.ok((dbTasks.match(new RegExp(clock.source, 'g')) || []).length >= 2, 'and listClaimableTasks');
+  assert.match(read('modules/lifecycle/goal-rollup.js'), clock, 'the goal rollup');
+  assert.equal(taskLib.taskActivityMs({ updated_at: '2026-01-01T00:00:00Z', shipped_at: '2026-02-01T00:00:00Z' }),
+    Date.parse('2026-02-01T00:00:00Z'), 'and the browser');
+});
+
+// ---- privacy -----------------------------------------------------------------
+
+await test('a rollup never hands a private goal\'s task title to a non-member', () => {
+  // Counts on a private goal are not the secret — its prose is (ADR 0112's leak
+  // rule). next_ready_title is a real task title, so it is gated on membership
+  // or Archon; the counters still come back, so the board renders the ring and
+  // the readiness line either way.
+  const rollup = read('modules/lifecycle/goal-rollup.js');
+  assert.match(rollup, /CASE WHEN bool_or\(g\.visibility IS DISTINCT FROM 'private'\)/);
+  assert.match(rollup, /bool_or\(gm\.builder_id IS NOT NULL\)/, 'membership is what unlocks it');
+  assert.match(rollup, /THEN MAX\(nr\.title\) END\s+AS next_ready_title/);
+  const routes = read('modules/lifecycle/routes/goals.js');
+  assert.match(routes, /viewerId: req\.builder\.id/, 'identity from the request, never the query');
+  assert.match(routes, /viewerIsArchon: req\.builder\.rank === 'archon'/);
+});
+
+await test('limit and offset are BOUND, not interpolated', () => {
+  const dbTasks = read('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /tail \+= ` LIMIT \$\$\{params\.length\}`/);
+  assert.equal(/LIMIT \$\{Number\(limit\)\}/.test(dbTasks), false,
+    'a query builder that is only safe because of who calls it is one careless caller from unsafe');
+});
+
+// ---- the scale check: EXECUTED, not asserted --------------------------------
+
+await test('the board pipeline survives the real corpus size (~1,400 rows), measured', () => {
+  // Reproduce the board's per-render work — filter (creator + staleness + the
+  // existing axes) then sort — over a corpus the size of BONGOS-V1's, and hold it
+  // to a budget. The budget is generous (well under one frame's headroom on this
+  // CI box) because the point is the ORDER of the cost, not a microbenchmark: a
+  // rewrite that makes this quadratic or fetch-per-row breaks the assert.
+  const { taskActivityMs, isStale } = taskLib;
+  const now = Date.now();
+  const corpus = Array.from({ length: 1400 }, (_, i) => ({
+    id: i + 1,
+    title: `Task number ${i} of the corpus`,
+    version_id: 'BONGOS-V1',
+    kind: ['feature', 'bug', 'infra'][i % 3],
+    discipline: ['engineer', 'artist', 'ideator'][i % 3],
+    created_by: i % 5 === 0 ? null : String(1000000 + (i % 7)),
+    goal_id: String(1000000 + (i % 40)),
+    updated_at: new Date(now - (i % 90) * DAY).toISOString(),
+    shipped_at: null,
+    credits_reward: i % 50,
+    est_minutes: 30 + (i % 120),
+    priority: (i % 5) + 1,
+    newcomer_friendly: i % 11 === 0,
+  }));
+  const t0 = process.hrtime.bigint();
+  let visible;
+  for (let pass = 0; pass < 10; pass++) {
+    visible = corpus
+      .filter((t) => String(t.created_by) === '1000003' || t.created_by == null)
+      .filter((t) => isStale(taskActivityMs(t), '30', now))
+      .sort((a, b) => taskActivityMs(a) - taskActivityMs(b));
+  }
+  const perPassMs = Number(process.hrtime.bigint() - t0) / 1e6 / 10;
+  assert.ok(visible.length > 0, 'sanity: the synthetic filters match something');
+  assert.ok(perPassMs < 50, `one filter+sort pass over 1,400 rows took ${perPassMs.toFixed(2)}ms — the view no longer survives the corpus`);
+});
+
+await test('the Tasks board still loads the corpus in a bounded number of requests', () => {
+  // The board's data story: claimable + backlog + one /goals read. The new axes
+  // must not have added a per-row or per-goal fetch. Count the getJSON call
+  // sites that run at boot — the creator labels ride ONE directory read.
+  const boots = WORK_SRC.match(/getJSON\(`\$\{API\}\/(tasks\/claimable|tasks\?status=backlog|goals|builders\/directory)`\)/g) || [];
+  assert.ok(boots.length <= 5, `bounded boot reads — got ${boots.length}`);
+  assert.equal(/getJSON\(`\$\{API\}\/tasks\/\$\{t\.id\}/.test(WORK_SRC.slice(WORK_SRC.indexOf('populateCreatorFilter'))), false,
+    'no per-task fetch crept into the new filter');
+});
+
+summary();

package/tests/goal_subtitle.mjs

@@ -154,8 +154,13 @@ test("Claude's prose is a CLOSED disclosure, not visible body text", () => {
 const el = () => ({ textContent: null, hidden: null, open: null });
 function applyProse(goal) {
   const lib = read('modules', 'hall-ui', 'public', 'goals-lib.js');
+  const taskLib = read('modules', 'hall-ui', 'public', 'task-lib.js');
   const els = { sub: el(), desc: el(), claude: el() };
-  const fn = new Function('window', `${lib}; return window.OTBGoalsLib.applyGoalProse;`)({ OTB: { escapeHtml: (x) => x } });
+  // task 1003278: goals-lib takes its activity clock from window.OTBTaskLib (one
+  // meaning of "touched" across both tiers), so the sibling loads first — the
+  // order goals.html uses. Loading the REAL one, not a stub: a stub that always
+  // agrees is exactly what a shared definition must not be tested against.
+  const fn = new Function('window', `${taskLib}; ${lib}; return window.OTBGoalsLib.applyGoalProse;`)({ OTB: { escapeHtml: (x) => x } });
   fn(els, goal);
   return els;
 }

package/tests/goals_lib.mjs

@@ -1,8 +1,15 @@
 // tests/goals_lib.mjs — the Goals page's extracted pure helpers (goals-lib.js,
-// task 1003135). Pins (a) that the lib loads standalone in a bare window — it
-// must not silently grow a dependency on the page's IIFE state, which is the
-// whole reason it could move out of the oversized goals-page.js — and (b) the
-// behaviour of the helpers the page destructures.
+// task 1003135). Pins (a) that the lib loads with no dependency on the page's
+// IIFE state — the whole reason it could move out of the oversized
+// goals-page.js — and (b) the behaviour of the helpers the page destructures.
+//
+// task 1003278: "no page state" is NOT "no siblings". The lib already read
+// window.OTB.escapeHtml (subtitleAttr), and its activity clock now comes from
+// window.OTBTaskLib, because the criterion legibility-sort-and-staleness needs
+// ONE meaning of "touched" across both tiers — a synced pair of definitions is
+// the thing it is trying to prevent. So the harness loads the sibling libs the
+// way goals.html does (task-lib before goals-lib) and the property under test
+// stays what it always was: no reach into page state.
 //
 // Run:  node tests/goals_lib.mjs
 
@@ -15,17 +22,22 @@ import { makeRunner } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-lib.js'), 'utf8');
+const TASK_LIB_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/task-lib.js'), 'utf8');
 const { test, summary } = makeRunner();
 
 const windowObj = {};
 const sandbox = { window: windowObj, Set, Map, Math, Number, String, Array, Object, Date, JSON };
 sandbox.globalThis = sandbox;
 vm.createContext(sandbox);
+// The REAL sibling, in load order — stubbing it would let the shared activity
+// clock rot behind a fake that always agrees.
+vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
 vm.runInContext(SRC, sandbox, { filename: 'goals-lib.js' });
 const lib = windowObj.OTBGoalsLib;
 
 await test('loads standalone in a bare window (no page-state dependency) and exports the full surface', () => {
   assert.ok(lib, 'window.OTBGoalsLib must be set');
+  assert.equal('state' in sandbox, false, 'the lib must not reach for page state');
   for (const k of ['DONE_STATUSES', 'CUT_STATUSES', 'isTodoStatus', 'ring', 'memberName',
     'readinessOf', 'EMPTY_ROLLUP', 'goalRollLine', 'matchesTodoSearch', 'msOf', 'taskActivityMs']) {
     assert.ok(k in lib, `missing export: ${k}`);