@bongos/core 1.19.375 → 1.19.376

package/modules/lifecycle/goal-rollup.js

@@ -0,0 +1,118 @@
+'use strict';
+
+// modules/lifecycle/goal-rollup.js — per-goal task rollups, computed in Postgres
+// instead of in the browser (task 1003278, goal 1000072, criterion
+// legibility-sort-and-staleness).
+//
+// THE MEASUREMENT THAT FORCED THIS. The Goals page derived each goal's readiness
+// counters, its last-activity timestamp and (task 1003278) its craft set by
+// FETCHING EVERY TASK IN THE VERSION — `GET /tasks?version=BONGOS-V1&include=deps`
+// — and reducing them client-side. On the real corpus that request is
+// **5,229,455 bytes for ~1,400 tasks**, measured 2026-08-25, to produce roughly
+// forty small counter objects. The criterion's own words: "~1,357 tasks on
+// BONGOS-V1 alone. A view that does not survive that number is not a solution."
+// It did not survive it; it merely did not fall over.
+//
+// So the reduction moves to where the rows already are. One query per version
+// returns one row per goal, and the payload stops scaling with the task count.
+//
+// THE BUCKETS ARE THE CLIENT'S, VERBATIM. goals-lib.js `readinessOf` is the
+// definition of record and this SQL mirrors it exactly — done (shipped |
+// confirmed | completed) · cut (abandoned | dropped, excluded from the total the
+// way migration 017 keeps them out of version_progress) · active · ready ·
+// blocked (backlog with >=1 unshipped dependency) · backlog. A divergence here
+// would show a person different numbers depending on which surface they opened,
+// so tests/goal_sort_staleness.mjs pins the two against each other.
+//
+// LAST ACTIVITY is `max(updated_at, shipped_at)` — the same "any task activity
+// counts" rule the client uses (task 1002965, the owner's call), now expressed
+// once in SQL and once in task-lib.js because the browser still needs it for
+// rows it holds itself.
+
+const api = require('../../src/module-api');
+const { pool } = api;
+
+// The status vocabularies, kept beside the SQL that uses them so a reader can
+// check them against goals-lib.js in one glance.
+const DONE_STATUSES = ['shipped', 'confirmed', 'completed'];
+const CUT_STATUSES = ['abandoned', 'dropped'];
+
+// goalRollups — one row per goal that has at least one task in `versionId`.
+// Returns [{ goal_id, done, active, ready, blocked, backlog, cut, total,
+//            last_activity_at, disciplines[], next_ready_id, next_ready_title }].
+//
+// `blocked` needs the dependency edges, so the CTE resolves each backlog task's
+// unshipped-dependency count once rather than per row. deps.pool honors the #538
+// test seam (NODE_ENV==='test' only), like every other helper in this module.
+// VISIBILITY. A rollup is a COUNT, and counts on a private goal are not the
+// secret — its prose is (ADR 0112's leak rule: a non-member must not learn a
+// private goal's title or scope). But `next_ready_title` is a real task title
+// off a real goal, so this returns it ONLY to a member or an Archon. Everyone
+// else gets the counters and a null title: the board still renders the ring and
+// the readiness line, and the "Claim next" affordance simply has no name to show
+// — which is correct, because they cannot claim it either (task 1003137's
+// membership gate). Raised in review; the pre-existing GET /goals listing has
+// the same unfiltered shape, and tightening THAT is its own task, not something
+// to smuggle in here.
+async function goalRollups({ versionId = null, viewerId = null, viewerIsArchon = false } = {}, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const { rows } = await activePool.query(
+    `WITH scoped AS (
+       SELECT t.id, t.goal_id, t.status, t.title, t.priority, t.discipline,
+              GREATEST(COALESCE(t.updated_at, 'epoch'::timestamptz),
+                       COALESCE(t.shipped_at, 'epoch'::timestamptz)) AS activity_at,
+              EXISTS (
+                SELECT 1 FROM dependencies d
+                  JOIN tasks dep ON dep.id = d.to_id
+                 WHERE d.from_kind = 'task' AND d.from_id = t.id
+                   AND d.to_kind = 'task' AND dep.status <> 'shipped'
+              ) AS has_unshipped_dep
+         FROM tasks t
+        WHERE t.goal_id IS NOT NULL
+          AND ($1::text IS NULL OR t.version_id = $1)
+     ), bucketed AS (
+       SELECT s.*,
+              CASE
+                WHEN s.status = ANY($2::text[]) THEN 'done'
+                WHEN s.status = ANY($3::text[]) THEN 'cut'
+                WHEN s.status = 'active'  THEN 'active'
+                WHEN s.status = 'ready'   THEN 'ready'
+                WHEN s.status = 'backlog' AND s.has_unshipped_dep THEN 'blocked'
+                ELSE 'backlog'
+              END AS bucket
+         FROM scoped s
+     ), next_ready AS (
+       -- The goal's next claimable task, picked the way the board orders work:
+       -- priority first (NULLS LAST), then oldest id. DISTINCT ON gives one row
+       -- per goal without a second round trip.
+       SELECT DISTINCT ON (goal_id) goal_id, id, title
+         FROM bucketed
+        WHERE bucket = 'ready'
+        ORDER BY goal_id, priority NULLS LAST, id
+     )
+     SELECT b.goal_id::text                                          AS goal_id,
+            COUNT(*) FILTER (WHERE b.bucket = 'done')::int           AS done,
+            COUNT(*) FILTER (WHERE b.bucket = 'active')::int         AS active,
+            COUNT(*) FILTER (WHERE b.bucket = 'ready')::int          AS ready,
+            COUNT(*) FILTER (WHERE b.bucket = 'blocked')::int        AS blocked,
+            COUNT(*) FILTER (WHERE b.bucket = 'backlog')::int        AS backlog,
+            COUNT(*) FILTER (WHERE b.bucket = 'cut')::int            AS cut,
+            COUNT(*) FILTER (WHERE b.bucket <> 'cut')::int           AS total,
+            MAX(b.activity_at)                                       AS last_activity_at,
+            ARRAY_AGG(DISTINCT COALESCE(b.discipline, 'unclassified')) AS disciplines,
+            MAX(nr.id)::text                                         AS next_ready_id,
+            CASE WHEN bool_or(g.visibility IS DISTINCT FROM 'private')
+                   OR $4::boolean
+                   OR bool_or(gm.builder_id IS NOT NULL)
+                 THEN MAX(nr.title) END                              AS next_ready_title
+       FROM bucketed b
+       JOIN goals g ON g.id = b.goal_id
+       LEFT JOIN next_ready nr ON nr.goal_id = b.goal_id
+       LEFT JOIN goal_members gm ON gm.goal_id = b.goal_id AND gm.builder_id = $5::bigint
+      GROUP BY b.goal_id`,
+    [versionId, DONE_STATUSES, CUT_STATUSES, viewerIsArchon === true, viewerId]
+  );
+  return rows;
+}
+
+module.exports = { goalRollups, DONE_STATUSES, CUT_STATUSES };

package/modules/lifecycle/routes/goals.js

@@ -29,6 +29,7 @@ const hierarchy = require('../hierarchy');
 const goalSuggest = require('../goal-suggest.js'); // task 1003062 — pre-creation goal suggester
 const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edit handlers
 const goalCategory = require('../goal-category.js'); // task 1003275 — the ADVISORY human category (gates nothing)
+const goalRollup = require('../goal-rollup.js'); // task 1003278 — per-goal rollups computed in SQL, not in the browser
 const { suggestCriteria } = require('../criterion-suggest');
 const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { validateOrRespond, parseId, LIMITS } = api;
@@ -145,6 +146,29 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // GET /goals/rollups?version= — one small row per goal: readiness counters, the
+  // last-activity timestamp, the craft set, and the next claimable task
+  // (task 1003278). It replaces the Goals page's whole-version task fetch, which
+  // measured 5,229,455 bytes for ~1,400 tasks on 2026-08-25 to produce ~40 counter
+  // objects. Registered BEFORE /goals/:id or Express routes 'rollups' to the param.
+  // rank: any-builder — the same read as the goal board it feeds.
+  router.get('/goals/rollups', auth.requireBuilder, async (req, res) => {
+    try {
+      // The viewer decides whether a PRIVATE goal's next-ready task TITLE comes
+      // back (counters always do — a count is not the secret, the prose is;
+      // ADR 0112). Identity from the authenticated request, never the query.
+      const rollups = await goalRollup.goalRollups({
+        versionId: req.query.version || null,
+        viewerId: req.builder.id,
+        viewerIsArchon: req.builder.rank === 'archon',
+      });
+      return res.json({ rollups });
+    } catch (err) {
+      log.error('[gds] GET /goals/rollups', err);
+      return res.fail('rollups_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // GET /goals?version=&status= — list goals (read).
   // rank: any-builder — viewing the goal board.
   router.get('/goals', auth.requireBuilder, async (req, res) => {
@@ -1150,6 +1174,8 @@ module.exports = function buildGoalsRouter() {
         discipline,
         source: 'goal-authored',
         goalId: goal.id,
+        // task 1003278 — attribution from the authenticated request (never the body).
+        createdBy: req.builder.id,
       });
 
       // Attach the sub-task parent (validated above; attachParent re-checks the

package/modules/lifecycle/routes/task-write-routes.js

@@ -195,6 +195,9 @@ module.exports = function registerTaskWriteRoutes(router) {
         requiresRank: body.requires_rank ?? null,
         moduleKey: body.module_key ?? null,
         goalId: body.goal_id ?? null,
+        // task 1003278 — attribution, from the AUTHENTICATED request, never the
+        // body: who created a task is a fact about the caller, not an input.
+        createdBy: req.builder.id,
       });
       // task 438: link resolved criteria (source='planning' — task-create is the
       // planning vector). The ids were version-checked above, so this is a single

package/modules/lifecycle/routes/tasks.js

@@ -71,6 +71,25 @@ module.exports = function buildTasksRouter() {
   const router = express.Router();
 
   // rank: any-builder — reads (filtered task list); preserved per CRITICAL §4.
+  // task 1003278 — shared by GET /tasks and GET /tasks/claimable, so the two
+  // surfaces cannot drift on what a valid creator id or age window is. Returns
+  // undefined (absent), a number, or { bad } for the caller to turn into a 400.
+  const posInt = (raw, code, max) => {
+    if (raw === undefined || raw === '') return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n <= 0 || (max && n > max)) return { bad: code };
+    return n;
+  };
+  // 'none' is a REAL value here — the unattributed set ("what has no owner"), not
+  // a missing filter. Anything else must be a positive builder id.
+  function parseCreatedBy(raw) {
+    if (raw === undefined || raw === '') return undefined;
+    if (raw === 'none') return 'none';
+    const n = Number(raw);
+    return (Number.isInteger(n) && n > 0) ? n : { bad: 'bad_created_by' };
+  }
+  const CREATED_BY_MSG = "created_by must be a positive builder id, or 'none' for the unattributed.";
+
   router.get('/tasks', auth.requireBuilder, async (req, res) => {
     const { version, status, kind, discipline, goal_id } = req.query;
     if (kind && !VALID_KINDS.has(kind)) {
@@ -88,7 +107,25 @@ module.exports = function buildTasksRouter() {
         return res.fail('bad_goal_id', { status: 400, message: 'goal_id must be a positive integer.' });
       }
     }
-    const tasks = await db.listTasks({ versionId: version, status, kind, discipline, goalId });
+    // task 1003278 — created_by / stale_days / limit / offset, so a board can ask
+    // the server a narrow question instead of reducing the whole table in the
+    // browser. All four are optional; omitting them is exactly today's behaviour.
+    const { created_by: createdByRaw, stale_days: staleRaw, limit: limitRaw, offset: offsetRaw } = req.query;
+    const createdBy = parseCreatedBy(createdByRaw);
+    if (createdBy && createdBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
+    const staleDays = posInt(staleRaw, 'bad_stale_days', 3650);
+    if (staleDays && staleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
+    // The cap is the point of the parameter: an unbounded limit would be the
+    // whole-table read this axis exists to stop.
+    const limit = posInt(limitRaw, 'bad_limit', 1000);
+    if (limit && limit.bad) return res.fail('bad_limit', { status: 400, message: 'limit must be a positive integer up to 1000.' });
+    const offset = posInt(offsetRaw, 'bad_offset');
+    if (offset && offset.bad) return res.fail('bad_offset', { status: 400, message: 'offset must be a positive integer.' });
+
+    const tasks = await db.listTasks({
+      versionId: version, status, kind, discipline, goalId,
+      createdBy, staleDays, limit, offset,
+    });
     // ?include=deps (hall redesign task 1002439) — enrich each task with its
     // dependency summary (`blocked_by[]` with per-target satisfied state, and a
     // `blocks` count) so the Goals rollup + Tasks dependency view can paint
@@ -117,12 +154,21 @@ module.exports = function buildTasksRouter() {
     if (fit && !VALID_FITS.has(fit)) {
       return res.fail('bad_fit', 400, { valid: Array.from(VALID_FITS) });
     }
+    // task 1003278 — the creator + staleness axes, so the Work Board narrows the
+    // feed at the SOURCE instead of downloading it and reducing it in the browser.
+    // Same validators as GET /tasks: one vocabulary, two surfaces.
+    const claimCreatedBy = parseCreatedBy(req.query.created_by);
+    if (claimCreatedBy && claimCreatedBy.bad) return res.fail('bad_created_by', { status: 400, message: CREATED_BY_MSG });
+    const claimStaleDays = posInt(req.query.stale_days, 'bad_stale_days', 3650);
+    if (claimStaleDays && claimStaleDays.bad) return res.fail('bad_stale_days', { status: 400, message: 'stale_days must be a positive integer number of days.' });
     const [claimable, active] = await Promise.all([
       db.listClaimableTasks({
         versionId: version || null,
         builderId: req.builder.id,
         discipline: discipline || null,
         fit: fit || null,
+        createdBy: claimCreatedBy ?? null,
+        staleDays: claimStaleDays ?? null,
       }),
       db.listActiveClaims(),
     ]);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.375",
+  "version": "1.19.376",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.375",
+      "version": "1.19.376",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.375",
+  "version": "1.19.376",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1190,8 +1190,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         ADR 0161 §2 is filed as an idea from task 1003044.
 //   1.19.375 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.374 with no explicit bump. run 32909701598. (task 1002620)
+//   1.19.376 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.375 with no explicit bump. run 32910331206. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.375'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.376'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_sort_staleness.mjs

@@ -0,0 +1,286 @@
+// tests/goal_sort_staleness.mjs — find your own work, and see what is rotting
+// (task 1003278, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// Three halves. (1) The shared vocabulary: ONE activity clock and ONE staleness
+// predicate in task-lib.js, consumed by both tiers — pinned by executing them.
+// (2) Attribution: tasks.created_by is stamped from the authenticated request on
+// every human create-vector and NEVER backfilled or body-supplied. (3) THE SCALE
+// CHECK, which the criterion makes the acceptance test ("~1,357 tasks on
+// BONGOS-V1 alone. A view that does not survive that number is not a solution"):
+// the board's filter+sort pipeline is EXECUTED over a synthetic corpus of that
+// size and measured, not asserted about.
+//
+// Run:  node tests/goal_sort_staleness.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const taskLib = require(path.join(ROOT, 'modules/hall-ui/public/task-lib.js'));
+const WORK_SRC = read('modules/hall-ui/public/work.js');
+const RENDER_SRC = read('modules/hall-ui/public/goals-render.js');
+const GOALS_LIB_SRC = read('modules/hall-ui/public/goals-lib.js');
+const MIGRATION = read('migrations/core_227_task_created_by.sql');
+const DB_TASKS = read('modules/lifecycle/db-tasks.js');
+
+const { test, summary } = makeRunner();
+const DAY = 24 * 60 * 60 * 1000;
+
+// ---- the shared vocabulary --------------------------------------------------
+
+await test('one activity clock: updated_at ∨ shipped_at, whichever is later', () => {
+  const { taskActivityMs, msOf } = taskLib;
+  const t = { updated_at: '2026-08-01T00:00:00Z', shipped_at: '2026-08-20T00:00:00Z' };
+  assert.equal(taskActivityMs(t), msOf('2026-08-20T00:00:00Z'),
+    'shipped_at folded in — a ship path can stamp it without touching updated_at (task 1002965)');
+  assert.equal(taskActivityMs({}), 0, 'no readable timestamp reads as epoch — the stalest possible');
+});
+
+await test('isStale: past the bucket is stale, inside it is not, and undated rows are STALE', () => {
+  const { isStale } = taskLib;
+  const now = Date.parse('2026-08-25T00:00:00Z');
+  const at = (daysAgo) => now - daysAgo * DAY;
+  assert.equal(isStale(at(31), '30', now), true);
+  assert.equal(isStale(at(29), '30', now), false);
+  assert.equal(isStale(at(29), '14', now), true);
+  assert.equal(isStale(at(5), '', now), true, "'' = no filter — everything passes");
+  assert.equal(isStale(0, '60', now), true,
+    'a row nobody can date is exactly what a rot-hunt must not hide');
+});
+
+await test('goals-lib DELEGATES to task-lib — one definition, not a synced pair', () => {
+  assert.match(GOALS_LIB_SRC, /const \{ msOf, taskActivityMs \} = window\.OTBTaskLib;/,
+    'the private copies were removed; a drift here would mean two meanings of "touched"');
+  assert.equal(/Date\.parse/.test(GOALS_LIB_SRC), false, 'no residual private clock');
+});
+
+await test('both tiers offer the SAME staleness buckets', () => {
+  assert.match(WORK_SRC, /\{ id: 'f-stale', label: 'Age', options: STALE_CHOICES \}/);
+  assert.match(read('modules/hall-ui/public/goals-page.js'), /\{ id: 'f-goal-stale', label: 'Age', options: window\.OTBTaskLib\.STALE_CHOICES \}/);
+});
+
+await test("the goals page's stale FILTER and its 'recently active' SORT read one clock", () => {
+  const body = RENDER_SRC.slice(RENDER_SRC.indexOf('function filteredGoals'));
+  assert.match(body.slice(0, 2400), /isStale\(goalActivityMs\(g\), staleDays\)/,
+    'the filter reads goalActivityMs — the same function the active/stale sorts compare on');
+});
+
+// ---- attribution ------------------------------------------------------------
+
+await test('created_by comes from the AUTHENTICATED request, never the body', () => {
+  // task-write-routes stamps req.builder.id; the body validator must NOT accept a
+  // created_by key — who created a task is a fact about the caller, not an input.
+  const routes = read('modules/lifecycle/routes/task-write-routes.js');
+  assert.match(routes, /createdBy: req\.builder\.id/);
+  assert.equal(/created_by: \{/.test(routes), false, 'not a validatable body field');
+});
+
+await test('the goal-authored and idea-route vectors attribute too', () => {
+  assert.match(read('modules/lifecycle/routes/goals.js'), /createdBy: req\.builder\.id/);
+  assert.match(read('modules/ideas/inbox.js'), /createdBy: capturedBy \?\? null/,
+    'routing an idea attributes the task to the person whose idea it was');
+});
+
+await test('history is never backfilled — a guessed attribution is a confident lie', () => {
+  assert.match(MIGRATION, /ADD COLUMN IF NOT EXISTS created_by bigint REFERENCES builders\(id\)/);
+  assert.equal(/UPDATE tasks\s+SET created_by/i.test(MIGRATION), false,
+    'NULL = created before attribution existed; the goals.created_by convention');
+});
+
+await test('the t.* views are rebuilt WITH the column — the core_190 lesson', () => {
+  // A Postgres view pins `SELECT t.*` at CREATE time; without the rebuild the
+  // Creator filter would read undefined off the claim feed for every row — the
+  // exact silent bug core_190 existed to repair.
+  assert.match(MIGRATION, /DROP VIEW IF EXISTS claimable_tasks;/);
+  assert.match(MIGRATION, /DROP VIEW IF EXISTS tasks_session_fit;/);
+});
+
+await test('createTask appends createdBy at the end of the bind list (the goals convention)', () => {
+  assert.match(DB_TASKS, /goal_id, created_by, promoted_at\)/,
+    'new columns go on the end so pinned bind orders survive');
+});
+
+// ---- the mixed option form is supported, not a latent render bug ------------
+
+await test('a filter control may mix string and {value,label} options — the kit normalises', () => {
+  // Raised in review as "will likely fail to render". It does not: hall-kit.js
+  // declares `options?: [{value,label}|string]` and normalises through optVal /
+  // optLabel, and the pre-existing f-discipline and f-goal-status controls have
+  // always used the mixed form. Pinned here so the question is settled in code.
+  const kit = read('modules/hall-ui/public/hall-kit.js');
+  assert.match(kit, /function optVal\(o\) \{ return typeof o === 'string' \? o : o\.value; \}/);
+  assert.match(kit, /function optLabel\(o\) \{ return typeof o === 'string' \? o : o\.label; \}/);
+  assert.match(WORK_SRC, /id: 'f-discipline',[\s\S]{0,200}'engineer', 'artist', 'ideator', 'ui', 'unclassified'/,
+    'the mixed form predates this task on the very same board');
+});
+
+// ---- the payload, which is where the scale actually bit ---------------------
+
+await test('the Goals page no longer downloads the version to count it', () => {
+  // MEASURED on the real corpus, 2026-08-25: GET /tasks?version=BONGOS-V1&include=deps
+  // returned 5,229,455 bytes for ~1,400 tasks to produce ~40 counter objects.
+  // GET /goals/rollups returns one small row per goal instead.
+  const page = read('modules/hall-ui/public/goals-page.js');
+  const body = page.slice(page.indexOf('async function loadRollups'), page.indexOf('/* ---------------- list view'));
+  assert.match(body, /getJSON\(`\$\{API\}\/goals\/rollups\?version=/);
+  assert.equal(/tasks\?version=/.test(body), false,
+    'not even as a fallback — a fallback that quietly re-downloads 5 MB is the bug wearing a safety belt');
+});
+
+await test('the Backlog read is BOUNDED — it was SELECT * FROM tasks WHERE status=backlog', () => {
+  assert.match(WORK_SRC, /const BACKLOG_LIMIT = \d+;/);
+  assert.match(WORK_SRC, /tasks\?status=backlog&limit=\$\{BACKLOG_LIMIT\}/);
+});
+
+await test('the server offers the axes, so a board can ask a narrow question', () => {
+  const routes = read('modules/lifecycle/routes/tasks.js');
+  for (const p of ['created_by', 'stale_days', 'limit', 'offset']) {
+    assert.ok(routes.includes(p), `GET /tasks must accept ${p}`);
+  }
+  assert.match(routes, /limit must be a positive integer up to 1000/,
+    'an uncapped limit would be the whole-table read this axis exists to stop');
+});
+
+await test("'none' selects the unattributed server-side, not a missing filter", () => {
+  const dbTasks = read('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /if \(createdBy === 'none'\) \{\s*\n\s*where\.push\('created_by IS NULL'\);/);
+});
+
+await test('the SQL rollup buckets MIRROR goals-lib readinessOf exactly', () => {
+  // A divergence here shows a person different numbers depending on which
+  // surface they opened, which is the opposite of what this goal is for.
+  const rollup = read('modules/lifecycle/goal-rollup.js');
+  const lib = GOALS_LIB_SRC;
+  // done + cut vocabularies
+  assert.match(rollup, /const DONE_STATUSES = \['shipped', 'confirmed', 'completed'\]/);
+  assert.match(lib, /DONE_STATUSES = new Set\(\['completed', 'confirmed', 'shipped'\]\)/);
+  assert.match(rollup, /const CUT_STATUSES = \['abandoned', 'dropped'\]/);
+  assert.match(lib, /CUT_STATUSES = new Set\(\['abandoned', 'dropped'\]\)/);
+  // blocked = backlog with >=1 unshipped dependency, both sides
+  assert.match(rollup, /WHEN s\.status = 'backlog' AND s\.has_unshipped_dep THEN 'blocked'/);
+  assert.match(lib, /s === 'backlog' && \(t\.blocked_by \|\| \[\]\)\.some\(\(d\) => !d\.satisfied\)/);
+  // cut is excluded from the total on both sides (migration 017's rule)
+  assert.match(rollup, /FILTER \(WHERE b\.bucket <> 'cut'\)::int\s+AS total/);
+  assert.match(read('modules/hall-ui/public/goals-page.js'), /total: row\.total \|\| 0/);
+});
+
+await test('the rollup activity clock is the SAME max(updated_at, shipped_at)', () => {
+  const rollup = read('modules/lifecycle/goal-rollup.js');
+  assert.match(rollup, /GREATEST\(COALESCE\(t\.updated_at, 'epoch'::timestamptz\),\s*\n?\s*COALESCE\(t\.shipped_at, 'epoch'::timestamptz\)\)/);
+  assert.match(read('modules/lifecycle/db-tasks.js'), /GREATEST\(COALESCE\(updated_at, 'epoch'::timestamptz\), COALESCE\(shipped_at, 'epoch'::timestamptz\)\)/,
+    "the server's stale_days filter reads the same clock as the rollup and the clients");
+});
+
+// ---- the board asks the SERVER the narrow question --------------------------
+
+await test('Creator and Age are sent to the server, on BOTH board feeds', () => {
+  assert.match(WORK_SRC, /function serverFilterQuery\(\)/);
+  assert.match(WORK_SRC, /tasks\/claimable\$\{serverFilterQuery\(\)\}/,
+    'the claimable feed narrows at the source, not in the browser');
+  assert.match(WORK_SRC, /tasks\?status=backlog&limit=\$\{BACKLOG_LIMIT\}\$\{q\}/,
+    'and so does the backlog read');
+  const routes = read('modules/lifecycle/routes/tasks.js');
+  const claimable = routes.slice(routes.indexOf("router.get('/tasks/claimable'"));
+  assert.match(claimable.slice(0, 2500), /createdBy: claimCreatedBy \?\? null/);
+  assert.match(claimable.slice(0, 2500), /staleDays: claimStaleDays \?\? null/);
+});
+
+await test('a server-side filter change RE-FETCHES; every other filter stays instant', () => {
+  // makeFilterBar hands onChange every value, not the changed id (hall-kit.js),
+  // so the decision is made by comparing the server-facing query — which is the
+  // direct question anyway, and means a control absent from that query can never
+  // cost a round-trip.
+  assert.match(WORK_SRC, /let lastServerFilterQuery = '';/);
+  assert.match(WORK_SRC, /if \(q !== lastServerFilterQuery\) \{[\s\S]{0,200}refreshLive\(\);\s*\n\s*loadBacklog\(\);/);
+  const kit = read('modules/hall-ui/public/hall-kit.js');
+  assert.match(kit, /if \(onChange\) onChange\(values\(\)\);/,
+    'the contract this decision depends on — if it ever hands the changed id instead, revisit');
+});
+
+await test('one staleness rule, four expressions, none of them drifting', () => {
+  const clock = /GREATEST\(COALESCE\((?:v\.|t\.)?updated_at, 'epoch'::timestamptz\),\s*\n?\s*COALESCE\((?:v\.|t\.)?shipped_at, 'epoch'::timestamptz\)\)/;
+  const dbTasks = read('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, clock, 'listTasks');
+  assert.ok((dbTasks.match(new RegExp(clock.source, 'g')) || []).length >= 2, 'and listClaimableTasks');
+  assert.match(read('modules/lifecycle/goal-rollup.js'), clock, 'the goal rollup');
+  assert.equal(taskLib.taskActivityMs({ updated_at: '2026-01-01T00:00:00Z', shipped_at: '2026-02-01T00:00:00Z' }),
+    Date.parse('2026-02-01T00:00:00Z'), 'and the browser');
+});
+
+// ---- privacy -----------------------------------------------------------------
+
+await test('a rollup never hands a private goal\'s task title to a non-member', () => {
+  // Counts on a private goal are not the secret — its prose is (ADR 0112's leak
+  // rule). next_ready_title is a real task title, so it is gated on membership
+  // or Archon; the counters still come back, so the board renders the ring and
+  // the readiness line either way.
+  const rollup = read('modules/lifecycle/goal-rollup.js');
+  assert.match(rollup, /CASE WHEN bool_or\(g\.visibility IS DISTINCT FROM 'private'\)/);
+  assert.match(rollup, /bool_or\(gm\.builder_id IS NOT NULL\)/, 'membership is what unlocks it');
+  assert.match(rollup, /THEN MAX\(nr\.title\) END\s+AS next_ready_title/);
+  const routes = read('modules/lifecycle/routes/goals.js');
+  assert.match(routes, /viewerId: req\.builder\.id/, 'identity from the request, never the query');
+  assert.match(routes, /viewerIsArchon: req\.builder\.rank === 'archon'/);
+});
+
+await test('limit and offset are BOUND, not interpolated', () => {
+  const dbTasks = read('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /tail \+= ` LIMIT \$\$\{params\.length\}`/);
+  assert.equal(/LIMIT \$\{Number\(limit\)\}/.test(dbTasks), false,
+    'a query builder that is only safe because of who calls it is one careless caller from unsafe');
+});
+
+// ---- the scale check: EXECUTED, not asserted --------------------------------
+
+await test('the board pipeline survives the real corpus size (~1,400 rows), measured', () => {
+  // Reproduce the board's per-render work — filter (creator + staleness + the
+  // existing axes) then sort — over a corpus the size of BONGOS-V1's, and hold it
+  // to a budget. The budget is generous (well under one frame's headroom on this
+  // CI box) because the point is the ORDER of the cost, not a microbenchmark: a
+  // rewrite that makes this quadratic or fetch-per-row breaks the assert.
+  const { taskActivityMs, isStale } = taskLib;
+  const now = Date.now();
+  const corpus = Array.from({ length: 1400 }, (_, i) => ({
+    id: i + 1,
+    title: `Task number ${i} of the corpus`,
+    version_id: 'BONGOS-V1',
+    kind: ['feature', 'bug', 'infra'][i % 3],
+    discipline: ['engineer', 'artist', 'ideator'][i % 3],
+    created_by: i % 5 === 0 ? null : String(1000000 + (i % 7)),
+    goal_id: String(1000000 + (i % 40)),
+    updated_at: new Date(now - (i % 90) * DAY).toISOString(),
+    shipped_at: null,
+    credits_reward: i % 50,
+    est_minutes: 30 + (i % 120),
+    priority: (i % 5) + 1,
+    newcomer_friendly: i % 11 === 0,
+  }));
+  const t0 = process.hrtime.bigint();
+  let visible;
+  for (let pass = 0; pass < 10; pass++) {
+    visible = corpus
+      .filter((t) => String(t.created_by) === '1000003' || t.created_by == null)
+      .filter((t) => isStale(taskActivityMs(t), '30', now))
+      .sort((a, b) => taskActivityMs(a) - taskActivityMs(b));
+  }
+  const perPassMs = Number(process.hrtime.bigint() - t0) / 1e6 / 10;
+  assert.ok(visible.length > 0, 'sanity: the synthetic filters match something');
+  assert.ok(perPassMs < 50, `one filter+sort pass over 1,400 rows took ${perPassMs.toFixed(2)}ms — the view no longer survives the corpus`);
+});
+
+await test('the Tasks board still loads the corpus in a bounded number of requests', () => {
+  // The board's data story: claimable + backlog + one /goals read. The new axes
+  // must not have added a per-row or per-goal fetch. Count the getJSON call
+  // sites that run at boot — the creator labels ride ONE directory read.
+  const boots = WORK_SRC.match(/getJSON\(`\$\{API\}\/(tasks\/claimable|tasks\?status=backlog|goals|builders\/directory)`\)/g) || [];
+  assert.ok(boots.length <= 5, `bounded boot reads — got ${boots.length}`);
+  assert.equal(/getJSON\(`\$\{API\}\/tasks\/\$\{t\.id\}/.test(WORK_SRC.slice(WORK_SRC.indexOf('populateCreatorFilter'))), false,
+    'no per-task fetch crept into the new filter');
+});
+
+summary();

package/tests/goal_subtitle.mjs

@@ -154,8 +154,13 @@ test("Claude's prose is a CLOSED disclosure, not visible body text", () => {
 const el = () => ({ textContent: null, hidden: null, open: null });
 function applyProse(goal) {
   const lib = read('modules', 'hall-ui', 'public', 'goals-lib.js');
+  const taskLib = read('modules', 'hall-ui', 'public', 'task-lib.js');
   const els = { sub: el(), desc: el(), claude: el() };
-  const fn = new Function('window', `${lib}; return window.OTBGoalsLib.applyGoalProse;`)({ OTB: { escapeHtml: (x) => x } });
+  // task 1003278: goals-lib takes its activity clock from window.OTBTaskLib (one
+  // meaning of "touched" across both tiers), so the sibling loads first — the
+  // order goals.html uses. Loading the REAL one, not a stub: a stub that always
+  // agrees is exactly what a shared definition must not be tested against.
+  const fn = new Function('window', `${taskLib}; ${lib}; return window.OTBGoalsLib.applyGoalProse;`)({ OTB: { escapeHtml: (x) => x } });
   fn(els, goal);
   return els;
 }

package/tests/goals_lib.mjs

@@ -1,8 +1,15 @@
 // tests/goals_lib.mjs — the Goals page's extracted pure helpers (goals-lib.js,
-// task 1003135). Pins (a) that the lib loads standalone in a bare window — it
-// must not silently grow a dependency on the page's IIFE state, which is the
-// whole reason it could move out of the oversized goals-page.js — and (b) the
-// behaviour of the helpers the page destructures.
+// task 1003135). Pins (a) that the lib loads with no dependency on the page's
+// IIFE state — the whole reason it could move out of the oversized
+// goals-page.js — and (b) the behaviour of the helpers the page destructures.
+//
+// task 1003278: "no page state" is NOT "no siblings". The lib already read
+// window.OTB.escapeHtml (subtitleAttr), and its activity clock now comes from
+// window.OTBTaskLib, because the criterion legibility-sort-and-staleness needs
+// ONE meaning of "touched" across both tiers — a synced pair of definitions is
+// the thing it is trying to prevent. So the harness loads the sibling libs the
+// way goals.html does (task-lib before goals-lib) and the property under test
+// stays what it always was: no reach into page state.
 //
 // Run:  node tests/goals_lib.mjs
 
@@ -15,17 +22,22 @@ import { makeRunner } from './helpers.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/goals-lib.js'), 'utf8');
+const TASK_LIB_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/task-lib.js'), 'utf8');
 const { test, summary } = makeRunner();
 
 const windowObj = {};
 const sandbox = { window: windowObj, Set, Map, Math, Number, String, Array, Object, Date, JSON };
 sandbox.globalThis = sandbox;
 vm.createContext(sandbox);
+// The REAL sibling, in load order — stubbing it would let the shared activity
+// clock rot behind a fake that always agrees.
+vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
 vm.runInContext(SRC, sandbox, { filename: 'goals-lib.js' });
 const lib = windowObj.OTBGoalsLib;
 
 await test('loads standalone in a bare window (no page-state dependency) and exports the full surface', () => {
   assert.ok(lib, 'window.OTBGoalsLib must be set');
+  assert.equal('state' in sandbox, false, 'the lib must not reach for page state');
   for (const k of ['DONE_STATUSES', 'CUT_STATUSES', 'isTodoStatus', 'ring', 'memberName',
     'readinessOf', 'EMPTY_ROLLUP', 'goalRollLine', 'matchesTodoSearch', 'msOf', 'taskActivityMs']) {
     assert.ok(k in lib, `missing export: ${k}`);