@bongos/core 1.19.375 → 1.19.377

package/scripts/gds/init.js

@@ -218,18 +218,11 @@ function provisioningRequest(spec) {
   return body;
 }
 
-// The one kickoff step the provisioning module AUTOMATES (ADR 0111 §3): standing up
-// production hosting/TLS/DNS/managed-DB. Kept as a named builder so init can either
-// FILE it (no provisioning requested, or the request couldn't be enqueued) or OMIT
-// it (a request went in — the control-plane runner covers this leg).
-function productionTopologyKickoff() {
-  return {
-    title: 'Production topology: TLS, real origins, managed Postgres',
-    kind: 'infra',
-    description: 'For a real (non-localhost) launch: front the instance with TLS (Caddy/Cloudflare/nginx), point ' +
-      'publicOrigin/buildersOrigin/statusOrigin at the real domain (the OAuth callback depends on this), and move off the bundled container DB volume to managed/backed-up Postgres.',
-  };
-}
+// The kickoff checklist itself (and the production-topology step the provisioning
+// module can automate) now live in modules/lifecycle/kickoff-checklist.js — ONE list shared
+// with the lifecycle module, which files the same steps at the founder's first
+// sign-in on the control-plane path (task 1003239). init keeps its names.
+const { kickoffChecklist, productionTopologyKickoff } = require('../../modules/lifecycle/kickoff-checklist');
 
 // The lean instance branding.json: ONLY the fields the owner supplied. Everything
 // else (theme, copy, rank labels, box subdomain pattern) resolves from
@@ -325,74 +318,11 @@ function mergeCoreDependency(pkg, { corePkg = CORE_PKG, coreRange, name = 'cloud
   return { pkg: next, action: 'added' };
 }
 
-// The kickoff checklist, as tasks. These are the steps init CANNOT do for you —
-// the human-only setup a fresh instance needs to actually launch (grounded in
-// the onboarding/deploy surfaces; see the task 1204 mapping pass). Each becomes
-// a real, claimable task so it's tracked, never silently skipped. Per-module
-// prerequisites are appended only for the modules the owner enabled.
+// The kickoff checklist, as tasks — the steps init CANNOT do for you (the shared
+// list, self-host shape). Production topology is omitted when the owner opted into
+// provisioning: the control-plane runner covers that leg (ADR 0111 §3).
 function kickoffTasks(spec) {
-  const origin = (spec.domains && spec.domains.publicOrigin) || 'http://localhost:3000';
-  const tasks = [
-    {
-      title: 'Register a GitHub OAuth app and set its credentials',
-      kind: 'infra',
-      description: 'Auth is the hard prerequisite for every sign-in — without it the server returns 503 ' +
-        'auth_not_configured and nobody (including you) can log in. Create a GitHub OAuth app, set ' +
-        `<ENVPREFIX>_GITHUB_CLIENT_ID/SECRET, tick "Enable Device Flow" (a separate save), and set the callback URL to ${origin}/api/gds/auth/web/callback.`,
-    },
-    {
-      title: `Sign in once as ${spec.firstAdmin} to seat the founding owner`,
-      kind: 'infra',
-      description: `A fresh database has no owner. Signing in as the configured firstAdmin (${spec.firstAdmin}) ` +
-        'the first time auto-seats that account as the founding Archon (owner). Config alone does nothing — you must actually sign in.',
-    },
-    {
-      title: 'Confirm the GitHub repo binding and deploy mode',
-      kind: 'infra',
-      description: `This instance ships work to ${spec.repo.owner}/${spec.repo.name}. Confirm the git remote / repo binding ` +
-        'and pick deploy mode in config/deploy.json (ci = server-mediated PR auto-merge, or laptop). A wrong/absent repo binding lets a task grade but never merge.',
-    },
-    {
-      title: 'Set the admission posture and invite the first builders',
-      kind: 'infra',
-      description: 'Enrollment is invite-only by default. Beyond you, no one can join until you approve an access request ' +
-        'or set <ENVPREFIX>_OPEN_XENOS_ENROLLMENT=1. Decide who can join and invite/approve the first builders.',
-    },
-    {
-      title: 'Arm the merge gate before a second builder joins (ci deploy mode)',
-      kind: 'infra',
-      description: 'For a shared instance on ci deploy mode, enable branch protection on main + required checks ' +
-        '(unit / secret-scan / gate-review), so untrusted builders cannot push straight to production. No review requirement — gates are CI checks, not human approvals (ADR 0162). Skippable for a solo/local instance.',
-    },
-  ];
-  // Production topology is either AUTOMATED (the owner opted into provisioning — the
-  // control-plane runner stands up TLS/DNS/managed-DB) or a tracked manual step.
-  // Keep it in its infra slot, before the look step, when it's still manual. (ADR 0111 §3)
-  if (!provisioningRequest(spec)) tasks.push(productionTopologyKickoff());
-  tasks.push({
-    title: 'Fill the instance look with your own LLM',
-    // 'ideator' is a DISCIPLINE, not a kind — tasks_kind_check rejects it as a
-    // kind and the task silently vanished from the checklist (the one non-infra
-    // kickoff step). Deciding the instance look is a decision by an ideator.
-    kind: 'decision',
-    discipline: 'ideator',
-    description: 'init wrote a lean config/branding.json and left the LOOK to you (a locked project rule: brand with your ' +
-      'own LLM, not a generator). Hand docs/branding-fill-prompt.md to your AI to design a palette/fonts/wordmark, or keep the vanilla look.',
-  });
-  const enabled = new Set(Array.isArray(spec.modules) ? spec.modules : []);
-  if (enabled.has('art-pipeline')) {
-    tasks.push({ title: 'Provide a Google Gemini API key for the art pipeline', kind: 'infra',
-      description: 'The art-pipeline module needs a Google AI Studio (Gemini) key (GOOGLE_AI_STUDIO_KEY, a shared key, or per-builder keys) or it cannot generate art.' });
-  }
-  if (enabled.has('discord')) {
-    tasks.push({ title: 'Provide Discord bot token + webhooks', kind: 'infra',
-      description: 'The discord module needs a bot token + webhook URLs + DISCORD_BOT_ENABLED=true. Note: outbound/link surfaces fire on credentials even if the module flag is later turned off.' });
-  }
-  if (enabled.has('dev-box')) {
-    tasks.push({ title: 'Provide a DigitalOcean API token for dev boxes', kind: 'infra',
-      description: 'The dev-box module needs a DigitalOcean API token (and optionally Cloudflare) on the operator control plane before any builder box can be provisioned.' });
-  }
-  return tasks;
+  return kickoffChecklist(spec, { provisioned: !!provisioningRequest(spec) });
 }
 
 // Normalize a raw spec (from --from or the interview) to canonical shape +

package/scripts/gds/test-path-guard.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+// scripts/gds/test-path-guard.js — a test must not build a filesystem path from
+// `URL.pathname` (task 1002889).
+//
+// THE BUG THIS EXISTS TO STOP. `new URL('..', import.meta.url).pathname` is a URL
+// path, not a filesystem path: percent-encoding survives (a space stays `%20`) and
+// on Windows it carries a leading slash before the drive letter. Handed to
+// require() or fs it resolves nowhere — four tests threw MODULE_NOT_FOUND at load
+// on the owner's checkout, whose path has a space in it.
+//
+// WHY A FITNESS CHECK AND NOT A TEST. CI checks out to a path with no space, so the
+// broken form passes there and the suite reads green while being unrunnable on a
+// Windows dev machine. CI can never catch the regression on its own; a static scan
+// at a different altitude can.
+//
+// THE FIX IT POINTS AT. `fileURLToPath(new URL('..', import.meta.url))` from
+// node:url (tests/fitness.mjs), or a plain relative require through
+// createRequire(import.meta.url) (tests/provisioning_teardown_intent.mjs).
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const NAME = 'a test builds its repo root with fileURLToPath, never URL.pathname (task 1002889)';
+
+// `import.meta.url).pathname` — the URL-path-as-filesystem-path defect, in both its
+// forms: new URL('..', import.meta.url).pathname and new URL(import.meta.url).pathname.
+const PATHNAME_ROOT = /import\.meta\.url\s*\)\s*\.pathname\b/;
+
+// Every tracked test file. Only tests use import.meta.url this way; source is CJS.
+function trackedTestFiles() {
+  try {
+    const out = execFileSync('git', ['ls-files', 'tests/*.mjs', 'tests/*.js', 'tests/**/*.mjs', 'tests/**/*.js'],
+      { cwd: REPO_ROOT, encoding: 'utf8' });
+    return [...new Set(out.split('\n').map((s) => s.trim()).filter(Boolean))];
+  } catch {
+    return [];
+  }
+}
+
+function scanTests(files, read) {
+  const violations = [];
+  let scanned = 0;
+  for (const rel of files) {
+    const src = read(rel);
+    if (src == null) continue;
+    scanned += 1;
+    const lines = src.split('\n');
+    for (let i = 0; i < lines.length; i += 1) {
+      if (!PATHNAME_ROOT.test(lines[i])) continue;
+      violations.push(
+        `${rel}:${i + 1} builds a filesystem path from URL.pathname — a space becomes %20 and a Windows `
+        + 'drive gains a leading slash, so require()/fs throw MODULE_NOT_FOUND at load. Use '
+        + "fileURLToPath(new URL('..', import.meta.url)) from node:url, or a relative require via "
+        + 'createRequire(import.meta.url).',
+      );
+    }
+  }
+  return { violations, scanned };
+}
+
+function checkTestsUseFileUrlToPath({ files, read } = {}) {
+  const list = files || trackedTestFiles();
+  if (!list.length) {
+    return {
+      name: NAME, ok: false, hardFail: true,
+      violations: ['scan defect — enumerated 0 tracked test files; a broken enumeration, not a clean result.'],
+      warnings: [], note: 'static scan of tests/ for a URL.pathname used as a filesystem path.',
+    };
+  }
+  const reader = read || ((rel) => {
+    try { return fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8'); } catch { return null; }
+  });
+  const { violations, scanned } = scanTests(list, reader);
+  return {
+    name: NAME,
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} test file(s) scanned: none may hand \`import.meta.url).pathname\` to require()/fs — `
+      + 'it keeps %20 and a Windows drive slash, so the file is unrunnable on a checkout with a space '
+      + 'in its path while CI (no space) stays green. fileURLToPath() or a relative require is the form.',
+  };
+}
+
+function main() {
+  const r = checkTestsUseFileUrlToPath();
+  for (const v of r.violations) console.error(`✗ ${v}`);
+  console.log(`${r.hardFail ? 'FAIL' : 'PASS'}  ${r.note}`);
+  process.exit(r.hardFail ? 1 : 0);
+}
+
+if (require.main === module) main();
+
+module.exports = { checkTestsUseFileUrlToPath, scanTests, trackedTestFiles, PATHNAME_ROOT };

package/src/bongos/auth-admission.js

@@ -261,6 +261,7 @@ async function maybeSeatFirstAdmin(builder) {
     const seated = await seatFirstAdminIfUnclaimed(builder.id, builder.github_login);
     if (seated) {
       log.info(`[auth] first-admin bootstrap: seated ${builder.github_login} as Archon (configured firstAdmin, no prior Archon).`);
+      await seedKickoffChecklist(builder.id);
       return { ...builder, rank: 'archon' };
     }
   } catch (err) {
@@ -269,6 +270,27 @@ async function maybeSeatFirstAdmin(builder) {
   return builder;
 }
 
+// seedKickoffChecklist — the founder's first board (task 1003239). A hub-provisioned
+// project reaches its first sign-in with an EMPTY tasks table (the scaffold ran init
+// --no-seed; no Archon existed to file anything), so the moment the founder is seated
+// is the first moment the kickoff checklist CAN be filed. Resolved through the
+// `lifecycle.kickoffSeed` port — this is a KERNEL_FILE and may not require a module
+// (ADR 0083 / ADR 0091 §1); the port itself skips a board that already has tasks.
+// BEST-EFFORT: a seed hiccup must never fail the sign-in that just seated the owner.
+// deps.port is a test seam; production resolves the seam registry.
+async function seedKickoffChecklist(builderId, deps = {}) {
+  const port = deps.port !== undefined ? deps.port : seams.resolveOptional('lifecycle.kickoffSeed');
+  if (!port) return null;
+  try {
+    const r = await port.seedIfEmpty({ builderId });
+    if (r && r.seeded) log.info(`[auth] first-admin bootstrap: filed ${r.seeded} kickoff task(s) under ${r.versionId} — the founder's first board.`);
+    return r;
+  } catch (err) {
+    log.error(`[auth] first-admin bootstrap: kickoff seed failed (non-fatal): ${err.message}`);
+    return null;
+  }
+}
+
 // safeSyncRankRole — give a builder the seeded rank-role matching their rank at
 // REGISTRATION (BV1.R95b, ADR 0151). governance_002's builder→role backfill is
 // run-once, so before this every builder admitted after that migration had no role
@@ -303,6 +325,7 @@ module.exports = {
   firstTimeAdmissionBlocked,
   joinabilityMode,
   maybeSeatFirstAdmin,
+  seedKickoffChecklist,
   membershipKind,
   openEnrollmentEnabled,
   reportActivityRollup,

package/src/module-api.js

@@ -1190,8 +1190,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         ADR 0161 §2 is filed as an idea from task 1003044.
 //   1.19.375 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.374 with no explicit bump. run 32909701598. (task 1002620)
+//   1.19.376 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.375 with no explicit bump. run 32910331206. (task 1002620)
+//   1.19.377 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.376 with no explicit bump. run 33025011131. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.375'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.377'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/first_admin_kickoff_seed.mjs

@@ -0,0 +1,56 @@
+// tests/first_admin_kickoff_seed.mjs — the kernel side of task 1003239: the first-admin
+// bootstrap files the founder's first board through the `lifecycle.kickoffSeed` port,
+// and NOTHING about that can fail the sign-in that just seated the owner.
+//
+// DB-free: the helper is exercised with an injected port (deps.port), the same seam the
+// production call resolves from the registry. Covers the three shapes the port can take
+// at runtime — absent (an instance without the lifecycle module), throwing, seeding.
+//
+// Run:  node --test tests/first_admin_kickoff_seed.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { seedKickoffChecklist } = require('../src/bongos/auth-admission.js');
+const seams = require('../src/module-seams.js');
+
+test('no port registered → a quiet null, never a throw (an instance without lifecycle signs in as before)', async () => {
+  assert.equal(seams.hasProvider('lifecycle.kickoffSeed'), false, 'nothing in-process registered the port');
+  assert.equal(await seedKickoffChecklist(1), null);
+});
+
+test('an absent port passed explicitly is the same quiet null', async () => {
+  assert.equal(await seedKickoffChecklist(1, { port: null }), null);
+});
+
+test('a throwing port is swallowed — best-effort, the seat stands', async () => {
+  const port = { seedIfEmpty: async () => { throw new Error('db went away'); } };
+  assert.equal(await seedKickoffChecklist(1, { port }), null);
+});
+
+test('a seeding port is handed the seated builder id and its result flows back', async () => {
+  const calls = [];
+  const port = { seedIfEmpty: async (arg) => { calls.push(arg); return { seeded: 3, versionId: 'V1' }; } };
+  const r = await seedKickoffChecklist(42, { port });
+  assert.deepEqual(calls, [{ builderId: 42 }]);
+  assert.deepEqual(r, { seeded: 3, versionId: 'V1' });
+});
+
+test('a skipping port (board already populated) flows back untouched', async () => {
+  const port = { seedIfEmpty: async () => ({ seeded: 0, skipped: 'tasks_exist' }) };
+  assert.deepEqual(await seedKickoffChecklist(42, { port }), { seeded: 0, skipped: 'tasks_exist' });
+});
+
+test('production resolves the port from the seam registry', async () => {
+  const calls = [];
+  seams.registerProvider('lifecycle.kickoffSeed', { seedIfEmpty: async (arg) => { calls.push(arg); return { seeded: 1, versionId: 'V1' }; } });
+  try {
+    const r = await seedKickoffChecklist(9);
+    assert.deepEqual(calls, [{ builderId: 9 }]);
+    assert.equal(r.seeded, 1);
+  } finally {
+    seams._reset();
+  }
+});

package/tests/goal_sort_staleness.mjs

@@ -0,0 +1,286 @@
+// tests/goal_sort_staleness.mjs — find your own work, and see what is rotting
+// (task 1003278, goal 1000072, criterion legibility-sort-and-staleness).
+//
+// Three halves. (1) The shared vocabulary: ONE activity clock and ONE staleness
+// predicate in task-lib.js, consumed by both tiers — pinned by executing them.
+// (2) Attribution: tasks.created_by is stamped from the authenticated request on
+// every human create-vector and NEVER backfilled or body-supplied. (3) THE SCALE
+// CHECK, which the criterion makes the acceptance test ("~1,357 tasks on
+// BONGOS-V1 alone. A view that does not survive that number is not a solution"):
+// the board's filter+sort pipeline is EXECUTED over a synthetic corpus of that
+// size and measured, not asserted about.
+//
+// Run:  node tests/goal_sort_staleness.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const taskLib = require(path.join(ROOT, 'modules/hall-ui/public/task-lib.js'));
+const WORK_SRC = read('modules/hall-ui/public/work.js');
+const RENDER_SRC = read('modules/hall-ui/public/goals-render.js');
+const GOALS_LIB_SRC = read('modules/hall-ui/public/goals-lib.js');
+const MIGRATION = read('migrations/core_227_task_created_by.sql');
+const DB_TASKS = read('modules/lifecycle/db-tasks.js');
+
+const { test, summary } = makeRunner();
+const DAY = 24 * 60 * 60 * 1000;
+
+// ---- the shared vocabulary --------------------------------------------------
+
+await test('one activity clock: updated_at ∨ shipped_at, whichever is later', () => {
+  const { taskActivityMs, msOf } = taskLib;
+  const t = { updated_at: '2026-08-01T00:00:00Z', shipped_at: '2026-08-20T00:00:00Z' };
+  assert.equal(taskActivityMs(t), msOf('2026-08-20T00:00:00Z'),
+    'shipped_at folded in — a ship path can stamp it without touching updated_at (task 1002965)');
+  assert.equal(taskActivityMs({}), 0, 'no readable timestamp reads as epoch — the stalest possible');
+});
+
+await test('isStale: past the bucket is stale, inside it is not, and undated rows are STALE', () => {
+  const { isStale } = taskLib;
+  const now = Date.parse('2026-08-25T00:00:00Z');
+  const at = (daysAgo) => now - daysAgo * DAY;
+  assert.equal(isStale(at(31), '30', now), true);
+  assert.equal(isStale(at(29), '30', now), false);
+  assert.equal(isStale(at(29), '14', now), true);
+  assert.equal(isStale(at(5), '', now), true, "'' = no filter — everything passes");
+  assert.equal(isStale(0, '60', now), true,
+    'a row nobody can date is exactly what a rot-hunt must not hide');
+});
+
+await test('goals-lib DELEGATES to task-lib — one definition, not a synced pair', () => {
+  assert.match(GOALS_LIB_SRC, /const \{ msOf, taskActivityMs \} = window\.OTBTaskLib;/,
+    'the private copies were removed; a drift here would mean two meanings of "touched"');
+  assert.equal(/Date\.parse/.test(GOALS_LIB_SRC), false, 'no residual private clock');
+});
+
+await test('both tiers offer the SAME staleness buckets', () => {
+  assert.match(WORK_SRC, /\{ id: 'f-stale', label: 'Age', options: STALE_CHOICES \}/);
+  assert.match(read('modules/hall-ui/public/goals-page.js'), /\{ id: 'f-goal-stale', label: 'Age', options: window\.OTBTaskLib\.STALE_CHOICES \}/);
+});
+
+await test("the goals page's stale FILTER and its 'recently active' SORT read one clock", () => {
+  const body = RENDER_SRC.slice(RENDER_SRC.indexOf('function filteredGoals'));
+  assert.match(body.slice(0, 2400), /isStale\(goalActivityMs\(g\), staleDays\)/,
+    'the filter reads goalActivityMs — the same function the active/stale sorts compare on');
+});
+
+// ---- attribution ------------------------------------------------------------
+
+await test('created_by comes from the AUTHENTICATED request, never the body', () => {
+  // task-write-routes stamps req.builder.id; the body validator must NOT accept a
+  // created_by key — who created a task is a fact about the caller, not an input.
+  const routes = read('modules/lifecycle/routes/task-write-routes.js');
+  assert.match(routes, /createdBy: req\.builder\.id/);
+  assert.equal(/created_by: \{/.test(routes), false, 'not a validatable body field');
+});
+
+await test('the goal-authored and idea-route vectors attribute too', () => {
+  assert.match(read('modules/lifecycle/routes/goals.js'), /createdBy: req\.builder\.id/);
+  assert.match(read('modules/ideas/inbox.js'), /createdBy: capturedBy \?\? null/,
+    'routing an idea attributes the task to the person whose idea it was');
+});
+
+await test('history is never backfilled — a guessed attribution is a confident lie', () => {
+  assert.match(MIGRATION, /ADD COLUMN IF NOT EXISTS created_by bigint REFERENCES builders\(id\)/);
+  assert.equal(/UPDATE tasks\s+SET created_by/i.test(MIGRATION), false,
+    'NULL = created before attribution existed; the goals.created_by convention');
+});
+
+await test('the t.* views are rebuilt WITH the column — the core_190 lesson', () => {
+  // A Postgres view pins `SELECT t.*` at CREATE time; without the rebuild the
+  // Creator filter would read undefined off the claim feed for every row — the
+  // exact silent bug core_190 existed to repair.
+  assert.match(MIGRATION, /DROP VIEW IF EXISTS claimable_tasks;/);
+  assert.match(MIGRATION, /DROP VIEW IF EXISTS tasks_session_fit;/);
+});
+
+await test('createTask appends createdBy at the end of the bind list (the goals convention)', () => {
+  assert.match(DB_TASKS, /goal_id, created_by, promoted_at\)/,
+    'new columns go on the end so pinned bind orders survive');
+});
+
+// ---- the mixed option form is supported, not a latent render bug ------------
+
+await test('a filter control may mix string and {value,label} options — the kit normalises', () => {
+  // Raised in review as "will likely fail to render". It does not: hall-kit.js
+  // declares `options?: [{value,label}|string]` and normalises through optVal /
+  // optLabel, and the pre-existing f-discipline and f-goal-status controls have
+  // always used the mixed form. Pinned here so the question is settled in code.
+  const kit = read('modules/hall-ui/public/hall-kit.js');
+  assert.match(kit, /function optVal\(o\) \{ return typeof o === 'string' \? o : o\.value; \}/);
+  assert.match(kit, /function optLabel\(o\) \{ return typeof o === 'string' \? o : o\.label; \}/);
+  assert.match(WORK_SRC, /id: 'f-discipline',[\s\S]{0,200}'engineer', 'artist', 'ideator', 'ui', 'unclassified'/,
+    'the mixed form predates this task on the very same board');
+});
+
+// ---- the payload, which is where the scale actually bit ---------------------
+
+await test('the Goals page no longer downloads the version to count it', () => {
+  // MEASURED on the real corpus, 2026-08-25: GET /tasks?version=BONGOS-V1&include=deps
+  // returned 5,229,455 bytes for ~1,400 tasks to produce ~40 counter objects.
+  // GET /goals/rollups returns one small row per goal instead.
+  const page = read('modules/hall-ui/public/goals-page.js');
+  const body = page.slice(page.indexOf('async function loadRollups'), page.indexOf('/* ---------------- list view'));
+  assert.match(body, /getJSON\(`\$\{API\}\/goals\/rollups\?version=/);
+  assert.equal(/tasks\?version=/.test(body), false,
+    'not even as a fallback — a fallback that quietly re-downloads 5 MB is the bug wearing a safety belt');
+});
+
+await test('the Backlog read is BOUNDED — it was SELECT * FROM tasks WHERE status=backlog', () => {
+  assert.match(WORK_SRC, /const BACKLOG_LIMIT = \d+;/);
+  assert.match(WORK_SRC, /tasks\?status=backlog&limit=\$\{BACKLOG_LIMIT\}/);
+});
+
+await test('the server offers the axes, so a board can ask a narrow question', () => {
+  const routes = read('modules/lifecycle/routes/tasks.js');
+  for (const p of ['created_by', 'stale_days', 'limit', 'offset']) {
+    assert.ok(routes.includes(p), `GET /tasks must accept ${p}`);
+  }
+  assert.match(routes, /limit must be a positive integer up to 1000/,
+    'an uncapped limit would be the whole-table read this axis exists to stop');
+});
+
+await test("'none' selects the unattributed server-side, not a missing filter", () => {
+  const dbTasks = read('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /if \(createdBy === 'none'\) \{\s*\n\s*where\.push\('created_by IS NULL'\);/);
+});
+
+await test('the SQL rollup buckets MIRROR goals-lib readinessOf exactly', () => {
+  // A divergence here shows a person different numbers depending on which
+  // surface they opened, which is the opposite of what this goal is for.
+  const rollup = read('modules/lifecycle/goal-rollup.js');
+  const lib = GOALS_LIB_SRC;
+  // done + cut vocabularies
+  assert.match(rollup, /const DONE_STATUSES = \['shipped', 'confirmed', 'completed'\]/);
+  assert.match(lib, /DONE_STATUSES = new Set\(\['completed', 'confirmed', 'shipped'\]\)/);
+  assert.match(rollup, /const CUT_STATUSES = \['abandoned', 'dropped'\]/);
+  assert.match(lib, /CUT_STATUSES = new Set\(\['abandoned', 'dropped'\]\)/);
+  // blocked = backlog with >=1 unshipped dependency, both sides
+  assert.match(rollup, /WHEN s\.status = 'backlog' AND s\.has_unshipped_dep THEN 'blocked'/);
+  assert.match(lib, /s === 'backlog' && \(t\.blocked_by \|\| \[\]\)\.some\(\(d\) => !d\.satisfied\)/);
+  // cut is excluded from the total on both sides (migration 017's rule)
+  assert.match(rollup, /FILTER \(WHERE b\.bucket <> 'cut'\)::int\s+AS total/);
+  assert.match(read('modules/hall-ui/public/goals-page.js'), /total: row\.total \|\| 0/);
+});
+
+await test('the rollup activity clock is the SAME max(updated_at, shipped_at)', () => {
+  const rollup = read('modules/lifecycle/goal-rollup.js');
+  assert.match(rollup, /GREATEST\(COALESCE\(t\.updated_at, 'epoch'::timestamptz\),\s*\n?\s*COALESCE\(t\.shipped_at, 'epoch'::timestamptz\)\)/);
+  assert.match(read('modules/lifecycle/db-tasks.js'), /GREATEST\(COALESCE\(updated_at, 'epoch'::timestamptz\), COALESCE\(shipped_at, 'epoch'::timestamptz\)\)/,
+    "the server's stale_days filter reads the same clock as the rollup and the clients");
+});
+
+// ---- the board asks the SERVER the narrow question --------------------------
+
+await test('Creator and Age are sent to the server, on BOTH board feeds', () => {
+  assert.match(WORK_SRC, /function serverFilterQuery\(\)/);
+  assert.match(WORK_SRC, /tasks\/claimable\$\{serverFilterQuery\(\)\}/,
+    'the claimable feed narrows at the source, not in the browser');
+  assert.match(WORK_SRC, /tasks\?status=backlog&limit=\$\{BACKLOG_LIMIT\}\$\{q\}/,
+    'and so does the backlog read');
+  const routes = read('modules/lifecycle/routes/tasks.js');
+  const claimable = routes.slice(routes.indexOf("router.get('/tasks/claimable'"));
+  assert.match(claimable.slice(0, 2500), /createdBy: claimCreatedBy \?\? null/);
+  assert.match(claimable.slice(0, 2500), /staleDays: claimStaleDays \?\? null/);
+});
+
+await test('a server-side filter change RE-FETCHES; every other filter stays instant', () => {
+  // makeFilterBar hands onChange every value, not the changed id (hall-kit.js),
+  // so the decision is made by comparing the server-facing query — which is the
+  // direct question anyway, and means a control absent from that query can never
+  // cost a round-trip.
+  assert.match(WORK_SRC, /let lastServerFilterQuery = '';/);
+  assert.match(WORK_SRC, /if \(q !== lastServerFilterQuery\) \{[\s\S]{0,200}refreshLive\(\);\s*\n\s*loadBacklog\(\);/);
+  const kit = read('modules/hall-ui/public/hall-kit.js');
+  assert.match(kit, /if \(onChange\) onChange\(values\(\)\);/,
+    'the contract this decision depends on — if it ever hands the changed id instead, revisit');
+});
+
+await test('one staleness rule, four expressions, none of them drifting', () => {
+  const clock = /GREATEST\(COALESCE\((?:v\.|t\.)?updated_at, 'epoch'::timestamptz\),\s*\n?\s*COALESCE\((?:v\.|t\.)?shipped_at, 'epoch'::timestamptz\)\)/;
+  const dbTasks = read('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, clock, 'listTasks');
+  assert.ok((dbTasks.match(new RegExp(clock.source, 'g')) || []).length >= 2, 'and listClaimableTasks');
+  assert.match(read('modules/lifecycle/goal-rollup.js'), clock, 'the goal rollup');
+  assert.equal(taskLib.taskActivityMs({ updated_at: '2026-01-01T00:00:00Z', shipped_at: '2026-02-01T00:00:00Z' }),
+    Date.parse('2026-02-01T00:00:00Z'), 'and the browser');
+});
+
+// ---- privacy -----------------------------------------------------------------
+
+await test('a rollup never hands a private goal\'s task title to a non-member', () => {
+  // Counts on a private goal are not the secret — its prose is (ADR 0112's leak
+  // rule). next_ready_title is a real task title, so it is gated on membership
+  // or Archon; the counters still come back, so the board renders the ring and
+  // the readiness line either way.
+  const rollup = read('modules/lifecycle/goal-rollup.js');
+  assert.match(rollup, /CASE WHEN bool_or\(g\.visibility IS DISTINCT FROM 'private'\)/);
+  assert.match(rollup, /bool_or\(gm\.builder_id IS NOT NULL\)/, 'membership is what unlocks it');
+  assert.match(rollup, /THEN MAX\(nr\.title\) END\s+AS next_ready_title/);
+  const routes = read('modules/lifecycle/routes/goals.js');
+  assert.match(routes, /viewerId: req\.builder\.id/, 'identity from the request, never the query');
+  assert.match(routes, /viewerIsArchon: req\.builder\.rank === 'archon'/);
+});
+
+await test('limit and offset are BOUND, not interpolated', () => {
+  const dbTasks = read('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /tail \+= ` LIMIT \$\$\{params\.length\}`/);
+  assert.equal(/LIMIT \$\{Number\(limit\)\}/.test(dbTasks), false,
+    'a query builder that is only safe because of who calls it is one careless caller from unsafe');
+});
+
+// ---- the scale check: EXECUTED, not asserted --------------------------------
+
+await test('the board pipeline survives the real corpus size (~1,400 rows), measured', () => {
+  // Reproduce the board's per-render work — filter (creator + staleness + the
+  // existing axes) then sort — over a corpus the size of BONGOS-V1's, and hold it
+  // to a budget. The budget is generous (well under one frame's headroom on this
+  // CI box) because the point is the ORDER of the cost, not a microbenchmark: a
+  // rewrite that makes this quadratic or fetch-per-row breaks the assert.
+  const { taskActivityMs, isStale } = taskLib;
+  const now = Date.now();
+  const corpus = Array.from({ length: 1400 }, (_, i) => ({
+    id: i + 1,
+    title: `Task number ${i} of the corpus`,
+    version_id: 'BONGOS-V1',
+    kind: ['feature', 'bug', 'infra'][i % 3],
+    discipline: ['engineer', 'artist', 'ideator'][i % 3],
+    created_by: i % 5 === 0 ? null : String(1000000 + (i % 7)),
+    goal_id: String(1000000 + (i % 40)),
+    updated_at: new Date(now - (i % 90) * DAY).toISOString(),
+    shipped_at: null,
+    credits_reward: i % 50,
+    est_minutes: 30 + (i % 120),
+    priority: (i % 5) + 1,
+    newcomer_friendly: i % 11 === 0,
+  }));
+  const t0 = process.hrtime.bigint();
+  let visible;
+  for (let pass = 0; pass < 10; pass++) {
+    visible = corpus
+      .filter((t) => String(t.created_by) === '1000003' || t.created_by == null)
+      .filter((t) => isStale(taskActivityMs(t), '30', now))
+      .sort((a, b) => taskActivityMs(a) - taskActivityMs(b));
+  }
+  const perPassMs = Number(process.hrtime.bigint() - t0) / 1e6 / 10;
+  assert.ok(visible.length > 0, 'sanity: the synthetic filters match something');
+  assert.ok(perPassMs < 50, `one filter+sort pass over 1,400 rows took ${perPassMs.toFixed(2)}ms — the view no longer survives the corpus`);
+});
+
+await test('the Tasks board still loads the corpus in a bounded number of requests', () => {
+  // The board's data story: claimable + backlog + one /goals read. The new axes
+  // must not have added a per-row or per-goal fetch. Count the getJSON call
+  // sites that run at boot — the creator labels ride ONE directory read.
+  const boots = WORK_SRC.match(/getJSON\(`\$\{API\}\/(tasks\/claimable|tasks\?status=backlog|goals|builders\/directory)`\)/g) || [];
+  assert.ok(boots.length <= 5, `bounded boot reads — got ${boots.length}`);
+  assert.equal(/getJSON\(`\$\{API\}\/tasks\/\$\{t\.id\}/.test(WORK_SRC.slice(WORK_SRC.indexOf('populateCreatorFilter'))), false,
+    'no per-task fetch crept into the new filter');
+});
+
+summary();

package/tests/goal_subtitle.mjs

@@ -154,8 +154,13 @@ test("Claude's prose is a CLOSED disclosure, not visible body text", () => {
 const el = () => ({ textContent: null, hidden: null, open: null });
 function applyProse(goal) {
   const lib = read('modules', 'hall-ui', 'public', 'goals-lib.js');
+  const taskLib = read('modules', 'hall-ui', 'public', 'task-lib.js');
   const els = { sub: el(), desc: el(), claude: el() };
-  const fn = new Function('window', `${lib}; return window.OTBGoalsLib.applyGoalProse;`)({ OTB: { escapeHtml: (x) => x } });
+  // task 1003278: goals-lib takes its activity clock from window.OTBTaskLib (one
+  // meaning of "touched" across both tiers), so the sibling loads first — the
+  // order goals.html uses. Loading the REAL one, not a stub: a stub that always
+  // agrees is exactly what a shared definition must not be tested against.
+  const fn = new Function('window', `${taskLib}; ${lib}; return window.OTBGoalsLib.applyGoalProse;`)({ OTB: { escapeHtml: (x) => x } });
   fn(els, goal);
   return els;
 }