@bongos/core 1.19.451 → 1.19.453

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.451",
-  "core_contract": "1.19.451",
-  "source_commit": "f2d301bff1deca7496735a9b24aed2ced913a54a",
+  "core_version": "1.19.453",
+  "core_contract": "1.19.453",
+  "source_commit": "d608d7888d16f919cc2775428848dcfff82d333b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-01T19:29:54.090Z",
+  "built_at": "2026-09-01T20:06:17.187Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 371,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1788,
+    "functional_verbatim": 1789,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2183,
-  "tree_sha256": "e1ab49577ffad8bf559f652561719a2590467717b87c215918689cc2e740a31e",
+  "file_count": 2184,
+  "tree_sha256": "b32b4f4ed373293772fa27594b928449ab80778248125d70b8401f71e0b34ac3",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2092,7 +2092,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ff76a324ccf245e1fd66a1aa9524c488fa4f54929e070c7b7d048b04521cbf0d"
+      "sha256": "9626b5a975e660041681a9d58615224db812a74a705251d12f53cd51bcc88f1f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4647,7 +4647,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "745663b0a264ae742702919fc9486f49723010dd797e1fe7151de5d65b98bf21"
+      "sha256": "cf646edc2f71e39aee26cb5648cc25915b5688c7d6356345c0365ada37fdb400"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -6302,12 +6302,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "288c4f929ae1ec0e24e6ffbb9a911683acf04b6fe8f5e324df3c5c42c1086043"
+      "sha256": "a9e7b10b99360f563204364b2a444ff18b701669723ef0a9a76a04a0046df317"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "dc7522ac5de90eec2d4764a2268601149b1215b3ad3d989326243cca2aab67ea"
+      "sha256": "ea1047b8ac17de0376d21a3a07d9f22f2854e20397b72b0626c896e4129bbfdf"
     },
     {
       "path": "public-docs/index.html",
@@ -7957,7 +7957,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c9498ea93c030472ed6d09afe79001e23d0fe2c3045f7b5d51b660d0237bcdb8"
+      "sha256": "118d1bcac62c551bf53344abd1b77785f9875d4a6e6c29a86123f4587ac79906"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8977,7 +8977,7 @@
     {
       "path": "tests/goal_advisory.mjs",
       "mode": "0000644",
-      "sha256": "7488d41a0d962f681f9482e4c06f518f38be824e8fa936b5bd7b1c1b70838c3d"
+      "sha256": "1b1c403574132def4c4beb98595987e90b720a851f29e42f643f1f00f285da5c"
     },
     {
       "path": "tests/goal_category.mjs",
@@ -9479,6 +9479,11 @@
       "mode": "0000644",
       "sha256": "51e1286235cbde1b56188f29b0e2bd12ac73a9637dbf1c16b325f10147256f27"
     },
+    {
+      "path": "tests/idea_route_attribution.mjs",
+      "mode": "0000644",
+      "sha256": "99a4665c1ddd97bb27238082c0e6e420eb66ab3c18ec92b543c3b35ba607ebda"
+    },
     {
       "path": "tests/idea_routing.mjs",
       "mode": "0000644",
@@ -10747,7 +10752,7 @@
     {
       "path": "tests/task_goal_link.mjs",
       "mode": "0000644",
-      "sha256": "d4f417d485cde211b7664c017f1909eb31bd86539cfc0128a08bf2b474023b80"
+      "sha256": "514be815c0466e4e2865ad85cb7a2ca206e5b46abc7b345da2c36278667c8bb2"
     },
     {
       "path": "tests/task_lib.mjs",

package/docs/module-api-changelog.md

@@ -1339,5 +1339,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.449 with no explicit bump. run 33414986466. (task 1002620)
   1.19.451 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.450 with no explicit bump. run 33549781105. (task 1002620)
+  1.19.452 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.451 with no explicit bump. run 33552353620. (task 1002620)
+  1.19.453 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.452 with no explicit bump. run 33553290345. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-tasks.js

@@ -23,6 +23,20 @@ const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 // -------------------------------------------------------------------------
 
 
+// The version statuses that can still receive new work. 'shipped' and 'frozen' are
+// closed: a version whose scope is sealed cannot be told about a bug found afterwards.
+// Mirrors the CHECK constraint on versions.status (migrations/003_pms.sql).
+const VERSION_STATUSES_OPEN_TO_WORK = new Set(['planning', 'building']);
+
+// versionAcceptsNewWork — PURE, FAIL-CLOSED. Is this version still a place work can
+// land? Exported so the truth table is pinned by a DB-free unit test, and so a caller
+// that needs the same judgement asks this instead of respelling the status list.
+// Anything unrecognised (null, a typo, a status added later) reads false: filing into
+// a version we cannot vouch for is the failure this predicate exists to prevent.
+function versionAcceptsNewWork(status) {
+  return typeof status === 'string' && VERSION_STATUSES_OPEN_TO_WORK.has(status);
+}
+
 // task 1763: resolve a version's catch-all "<version> — general" goal (created by
 // migration 160, created_by NULL). This is the fallback goal a goal-less task
 // defaults into (see createTask) so the "every task belongs to a goal" invariant
@@ -32,14 +46,39 @@ const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 // unit-testable DB-free. The title mirrors migration 160's insert exactly (a spaced
 // em-dash); it is built by ../goal-advisory.generalGoalTitle so this SQL and the
 // advisory that detects the same goal can never disagree (task 1002539).
+//
+// task 1003061 (BV1.R03): it also refuses a CLOSED version's catch-all. That is the
+// 1000771 failure shape — Discord #bugs hardcoded GDS-V3, a shipped version, so every
+// bug reported through it resolved into "GDS-V3 — general" and was filed somewhere
+// nobody would ever look again. routeIdeaToGoal (BV1.R01) already refuses an EXPLICIT
+// goal on a closed version; this closes the IMPLICIT door that every other create
+// vector walks through. Returning null is deliberately NOT an error: the create still
+// succeeds with goal_id NULL, and the orphan advisory then says so out loud — a task
+// visibly without a home beats one quietly entombed.
+//
+// The status is judged in JS rather than the WHERE clause so the rule is one exported,
+// unit-tested predicate instead of a string list duplicated into SQL. The JOIN is inner
+// on purpose: a goal whose version row is missing is not a home either.
 async function generalGoalIdForVersion(versionId, deps = {}) {
   if (versionId == null) return null;
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
-    'SELECT id FROM goals WHERE version_id = $1 AND title = $2 LIMIT 1',
+    `SELECT g.id, v.status AS version_status
+       FROM goals g
+       JOIN versions v ON v.id = g.version_id
+      WHERE g.version_id = $1 AND g.title = $2
+      LIMIT 1`,
     [versionId, generalGoalTitle(versionId)]
   );
-  return rows[0] ? rows[0].id : null;
+  if (!rows[0]) return null;
+  if (!versionAcceptsNewWork(rows[0].version_status)) {
+    log.debug(
+      { versionId, versionStatus: rows[0].version_status ?? null, goalId: rows[0].id },
+      'catch-all goal refused: version is closed to new work (task 1003061)'
+    );
+    return null;
+  }
+  return rows[0].id;
 }
 
 async function createTask({
@@ -870,4 +909,5 @@ module.exports = {
   updateTaskRequiresRank,
   updateTaskSecuritySensitive,
   updateTaskStatus,
+  versionAcceptsNewWork,
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.451",
+  "version": "1.19.453",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.451",
+      "version": "1.19.453",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.451",
+  "version": "1.19.453",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.451'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.453'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_advisory.mjs

@@ -108,7 +108,7 @@ await test('candidateGoals is total — non-array, empty, and missing scope_modu
 
 await test('db.js resolves the catch-all through generalGoalTitle — no second spelling', () => {
   assert.match(dbSrc, /require\('\.\/goal-advisory\.js'\)/, 'db.js imports the shared helper');
-  assert.match(dbSrc, /title = \$2 LIMIT 1/, 'the SQL binds the title rather than inlining it');
+  assert.match(dbSrc, /g\.title = \$2/, 'the SQL binds the title rather than inlining it');
   assert.equal(
     (dbSrc.match(/' — general'/g) || []).length, 0,
     'the em-dash literal must exist in exactly ONE place (goal-advisory.js), not in db.js too'

package/tests/idea_route_attribution.mjs

@@ -0,0 +1,330 @@
+// tests/idea_route_attribution.mjs
+//
+// THE PROOF — task 1003072 (BV1.R04, goal 1000071 "Idea routing"). Criterion
+// C3, "no route loses the person who thought of it":
+//
+//   (1) every routed task has an ideas_task_lineage row (origin='route') back to
+//       an idea_inbox row with captured_by;
+//   (3) sourceIdeaForTask on a routed, SHIPPED task returns the filer — the trail
+//       goal 1000067's ideator credit will pay against;
+//   (4) an unlinked Discord author still yields an idea row (captured_by null)
+//       rather than an attribution-free task.
+//
+// WHY THIS FILE EXISTS ALONGSIDE tests/idea_routing.mjs. That file proves the
+// WRITE: a routed capture emits idea + task + lineage in one transaction, in FK
+// order, and rolls all three back together. tests/idea_task_lineage.mjs proves
+// the READ: given a hand-seeded lineage row, sourceIdeaForTask names the idea and
+// its author. Neither proves the two HALVES COMPOSE — that the row routing
+// actually writes is the row the credit hook actually finds. A typo'd origin, a
+// task id written where an idea id was meant, a captured_by dropped on the way
+// in: each passes both existing files and still loses the ideator their credit,
+// silently, months before anyone tries to pay them.
+//
+// So this file runs the write and the read against ONE store. Nothing is
+// hand-seeded: every row the assertions read was put there by captureIdea.
+//
+// THE STORE, not a matcher table. The other two files answer per-statement with
+// canned rows, which is right for asserting statement SEQUENCE. Here the point is
+// end-to-end agreement, so the fake speaks the three tables as maps and the
+// queries genuinely join across them. A canned answer would prove nothing: it
+// would be the test asserting its own fixture.
+//
+// MUTATION-VERIFIED (task 1003072). A proof that has never failed is a rumour, so
+// each of these was applied to modules/ideas/inbox.js and the file was confirmed RED
+// before being reverted:
+//
+//   origin 'route' -> 'promote' in the lineage insert ......... 4 of 9 fail
+//   createdBy: capturedBy -> null on the task ................. 1 of 9 fail
+//   lineage params [task.id, idea.id] swapped ................. 5 of 9 fail
+//   captured_by -> null on the idea insert .................... 3 of 9 fail
+//   the lineage INSERT deleted (the #bugs bypass shape) ....... 5 of 9 fail
+//
+// Re-run that check if this file is ever rewritten: the store fake is expressive
+// enough that a careless edit could make it answer its own questions.
+//
+// Run:  node tests/idea_route_attribution.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+
+// ---------------------------------------------------------------------------
+// The store: idea_inbox, tasks, ideas_task_lineage as three maps.
+// ---------------------------------------------------------------------------
+
+const GOAL = {
+  id: 7, status: 'open', version_id: 'BONGOS-V1', version_status: 'building', scope_modules: ['ideas'],
+};
+
+function makeStore() {
+  return {
+    ideas: new Map(),    // id -> row
+    tasks: new Map(),    // id -> row
+    lineage: new Map(),  // task_id -> { idea_id, origin }
+    nextIdeaId: 500,
+    nextTaskId: 9000,
+    goal: { ...GOAL },
+  };
+}
+
+// One SQL handler over the store, shared by the transaction client and the
+// module-level pool — so the write path and the read path cannot disagree about
+// what is in the database.
+function handlerFor(store) {
+  return async (s, params = []) => {
+    // the locked goal read (routeIdeaToGoal step a)
+    if (/FROM goals g JOIN versions v/.test(s)) {
+      return { rows: store.goal ? [store.goal] : [] };
+    }
+    // the idea row (step b)
+    if (/INSERT INTO idea_inbox/.test(s)) {
+      const [title, bodyMd, kind, suggestedVersion, suggestedPriority, capturedBy, suggestedGoalId] = params;
+      const id = store.nextIdeaId++;
+      const row = {
+        id,
+        title,
+        body_md: bodyMd,
+        kind,
+        suggested_version: suggestedVersion ?? null,
+        suggested_priority: suggestedPriority ?? null,
+        // captured_by is THE field under test: it must survive the write
+        // unmodified, including when it is null (the unlinked-Discord case).
+        captured_by: capturedBy ?? null,
+        status: 'promoted',
+        suggested_goal_id: suggestedGoalId ?? null,
+        promoted_to_task_id: null,
+        reviewed_at: 'T0',
+        merged_into_idea_id: null,
+        triage_note: null,
+        captured_at: 'T0',
+      };
+      store.ideas.set(String(id), row);
+      return { rows: [row] };
+    }
+    // the lineage row (step d)
+    if (/INSERT INTO ideas_task_lineage/.test(s)) {
+      const [taskId, ideaId] = params;
+      // origin is a literal in the statement, not a param — read it from the SQL
+      // so a change to that literal is caught here rather than assumed.
+      const origin = (s.match(/VALUES \(\$1, \$2, '(\w+)'\)/) || [])[1] ?? null;
+      store.lineage.set(String(taskId), { idea_id: String(ideaId), origin });
+      return { rowCount: 1, rows: [] };
+    }
+    // closing the FK loop (step e)
+    if (/UPDATE idea_inbox SET promoted_to_task_id/.test(s)) {
+      const [ideaId, taskId] = params;
+      const row = store.ideas.get(String(ideaId));
+      if (row) row.promoted_to_task_id = taskId;
+      return { rows: row ? [row] : [] };
+    }
+    // sourceIdeaForTask — the read the ship hook does
+    if (/l\.idea_id, l\.origin, i\.captured_by/.test(s)) {
+      const link = store.lineage.get(String(params[0]));
+      if (!link) return { rows: [] };
+      const idea = store.ideas.get(String(link.idea_id));
+      if (!idea) return { rows: [] }; // an INNER JOIN finds nothing
+      return { rows: [{ idea_id: link.idea_id, origin: link.origin, captured_by: idea.captured_by }] };
+    }
+    // countShippedTasksForIdea
+    if (/COUNT\(\*\)::int AS n/.test(s)) {
+      const ideaId = String(params[0]);
+      let n = 0;
+      for (const [taskId, link] of store.lineage) {
+        if (link.idea_id === ideaId && (store.tasks.get(taskId) || {}).status === 'shipped') n++;
+      }
+      return { rows: [{ n }] };
+    }
+    return { rows: [] }; // BEGIN / COMMIT / ROLLBACK and anything unmatched
+  };
+}
+
+// A pool whose query() and connect().query() both run the same handler against
+// the same store, and which records every statement for ordering assertions.
+function poolFor(store) {
+  const handler = handlerFor(store);
+  const queries = [];
+  const client = {
+    queries,
+    async query(sql, params) {
+      queries.push({ sql: String(sql).replace(/\s+/g, ' ').trim(), params });
+      return handler(String(sql).replace(/\s+/g, ' ').trim(), params);
+    },
+    release() {},
+  };
+  return {
+    queries,
+    query: client.query,
+    connect: async () => client,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Wiring: the lifecycle port (createTask) writes into the SAME store.
+// ---------------------------------------------------------------------------
+
+const seams = require('../src/module-seams.js');
+seams._reset();
+
+let activeStore = makeStore();
+
+seams.registerProvider('lifecycle', {
+  createTask: async (args) => {
+    const id = activeStore.nextTaskId++;
+    const row = {
+      id,
+      status: args.status,
+      goal_id: args.goalId,
+      version_id: args.versionId,
+      title: args.title,
+      kind: args.kind,
+      source: args.source,
+      source_ref: args.sourceRef,
+      created_by: args.createdBy ?? null,
+    };
+    activeStore.tasks.set(String(id), row);
+    return row;
+  },
+});
+
+const inbox = require('../modules/ideas/inbox.js');
+const { captureIdea, sourceIdeaForTask, countShippedTasksForIdea } = inbox;
+
+// sourceIdeaForTask and countShippedTasksForIdea read the MODULE-LEVEL pool (no
+// deps seam), so point that at the live store too. Same object the module
+// captured at load, so replacing the method is enough.
+api.pool.query = async (sql, params) => handlerFor(activeStore)(String(sql).replace(/\s+/g, ' ').trim(), params);
+
+const { test, summary } = makeRunner();
+
+// Route one bug and hand back everything the assertions need.
+async function routeABug({ capturedBy = 42, filerRank = 'metic', title = 'the thing is broken' } = {}) {
+  activeStore = makeStore();
+  const pool = poolFor(activeStore);
+  const idea = await captureIdea(
+    { title, bodyMd: 'steps to reproduce', kind: 'bug', goalId: GOAL.id, capturedBy, filerRank },
+    { pool }
+  );
+  return { idea, pool, store: activeStore };
+}
+
+const ship = (store, taskId) => { store.tasks.get(String(taskId)).status = 'shipped'; };
+
+// =========================================================================
+// C3 (1) — the routed task HAS a lineage row, and it points at a real idea
+// =========================================================================
+
+await test('a routed bug writes lineage origin=route from the task back to the idea', async () => {
+  const { idea, store } = await routeABug();
+  const taskId = idea.routing.task_id;
+
+  assert.ok(taskId, 'the capture became a task');
+  const link = store.lineage.get(String(taskId));
+  assert.ok(link, 'a lineage row exists for the task that was just created');
+  assert.equal(link.origin, 'route', "origin is 'route' — not 'promote', which would misattribute the lane");
+  assert.equal(link.idea_id, String(idea.id), 'and it points at the idea this very capture wrote');
+  assert.ok(store.ideas.has(String(idea.id)), 'that idea id is a real row, not a dangling reference');
+});
+
+await test('the idea row carries the filer, and the task records them as its creator', async () => {
+  const { idea, store } = await routeABug({ capturedBy: 42 });
+  assert.equal(store.ideas.get(String(idea.id)).captured_by, 42, 'the filer is on the idea row');
+  assert.equal(store.tasks.get(String(idea.routing.task_id)).created_by, 42,
+    'and on the task — routing an idea attributes the work to whoever reported it');
+});
+
+// =========================================================================
+// C3 (3) — THE COMPOSITION. What routing wrote is what the ship hook reads.
+// =========================================================================
+
+await test('sourceIdeaForTask on the routed, SHIPPED task returns the filer', async () => {
+  const { idea, store } = await routeABug({ capturedBy: 42 });
+  const taskId = idea.routing.task_id;
+  ship(store, taskId);
+
+  const src = await sourceIdeaForTask(taskId);
+  assert.ok(src, 'the ship hook finds a source idea — nothing to pay is the failure this goal exists to prevent');
+  assert.equal(String(src.idea_id), String(idea.id), 'it names the idea the filing created');
+  assert.equal(src.origin, 'route', 'and says the route is where it came from');
+  assert.equal(src.captured_by, 42, 'and names the person to pay');
+});
+
+await test('the shipped-task count for that idea is exactly one — the credit lane can meter it', async () => {
+  const { idea, store } = await routeABug();
+  assert.equal(await countShippedTasksForIdea(idea.id), 0, 'nothing is owed before it ships');
+  ship(store, idea.routing.task_id);
+  assert.equal(await countShippedTasksForIdea(idea.id), 1, 'and exactly one afterwards — never double-paid');
+});
+
+await test('the trail survives with NOTHING hand-seeded — every row came from the capture', async () => {
+  const { idea, store } = await routeABug({ capturedBy: 77 });
+  // The point of the whole file, asserted directly: three tables, one act.
+  assert.equal(store.ideas.size, 1, 'one idea');
+  assert.equal(store.tasks.size, 1, 'one task');
+  assert.equal(store.lineage.size, 1, 'one lineage row');
+  ship(store, idea.routing.task_id);
+  const src = await sourceIdeaForTask(idea.routing.task_id);
+  assert.deepEqual(
+    { idea: String(src.idea_id), origin: src.origin, who: src.captured_by },
+    { idea: String(idea.id), origin: 'route', who: 77 }
+  );
+});
+
+// =========================================================================
+// C3 (4) — an unlinked author still leaves a trail
+// =========================================================================
+
+await test('an UNLINKED filer (captured_by null) still yields an idea row, not an attribution-free task', async () => {
+  // A Discord author with no Bongos account. The report must not become a task
+  // that exists with no idea behind it — that is precisely the #bugs bypass this
+  // goal retires. The trail exists and is honestly empty at the person-shaped
+  // end, which is recoverable later; a missing lineage row never is.
+  const { idea, store } = await routeABug({ capturedBy: null, filerRank: 'metic' });
+  const taskId = idea.routing.task_id;
+
+  assert.ok(store.lineage.get(String(taskId)), 'the lineage row exists even with no known author');
+  ship(store, taskId);
+  const src = await sourceIdeaForTask(taskId);
+  assert.ok(src, 'the ship hook still finds the idea');
+  assert.equal(src.origin, 'route');
+  assert.equal(src.captured_by, null, 'unattributed, and honestly so — never guessed');
+  assert.equal(store.tasks.get(String(taskId)).created_by, null, 'the task does not invent a creator either');
+});
+
+// =========================================================================
+// The negative: a task with no route has no trail, so a passing test above
+// cannot be the fake answering itself.
+// =========================================================================
+
+await test('a task that was never routed has no source idea (the read is not vacuously true)', async () => {
+  activeStore = makeStore();
+  activeStore.tasks.set('4242', { id: 4242, status: 'shipped' });
+  assert.equal(await sourceIdeaForTask(4242), null,
+    'no lineage row → null; if this returned a row the store would be answering blind');
+});
+
+await test('lineage pointing at a missing idea reads as no source, never as a half-row', async () => {
+  activeStore = makeStore();
+  activeStore.tasks.set('4243', { id: 4243, status: 'shipped' });
+  activeStore.lineage.set('4243', { idea_id: '999', origin: 'route' }); // idea absent
+  assert.equal(await sourceIdeaForTask(4243), null,
+    "the INNER JOIN drops it — the credit lane must never see an author-less 'source'");
+});
+
+// =========================================================================
+// The provenance pair, so one idea can only ever mint one routed task
+// =========================================================================
+
+await test('the routed task carries the idempotency provenance the create-vector read keys on', async () => {
+  const { idea, store } = await routeABug();
+  const task = store.tasks.get(String(idea.routing.task_id));
+  assert.equal(task.source, 'idea-route', 'source names the vector');
+  assert.equal(task.source_ref, `idea-${idea.id}`,
+    'and source_ref names the idea — db.findTaskBySourceRef is what stops a second task being minted');
+});
+
+summary();

package/tests/task_goal_link.mjs

@@ -12,6 +12,8 @@
 //       - null versionId → null and NO SQL (nothing to resolve).
 //       - a version id → exactly one SELECT keyed on (version_id, the spaced
 //         em-dash title match), bound param [versionId], returning the id or null.
+//       - a CLOSED version (shipped/frozen) → null even when the goal exists, so
+//         the create lands goal-less rather than in a tomb (task 1003061).
 //
 //   routes/tasks.js — the router still BUILDS after the PATCH /tasks/:id goal_id
 //     extension (imports resolve; the factory returns a router). The SQL + the
@@ -29,6 +31,10 @@ process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
 const db = require('../modules/lifecycle/db.js');
 const { generalGoalIdForVersion } = db;
+// versionAcceptsNewWork is INTERNAL to the tasks slice (task 1003061): db.js is the
+// facade for the call sites, and re-exporting a predicate nothing outside this file
+// calls would only widen the facade. Required from where it lives instead.
+const { versionAcceptsNewWork } = require('../modules/lifecycle/db-tasks.js');
 const buildTasksRouter = require('../modules/lifecycle/routes/tasks.js');
 
 const { test, summary } = makeRunner();
@@ -55,17 +61,21 @@ await test('null / undefined versionId → null, and NO SQL is issued', async ()
   }
 });
 
-await test('a version with a general goal → returns its id via one SELECT on the em-dash title', async () => {
-  const pool = fakePool([{ id: 3 }]);
+await test('a BUILDING version with a general goal → returns its id via one SELECT on the em-dash title', async () => {
+  const pool = fakePool([{ id: 3, version_status: 'building' }]);
   const out = await generalGoalIdForVersion('BONGOS-V1', { pool });
 
   assert.equal(out, 3, 'returns the general goal id');
   assert.equal(pool.queries.length, 1, 'exactly one SELECT');
   const q = pool.queries[0];
+  // task 1003061 (BV1.R03): the lookup now JOINs versions and brings the version
+  // status back, so the resolver can refuse a closed version's catch-all.
+  assert.match(q.sql, /JOIN versions/, 'the lookup reaches the version, not just the goal');
+  assert.match(q.sql, /AS version_status/, 'and carries its status back to be judged');
   // task 1002539: the title is no longer inlined in SQL — it is BOUND, built by the
   // shared goal-advisory.generalGoalTitle so this lookup and the orphan advisory that
   // names the same goal cannot drift apart.
-  assert.match(q.sql, /SELECT id FROM goals WHERE version_id = \$1 AND title = \$2/,
+  assert.match(q.sql, /WHERE g\.version_id = \$1 AND g\.title = \$2/,
     'keyed on version_id + a BOUND title (one definition, in goal-advisory.js)');
   assert.match(q.sql, /LIMIT 1/, 'single row');
   assert.deepEqual(q.params, ['BONGOS-V1', 'BONGOS-V1 — general'],
@@ -81,7 +91,7 @@ await test('a version with no general goal → null (caller leaves goal_id NULL,
 });
 
 await test('the em-dash in the title match is U+2014 (not a hyphen/en-dash) — or the backfill silently matches nothing', async () => {
-  const pool = fakePool([{ id: 9 }]);
+  const pool = fakePool([{ id: 9, version_status: 'building' }]);
   await generalGoalIdForVersion('V2', { pool });
   // The em-dash moved from the SQL text into the BOUND param (task 1002539); assert
   // it there, which is stricter — the exact string Postgres compares.
@@ -92,6 +102,54 @@ await test('the em-dash in the title match is U+2014 (not a hyphen/en-dash) —
   assert.ok(!title.includes(' – general'), 'not an en dash');
 });
 
+// =========================================================================
+// task 1003061 (BV1.R03) — the catch-all must never be a TOMB.
+//
+// The 1000771 failure: Discord #bugs hardcoded GDS-V3, a SHIPPED version, so every
+// reported bug resolved into "GDS-V3 — general" and was filed where nobody would look
+// again. routeIdeaToGoal (BV1.R01) already refuses an EXPLICIT goal on a closed
+// version; this closes the IMPLICIT door — the goal-less fallback that every other
+// create vector (POST /tasks, capture, newcomer-restock, seeds) walks through.
+//
+// A closed version's catch-all resolves to null, so createTask leaves goal_id NULL and
+// the orphan advisory (goal-advisory.js) speaks up. Loud silence beats a quiet tomb.
+
+await test('versionAcceptsNewWork: only a version still open for work can receive it', () => {
+  assert.equal(versionAcceptsNewWork('building'), true, 'building — the live case');
+  assert.equal(versionAcceptsNewWork('planning'), true, 'planning — a legitimate future home');
+  assert.equal(versionAcceptsNewWork('shipped'), false, 'shipped — the 1000771 tomb');
+  assert.equal(versionAcceptsNewWork('frozen'), false, 'frozen — closed to new work');
+});
+
+await test('versionAcceptsNewWork fails CLOSED on anything it does not recognise', () => {
+  for (const v of [null, undefined, '', 'BUILDING', 'archived', 42, {}]) {
+    assert.equal(versionAcceptsNewWork(v), false, `refuses ${JSON.stringify(v)}`);
+  }
+});
+
+await test("a SHIPPED version's catch-all does not resolve — the create lands goal-less, not in a tomb", async () => {
+  const pool = fakePool([{ id: 3, version_status: 'shipped' }]);
+  const out = await generalGoalIdForVersion('GDS-V3', { pool });
+  assert.equal(out, null, 'the goal EXISTS and is still refused — that is the whole point');
+  assert.equal(pool.queries.length, 1, 'it did look — it just declined what it found');
+});
+
+await test("a FROZEN version's catch-all does not resolve either", async () => {
+  const pool = fakePool([{ id: 4, version_status: 'frozen' }]);
+  assert.equal(await generalGoalIdForVersion('OLD-V1', { pool }), null);
+});
+
+await test("a PLANNING version's catch-all still resolves (a future home is a real home)", async () => {
+  const pool = fakePool([{ id: 5, version_status: 'planning' }]);
+  assert.equal(await generalGoalIdForVersion('NEXT-V1', { pool }), 5);
+});
+
+await test('a row with no readable version status resolves to null (fail closed)', async () => {
+  const pool = fakePool([{ id: 6 }]);
+  assert.equal(await generalGoalIdForVersion('MYSTERY-V1', { pool }), null,
+    'an unjoinable or absent version is not a home');
+});
+
 // -------------------------------------------------------------------------
 await test('routes/tasks.js still builds after the goal_id PATCH extension', () => {
   assert.equal(typeof buildTasksRouter, 'function', 'module exports the router factory');