@bongos/core 1.19.453 → 1.19.455

package/tests/filing_abuse_matrix.mjs

@@ -0,0 +1,394 @@
+// tests/filing_abuse_matrix.mjs — the FILING wall's ABUSE MATRIX (BV1.R06,
+// task 1003073, goal 1000071 "Idea routing"). Criterion C4: "filing can't outrun
+// rank — scope walls and rank floors hold on routed tasks."
+//
+// THE SISTER FILE. tests/goal_abuse_matrix.mjs is the same document for the
+// AUTHORING wall — POST /goals/:id/tasks, where a joined member deliberately
+// writes a task. This one covers the other door goal 1000071 opened: FILING, where
+// somebody reports a thing and the system turns it into work on their behalf.
+// Authoring is a member's privilege and is gated by membership; filing is open to
+// anyone by design (criterion C5: "the filer never has to know the goal map"), so
+// the safety has to come from somewhere else. This file is where "somewhere else"
+// is written down and made executable.
+//
+// THE ATTACKER, unless a row says otherwise: a Xenos with a valid session, filing
+// as fast as they can, naming whatever goal they like.
+//
+//   #   attack vector                                          → server response
+//   ──  ───────────────────────────────────────────────────     ────────────────────
+//   F1  file a bug naming an ordinary goal                     → routes, but 'backlog'
+//   F2  file a bug naming a PROTECTED-scope goal               → refused (protected_scope)
+//   F3  claim a higher rank in the request body                → ignored; rank is from auth
+//   F4  file a non-bug kind hoping it hard-lands               → 'backlog', every kind
+//   F5  file with a junk kind                                 → refused upstream (BAD_KIND)
+//   F5b …and if one slipped that validator                    → 'backlog' (fail-closed)
+//   F6  file with a junk/absent RANK                           → 'backlog' (fail-closed)
+//   F7  a criterion-proposal or decision (judgment kinds)      → never routes at all
+//   F8  a Full Idea naming a goal                              → never routes (Board Room's)
+//   F9  MASS-file through Discord #bugs                        → capped per rolling hour
+//   F10 make the rate-limit COUNT fail, to slip past the cap   → denied (fail-closed)
+//   F11 file through Discord #bugs at all, as a sub-Metic      → 'backlog', never 'ready'
+//   F12 file through Discord #ideas naming a goal              → that vector cannot route
+//   F15 reach #bugs' old direct-createTask bypass              → it no longer exists
+//   F16 file through #bugs as an UNLINKED author               → an inbox row, never work
+//   F13 declare touches[] outside the goal to widen blast area → the real wall refuses
+//   F14 file against a SHIPPED version's goal                  → refused (version not building)
+//   P1  a Metic+ files a bug in an ordinary goal               → 'ready' (the C1 grant)
+//   P2  a Metic+ files into protected scope                    → allowed, floored to metic
+//
+// AND THE ANTI-DRIFT PIN (the point of the file, really). The rows above are true
+// of the capture vectors that exist TODAY. Nothing stops a fifth being added
+// next month that quietly skips all of it — which is exactly how the 1000771 bug
+// got in. So the last section ENUMERATES the vectors from source and fails when
+// the roster changes, forcing a new vector's author to come here and add its row.
+//
+// PURE: the decision cores only (decideLanding, authorizeRoutedLanding,
+// rateLimitPerHour) — no DB, no network. The transaction that
+// obeys them is proven in tests/idea_routing.mjs; the end-to-end attribution trail
+// in tests/idea_route_attribution.mjs.
+//
+// MUTATION-VERIFIED (task 1003073). Each of these was applied to the source and the
+// file confirmed RED before reverting, so the matrix is known to have teeth:
+//
+//   METIC_PLUS widened to include xenos ....................... 4 of 23 fail
+//   the protected-scope refusal short-circuited to false ...... 1 of 23 fail
+//   NEVER_ROUTE_KINDS emptied ................................. 1 of 23 fail
+//   #bugs READY_RANKS widened to include thetes ............... 2 of 23 fail
+//   the rate cap made env-uncappable (negatives accepted) ..... 1 of 23 fail
+//
+// Run:  node tests/filing_abuse_matrix.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { makeRunner } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => readFileSync(path.join(ROOT, rel), 'utf8');
+
+const routing = require('../modules/ideas/routing.js');
+const { decideLanding, authorizeRoutedLanding, routedPriority, PROTECTED_SCOPE_FLOOR } = routing;
+const bugs = require('../modules/discord/discord-bugs.js');
+const { rateLimitPerHour } = bugs;
+const { scopeIncludesProtected, isModuleKey } = require('../src/bongos/module-scope-map.js');
+
+const { test, summary } = makeRunner();
+
+// Ranks below the trust boundary. 'thetes' and 'xenos' are the real sub-Metic
+// tiers; the rest are the shapes a hostile or buggy caller actually produces.
+const SUB_METIC = ['xenos', 'thetes', null, undefined, '', 'METIC ', 'admin', 'root', 'archon ', 42, {}];
+const TRUSTED = ['metic', 'archon', 'Metic', 'ARCHON'];
+
+// A routed filing lands claimable ONLY when decideLanding says 'ready' AND
+// authorizeRoutedLanding lets it through. Both, because either alone is half the
+// gate — this helper is the composition the server actually runs.
+function landing({ kind = 'bug', filerRank = 'xenos', goalId = 5, grade = null, scopeProtected = false, scopeCheck = null } = {}) {
+  const verdict = decideLanding({ goalId, kind, grade, filerRank });
+  if (!verdict.route) return { landed: false, status: null, reason: verdict.reason };
+  const authorized = authorizeRoutedLanding({ landing: verdict, scopeProtected, scopeCheck, filerRank });
+  if (!authorized.ok) return { landed: false, status: null, refused: authorized.code };
+  return { landed: true, status: authorized.status, requiresRank: authorized.requiresRank, reason: verdict.reason };
+}
+
+// =========================================================================
+// Fixtures anchored in real facts, so the matrix cannot drift into fiction.
+// =========================================================================
+
+await test('fixtures: ideas is a real UNprotected module, lifecycle a protected one', () => {
+  assert.ok(isModuleKey('ideas') && isModuleKey('lifecycle'), 'both fixture modules are real');
+  assert.equal(scopeIncludesProtected(['ideas']), false, 'an ordinary goal scope');
+  assert.equal(scopeIncludesProtected(['lifecycle']), true, 'a protected one — the matrix depends on this');
+});
+
+// =========================================================================
+// F1–F8 — the filing matrix: a sub-Metic can report anything and set nothing
+// =========================================================================
+
+await test('[F1] a Xenos bug in an ordinary goal routes, but lands at backlog — never claimable', () => {
+  const r = landing({ kind: 'bug', filerRank: 'xenos' });
+  assert.equal(r.landed, true, 'the report is accepted — refusing it would be the triage tax this goal removes');
+  assert.equal(r.status, 'backlog', 'and it waits for a nod');
+  assert.equal(r.reason, 'bug_awaiting_nod');
+});
+
+await test('[F2] a Xenos bug in a PROTECTED-scope goal is refused outright, not merely floored', () => {
+  const r = landing({ kind: 'bug', filerRank: 'xenos', scopeProtected: true });
+  assert.equal(r.landed, false, 'no row is minted in the permission/ship/deploy core queue at all');
+  assert.equal(r.refused, 'protected_scope');
+});
+
+await test('[F3] rank comes from AUTH, never the body — the route never reads a body rank', () => {
+  // The decision core is handed a rank; the guarantee that it is the authenticated
+  // one lives at the call site, so assert it there, in source.
+  const src = read('modules/ideas/routes/inbox.js');
+  assert.match(src, /filerRank:\s*req\.builder\?\.rank/,
+    'POST /inbox must pass the AUTHENTICATED rank');
+  assert.ok(!/filerRank:\s*body\./.test(src), 'and must never take one from the request body');
+  assert.match(src, /capturedBy:\s*req\.builder\.id/, 'the filer identity is likewise from auth');
+});
+
+await test('[F4] no NON-BUG kind hard-lands, whoever files it — a filer cannot set the agenda', () => {
+  for (const kind of ['feature', 'cleanup', 'refactor', 'infra', 'chore', 'docs']) {
+    for (const rank of [...SUB_METIC, ...TRUSTED]) {
+      const r = landing({ kind, filerRank: rank });
+      assert.equal(r.status, 'backlog', `${kind} filed by ${JSON.stringify(rank)} must soft-land`);
+    }
+  }
+});
+
+await test('[F5] a junk kind never even reaches the matrix — captureIdea refuses it first', () => {
+  // The real wall for a bogus kind is upstream of routing: captureIdea resolves
+  // kind (or auto-classifies an absent one) and then refuses anything outside
+  // VALID_KINDS with BAD_KIND, before any write. So the matrix is never asked
+  // about 'BUG' or '__proto__' in production.
+  const src = read('modules/ideas/inbox.js');
+  assert.match(src, /const resolvedKind = kind \|\| classify\(/,
+    'an absent kind is auto-classified, never passed through as null');
+  assert.match(src, /VALID_KINDS\.includes\(resolvedKind\)/, 'and an unknown one is rejected');
+  assert.match(src, /BAD_KIND/, 'by a named refusal');
+});
+
+await test('[F5b] and if one DID reach the matrix, it soft-lands — belt to that braces', () => {
+  // decideLanding called directly: no helper default can stand in for the input.
+  // Only the exact string 'bug' hard-lands; every near-miss casing and shape is
+  // a soft landing, so a kind that slipped a future validator still cannot make
+  // claimable work.
+  for (const kind of [null, undefined, '', 'BUG', 'bug ', 'Bug', 'bugs', '__proto__', 0, {}]) {
+    const v = decideLanding({ goalId: 5, kind, grade: null, filerRank: 'archon' });
+    assert.equal(v.route, true, 'it still finds a home');
+    assert.equal(v.status, 'backlog', `kind ${JSON.stringify(kind)} must not hard-land`);
+  }
+  assert.equal(decideLanding({ goalId: 5, kind: 'bug', filerRank: 'archon' }).status, 'ready',
+    'only the exact kind hard-lands — otherwise this test would pass vacuously');
+});
+
+await test('[F6] a junk or absent RANK never reads as trusted (the fail-closed posture)', () => {
+  for (const rank of SUB_METIC) {
+    const r = landing({ kind: 'bug', filerRank: rank });
+    assert.equal(r.status, 'backlog', `rank ${JSON.stringify(rank)} must not hard-land a bug`);
+  }
+});
+
+await test('[F7] judgment kinds never route, so they cannot be laundered into work', () => {
+  for (const kind of ['criterion-proposal', 'decision']) {
+    for (const rank of [...SUB_METIC, ...TRUSTED]) {
+      const r = landing({ kind, filerRank: rank });
+      assert.equal(r.landed, false, `${kind} must stay in the inbox`);
+      assert.equal(r.reason, 'judgment_kind');
+    }
+  }
+});
+
+await test('[F8] a Full Idea never routes, even a bug-kinded one from an Archon', () => {
+  const r = landing({ kind: 'bug', filerRank: 'archon', grade: 'full' });
+  assert.equal(r.landed, false, "a Full Idea is the Board Room's subject, not its filer's task");
+  assert.equal(r.reason, 'full_idea_never_routes');
+});
+
+// =========================================================================
+// F9–F11 — MASS FILING through Discord #bugs
+// =========================================================================
+
+await test('[F9] the #bugs vector is capped per builder per rolling hour, and the cap is sane', () => {
+  const n = rateLimitPerHour({});
+  assert.ok(Number.isInteger(n) && n > 0, 'a real positive cap exists by default');
+  assert.ok(n <= 50, `the default cap bounds a flood (got ${n})`);
+  // A hostile env cannot uncap it with a non-number, a negative, or zero.
+  for (const bad of ['', 'lots', '-1', '0', 'Infinity', null, undefined, '1e999']) {
+    const got = rateLimitPerHour({ DISCORD_BUGS_RATE_PER_HOUR: bad });
+    assert.ok(Number.isInteger(got) && got > 0 && got <= 50,
+      `env ${JSON.stringify(bad)} must fall back to a finite cap, got ${got}`);
+  }
+});
+
+await test('[F10] a rate-limit COUNT failure DENIES — you cannot break the counter to slip the cap', () => {
+  // The behaviour is proven end-to-end in tests/discord_bugs.mjs; pinned here in
+  // source because "fail closed" is the property this matrix is about, and a
+  // future refactor that flips the catch to allow would pass every other test.
+  const src = read('modules/discord/discord-bugs.js');
+  assert.match(src, /fail-closed/i, 'the deny-on-count-error intent is stated');
+  assert.match(src, /rate_limit_count_error/,
+    'and audited under its own reason, so a broken counter is visible rather than silent');
+});
+
+await test('[F11] #bugs lands a sub-Metic at backlog and only Metic+ at ready', () => {
+  // Since R11 this is the SAME rule as F1/P1 — the channel has no landing logic of
+  // its own. Asserted through the matrix, which is now the only place it exists.
+  for (const rank of SUB_METIC) {
+    assert.equal(landing({ kind: 'bug', filerRank: rank }).status, 'backlog',
+      `${JSON.stringify(rank)} must not reach ready`);
+  }
+  for (const rank of TRUSTED) {
+    assert.equal(landing({ kind: 'bug', filerRank: rank }).status, 'ready',
+      `${rank} is the C1 straight-through grant`);
+  }
+});
+
+await test('[F9+F11] the flood, composed: at the cap, EVERY landed row is still backlog', () => {
+  const cap = rateLimitPerHour({});
+  const landedStatuses = [];
+  for (let i = 0; i < cap + 25; i++) {
+    if (i >= cap) continue; // the counter refuses past the cap (F9/F10)
+    landedStatuses.push(landing({ kind: 'bug', filerRank: 'xenos' }).status);
+  }
+  assert.equal(landedStatuses.length, cap, 'the cap bounds how many rows exist at all');
+  assert.ok(landedStatuses.every((s) => s === 'backlog'),
+    'and not one of them is claimable — a flood costs a Metic+ nothing but a queue to ignore');
+});
+
+// =========================================================================
+// F12 — the #ideas vector cannot route at all
+// =========================================================================
+
+await test('[F12] Discord #ideas never routes: it passes no goal, so every filing is an inbox row', () => {
+  const src = read('modules/discord/discord-inbound.js');
+  const call = src.slice(src.indexOf('deps.captureIdea({'));
+  assert.ok(call, 'the capture call is findable');
+  const body = call.slice(0, call.indexOf('});') + 3);
+  assert.ok(!/goalId/.test(body), 'no goalId is passed, so decideLanding returns no_goal');
+  assert.ok(!/filerRank/.test(body), 'and no rank, so it could not hard-land even if a goal appeared');
+  // Belt and braces: prove the decision, not just the absence.
+  assert.equal(decideLanding({ goalId: null, kind: 'bug', filerRank: 'archon' }).route, false,
+    'no goal ⇒ the inbox, which is the default path every goal-unaware vector keeps');
+});
+
+// =========================================================================
+// F13–F14 — the walls that are NOT the matrix's own
+// =========================================================================
+
+await test('[F13] a declared touches[] outside the goal is refused by the real scope wall, verbatim', () => {
+  // authorizeRoutedLanding passes the wall's verdict through unchanged — the same
+  // refusal an authored task gets, so there is only one definition of out-of-scope.
+  const refusal = { ok: false, code: 'out_of_scope', reason: 'nope', details: { offender: 'src/bongos/db.js' } };
+  const r = landing({ kind: 'bug', filerRank: 'archon', scopeCheck: refusal });
+  assert.equal(r.landed, false, 'even an Archon is bounded by the goal scope');
+  assert.equal(r.refused, 'out_of_scope');
+});
+
+await test('[F14] a goal on a non-building version cannot receive routed work (the 1000771 wall)', () => {
+  // Enforced inside the transaction, so pin it at its source: the locked read
+  // carries the version status and refuses anything but 'building'.
+  const src = read('modules/ideas/inbox.js');
+  assert.match(src, /VERSION_NOT_BUILDING/, 'the refusal exists and is named');
+  assert.match(src, /goal\.version_status !== 'building'/,
+    "and it admits ONLY a building version — 'shipped' is the tomb 1000771 was filed over");
+});
+
+// =========================================================================
+// P1–P2 — the grants, so the matrix is not vacuously "everything is refused"
+// =========================================================================
+
+await test('[P1] a Metic+ bug in an ordinary goal IS claimable immediately — criterion C1 still holds', () => {
+  const r = landing({ kind: 'bug', filerRank: 'metic' });
+  assert.equal(r.status, 'ready', 'the whole point of the goal: no triage stop for a trusted bug report');
+  assert.equal(r.requiresRank, null, 'and no floor is imposed — createTask derives it as for any vector');
+});
+
+await test('[P2] a Metic+ CAN file into protected scope, and the task is floored to metic', () => {
+  const r = landing({ kind: 'bug', filerRank: 'archon', scopeProtected: true });
+  assert.equal(r.landed, true);
+  assert.equal(r.requiresRank, PROTECTED_SCOPE_FLOOR, 'so no sub-Metic can claim it however it got there');
+});
+
+await test('priority cannot be weaponised: an out-of-band suggestion is clamped, never honoured', () => {
+  for (const p of [99, -5, 0, 6, 'urgent', null, Infinity, 1.5]) {
+    const got = routedPriority(p);
+    assert.ok(Number.isInteger(got) && got >= 1 && got <= 5, `priority ${JSON.stringify(p)} → ${got}`);
+  }
+  assert.equal(routedPriority(1), 1, 'a sane suggestion still rides through');
+});
+
+// =========================================================================
+// F15–F16 — the #bugs bypass is retired (task 1003067 / BV1.R11)
+// =========================================================================
+
+await test('[F15] #bugs mints NO task of its own — the bypass that lost attribution is gone', () => {
+  const src = read('modules/discord/discord-bugs.js');
+  const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.ok(!/\bdeps\.createTask\(/.test(code),
+    'the vector must file through ideas.capture, so every report leaves an idea row + lineage');
+  assert.match(code, /deps\.captureIdea\(/, 'and it does');
+});
+
+await test('[F15b] #bugs names NO version — a vector that cannot name one cannot name a dead one', () => {
+  const src = read('modules/discord/discord-bugs.js');
+  const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  // This is idea 1000771 in one assertion: the old default was 'GDS-V3', shipped,
+  // so every bug reported here landed in a closed version's catch-all.
+  assert.ok(!/GDS-V3|DEFAULT_BUGS_VERSION_ID|DISCORD_BUGS_VERSION_ID/.test(code),
+    'no version id may be hardcoded or env-configured on this path any more');
+  assert.ok(!/versionId:/.test(code), 'and none is passed into the capture');
+});
+
+await test('[F16] an unlinked #bugs author gets an inbox row and CANNOT reach work', () => {
+  // The report is kept (it used to be dropped), but with no rank and no goal, so
+  // the matrix has nothing to route: structurally incapable of becoming a task.
+  const noRank = decideLanding({ goalId: null, kind: 'bug', filerRank: null });
+  assert.equal(noRank.route, false, 'no goal ⇒ the inbox');
+  // And even if a goal somehow reached it, an unknown filer never hard-lands:
+  const withGoal = decideLanding({ goalId: 5, kind: 'bug', filerRank: null });
+  assert.equal(withGoal.status, 'backlog', 'never claimable on an unknown filer');
+  const src = read('modules/discord/discord-bugs.js');
+  const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.match(code, /if \(builder\) \{[\s\S]{0,200}suggestGoalForCapture/,
+    'a goal is only ever sought for a LINKED builder');
+});
+
+// =========================================================================
+// THE ANTI-DRIFT PIN — a fifth vector cannot arrive unaudited
+// =========================================================================
+
+// Every place a FILING becomes work, and the row above that covers it. Adding a
+// vector without adding it here is what this pin is for: the 1000771 bug got in
+// because #bugs was written as its own path and nobody re-read the matrix.
+const KNOWN_FILING_VECTORS = {
+  'modules/ideas/inbox.js': 'routeIdeaToGoal — the ONE transaction every routed filing runs (F1–F8, F13, F14)',
+  'modules/ideas/routes/inbox.js': 'POST /inbox — the web + CLI door onto it (F3)',
+  'modules/discord/discord-inbound.js': 'Discord #ideas — files an idea, never routes (F12)',
+  'modules/discord/discord-bugs.js': 'Discord #bugs — files through ideas.capture since R11 (F9–F11, F15, F16)',
+};
+
+await test('[pin] every declared vector still reaches a task-minting path', () => {
+  const found = Object.keys(KNOWN_FILING_VECTORS).filter((rel) => /captureIdea\(|createTask\(/.test(read(rel)));
+  assert.deepEqual(found.sort(), Object.keys(KNOWN_FILING_VECTORS).sort(),
+    'a vector that no longer files needs its row retired, not left as decoration');
+});
+
+await test('[pin] no OTHER module file mints a task from a filing without a row here', () => {
+  // Scan the two filing-facing modules for task-minting call sites. A new file
+  // that creates work from a report has to be classified here before it ships.
+  const { execFileSync } = require('node:child_process');
+  const tracked = execFileSync('git', ['ls-files', 'modules/ideas/*.js', 'modules/ideas/**/*.js', 'modules/discord/*.js', 'modules/discord/**/*.js'], { cwd: ROOT, encoding: 'utf8' })
+    .split('\n').map((l) => l.trim()).filter(Boolean);
+
+  const minters = tracked.filter((rel) => {
+    if (rel.includes('/tests/') || rel.endsWith('.mjs')) return false;
+    const src = read(rel);
+    // A minter CALLS a task-create; declaring/forwarding the dep is not minting.
+    return /(?:deps|lifecycle|db|api)\.createTask\(|resolve\('lifecycle'\)[\s\S]{0,80}createTask\(/.test(src);
+  });
+
+  const unaudited = minters.filter((rel) => !(rel in KNOWN_FILING_VECTORS));
+  assert.deepEqual(unaudited, [],
+    `a new filing vector must be added to KNOWN_FILING_VECTORS and given a matrix row: ${unaudited.join(', ')}`);
+});
+
+await test('[pin] there is ONE trusted-tier definition, and #bugs no longer keeps a copy', () => {
+  // This pin used to assert that two spellings of "Metic+" AGREED — routing.js and
+  // discord-bugs.js each carried one. R11 deleted the second, which is the better
+  // outcome: agreement you have to test for is a duplication you could have removed.
+  const routingSrc = read('modules/ideas/routing.js');
+  assert.match(routingSrc, /METIC_PLUS = new Set\(\['metic', 'archon'\]\)/,
+    'the one definition, in the matrix');
+  const bugsCode = read('modules/discord/discord-bugs.js')
+    .split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.ok(!/READY_RANKS/.test(bugsCode), '#bugs must not reintroduce a local rank set');
+  assert.ok(!/decideBugLanding/.test(bugsCode), 'nor a local landing decision');
+});
+
+summary();

package/tests/goal_suggest.mjs

@@ -24,7 +24,7 @@ import { makeRunner } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
-const { suggestGoals, goalSuggestHandler, SUGGEST_LIMIT } = require('../modules/lifecycle/goal-suggest.js');
+const { suggestGoals, suggestGoalForCapture, goalSuggestHandler, SUGGEST_LIMIT } = require('../modules/lifecycle/goal-suggest.js');
 const { test, summary } = makeRunner();
 
 const V = 'BONGOS-V1';
@@ -192,4 +192,110 @@ await test('the handler clamps limit into a sane range', async () => {
   }
 });
 
+// =========================================================================
+// suggestGoalForCapture — ONE goal, or none, for a filing with nobody to choose
+// (task 1003067 / BV1.R11). The HTTP suggester offers a human five options; a
+// Discord message has no human in the loop, so this collapses to a single
+// confident answer and declines whenever "confident" is not available.
+// =========================================================================
+
+const fakeDb = ({ versions = [], goals = [], throws = null, calls = null } = {}) => ({
+  listVersions: async () => { if (throws === 'versions') throw new Error('boom'); return versions; },
+  listGoals: async (args) => {
+    if (calls) calls.push(args);
+    if (throws === 'goals') throw new Error('boom');
+    return goals;
+  },
+});
+
+const BUILDING = { id: 'BONGOS-V1', status: 'building' };
+const SHIPPED = { id: 'GDS-V3', status: 'shipped' };
+const HALL_GOAL = { id: 81, title: 'Builders hall in the world', scope_modules: ['hall-ui'], version_id: 'BONGOS-V1' };
+const ECON_GOAL = { id: 78, title: 'Project money out', scope_modules: ['economy'], version_id: 'BONGOS-V1' };
+
+await test('suggestGoalForCapture: the one building version, and the goal the words match', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses on mobile', body: '' },
+    { db: fakeDb({ versions: [BUILDING, SHIPPED], goals: [ECON_GOAL, HALL_GOAL] }) }
+  );
+  assert.equal(got.id, 81, 'the hall goal, not the economy one');
+  assert.equal(got.version_id, 'BONGOS-V1', 'and the version comes from the version row, never a hardcode');
+  assert.ok(got.score > 0);
+});
+
+await test('suggestGoalForCapture: a SHIPPED version is never the home (idea 1000771)', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses', body: '' },
+    { db: fakeDb({ versions: [SHIPPED], goals: [HALL_GOAL] }) }
+  );
+  assert.equal(got, null, 'nothing is open to work, so there is no home — the filing goes to the inbox');
+});
+
+// This instance runs BONGOS-V1 and CB-V1 concurrently. An earlier cut declined
+// whenever more than one version was open, which would have returned null for
+// every report ever filed — a dead feature that looked like prudence. The goal
+// carries the version, so rank across all of them and let the winner say.
+await test('suggestGoalForCapture: TWO open versions ⇒ rank across BOTH, winner names its version', async () => {
+  const CB_GOAL = { id: 99, title: 'The front door', scope_modules: ['public-landing'], version_id: 'CB-V1' };
+  const got = await suggestGoalForCapture(
+    { title: 'the front door hero is broken', body: '' },
+    { db: fakeDb({ versions: [BUILDING, { id: 'CB-V1', status: 'building' }], goals: [HALL_GOAL, CB_GOAL] }) }
+  );
+  assert.equal(got.id, 99, 'the goal on the OTHER open version can win');
+  assert.equal(got.version_id, 'CB-V1', 'and it reports its own version, not the first one open');
+});
+
+await test('suggestGoalForCapture: a goal on a CLOSED version is never a home, even if it matches best', async () => {
+  const DEAD_GOAL = { id: 12, title: 'the hall sidebar and hall chrome', scope_modules: ['hall-ui'], version_id: 'GDS-V3' };
+  const got = await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses', body: '' },
+    { db: fakeDb({ versions: [BUILDING, SHIPPED], goals: [DEAD_GOAL, ECON_GOAL] }) }
+  );
+  assert.equal(got, null, 'the better-matching goal sits on a shipped version — idea 1000771 exactly');
+});
+
+await test('suggestGoalForCapture: asks for open goals across ALL versions, not one', async () => {
+  const calls = [];
+  await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses', body: '' },
+    { db: fakeDb({ versions: [BUILDING], goals: [HALL_GOAL], calls }) }
+  );
+  assert.equal(calls.length, 1, 'one query, not one per version');
+  assert.equal(calls[0].status, 'open');
+  assert.equal(calls[0].versionId, undefined, 'unscoped — the open-version filter is applied in JS');
+});
+
+await test('suggestGoalForCapture: no confident match ⇒ null, not the first goal dressed up', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'zzzz qqqq nothing matches this', body: '' },
+    { db: fakeDb({ versions: [BUILDING], goals: [HALL_GOAL, ECON_GOAL] }) }
+  );
+  assert.equal(got, null);
+});
+
+await test('suggestGoalForCapture: empty draft ⇒ null without touching the db', async () => {
+  let touched = false;
+  const db = { listVersions: async () => { touched = true; return [BUILDING]; }, listGoals: async () => [] };
+  assert.equal(await suggestGoalForCapture({ title: '   ', body: '' }, { db }), null);
+  assert.equal(touched, false, 'nothing to rank against ⇒ no query');
+});
+
+await test('suggestGoalForCapture: a db failure SHRUGS — it never throws at a bug report', async () => {
+  for (const throws of ['versions', 'goals']) {
+    const got = await suggestGoalForCapture(
+      { title: 'the hall sidebar collapses', body: '' },
+      { db: fakeDb({ versions: [BUILDING], goals: [HALL_GOAL], throws }) }
+    );
+    assert.equal(got, null, `a ${throws} failure degrades to "no home", never to a lost report`);
+  }
+});
+
+await test('suggestGoalForCapture: the catch-all is never offered as a home', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'general problem in BONGOS', body: '' },
+    { db: fakeDb({ versions: [BUILDING], goals: [{ id: 3, title: 'BONGOS-V1 — general', scope_modules: [], version_id: 'BONGOS-V1' }] }) }
+  );
+  assert.equal(got, null, 'a bucket is not a workspace — dropped for EVERY open version, not just one');
+});
+
 summary();