@bongos/core 1.19.454 → 1.19.455

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.454",
-  "core_contract": "1.19.454",
-  "source_commit": "4b419dfb5f2bb554648dbaaa7cf5e6c1eeb05f52",
+  "core_version": "1.19.455",
+  "core_contract": "1.19.455",
+  "source_commit": "73e271f9813d11dde6c2ceaca0eedeb4cf71ed4e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-01T20:23:17.614Z",
+  "built_at": "2026-09-01T21:02:15.357Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 371,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2185,
-  "tree_sha256": "9497797c979a0e4da67c6094cf2bd050cde6f532f00a8890f9dbe4c0a4065527",
+  "tree_sha256": "65ad277694ad3b8aed5a0a975bc77754be62f4e305062a558e5608dda4d49bbc",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -682,7 +682,7 @@
     {
       "path": "docs/adr/0047-discord-bugs-intake-anti-abuse.md",
       "mode": "0000644",
-      "sha256": "06eda1262e9b5f2b44b57d6ee97edd64ba9f12fcab7a7dea1e97a88ac41f9115"
+      "sha256": "013c11580a411d12691c1d79a60e54483faea08c056a71ebd953364e4eca4754"
     },
     {
       "path": "docs/adr/0048-works-in-progress-ia-split.md",
@@ -2092,7 +2092,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "1f9bf7b7d0d9e7c4ea7bc03285e12b1859443c4197dd241e3ee1aec331a32507"
+      "sha256": "4b48503d7e83ce2f3678aa1e17f57f859a3d659ac12438deb3ad9382acd2ea47"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3472,7 +3472,7 @@
     {
       "path": "modules/discord/db.js",
       "mode": "0000644",
-      "sha256": "8c7f64ab027fa52885e047d47b68c3f6ed2cba79f55aaf8303266973a5370cf8"
+      "sha256": "e265e853cf153a76e7b84f304e6f4338bd2bbfc2098383c358a0df7ac02a6817"
     },
     {
       "path": "modules/discord/discord-approvals.js",
@@ -3487,12 +3487,12 @@
     {
       "path": "modules/discord/discord-bot.js",
       "mode": "0000644",
-      "sha256": "7bdd8892cf1dcc7edddcc2e8f95d3174b7f902be83fd0a34ecfc2b7cc998ce55"
+      "sha256": "15d3bf047731fa50cca8bc3b06ef1c2b27e9b8a0067f3151a00974f99eb2ac3d"
     },
     {
       "path": "modules/discord/discord-bugs.js",
       "mode": "0000644",
-      "sha256": "6f2e61eb3a0722405ffce08aba52cc4569a6dc1c9da3897bb83f29f658d3b5d0"
+      "sha256": "083569e4fe2a621dc6c8663fafc5ec1d6f5e1e1893a3b4a9bdb74ecf4854cd24"
     },
     {
       "path": "modules/discord/discord-channels.js",
@@ -3527,7 +3527,7 @@
     {
       "path": "modules/discord/module.json",
       "mode": "0000644",
-      "sha256": "38d30f5a250d708cbbbee1c84a9a417d2a44d51dda1e6e4030f6b577d941491c"
+      "sha256": "6800aead0d24b615912d2711dbe90ef284e8a31579da7c8a8ce642de81274307"
     },
     {
       "path": "modules/discord/pollers/discord-bot.js",
@@ -4712,7 +4712,7 @@
     {
       "path": "modules/lifecycle/goal-suggest.js",
       "mode": "0000644",
-      "sha256": "5fac15e501d6e5639b9e14d08ab34723b60e3569af913f4d15bb703a4e126a77"
+      "sha256": "85117db645accd023f4f61735f9f22a8c5f6ef08a29c61db99fbade51d081147"
     },
     {
       "path": "modules/lifecycle/help-requests.js",
@@ -4737,7 +4737,7 @@
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
-      "sha256": "2d683f62f6813d7894dd54657a70b027cf686dfa76879541adc84544f03d4b51"
+      "sha256": "8631c6ce8a2d33631f9dc549a47102cdb8121484b98cb759151e10e2be9af4c5"
     },
     {
       "path": "modules/lifecycle/merge-lock.js",
@@ -6302,12 +6302,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3cf929a4fd6e48bffbaacc887e14004384e99789cf49751816cca91e5e12b31b"
+      "sha256": "f797395e1506e7142c1e0e200fce54996022fbe3547bcf44cab043b7da5cdc2c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "028b1cb8d72191904fc916ca6e4c4d3b819c4b0a6b3ebadb8274d9d94a0bfa2f"
+      "sha256": "977df81d28e616a4f9dafd80e10288b68712c590dbf87201ab959e52b9c6630a"
     },
     {
       "path": "public-docs/index.html",
@@ -7957,7 +7957,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "eb69000bc81b5e5947fbd10736783070e11c38d0cc63d15eea61fcccfdb37d67"
+      "sha256": "bb1314a41a5f8447e2251d885dd2983c6be5e7bbfee1043e1e2dbb26c67742f0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8757,7 +8757,7 @@
     {
       "path": "tests/discord_bugs.mjs",
       "mode": "0000644",
-      "sha256": "60fc6a8e44541337e80ffe5ced53801fa1e5245ce7e993e813afdbd59cc3985a"
+      "sha256": "488c68953274278e7569136705307f89f25d4bd4436839a699cbcef07d789730"
     },
     {
       "path": "tests/discord_channels.mjs",
@@ -8867,7 +8867,7 @@
     {
       "path": "tests/filing_abuse_matrix.mjs",
       "mode": "0000644",
-      "sha256": "3688a9615a05eb94de9905698c4ed9dd044e9b67ef234124c548cf9aeffa338f"
+      "sha256": "dd63216406ff8d76a6250944c03fb8e0f2028c599d01ee4720ba3dd79d547a63"
     },
     {
       "path": "tests/first_admin_bootstrap.mjs",
@@ -9052,7 +9052,7 @@
     {
       "path": "tests/goal_suggest.mjs",
       "mode": "0000644",
-      "sha256": "7fc1d81afc49311a3c8525b644319e4831bff295bef8be244220fea5ebfbbbd1"
+      "sha256": "d61e2bd5b5a65239f1410011a5035b124bf8e20c41eac08018635ec8cd3a49c7"
     },
     {
       "path": "tests/goal_tier.mjs",

package/docs/adr/0047-discord-bugs-intake-anti-abuse.md

@@ -32,5 +32,6 @@ Every filing is audited with `surface='discord_bot'` (`route='discord:bugs'`), s
 
 - **Config / go-live:** inert until `DISCORD_BUGS_CHANNEL_ID` (env, or `bugs_channel_id` in `~/.config/otb/discord-bot.json`) is set **and** the bot is enabled (`DISCORD_BOT_ENABLED=true`) with the Message Content intent — exactly like `#ideas`. The channel itself is created/edited by the ADR 0037 channel reconciler from `channels.json`.
 - **Version:** filed bugs default to `DISCORD_BUGS_VERSION_ID` (default `GDS-V3`, the open internal version, since most builder-filed bugs are about the dev system). An Archon can re-home a game bug to a product version. Reward defaults to `DISCORD_BUGS_CREDITS` (10).
+  - **SUPERSEDED by task 1003067 (BV1.R11, goal 1000071).** `GDS-V3` shipped, and this default kept filing live bug reports into a closed version's catch-all goal — the failure idea 1000771 was raised over. Both env knobs are gone: #bugs now files through the ideas capture-time routing path, so the version comes from the goal the report routes into and the reward auto-assigns at the create layer (ADR 0096). Guard 1 below (linked-builder-only) is also superseded — see `modules/discord/discord-bugs.js` for the guard set as it now stands.
 - **Trust boundary intact (ADR 0016):** the bot asserts only *who* posted; the landing state is derived from the live GDS rank, never trusted from the message. The bot grants nothing.
 - **Deferred:** a dedicated abuse-flag widget on the `/watch` red-team view. The audit trail (`surface='discord_bot'`, the 429 rejections) already makes abuse queryable; a bespoke view is a follow-up if volume warrants it.

package/docs/module-api-changelog.md

@@ -1345,5 +1345,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.452 with no explicit bump. run 33553290345. (task 1002620)
   1.19.454 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.453 with no explicit bump. run 33554965618. (task 1002620)
+  1.19.455 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.454 with no explicit bump. run 33558738299. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/discord/db.js

@@ -143,9 +143,6 @@ module.exports = {
   markBoardMessageEdited,
   // kernel db helpers, re-exported off the doorway (one `db.*` namespace)
   insertAuditLog: (...a) => api.insertAuditLog(...a),
-  // createTask is a LIFECYCLE write — resolve the `lifecycle` kernel port at call
-  // time (the doorway leak retired at BV1.R86); used by discord-bugs (#bugs → task).
-  createTask: (...a) => api.resolveOptional('lifecycle').createTask(...a),
   getBuilderById: (...a) => api.getBuilderById(...a),
   get LIVE_RANK_LADDER() { return api.LIVE_RANK_LADDER; },
   // the shared pool, for any module file that wants it via db.pool

package/modules/discord/discord-bot.js

@@ -348,7 +348,14 @@ async function start() {
     // real filing path (recordInboundBug). Built once at startup.
     const bugAggregator = bugs.createBugAggregator({
       onFlush: (combined) => bugs.recordInboundBug(combined).then((result) => {
-        log.info(`[discord-bot] #bugs burst → ${result.outcome}${result.taskId ? ` (task #${result.taskId}, ${result.status}, ${result.images || 0} img)` : (result.reason ? ` (${result.reason})` : '')}`);
+        // task 1003067: a filing now always yields an IDEA; whether it also became
+        // a task depends on the landing matrix. Log both, so a homeless report is
+        // traceable instead of showing as a bare "filed" with no id to chase.
+        log.info(`[discord-bot] #bugs burst → ${result.outcome}${
+          result.ideaId
+            ? ` (idea ${result.ideaId}${result.taskId ? `, task ${result.taskId}, ${result.status}` : ', inbox'}, ${result.images || 0} img)`
+            : (result.reason ? ` (${result.reason})` : '')
+        }`);
         return result;
       }),
     });

package/modules/discord/discord-bugs.js

@@ -1,28 +1,45 @@
 'use strict';
 
-// Discord #bugs → GDS tasks (kind='bug') — Phase 3 F8 (ADR 0033 §F8, ADR 0047).
+// Discord #bugs → a routed filing — Phase 3 F8 (ADR 0033 §F8, ADR 0047),
+// retired onto the capture-time routing path by task 1003067 (BV1.R11).
 //
-// The bot turns a message posted in the designated #bugs channel into a GDS
-// task with kind='bug', STRAIGHT THROUGH — no idea_inbox, no triage step. This
-// is the deliberate difference from #ideas (discord-inbound.js): a bug is a
-// small fix a builder wants to drop without context-switching, and it becomes
-// claimable work directly.
+// WHAT CHANGED AND WHY. This path used to call createTask DIRECTLY, against a
+// hardcoded version id. Two things followed from that, and both were bugs:
 //
-// ANTI-ABUSE GUARD (ADR 0047 — the red-team resolution). Creating claimable
-// work with no triage gate is an injection surface, so this path is guarded in
-// depth, all server-side, all fail-closed:
-//   1. LINKED-BUILDER-ONLY. An unlinked Discord author cannot create a task —
-//      their message is ignored (not filed). Unlike #ideas (which captures
-//      unattributed), making *claimable work* requires being an accountable,
-//      known builder. This is the single biggest lever.
-//   2. RANK-AWARE LANDING. A linked Metic+ builder's bug lands 'ready'
-//      (instantly claimable — the true straight-through path their trust earns).
-//      A linked Xenos/Thetes builder's bug lands 'backlog' (needs a one-click
-//      Metic+ promote, like any other backlog task). Mirrors the trust ladder
-//      used everywhere else in the GDS.
-//   3. PER-BUILDER RATE-LIMIT. At most N bug-tasks per builder per rolling hour
-//      (counted from audit_log). Over-limit filings are ignored AND audited so
-//      a spammer surfaces in forensics / the red-team view.
+//   * The hardcoded id was GDS-V3, a SHIPPED version. Every bug reported through
+//     Discord resolved into that version's catch-all goal — a bucket nobody ever
+//     opens again. That is idea 1000771, the report goal 1000071 was filed over.
+//   * Creating the task directly meant NO idea row and NO lineage, so the person
+//     who reported the bug vanished from the record the moment it became work.
+//     The ideator credit lane (goal 1000067) pays against that lineage, so this
+//     vector was quietly minting unattributable work.
+//
+// Now the message becomes a CAPTURE (ideas.capture, the same port #ideas uses)
+// with a suggested goal, and the ideas module's landing matrix decides the rest.
+// The version is no longer named here at all: the goal carries it, and lifecycle
+// resolves which version is open to work (suggestGoalForCapture). A vector that
+// does not know a version id cannot hardcode a dead one.
+//
+// ANTI-ABUSE GUARD (ADR 0047 — the red-team resolution), as it stands now:
+//   1. AN UNLINKED AUTHOR CANNOT CREATE WORK. The original lever was
+//      linked-builder-ONLY: an unlinked message was dropped entirely, because
+//      this path minted claimable work with no triage gate. It no longer mints
+//      anything — an unlinked author's report becomes an idea_inbox row with
+//      captured_by NULL and NO goal, which is precisely what #ideas has always
+//      done for the same person. The security property ADR 0047 actually bought
+//      ("an unlinked author cannot inject claimable work") is intact and now
+//      structural; what is gone is the silent drop of a real bug report, which
+//      only ever protected us from reading it.
+//   2. RANK-AWARE LANDING, now the ideas landing matrix rather than a local
+//      copy of it: a linked Metic+ builder's bug lands 'ready', a linked
+//      sub-Metic builder's lands 'backlog' awaiting a nod. Same outcomes as
+//      before, one definition instead of two (pinned in
+//      tests/filing_abuse_matrix.mjs).
+//   3. PER-BUILDER RATE-LIMIT. At most N filings per LINKED builder per rolling
+//      hour (counted from audit_log). Over-limit filings are ignored AND audited
+//      so a spammer surfaces in forensics / the red-team view. An unlinked author
+//      has no builder id to count against, so they are held to the #ideas posture
+//      — an inbox row, never a task — rather than a cap this table cannot express.
 //   4. BODY SCREEN. Empty / too-short / text-free messages are ignored before
 //      any DB write; title + body are capped to the GDS limits.
 //
@@ -40,11 +57,15 @@ const { auditDiscordBot } = require('./discord-audit');
 const auth = require('./auth');
 const attachments = require('./bug-attachments');
 const { combineParts, createMessageAggregator } = require('./discord-message-buffer');
-const { LIMITS } = require('../../src/module-api');
+const api = require('../../src/module-api');
+const { LIMITS } = api;
+const log = api.logger('discord');
 
-// Ranks whose bugs land 'ready' (instantly claimable). Everyone else linked
-// lands 'backlog'. Metic+ — matches REQUIRES_RANK_TIER >= metic in db.js.
-const READY_RANKS = new Set(['metic', 'archon']);
+// NO LOCAL RANK RULE LIVES HERE (task 1003067). READY_RANKS + decideBugLanding
+// used to decide ready-vs-backlog for this channel alone. The ideas landing matrix
+// (modules/ideas/routing.js) now decides it for EVERY filing vector, so a second
+// copy here could only ever drift from it — which is what
+// tests/filing_abuse_matrix.mjs exists to prevent.
 
 // Smallest message we'll treat as a real bug report. Anything shorter is noise.
 const MIN_BUG_CHARS = 8;
@@ -53,13 +74,11 @@ const MIN_BUG_CHARS = 8;
 // DISCORD_BUGS_RATE_PER_HOUR overrides (a number); falls back to this.
 const DEFAULT_RATE_PER_HOUR = 5;
 
-// Default GDS version a filed bug is filed under. Most builder-filed bugs are
-// about the dev system; an Archon can re-home a game bug to a product version.
-// Env DISCORD_BUGS_VERSION_ID overrides.
-const DEFAULT_BUGS_VERSION_ID = 'GDS-V3';
-
-// Modest reward for fixing a drive-by bug. Env DISCORD_BUGS_CREDITS overrides.
-const DEFAULT_BUGS_CREDITS = 10;
+// NO DEFAULT VERSION LIVES HERE ANY MORE (task 1003067). DEFAULT_BUGS_VERSION_ID
+// used to be 'GDS-V3' and DISCORD_BUGS_CREDITS set a per-task reward. The version
+// is now carried by the goal the filing routes into — a vector that cannot name a
+// version cannot name a dead one, which is idea 1000771 in one sentence — and the
+// reward auto-assigns at the lowest create layer like every other vector (ADR 0096).
 
 // Auto-pairing window: consecutive #bugs messages from the SAME author within
 // this window are combined into ONE bug-task (so "screenshot" + "here's what
@@ -75,27 +94,11 @@ function rateLimitPerHour(env = process.env) {
   return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_RATE_PER_HOUR;
 }
 
-function bugsVersionId(env = process.env) {
-  return env.DISCORD_BUGS_VERSION_ID || DEFAULT_BUGS_VERSION_ID;
-}
-
-function bugsCredits(env = process.env) {
-  const n = Number(env.DISCORD_BUGS_CREDITS);
-  return Number.isFinite(n) && n >= 0 ? Math.floor(n) : DEFAULT_BUGS_CREDITS;
-}
-
 function pairWindowMs(env = process.env) {
   const n = Number(env.DISCORD_BUGS_PAIR_WINDOW_MS);
   return Number.isFinite(n) && n > 0 ? Math.floor(n) : DEFAULT_PAIR_WINDOW_MS;
 }
 
-// PURE — decide where a bug lands from the reporter's LIVE rank. Metic+ →
-// 'ready' (straight-through, claimable now); any other linked rank → 'backlog'
-// (a Metic+ promotes it, the lightweight confirm gate). Unit-tested.
-function decideBugLanding(rank) {
-  return READY_RANKS.has(String(rank || '').toLowerCase()) ? 'ready' : 'backlog';
-}
-
 // PURE — screen + shape a raw message into { ok, title, bodyMd } or
 // { ok:false, reason }. The body screen rejects blank / too-short / text-free
 // (no letters) messages before any DB write — UNLESS the message carries
@@ -127,7 +130,18 @@ function screenBug(content, { hasImages = false } = {}) {
 const realDeps = {
   getBuilderByDiscordUserId: db.getBuilderByDiscordUserId,
   countRecentDiscordBugFilings: db.countRecentDiscordBugFilings,
-  createTask: db.createTask,
+  // The two kernel ports this vector files through (never an import — the one-way
+  // module rule, ADR 0083/0093). `ideas.capture` is the same door #ideas uses;
+  // `lifecycle` answers which goal, on which still-open version.
+  captureIdea: (...a) => api.resolve('ideas.capture')(...a),
+  // resolveOptional, not resolve: an instance running without the lifecycle module
+  // has no goals to suggest, and that is a reason to file the report WITHOUT a
+  // home — never a reason to lose it. Returns null, which lands it in the inbox.
+  suggestGoalForCapture: async (...a) => {
+    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
+    if (!lifecycle || !lifecycle.suggestGoalForCapture) return null;
+    return lifecycle.suggestGoalForCapture(...a);
+  },
   insertAuditLog: db.insertAuditLog,
   persistImages: attachments.persistImages,
 };
@@ -144,14 +158,13 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
   if (!screened.ok) return { outcome: 'ignored', reason: screened.reason };
 
   const limit = config.rateLimitPerHour ?? rateLimitPerHour();
-  const versionId = config.versionId ?? bugsVersionId();
-  const credits = config.credits ?? bugsCredits();
 
   try {
-    // (1) LINKED-BUILDER-ONLY. No linked builder → reject (do not file). An
-    // unlinked author cannot inject claimable work.
+    // (1) WHO POSTED. A linked builder files with their rank and is rate-limited;
+    // an unlinked author still gets their report recorded, but only ever as an
+    // inbox row (no goal, no rank ⇒ the matrix cannot route it into work). See
+    // the guard note in the header for why this replaced the outright drop.
     const builder = await deps.getBuilderByDiscordUserId(discordUserId);
-    if (!builder) return { outcome: 'ignored', reason: 'unlinked' };
 
     // (3) PER-BUILDER RATE-LIMIT. Count this builder's bug filings in the last
     // hour; over the cap → reject AND audit (so a spammer is visible in
@@ -160,7 +173,7 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
     let recent = 0;
     let countFailed = false;
     try {
-      recent = await deps.countRecentDiscordBugFilings(builder.id, sinceIso);
+      if (builder) recent = await deps.countRecentDiscordBugFilings(builder.id, sinceIso);
     } catch (e) {
       // L4 (red-team 2026-06-12): FAIL CLOSED on a count error. The old behaviour
       // proceeded ("fail-open"), which let a DB error be used to slip past the
@@ -170,7 +183,7 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
       console.error('[discord-bot] bug rate-limit count failed (denying — fail-closed):', e.message);
       countFailed = true;
     }
-    if (countFailed || recent >= limit) {
+    if (builder && (countFailed || recent >= limit)) {
       const reason = countFailed ? 'rate_limit_count_error' : 'rate_limited';
       await auditDiscordBot(deps, {
         builderId: builder.id,
@@ -182,8 +195,11 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
       return { outcome: 'ignored', reason, recent };
     }
 
-    // (2) RANK-AWARE LANDING — decided from the LIVE rank, never the message.
-    const status = decideBugLanding(builder.rank);
+    // (2) RANK-AWARE LANDING is no longer decided here. The rank still comes from
+    // the LIVE builder row and never from the message — it is simply handed to the
+    // ideas landing matrix, which owns the ready-vs-backlog split for every filing
+    // vector. One definition, so this channel cannot drift from the others.
+    const filerRank = builder ? builder.rank : null;
 
     // Re-host any images on our server (durable — Discord CDN links expire). The
     // guard (host allowlist + content-type + magic-byte sniff + size/count caps)
@@ -201,7 +217,9 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
     // Provenance footer so a claimer knows where the bug came from + who to ask.
     // The raw Discord snowflake is NOT embedded (it lives in the Archon-only
     // audit_log); only the builder login. Then the durable attachment links.
-    const origin = `\n\n— reported from Discord #bugs by ${builder.github_login}`;
+    const origin = builder
+      ? `\n\n— reported from Discord #bugs by ${builder.github_login}`
+      : '\n\n— reported from Discord #bugs (unlinked author)';
     let description = `${screened.bodyMd}${origin}`;
     if (stored.length > 0) {
       const imgs = stored.map((s, i) => `![attachment ${i + 1}](${s.url})`).join('\n');
@@ -209,27 +227,71 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
     }
     description = description.slice(0, LIMITS.DESCRIPTION);
 
-    const task = await deps.createTask({
-      versionId,
+    // THE HOME. Only a linked builder's report is offered one: an unlinked author
+    // stays strictly less privileged than any signed-in builder (the #ideas rule),
+    // and with no goal the matrix files them to the inbox, which is the point.
+    // A null suggestion is the ordinary case and lands in the inbox too.
+    let goal = null;
+    if (builder) {
+      goal = await deps.suggestGoalForCapture({ title: screened.title, body: screened.bodyMd });
+    }
+
+    // The capture. One transaction inside the ideas module writes the idea row,
+    // the task (when the matrix routes it) and the lineage that keeps the reporter
+    // attached to the work — the whole reason this vector stopped calling
+    // createTask. kind is forced to 'bug' because the channel IS the classification.
+    const capture = {
       title: screened.title,
-      description,
-      status,
+      bodyMd: description,
       kind: 'bug',
-      priority: 3,
-      creditsReward: credits,
-      source: 'discord:bugs',
-      sourceRef: `discord:${messageId}`,
-    });
+      capturedBy: builder ? builder.id : null,
+      filerRank,
+      goalId: goal ? goal.id : null,
+      suggestedPriority: 3,
+    };
+
+    // THE HOME IS A SUGGESTION, NOT A CONDITION OF BEING HEARD. routeIdeaToGoal is
+    // ONE transaction, so a goal that refuses the landing — protected scope, a
+    // scope-wall verdict, a goal archived mid-flight — rolls the idea row back too
+    // and the report is gone. That is the exact failure this task exists to end, and
+    // it would be caused by a goal WE guessed at, not by anything the reporter did.
+    // So a refusal drops the guess and files the report homeless: it lands in the
+    // inbox for triage, which is strictly what would have happened before we tried.
+    let idea;
+    try {
+      idea = await deps.captureIdea(capture);
+    } catch (routeErr) {
+      if (!capture.goalId) throw routeErr; // nothing to drop — a real failure
+      log.warn({ err: routeErr && (routeErr.code || routeErr.message), goalId: capture.goalId },
+        'routed capture refused — filing the report to the inbox instead');
+      idea = await deps.captureIdea({ ...capture, goalId: null });
+    }
 
+    const routed = idea && idea.routing && idea.routing.routed ? idea.routing : null;
     await auditDiscordBot(deps, {
-      builderId: builder.id,
+      builderId: builder ? builder.id : null,
       route: 'discord:bugs',
-      requestBodyRedacted: { discord_user_id: discordUserId, message_id: messageId, task_id: task.id, status, images: stored.length },
+      requestBodyRedacted: {
+        discord_user_id: discordUserId,
+        message_id: messageId,
+        idea_id: idea.id,
+        task_id: routed ? routed.task_id : null,
+        goal_id: routed ? routed.goal_id : null,
+        status: routed ? routed.status : null,
+        images: stored.length,
+      },
       responseStatus: 201,
       logLabel: 'bug audit-log write failed',
     });
 
-    return { outcome: 'filed', taskId: task.id, status, builderId: builder.id, images: stored.length };
+    return {
+      outcome: 'filed',
+      ideaId: idea.id,
+      taskId: routed ? routed.task_id : null,
+      status: routed ? routed.status : null,
+      builderId: builder ? builder.id : null,
+      images: stored.length,
+    };
   } catch (err) {
     console.error('[discord-bot] recordInboundBug failed:', err.message);
     return { outcome: 'error', error: err.message };
@@ -245,13 +307,10 @@ function createBugAggregator({ onFlush, windowMs = pairWindowMs(), timers = glob
 
 module.exports = {
   screenBug,
-  decideBugLanding,
   recordInboundBug,
   combineParts,
   createBugAggregator,
   realDeps,
   rateLimitPerHour,
-  bugsVersionId,
-  bugsCredits,
   pairWindowMs,
 };

package/modules/discord/module.json

@@ -12,6 +12,6 @@
     "uiSections": []
   },
   "provides": ["discord.isLinked"],
-  "consumes": ["ideas.capture", "government"],
+  "consumes": ["ideas.capture", "government", "lifecycle"],
   "dependencies": { "discord.js": "^14.26.4" }
 }

package/modules/lifecycle/goal-suggest.js

@@ -26,10 +26,14 @@
 // really does belong with a goal scoped to `hall-ui`.
 
 const { tokenize } = require('./criterion-suggest.js');
-const { candidateGoals } = require('./goal-advisory.js');
+const { versionAcceptsNewWork } = require('./db-tasks.js');
+const { candidateGoals, generalGoalTitle } = require('./goal-advisory.js');
 const api = require('../../src/module-api');
 // Through the published logger seam, not a raw console call (est-advisory.js precedent).
 const proseErr = (err) => api.logger('lifecycle').error({ err: err && err.message }, 'GET /goals/suggestions failed');
+// The capture-time twin has its own message: it is not an HTTP route, and a log
+// line that names the wrong caller is a wrong turn taken during an incident.
+const captureErr = (err) => api.logger('lifecycle').error({ err: err && err.message }, 'suggestGoalForCapture failed — filing without a goal');
 
 // Matches suggestCriteria's default so the two suggesters feel the same.
 const SUGGEST_LIMIT = 5;
@@ -82,6 +86,70 @@ function suggestGoals(goals, draft = {}, opts = {}) {
 }
 
 
+// suggestGoalForCapture — ONE goal for a filing that arrived with no goal named
+// (task 1003067 / BV1.R11). The HTTP suggester above hands a human five options to
+// choose from; a Discord message has nobody to choose, so this collapses the same
+// ranking to a single confident answer or none at all.
+//
+// WHY IT RESOLVES THE VERSION ITSELF. The vector this was built for — Discord
+// #bugs — used to carry a hardcoded version id, and because that id was a SHIPPED
+// version every bug reported through it landed in a tomb nobody reads (idea
+// 1000771, the failure goal 1000071 exists to fix). A filing vector should not be
+// in the business of naming a version at all, so it does not: the GOAL carries the
+// version, and this picks the goal.
+//
+// It therefore ranks across EVERY version still open to work (versionAcceptsNewWork,
+// task 1003061), not one. An earlier cut of this declined whenever more than one
+// version was open — prudent-looking, and a dead feature: this instance runs two
+// building versions concurrently, so it would have returned null for every report
+// ever filed. "Which version" is not a question worth asking when the answer is
+// already attached to the goal that won.
+//
+// Catch-all goals are excluded for every one of those versions. candidateGoals
+// drops the catch-all for ONE version id, which is the wrong shape here, so the
+// filtering happens up front — a "<version> — general" bucket is never a home
+// (that is R03's fallback question, a different one).
+//
+// Returns { id, title, version_id, score } or NULL. Null is the ordinary case and
+// a good one: no goal means the filing lands in the inbox, exactly as every
+// goal-unaware capture always has. Never throws — a suggester that takes down a
+// bug report is worse than one that shrugs.
+async function suggestGoalForCapture({ title = '', body = '' } = {}, deps = {}) {
+  const db = deps.db || require('./db.js');
+  try {
+    if (!String(title || '').trim() && !String(body || '').trim()) return null;
+
+    // Independent reads — issued together rather than in sequence.
+    const [versions, allGoals] = await Promise.all([db.listVersions(), db.listGoals({ status: 'open' })]);
+    const openIds = new Set(
+      (versions || []).filter((v) => versionAcceptsNewWork(v && v.status)).map((v) => String(v.id))
+    );
+    // Nothing is being built ⇒ nowhere for new work to go ⇒ the inbox.
+    if (openIds.size === 0) return null;
+
+    const goals = allGoals || [];
+    const homes = goals.filter((g) => g
+      && openIds.has(String(g.version_id))
+      && g.title !== generalGoalTitle(g.version_id));
+    if (homes.length === 0) return null;
+
+    // versionId is passed null: the catch-alls are already gone, and passing one
+    // version's id here would only re-filter for that version. includeZero stays
+    // false, so a filing that matches nothing gets NO goal rather than the
+    // first one dressed up as a suggestion.
+    const [best] = suggestGoals(homes, { title, body }, { versionId: null, limit: 1 });
+    if (!best) return null;
+
+    // suggestGoals normalises to { id, title, scope_modules, … } and drops
+    // version_id, so read it back off the row that won.
+    const row = homes.find((g) => String(g.id) === String(best.id));
+    return { id: best.id, title: best.title, version_id: row ? row.version_id : null, score: best.score };
+  } catch (err) {
+    captureErr(err);
+    return null;
+  }
+}
+
 // goalSuggestHandler — GET /goals/suggestions. Handler lives here, not inline in
 // routes/goals.js, because that file is over the fitness oversize threshold and
 // the ratchet is shrink-only; collaborators are injected so this module still
@@ -168,4 +236,4 @@ function criteriaSuggestHandler({ db, suggestCriteria, parseId }) {
   };
 }
 
-module.exports = { suggestGoals, goalSuggestHandler, criteriaSuggestHandler, SUGGEST_LIMIT };
+module.exports = { suggestGoals, suggestGoalForCapture, goalSuggestHandler, criteriaSuggestHandler, SUGGEST_LIMIT };

package/modules/lifecycle/lifecycle.js

@@ -18,6 +18,7 @@
 
 const db = require('./db');
 const classifier = require('./task-classifier');
+const goalSuggest = require('./goal-suggest');
 const helpRequests = require('./help-requests');
 const taskRecommendations = require('./task-recommendations');
 const activity = require('./activity');
@@ -35,6 +36,12 @@ module.exports = {
   // (consumer: core cascade-dispatch.js, the dormant System-3 lib).
   get VOTABLE_TASK_STATUSES() { return classifier.VOTABLE_TASK_STATUSES; },
   classifyTaskKind: (...a) => classifier.classifyTaskKind(...a),
+  // suggestGoalForCapture: ONE goal for a filing that named none, or null (task
+  // 1003067). Consumer: the discord #bugs vector, which files through the ideas
+  // routing path and needs a home to offer it. Lives behind the port because
+  // "which goal, on which version" is a lifecycle judgement and discord may not
+  // import lifecycle (the one-way module rule).
+  suggestGoalForCapture: (...a) => goalSuggest.suggestGoalForCapture(...a),
 
   // --- work-tracking READS the staying-core read routes resolve --------------
   // public.js (the status surface): version/ship feed + grade trend.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.454",
+  "version": "1.19.455",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.454",
+      "version": "1.19.455",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.454",
+  "version": "1.19.455",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.454'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.455'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/discord_bugs.mjs

@@ -3,7 +3,8 @@
 // Unit tests for Discord #bugs → GDS tasks (kind='bug') (Phase 3 F8, ADR 0047).
 // Pure screening/landing + orchestration via injected fakes — no Discord, no DB:
 //   - screenBug: message → { ok, title, bodyMd }; blank/short/text-free rejected.
-//   - decideBugLanding: Metic+ → 'ready'; everyone else linked → 'backlog'.
+//   - the landing: Metic+ → 'ready'; everyone else linked → 'backlog'. Decided by
+//     the ideas landing matrix since task 1003067, not by this module.
 //   - recordInboundBug: files via createTask under the anti-abuse guard —
 //     linked-only (unlinked rejected), rank-aware landing, per-builder
 //     rate-limit, body screen; audits surface='discord_bot'; never throws.
@@ -23,7 +24,9 @@ function t(name, fn) {
 }
 
 const GOOD_ID = '123456789012345678';
-const CFG = { rateLimitPerHour: 5, versionId: 'GDS-V3', credits: 10 };
+// task 1003067: versionId and credits are gone from this vector's config — the
+// goal carries the version and the reward auto-assigns at the create layer.
+const CFG = { rateLimitPerHour: 5 };
 
 console.log('Discord #bugs → GDS tasks (Phase 3 F8):');
 
@@ -51,21 +54,16 @@ await t('screenBug: long first line is capped (≤200, ellipsis)', () => {
   assert.ok(s.title.endsWith('…'));
 });
 
-// ---- decideBugLanding ------------------------------------------------------
-await t('decideBugLanding: Metic+ → ready', () => {
-  assert.equal(bg.decideBugLanding('metic'), 'ready');
-  assert.equal(bg.decideBugLanding('archon'), 'ready');
-  assert.equal(bg.decideBugLanding('ARCHON'), 'ready');
-});
-await t('decideBugLanding: Xenos/Thetes/unknown → backlog', () => {
-  for (const r of ['xenos', 'thetes', 'periokoi', '', null, undefined]) {
-    assert.equal(bg.decideBugLanding(r), 'backlog');
-  }
-});
 
 // ---- recordInboundBug (fakes) ---------------------------------------------
+// The fake capture mirrors the real landing rule rather than hardcoding a status,
+// so a matrix change shows up here as a failure instead of a stale fixture.
+// task 1003067: the fake defers to the REAL landing matrix, so this fixture can
+// never quietly disagree with the rule the server actually applies.
+const { decideLanding } = require('../modules/ideas/routing.js');
+const READY_OR_BACKLOG = (rank) => (rank == null ? null : decideLanding({ goalId: 7, kind: 'bug', filerRank: rank }).status);
 function makeDeps(over = {}) {
-  const calls = { create: [], audit: [], count: [], persist: [] };
+  const calls = { create: [], audit: [], count: [], persist: [], suggest: [] };
   const deps = {
     getBuilderByDiscordUserId: async () => (over.builder === undefined ? null : over.builder),
     countRecentDiscordBugFilings: async (id, since) => {
@@ -73,7 +71,29 @@ function makeDeps(over = {}) {
       if (over.countThrows) throw new Error('count boom');
       return over.recent ?? 0;
     },
-    createTask: async (a) => { calls.create.push(a); if (over.createThrows) throw new Error('db boom'); return { id: over.taskId ?? 555 }; },
+    // task 1003067: the vector files through ideas.capture now. `calls.create`
+    // keeps its name — it is still "what this vector asked to be created" — but
+    // the argument shape is a CAPTURE, and the landing status comes back from the
+    // matrix rather than being posted in.
+    suggestGoalForCapture: async (draft) => {
+      calls.suggest.push(draft);
+      if (over.suggestThrows) throw new Error('suggest boom');
+      return over.goal === undefined ? { id: 7, title: 'A goal', version_id: 'BONGOS-V1', score: 4 } : over.goal;
+    },
+    captureIdea: async (a) => {
+      calls.create.push(a);
+      if (over.createThrows) throw new Error('db boom');
+      // routeIdeaToGoal refuses a landing by THROWING, which rolls the idea row
+      // back with it — the case the goal-dropping retry exists for.
+      if (over.refuseRouted && a.goalId != null) throw { code: 'ROUTE_NOT_AUTHORIZED', gate: 'protected_scope' };
+      const routes = a.goalId != null && READY_OR_BACKLOG(a.filerRank) !== null;
+      return {
+        id: over.ideaId ?? 900,
+        routing: routes
+          ? { routed: true, task_id: over.taskId ?? 555, goal_id: a.goalId, status: READY_OR_BACKLOG(a.filerRank) }
+          : { routed: false, reason: 'no_goal' },
+      };
+    },
     insertAuditLog: async (a) => { calls.audit.push(a); if (over.auditThrows) throw new Error('audit boom'); return { id: 1 }; },
     persistImages: async (urls, opts) => {
       calls.persist.push({ urls, opts });
@@ -90,13 +110,16 @@ await t('recordInboundBug: linked Metic → filed at ready, kind=bug, attributed
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'Boats vanish at the dock', messageId: 'm1' }, deps, CFG);
   assert.equal(r.outcome, 'filed');
   assert.equal(r.taskId, 555);
+  assert.equal(r.ideaId, 900, 'the idea row is the attribution the old path threw away');
   assert.equal(r.status, 'ready');
-  assert.equal(calls.create[0].kind, 'bug');
-  assert.equal(calls.create[0].status, 'ready');
-  assert.equal(calls.create[0].source, 'discord:bugs');
-  assert.equal(calls.create[0].sourceRef, 'discord:m1');
-  assert.equal(calls.create[0].versionId, 'GDS-V3');
-  assert.match(calls.create[0].description, /reported from Discord #bugs by mona/);
+  assert.equal(calls.create[0].kind, 'bug', 'the channel IS the classification');
+  assert.equal(calls.create[0].filerRank, 'metic', 'the LIVE rank is handed to the matrix');
+  assert.equal(calls.create[0].capturedBy, 9, 'and the reporter is attached to the capture');
+  assert.equal(calls.create[0].goalId, 7, 'the suggester found it a home');
+  // task 1003067: no versionId is passed AT ALL. It used to be the hardcoded
+  // 'GDS-V3' — a shipped version, which is idea 1000771. The goal carries it now.
+  assert.equal(calls.create[0].versionId, undefined, 'this vector no longer names a version');
+  assert.match(calls.create[0].bodyMd, /reported from Discord #bugs by mona/);
   assert.equal(calls.audit[0].surface, 'discord_bot');
   assert.equal(calls.audit[0].responseStatus, 201);
   assert.equal(calls.audit[0].builderId, 9);
@@ -106,18 +129,74 @@ await t('recordInboundBug: linked Xenos → filed at backlog (needs confirm)', a
   const { deps, calls } = makeDeps({ builder: { id: 4, github_login: 'newbie', rank: 'xenos' } });
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'Typo on the welcome sign', messageId: 'm2' }, deps, CFG);
   assert.equal(r.outcome, 'filed');
-  assert.equal(r.status, 'backlog');
-  assert.equal(calls.create[0].status, 'backlog');
+  assert.equal(r.status, 'backlog', 'a sub-Metic report waits for a nod, as before');
+  assert.equal(calls.create[0].filerRank, 'xenos');
 });
 
-await t('recordInboundBug: UNLINKED author → ignored, nothing created', async () => {
+await t('recordInboundBug: UNLINKED author → an inbox idea, never a task [changed by 1003067]', async () => {
+  // WAS: dropped entirely ('unlinked'), because this path minted claimable work
+  // and ADR 0047 would not let an unaccountable author near that. It no longer
+  // mints work, so the report is kept — as an idea row with no author and NO
+  // GOAL, which is exactly what #ideas has always done for the same person.
+  // The security property survives structurally: no goal ⇒ the matrix cannot
+  // route ⇒ no task exists to claim.
   const { deps, calls } = makeDeps({ builder: null });
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'something is broken here', messageId: 'm3' }, deps, CFG);
-  assert.equal(r.outcome, 'ignored');
-  assert.equal(r.reason, 'unlinked');
+  assert.equal(r.outcome, 'filed');
+  assert.equal(r.ideaId, 900, 'the report is recorded rather than silently dropped');
+  assert.equal(r.taskId, null, 'and it is NOT work');
+  assert.equal(r.status, null);
+  assert.equal(calls.create[0].capturedBy, null, 'unattributed, and honestly so');
+  assert.equal(calls.create[0].goalId, null, 'no home is offered to an unlinked author');
+  assert.equal(calls.suggest.length, 0, 'we do not even ask for one');
+  assert.match(calls.create[0].bodyMd, /unlinked author/);
+});
+
+await t('recordInboundBug: an unlinked author is NOT rate-limited by builder id (there is none)', async () => {
+  const { deps, calls } = makeDeps({ builder: null, recent: 999 });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'another unlinked report', messageId: 'm3b' }, deps, CFG);
+  assert.equal(r.outcome, 'filed', 'the per-builder cap cannot express an author with no builder row');
+  assert.equal(calls.count.length, 0, 'so it is not consulted');
+  assert.equal(r.taskId, null, 'the bound that matters is that none of it becomes work');
+});
+
+await t('recordInboundBug: a suggester failure still files — to the inbox [1003067]', async () => {
+  // A suggester that throws must not lose the bug report. No goal ⇒ inbox row.
+  const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, suggestThrows: true });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'the suggester is down', messageId: 'm3c' }, deps, CFG);
+  assert.equal(r.outcome, 'error', 'it surfaces as an error rather than pretending to have filed');
   assert.equal(calls.create.length, 0);
 });
 
+await t('recordInboundBug: a REFUSED goal drops the guess and still files the report [1003067]', async () => {
+  // The suggester picks the home; the goal can still refuse it (protected scope, a
+  // scope-wall verdict, an archive mid-flight). Because routing is one transaction
+  // that refusal takes the idea row with it — so a goal WE guessed at would lose a
+  // report the reporter did nothing wrong to file. Drop the guess, keep the report.
+  const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, refuseRouted: true });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'a bug whose words match a protected goal', messageId: 'm7' }, deps, CFG);
+  assert.equal(r.outcome, 'filed', 'the report survives the refusal');
+  assert.equal(calls.create.length, 2, 'one routed attempt, then one homeless retry');
+  assert.equal(calls.create[0].goalId, 7, 'the first carried the suggested home');
+  assert.equal(calls.create[1].goalId, null, 'the retry drops it');
+  assert.equal(r.taskId, null, 'and it lands in the inbox, where triage will see it');
+});
+
+await t('recordInboundBug: a refusal with NO goal to drop is a real error, not a retry loop', async () => {
+  const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, goal: null, refuseRouted: true, createThrows: true });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'the database is simply down', messageId: 'm8' }, deps, CFG);
+  assert.equal(r.outcome, 'error', 'nothing to drop ⇒ surface it rather than retrying forever');
+  assert.equal(calls.create.length, 1, 'exactly one attempt');
+});
+
+await t('recordInboundBug: NO confident goal → the report still lands, in the inbox', async () => {
+  const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, goal: null });
+  const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'a bug matching no goal at all', messageId: 'm3d' }, deps, CFG);
+  assert.equal(r.outcome, 'filed');
+  assert.equal(r.taskId, null, 'no home ⇒ no task, which is the homeless-inbox contract (C2)');
+  assert.equal(calls.create[0].goalId, null);
+});
+
 await t('recordInboundBug: over rate-limit → ignored + audited 429, nothing created', async () => {
   const { deps, calls } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, recent: 5 });
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'yet another bug report', messageId: 'm4' }, deps, CFG);
@@ -170,7 +249,7 @@ await t('recordInboundBug: audit failure does NOT undo the filing', async () =>
   assert.equal(calls.create.length, 1);
 });
 
-await t('recordInboundBug: createTask error → {error}, never throws', async () => {
+await t('recordInboundBug: a capture error → {error}, never throws', async () => {
   const { deps } = makeDeps({ builder: { id: 9, github_login: 'mona', rank: 'metic' }, createThrows: true });
   const r = await bg.recordInboundBug({ discordUserId: GOOD_ID, content: 'valid bug body here', messageId: 'm' }, deps, CFG);
   assert.equal(r.outcome, 'error');
@@ -202,8 +281,8 @@ await t('recordInboundBug: text + images → persists images + embeds durable li
   assert.equal(r.images, 1);
   assert.equal(calls.persist.length, 1);
   assert.deepEqual(calls.persist[0].urls, ['https://cdn.discordapp.com/a.png']);
-  assert.match(calls.create[0].description, /Attachments \(1\)/);
-  assert.match(calls.create[0].description, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
+  assert.match(calls.create[0].bodyMd, /Attachments \(1\)/);
+  assert.match(calls.create[0].bodyMd, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
 });
 
 await t('recordInboundBug: image-only (empty text) → filed with screenshot title', async () => {
@@ -225,7 +304,7 @@ await t('recordInboundBug: image persist failure → still files (without images
   );
   assert.equal(r.outcome, 'filed');
   assert.equal(r.images, 0);
-  assert.doesNotMatch(calls.create[0].description, /Attachments/);
+  assert.doesNotMatch(calls.create[0].bodyMd, /Attachments/);
 });
 
 await t('recordInboundBug: all images refused (stored empty) → filed, no Attachments block', async () => {
@@ -236,7 +315,7 @@ await t('recordInboundBug: all images refused (stored empty) → filed, no Attac
   );
   assert.equal(r.outcome, 'filed');
   assert.equal(r.images, 0);
-  assert.doesNotMatch(calls.create[0].description, /Attachments/);
+  assert.doesNotMatch(calls.create[0].bodyMd, /Attachments/);
 });
 
 // ---- combineParts ----------------------------------------------------------

package/tests/filing_abuse_matrix.mjs

@@ -29,19 +29,21 @@
 //   F10 make the rate-limit COUNT fail, to slip past the cap   → denied (fail-closed)
 //   F11 file through Discord #bugs at all, as a sub-Metic      → 'backlog', never 'ready'
 //   F12 file through Discord #ideas naming a goal              → that vector cannot route
+//   F15 reach #bugs' old direct-createTask bypass              → it no longer exists
+//   F16 file through #bugs as an UNLINKED author               → an inbox row, never work
 //   F13 declare touches[] outside the goal to widen blast area → the real wall refuses
 //   F14 file against a SHIPPED version's goal                  → refused (version not building)
 //   P1  a Metic+ files a bug in an ordinary goal               → 'ready' (the C1 grant)
 //   P2  a Metic+ files into protected scope                    → allowed, floored to metic
 //
 // AND THE ANTI-DRIFT PIN (the point of the file, really). The rows above are true
-// of the four capture vectors that exist TODAY. Nothing stops a fifth being added
+// of the capture vectors that exist TODAY. Nothing stops a fifth being added
 // next month that quietly skips all of it — which is exactly how the 1000771 bug
 // got in. So the last section ENUMERATES the vectors from source and fails when
 // the roster changes, forcing a new vector's author to come here and add its row.
 //
 // PURE: the decision cores only (decideLanding, authorizeRoutedLanding,
-// decideBugLanding, rateLimitPerHour) — no DB, no network. The transaction that
+// rateLimitPerHour) — no DB, no network. The transaction that
 // obeys them is proven in tests/idea_routing.mjs; the end-to-end attribution trail
 // in tests/idea_route_attribution.mjs.
 //
@@ -72,7 +74,7 @@ const read = (rel) => readFileSync(path.join(ROOT, rel), 'utf8');
 const routing = require('../modules/ideas/routing.js');
 const { decideLanding, authorizeRoutedLanding, routedPriority, PROTECTED_SCOPE_FLOOR } = routing;
 const bugs = require('../modules/discord/discord-bugs.js');
-const { decideBugLanding, rateLimitPerHour } = bugs;
+const { rateLimitPerHour } = bugs;
 const { scopeIncludesProtected, isModuleKey } = require('../src/bongos/module-scope-map.js');
 
 const { test, summary } = makeRunner();
@@ -215,11 +217,15 @@ await test('[F10] a rate-limit COUNT failure DENIES — you cannot break the cou
 });
 
 await test('[F11] #bugs lands a sub-Metic at backlog and only Metic+ at ready', () => {
+  // Since R11 this is the SAME rule as F1/P1 — the channel has no landing logic of
+  // its own. Asserted through the matrix, which is now the only place it exists.
   for (const rank of SUB_METIC) {
-    assert.equal(decideBugLanding(rank), 'backlog', `${JSON.stringify(rank)} must not reach ready`);
+    assert.equal(landing({ kind: 'bug', filerRank: rank }).status, 'backlog',
+      `${JSON.stringify(rank)} must not reach ready`);
   }
   for (const rank of TRUSTED) {
-    assert.equal(decideBugLanding(rank), 'ready', `${rank} is the C1 straight-through grant`);
+    assert.equal(landing({ kind: 'bug', filerRank: rank }).status, 'ready',
+      `${rank} is the C1 straight-through grant`);
   }
 });
 
@@ -228,7 +234,7 @@ await test('[F9+F11] the flood, composed: at the cap, EVERY landed row is still
   const landedStatuses = [];
   for (let i = 0; i < cap + 25; i++) {
     if (i >= cap) continue; // the counter refuses past the cap (F9/F10)
-    landedStatuses.push(decideBugLanding('xenos'));
+    landedStatuses.push(landing({ kind: 'bug', filerRank: 'xenos' }).status);
   }
   assert.equal(landedStatuses.length, cap, 'the cap bounds how many rows exist at all');
   assert.ok(landedStatuses.every((s) => s === 'backlog'),
@@ -297,6 +303,42 @@ await test('priority cannot be weaponised: an out-of-band suggestion is clamped,
   assert.equal(routedPriority(1), 1, 'a sane suggestion still rides through');
 });
 
+// =========================================================================
+// F15–F16 — the #bugs bypass is retired (task 1003067 / BV1.R11)
+// =========================================================================
+
+await test('[F15] #bugs mints NO task of its own — the bypass that lost attribution is gone', () => {
+  const src = read('modules/discord/discord-bugs.js');
+  const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.ok(!/\bdeps\.createTask\(/.test(code),
+    'the vector must file through ideas.capture, so every report leaves an idea row + lineage');
+  assert.match(code, /deps\.captureIdea\(/, 'and it does');
+});
+
+await test('[F15b] #bugs names NO version — a vector that cannot name one cannot name a dead one', () => {
+  const src = read('modules/discord/discord-bugs.js');
+  const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  // This is idea 1000771 in one assertion: the old default was 'GDS-V3', shipped,
+  // so every bug reported here landed in a closed version's catch-all.
+  assert.ok(!/GDS-V3|DEFAULT_BUGS_VERSION_ID|DISCORD_BUGS_VERSION_ID/.test(code),
+    'no version id may be hardcoded or env-configured on this path any more');
+  assert.ok(!/versionId:/.test(code), 'and none is passed into the capture');
+});
+
+await test('[F16] an unlinked #bugs author gets an inbox row and CANNOT reach work', () => {
+  // The report is kept (it used to be dropped), but with no rank and no goal, so
+  // the matrix has nothing to route: structurally incapable of becoming a task.
+  const noRank = decideLanding({ goalId: null, kind: 'bug', filerRank: null });
+  assert.equal(noRank.route, false, 'no goal ⇒ the inbox');
+  // And even if a goal somehow reached it, an unknown filer never hard-lands:
+  const withGoal = decideLanding({ goalId: 5, kind: 'bug', filerRank: null });
+  assert.equal(withGoal.status, 'backlog', 'never claimable on an unknown filer');
+  const src = read('modules/discord/discord-bugs.js');
+  const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.match(code, /if \(builder\) \{[\s\S]{0,200}suggestGoalForCapture/,
+    'a goal is only ever sought for a LINKED builder');
+});
+
 // =========================================================================
 // THE ANTI-DRIFT PIN — a fifth vector cannot arrive unaudited
 // =========================================================================
@@ -308,7 +350,7 @@ const KNOWN_FILING_VECTORS = {
   'modules/ideas/inbox.js': 'routeIdeaToGoal — the ONE transaction every routed filing runs (F1–F8, F13, F14)',
   'modules/ideas/routes/inbox.js': 'POST /inbox — the web + CLI door onto it (F3)',
   'modules/discord/discord-inbound.js': 'Discord #ideas — files an idea, never routes (F12)',
-  'modules/discord/discord-bugs.js': 'Discord #bugs — the direct-createTask bypass R11 retires (F9–F11)',
+  'modules/discord/discord-bugs.js': 'Discord #bugs — files through ideas.capture since R11 (F9–F11, F15, F16)',
 };
 
 await test('[pin] every declared vector still reaches a task-minting path', () => {
@@ -336,20 +378,17 @@ await test('[pin] no OTHER module file mints a task from a filing without a row
     `a new filing vector must be added to KNOWN_FILING_VECTORS and given a matrix row: ${unaudited.join(', ')}`);
 });
 
-await test('[pin] the trusted tier is Metic+ in BOTH decision cores — one boundary, not two', () => {
-  // routing.js and discord-bugs.js each spell the tier locally (both are pure and
-  // import-free by design). They must agree, or "Metic+" means two things.
+await test('[pin] there is ONE trusted-tier definition, and #bugs no longer keeps a copy', () => {
+  // This pin used to assert that two spellings of "Metic+" AGREED — routing.js and
+  // discord-bugs.js each carried one. R11 deleted the second, which is the better
+  // outcome: agreement you have to test for is a duplication you could have removed.
   const routingSrc = read('modules/ideas/routing.js');
-  const bugsSrc = read('modules/discord/discord-bugs.js');
-  assert.match(routingSrc, /METIC_PLUS = new Set\(\['metic', 'archon'\]\)/);
-  assert.match(bugsSrc, /READY_RANKS = new Set\(\['metic', 'archon'\]\)/);
-  // And behaviourally, which is what actually matters:
-  for (const rank of [...SUB_METIC, ...TRUSTED]) {
-    const viaRouting = landing({ kind: 'bug', filerRank: rank }).status;
-    const viaBugs = decideBugLanding(rank);
-    assert.equal(viaRouting, viaBugs,
-      `the two vectors must agree on ${JSON.stringify(rank)} (routing=${viaRouting}, bugs=${viaBugs})`);
-  }
+  assert.match(routingSrc, /METIC_PLUS = new Set\(\['metic', 'archon'\]\)/,
+    'the one definition, in the matrix');
+  const bugsCode = read('modules/discord/discord-bugs.js')
+    .split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.ok(!/READY_RANKS/.test(bugsCode), '#bugs must not reintroduce a local rank set');
+  assert.ok(!/decideBugLanding/.test(bugsCode), 'nor a local landing decision');
 });
 
 summary();

package/tests/goal_suggest.mjs

@@ -24,7 +24,7 @@ import { makeRunner } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
-const { suggestGoals, goalSuggestHandler, SUGGEST_LIMIT } = require('../modules/lifecycle/goal-suggest.js');
+const { suggestGoals, suggestGoalForCapture, goalSuggestHandler, SUGGEST_LIMIT } = require('../modules/lifecycle/goal-suggest.js');
 const { test, summary } = makeRunner();
 
 const V = 'BONGOS-V1';
@@ -192,4 +192,110 @@ await test('the handler clamps limit into a sane range', async () => {
   }
 });
 
+// =========================================================================
+// suggestGoalForCapture — ONE goal, or none, for a filing with nobody to choose
+// (task 1003067 / BV1.R11). The HTTP suggester offers a human five options; a
+// Discord message has no human in the loop, so this collapses to a single
+// confident answer and declines whenever "confident" is not available.
+// =========================================================================
+
+const fakeDb = ({ versions = [], goals = [], throws = null, calls = null } = {}) => ({
+  listVersions: async () => { if (throws === 'versions') throw new Error('boom'); return versions; },
+  listGoals: async (args) => {
+    if (calls) calls.push(args);
+    if (throws === 'goals') throw new Error('boom');
+    return goals;
+  },
+});
+
+const BUILDING = { id: 'BONGOS-V1', status: 'building' };
+const SHIPPED = { id: 'GDS-V3', status: 'shipped' };
+const HALL_GOAL = { id: 81, title: 'Builders hall in the world', scope_modules: ['hall-ui'], version_id: 'BONGOS-V1' };
+const ECON_GOAL = { id: 78, title: 'Project money out', scope_modules: ['economy'], version_id: 'BONGOS-V1' };
+
+await test('suggestGoalForCapture: the one building version, and the goal the words match', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses on mobile', body: '' },
+    { db: fakeDb({ versions: [BUILDING, SHIPPED], goals: [ECON_GOAL, HALL_GOAL] }) }
+  );
+  assert.equal(got.id, 81, 'the hall goal, not the economy one');
+  assert.equal(got.version_id, 'BONGOS-V1', 'and the version comes from the version row, never a hardcode');
+  assert.ok(got.score > 0);
+});
+
+await test('suggestGoalForCapture: a SHIPPED version is never the home (idea 1000771)', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses', body: '' },
+    { db: fakeDb({ versions: [SHIPPED], goals: [HALL_GOAL] }) }
+  );
+  assert.equal(got, null, 'nothing is open to work, so there is no home — the filing goes to the inbox');
+});
+
+// This instance runs BONGOS-V1 and CB-V1 concurrently. An earlier cut declined
+// whenever more than one version was open, which would have returned null for
+// every report ever filed — a dead feature that looked like prudence. The goal
+// carries the version, so rank across all of them and let the winner say.
+await test('suggestGoalForCapture: TWO open versions ⇒ rank across BOTH, winner names its version', async () => {
+  const CB_GOAL = { id: 99, title: 'The front door', scope_modules: ['public-landing'], version_id: 'CB-V1' };
+  const got = await suggestGoalForCapture(
+    { title: 'the front door hero is broken', body: '' },
+    { db: fakeDb({ versions: [BUILDING, { id: 'CB-V1', status: 'building' }], goals: [HALL_GOAL, CB_GOAL] }) }
+  );
+  assert.equal(got.id, 99, 'the goal on the OTHER open version can win');
+  assert.equal(got.version_id, 'CB-V1', 'and it reports its own version, not the first one open');
+});
+
+await test('suggestGoalForCapture: a goal on a CLOSED version is never a home, even if it matches best', async () => {
+  const DEAD_GOAL = { id: 12, title: 'the hall sidebar and hall chrome', scope_modules: ['hall-ui'], version_id: 'GDS-V3' };
+  const got = await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses', body: '' },
+    { db: fakeDb({ versions: [BUILDING, SHIPPED], goals: [DEAD_GOAL, ECON_GOAL] }) }
+  );
+  assert.equal(got, null, 'the better-matching goal sits on a shipped version — idea 1000771 exactly');
+});
+
+await test('suggestGoalForCapture: asks for open goals across ALL versions, not one', async () => {
+  const calls = [];
+  await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses', body: '' },
+    { db: fakeDb({ versions: [BUILDING], goals: [HALL_GOAL], calls }) }
+  );
+  assert.equal(calls.length, 1, 'one query, not one per version');
+  assert.equal(calls[0].status, 'open');
+  assert.equal(calls[0].versionId, undefined, 'unscoped — the open-version filter is applied in JS');
+});
+
+await test('suggestGoalForCapture: no confident match ⇒ null, not the first goal dressed up', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'zzzz qqqq nothing matches this', body: '' },
+    { db: fakeDb({ versions: [BUILDING], goals: [HALL_GOAL, ECON_GOAL] }) }
+  );
+  assert.equal(got, null);
+});
+
+await test('suggestGoalForCapture: empty draft ⇒ null without touching the db', async () => {
+  let touched = false;
+  const db = { listVersions: async () => { touched = true; return [BUILDING]; }, listGoals: async () => [] };
+  assert.equal(await suggestGoalForCapture({ title: '   ', body: '' }, { db }), null);
+  assert.equal(touched, false, 'nothing to rank against ⇒ no query');
+});
+
+await test('suggestGoalForCapture: a db failure SHRUGS — it never throws at a bug report', async () => {
+  for (const throws of ['versions', 'goals']) {
+    const got = await suggestGoalForCapture(
+      { title: 'the hall sidebar collapses', body: '' },
+      { db: fakeDb({ versions: [BUILDING], goals: [HALL_GOAL], throws }) }
+    );
+    assert.equal(got, null, `a ${throws} failure degrades to "no home", never to a lost report`);
+  }
+});
+
+await test('suggestGoalForCapture: the catch-all is never offered as a home', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'general problem in BONGOS', body: '' },
+    { db: fakeDb({ versions: [BUILDING], goals: [{ id: 3, title: 'BONGOS-V1 — general', scope_modules: [], version_id: 'BONGOS-V1' }] }) }
+  );
+  assert.equal(got, null, 'a bucket is not a workspace — dropped for EVERY open version, not just one');
+});
+
 summary();