@bongos/core 1.19.499 → 1.19.500

package/modules/lifecycle/goal-advisory.js

@@ -28,24 +28,38 @@ function generalGoalTitle(versionId) {
 }
 
 // adviseGoal — PURE, FAIL-OPEN. Returns null when the task has a real home, or the
-// advisory body when it does not. Two reasons, checked in order:
+// advisory body when it does not. Three reasons, checked in order:
 //
-//   no_goal   — goal_id is NULL. The version has no catch-all at all (created after
-//               migration 160), so the task is structurally orphaned.
-//   catch_all — the task landed in "<version> — general": a bucket, not a workspace.
-//               No scope wall, no criteria, no members, no review. Better than NULL,
-//               still not a home.
+//   no_goal          — goal_id is NULL. The version has no catch-all at all
+//                       (created after migration 160), so the task is
+//                       structurally orphaned.
+//   catch_all        — the task landed in "<version> — general": a bucket, not a
+//                       workspace. No scope wall, no criteria, no members, no
+//                       review. Better than NULL, still not a home.
+//   no_criterion_link — the task DOES have a real goal, that goal HAS done-when
+//                       criteria, and the task links none (task 1003157). Only
+//                       the planning-session seeder ever links a criterion at
+//                       create time; every other path — idea promotion, a manual
+//                       POST /tasks, a captured bug — silently omits it. That
+//                       mattered less before ADR 0183's auto-satisfy made a
+//                       criterion close itself the moment every LINKED task
+//                       ships: an unlinked goal-bound task can never advance any
+//                       criterion, so it now reads as goal progress that never
+//                       moves no matter how much ships.
 //
 // Fail-OPEN on ambiguity (return null, say nothing) — the opposite posture from an
 // authorization gate. This is advice appended to a request that ALREADY SUCCEEDED;
 // a wrong guess here nags a builder about a task that is fine, which is worse than
 // staying quiet. A missing versionId or an unreadable goal title yields null.
 //
-// kind='bug' is a THIRD silent case (task 1003214, idea 1000828 — the owner
-// directive against manufacturing small goals): a fix sitting in the catch-all,
-// or with no goal at all, is already where it belongs, so both reasons above
-// collapse to null for a bug. The nudge is for homeless FEATURE work only.
-function adviseGoal({ versionId, goalId, goalTitle, kind } = {}) {
+// kind='bug' is silent for ALL THREE reasons (task 1003214, idea 1000828 — the
+// owner directive against manufacturing small goals; the exemption is extended to
+// no_criterion_link here and the decision is written up at task 1003215): a bug
+// fix sitting in the catch-all, with no goal at all, or under a real goal with no
+// criterion named is already where it belongs — a fix is the goal's "fix
+// category", not a delivery against one of its stated outcomes, so it needs no
+// criterion to justify its home. The nudge is for FEATURE-shaped work only.
+function adviseGoal({ versionId, goalId, goalTitle, kind, goalCriteria, hasCriterionLink } = {}) {
   if (goalId == null) {
     if (kind === 'bug') return null;
     return {
@@ -58,15 +72,32 @@ function adviseGoal({ versionId, goalId, goalTitle, kind } = {}) {
     };
   }
   if (versionId == null || typeof goalTitle !== 'string') return null;
-  if (goalTitle !== generalGoalTitle(versionId)) return null;
-  if (kind === 'bug') return null;
-  return {
-    reason: 'catch_all',
-    message: `This task landed in "${goalTitle}", the version's catch-all bucket rather than a real goal — `
-      + 'no scope wall, no criteria, and no owner reviewing it.',
-    version_id: versionId,
-    goal_id: goalId,
-  };
+  if (goalTitle === generalGoalTitle(versionId)) {
+    if (kind === 'bug') return null;
+    return {
+      reason: 'catch_all',
+      message: `This task landed in "${goalTitle}", the version's catch-all bucket rather than a real goal — `
+        + 'no scope wall, no criteria, and no owner reviewing it.',
+      version_id: versionId,
+      goal_id: goalId,
+    };
+  }
+  // A REAL, named goal (not the catch-all) — the case adviseGoal used to go
+  // silent on unconditionally. task 1003157's gap: nothing said so when the
+  // goal HAS criteria and this task links none.
+  if (kind !== 'bug' && !hasCriterionLink && Array.isArray(goalCriteria) && goalCriteria.length > 0) {
+    const named = goalCriteria.map((c) => c.criterion_md).join(' | ');
+    return {
+      reason: 'no_criterion_link',
+      message: `This task is linked to none of this goal's ${goalCriteria.length} done-when criteria: `
+        + `${named}. Link one via POST /tasks/:id/criteria if this task delivers toward it, or leave it `
+        + 'unlinked if it genuinely serves none of them — this is advice, not a requirement.',
+      version_id: versionId,
+      goal_id: goalId,
+      criteria: goalCriteria.map((c) => ({ id: c.id, criterion_md: c.criterion_md })),
+    };
+  }
+  return null;
 }
 
 // candidateGoals — PURE. The version's OPEN goals minus the catch-all, shaped down
@@ -93,16 +124,43 @@ const CANDIDATE_LIMIT = 5;
 // retries — and source_ref idempotency only saves callers who set one, so a bare
 // retry mints a DUPLICATE task. Degrading to null (silence) is always correct here.
 // Only the unhappy path pays for the second query.
-async function buildGoalAdvisory({ db, versionId, task }) {
+//
+// hasCriterionLink (task 1003157) — did THIS task already link at least one
+// done-when criterion (via body.criterion_ids at create)? The caller (POST /tasks)
+// already knows this from the same request; feeding it in avoids re-deriving it
+// from a task_criteria read. db.listCriteriaForGoal is only queried when it
+// might matter (a real, non-catch-all, non-bug task with no link) — the
+// no_goal/catch_all paths, and any task that already linked one, pay nothing
+// extra. The catch-all check is resolved FIRST (grade-round-1 finding, task
+// 1003157): reading goalTitle off the already-fetched homeGoal costs nothing,
+// so the goal's criteria are never queried only to be discarded once adviseGoal
+// hits its catch_all branch.
+async function buildGoalAdvisory({ db, versionId, task, hasCriterionLink = false }) {
   try {
     const homeGoal = task.goal_id != null ? await db.getGoal(task.goal_id) : null;
+    const goalTitle = homeGoal && homeGoal.title;
+    const isCatchAll = task.goal_id != null && versionId != null && typeof goalTitle === 'string'
+      && goalTitle === generalGoalTitle(versionId);
+    const needsCriteriaRead = task.goal_id != null && !isCatchAll && task.kind !== 'bug' && !hasCriterionLink;
+    const goalCriteria = needsCriteriaRead ? await db.listCriteriaForGoal(task.goal_id) : [];
     const verdict = adviseGoal({
       versionId,
       goalId: task.goal_id,
-      goalTitle: homeGoal && homeGoal.title,
+      goalTitle,
       kind: task.kind,
+      goalCriteria,
+      hasCriterionLink,
     });
     if (!verdict) return null;
+    if (verdict.reason === 'no_criterion_link') {
+      // The task already has a home — the ask is "link a criterion", not "pick a
+      // goal", so no candidate_goals here.
+      return {
+        ...verdict,
+        next_step: `Link one via POST /tasks/${task.id}/criteria, or leave it unlinked if this task `
+          + 'genuinely serves none of them.',
+      };
+    }
     // LIMIT 6, not 6-in-JS: Postgres truncates instead of shipping every open goal
     // on the version to be discarded here. Six because candidateGoals drops the
     // catch-all, so 6 rows still guarantee the 5 candidates below.

package/modules/lifecycle/routes/goals.js

@@ -252,13 +252,20 @@ module.exports = function buildGoalsRouter() {
     try {
       const goal = await db.getGoal(id);
       if (!goal) return res.fail('goal_not_found', 404);
-      const [members, criteria, dependencies] = await Promise.all([
+      const [members, criteria, dependencies, criterionless_task_count] = await Promise.all([
         db.listGoalMembers(id),
         db.listCriteriaForGoal(id),
         db.getGoalDependencies(id),  // task 1761 — prerequisite goals + satisfied state
+        // task 1003157 (DONE WHEN item 2): the count beside the criteria this
+        // page already renders, so a builder sees the gap without waiting for
+        // the create-time advisory to catch the next task.
+        db.countTasksWithoutCriterionLink(id),
       ]);
       const byId = await goalCategory.categoryIndex();
-      return res.json({ goal: goalCategory.decorateGoalCategory(decorateGoalScope(goal), byId), members, criteria, dependencies });
+      return res.json({
+        goal: goalCategory.decorateGoalCategory(decorateGoalScope(goal), byId),
+        members, criteria, dependencies, criterionless_task_count,
+      });
     } catch (err) {
       log.error('[gds] GET /goals/:id', err);
       return res.fail('fetch_failed', { status: 500, message: 'internal error' });

package/modules/lifecycle/routes/task-write-routes.js

@@ -235,8 +235,13 @@ module.exports = function registerTaskWriteRoutes(router) {
       }
       // task 1002539 — the orphan-task advisory (the /goal-create auto-pickup
       // hook). Nothing 4xxs when a task has no goal, so surface it here instead of
-      // blocking. Non-blocking by construction — see goal-advisory.js.
-      const goal_advisory = await buildGoalAdvisory({ db, versionId: body.version_id, task });
+      // blocking. Non-blocking by construction — see goal-advisory.js. task
+      // 1003157 extends it: hasCriterionLink tells it whether THIS create already
+      // linked a criterion, so a goal-bound task with unsatisfied criteria and no
+      // link gets named too.
+      const goal_advisory = await buildGoalAdvisory({
+        db, versionId: body.version_id, task, hasCriterionLink: criteria.length > 0,
+      });
       res.status(201).json({
         task,
         credits_reward: task.credits_reward,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.499",
+  "version": "1.19.500",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.499",
+      "version": "1.19.500",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.499",
+  "version": "1.19.500",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.499'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.500'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_advisory.mjs

@@ -79,6 +79,53 @@ await test("kind='bug' under a real goal is silent too — already silent, kind
   assert.equal(adviseGoal({ versionId: V, goalId: 1000025, goalTitle: 'Builder experience — hall, dev box, and skills', kind: 'bug' }), null);
 });
 
+// ---- adviseGoal: the third reason — no_criterion_link (task 1003157) ----
+
+const REAL_GOAL_TITLE = 'Builder experience — hall, dev box, and skills';
+const SOME_CRITERIA = [
+  { id: 11, criterion_md: 'Every onboarding page renders under 2s' },
+  { id: 12, criterion_md: 'The hall shows a builder their own karma trend' },
+];
+
+await test('no_criterion_link — a real goal WITH criteria and no link names them', () => {
+  const a = adviseGoal({
+    versionId: V, goalId: 1000025, goalTitle: REAL_GOAL_TITLE, kind: 'feature',
+    goalCriteria: SOME_CRITERIA, hasCriterionLink: false,
+  });
+  assert.equal(a.reason, 'no_criterion_link');
+  assert.equal(a.goal_id, 1000025);
+  assert.match(a.message, /Every onboarding page renders under 2s/, 'names the criteria in the message');
+  assert.match(a.message, /The hall shows a builder their own karma trend/);
+  assert.deepEqual(a.criteria, [
+    { id: 11, criterion_md: 'Every onboarding page renders under 2s' },
+    { id: 12, criterion_md: 'The hall shows a builder their own karma trend' },
+  ], 'the structured list a caller can pick from without parsing the message');
+});
+
+await test('a criterion link already present is quiet — the seeder-path invariant holds', () => {
+  const a = adviseGoal({
+    versionId: V, goalId: 1000025, goalTitle: REAL_GOAL_TITLE, kind: 'feature',
+    goalCriteria: SOME_CRITERIA, hasCriterionLink: true,
+  });
+  assert.equal(a, null);
+});
+
+await test("kind='bug' under a real goal with criteria and no link is quiet too — exempt (task 1003215)", () => {
+  const a = adviseGoal({
+    versionId: V, goalId: 1000025, goalTitle: REAL_GOAL_TITLE, kind: 'bug',
+    goalCriteria: SOME_CRITERIA, hasCriterionLink: false,
+  });
+  assert.equal(a, null);
+});
+
+await test('a real goal with NO criteria is silent — nothing to link to, unchanged behaviour', () => {
+  const a = adviseGoal({
+    versionId: V, goalId: 1000025, goalTitle: REAL_GOAL_TITLE, kind: 'feature',
+    goalCriteria: [], hasCriterionLink: false,
+  });
+  assert.equal(a, null);
+});
+
 // The bug this guards: a near-miss title must not be mistaken for the catch-all.
 // db.generalGoalIdForVersion resolves the SAME string, so if these two ever disagree
 // a task would be filed into a goal the advisory then calls orphaned (or vice versa).
@@ -138,7 +185,10 @@ await test('db.js resolves the catch-all through generalGoalTitle — no second
 // ---- the non-blocking contract, asserted rather than commented ----
 
 await test('the route delegates to buildGoalAdvisory in one line — no inline logic to drift', () => {
-  assert.match(tasksSrc, /const goal_advisory = await buildGoalAdvisory\(\{ db, versionId: body\.version_id, task \}\);/);
+  // task 1003157: the call now also passes hasCriterionLink (from THIS create's
+  // own criteria array), spread across the call site — match the tokens, not one
+  // literal line.
+  assert.match(tasksSrc, /await buildGoalAdvisory\(\{[\s\S]{0,120}?db, versionId: body\.version_id, task, hasCriterionLink: criteria\.length > 0,[\s\S]{0,20}?\}\);/);
   // task 1003148: was /goal_advisory,\s*\}\);/ — it required goal_advisory to be
   // the LAST key, which the sibling est_advisory broke. The assertion's intent is
   // "present in the 201 body", so assert that, not the key order.
@@ -149,9 +199,10 @@ await test('the route delegates to buildGoalAdvisory in one line — no inline l
 
 // ---- buildGoalAdvisory: the real function, driven with a stub db ----
 
-const stubDb = ({ goal = null, goals = [], throwOn = null } = {}) => ({
+const stubDb = ({ goal = null, goals = [], criteria = [], throwOn = null } = {}) => ({
   async getGoal() { if (throwOn === 'getGoal') throw new Error('db down'); return goal; },
   async listGoals() { if (throwOn === 'listGoals') throw new Error('db down'); return goals; },
+  async listCriteriaForGoal() { if (throwOn === 'listCriteriaForGoal') throw new Error('db down'); return criteria; },
 });
 
 await test('buildGoalAdvisory: a goal-less task yields the no_goal advisory + candidates', async () => {
@@ -167,14 +218,57 @@ await test('buildGoalAdvisory: a goal-less task yields the no_goal advisory + ca
   assert.match(a.next_step, /PATCH \/tasks\/42/, 'names the actual task id');
 });
 
-await test('buildGoalAdvisory: a task in a REAL goal is silent, and never reads the goal list', async () => {
+await test('buildGoalAdvisory: a task in a REAL goal with no criteria is silent, and never reads the goal list', async () => {
   let listed = false;
   const db = {
     async getGoal() { return { id: 9, title: 'Builder experience' }; },
     async listGoals() { listed = true; return []; },
+    async listCriteriaForGoal() { return []; },  // this goal has none — nothing to link to
   };
   assert.equal(await buildGoalAdvisory({ db, versionId: V, task: { id: 1, goal_id: 9 } }), null);
-  assert.equal(listed, false, 'the happy path costs exactly one query');
+  assert.equal(listed, false, 'the happy path never reads the version-wide goal list');
+});
+
+// ---- buildGoalAdvisory: the no_criterion_link reason, end to end (task 1003157) ----
+
+await test('buildGoalAdvisory: a real goal WITH criteria and no link surfaces no_criterion_link', async () => {
+  const db = stubDb({
+    goal: { id: 9, title: 'Builder experience' },
+    criteria: [{ id: 11, criterion_md: 'Karma trend renders on the profile' }],
+  });
+  const a = await buildGoalAdvisory({ db, versionId: V, task: { id: 55, goal_id: 9, kind: 'feature' } });
+  assert.equal(a.reason, 'no_criterion_link');
+  assert.equal(a.goal_id, 9);
+  assert.equal(a.candidate_goals, undefined, 'the task already has a home — no goal picker here');
+  assert.match(a.next_step, /POST \/tasks\/55\/criteria/, 'names the actual task id');
+});
+
+await test('buildGoalAdvisory: hasCriterionLink=true skips the criteria read entirely', async () => {
+  let read = false;
+  const db = {
+    async getGoal() { return { id: 9, title: 'Builder experience' }; },
+    async listCriteriaForGoal() { read = true; return [{ id: 11, criterion_md: 'x' }]; },
+  };
+  const a = await buildGoalAdvisory({ db, versionId: V, task: { id: 1, goal_id: 9, kind: 'feature' }, hasCriterionLink: true });
+  assert.equal(a, null);
+  assert.equal(read, false, 'a task that already linked one pays no extra query');
+});
+
+await test("buildGoalAdvisory: kind='bug' skips the criteria read entirely — exempt (task 1003215)", async () => {
+  let read = false;
+  const db = {
+    async getGoal() { return { id: 9, title: 'Builder experience' }; },
+    async listCriteriaForGoal() { read = true; return [{ id: 11, criterion_md: 'x' }]; },
+  };
+  const a = await buildGoalAdvisory({ db, versionId: V, task: { id: 1, goal_id: 9, kind: 'bug' } });
+  assert.equal(a, null);
+  assert.equal(read, false, 'a bug pays no extra query either — same exemption as no_goal/catch_all');
+});
+
+await test('NON-BLOCKING: buildGoalAdvisory returns null when listCriteriaForGoal throws', async () => {
+  const db = stubDb({ goal: { id: 9, title: 'Builder experience' }, throwOn: 'listCriteriaForGoal' });
+  const a = await buildGoalAdvisory({ db, versionId: V, task: { id: 1, goal_id: 9, kind: 'feature' } });
+  assert.equal(a, null, 'degrades to silence — never propagates into the already-committed create');
 });
 
 await test('buildGoalAdvisory: the catch-all is detected and named', async () => {
@@ -184,6 +278,23 @@ await test('buildGoalAdvisory: the catch-all is detected and named', async () =>
   assert.equal(a.goal_id, 3);
 });
 
+// Grade-round-1 finding (task 1003157): a feature-kind task landing in the
+// catch-all used to fire listCriteriaForGoal anyway — its result discarded the
+// moment adviseGoal hit its catch_all branch — because needsCriteriaRead didn't
+// yet know the goal was the catch-all. buildGoalAdvisory now resolves that off
+// the SAME getGoal read before deciding whether the criteria read is needed.
+await test('buildGoalAdvisory: a catch-all landing never reads the goal criteria (no wasted query)', async () => {
+  let read = false;
+  const db = {
+    async getGoal() { return { id: 3, title: generalGoalTitle(V) }; },
+    async listCriteriaForGoal() { read = true; return [{ id: 1, criterion_md: 'x' }]; },
+    async listGoals() { return []; },
+  };
+  const a = await buildGoalAdvisory({ db, versionId: V, task: { id: 7, goal_id: 3, kind: 'feature' } });
+  assert.equal(a.reason, 'catch_all', 'the catch-all nudge still fires — only the criteria read is skipped');
+  assert.equal(read, false, 'the catch-all is structurally criteria-less; nothing here needs the query');
+});
+
 // task 1003214: the full POST /tasks path (buildGoalAdvisory reads task.kind
 // off the already-committed row) for a bug landed in the catch-all — silent.
 await test("buildGoalAdvisory: kind='bug' in the catch-all yields null end to end", async () => {

package/tests/goal_criterion_confirm_ui.mjs

@@ -56,7 +56,7 @@ const CRIT = {
 
 // Boot goals-page.js against a fake API and return what it rendered + recorded.
 // `rank` drives the client-side control gate; `goalStatus` drives the goal state.
-async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.values(CRIT), satisfyResponse } = {}) {
+async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.values(CRIT), satisfyResponse, criterionlessTaskCount } = {}) {
   const calls = { requests: [], toasts: [] };
   const els = new Map();
   const listeners = new Map(); // selector -> [handler]
@@ -83,7 +83,7 @@ async function render({ rank = 'metic', goalStatus = 'open', criteria = Object.v
   };
 
   const goal = { id: 7, version_id: 'V1', title: 'Builder experience', description: '', status: goalStatus, visibility: 'public', created_by: 999, scope_modules: [] };
-  const detail = { goal, members: [], criteria, dependencies: [] };
+  const detail = { goal, members: [], criteria, dependencies: [], criterionless_task_count: criterionlessTaskCount };
 
   const api = {
     request(method, p) {
@@ -239,6 +239,36 @@ await test('with nothing pending, the summary explains when a criterion becomes
   assert.match(band, /once every task linked to it has shipped/, 'explains the precondition instead');
 });
 
+// =========================================================================
+// The criterionless-task count (task 1003157 DONE WHEN item 2) — the
+// create-time advisory's gap, also visible on the goal's own detail view.
+// =========================================================================
+
+await test('a nonzero criterionless_task_count renders a line beside the criteria rollup', async () => {
+  const { band } = await render({ criterionlessTaskCount: 4 });
+  assert.match(band, /4 tasks in this goal are linked to no criterion/);
+});
+
+await test('a count of exactly 1 uses singular phrasing', async () => {
+  const { band } = await render({ criterionlessTaskCount: 1 });
+  assert.match(band, /1 task in this goal is linked to no criterion/);
+});
+
+await test('a zero count renders nothing — quiet, not a false "all clear" line', async () => {
+  const { band } = await render({ criterionlessTaskCount: 0 });
+  assert.doesNotMatch(band, /linked to no criterion/);
+});
+
+await test('an absent count (older server / field omitted) renders nothing, never throws', async () => {
+  const { band } = await render({ criterionlessTaskCount: undefined });
+  assert.doesNotMatch(band, /linked to no criterion/);
+});
+
+await test('a goal with NO criteria never shows the line even if tasks are unlinked — nothing to link to', async () => {
+  const { band } = await render({ criteria: [], criterionlessTaskCount: 5 });
+  assert.doesNotMatch(band, /linked to no criterion/, 'crit.length === 0 makes the count meaningless — matches goal-advisory.js\'s own null-when-no-criteria rule');
+});
+
 await test('an achieved goal keeps its own summary line', async () => {
   const { band } = await render({ goalStatus: 'achieved', criteria: [CRIT.satisfied] });
   assert.match(band, /Goal achieved/, 'achieved wording is preserved');

package/tests/goal_routes.mjs

@@ -23,7 +23,7 @@ process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
 const { validate, LIMITS } = require('../src/bongos/routes/_helpers.js');
 const buildGoalsRouter = require('../modules/lifecycle/routes/goals.js');
-const { listCriteriaForGoal } = require('../modules/lifecycle/db.js');
+const { listCriteriaForGoal, countTasksWithoutCriterionLink } = require('../modules/lifecycle/db.js');
 const { TASK_FIELD_BOUNDS } = require('../modules/lifecycle/task-classifier.js');
 
 const { test, summary } = makeRunner();
@@ -217,6 +217,34 @@ await test('listCriteriaForGoal: counts arrive as numbers even if the driver ret
   assert.equal(out.pending_review, true);
 });
 
+// ---- countTasksWithoutCriterionLink (db helper, executor seam) — task 1003157
+// DONE WHEN item 2: the count GET /goals/:id now returns beside its criteria, so
+// the create-time advisory's gap is visible on the goal detail view too. Unlike
+// listCriteriaForGoal's `{ pool }` deps object, this takes the executor
+// POSITIONALLY (the findCycle/unsatisfiedDeps seam in db-deps-criteria.js) — same
+// file, same convention. ----
+const UNLINKED_SQL_RE = /FROM tasks t\s+WHERE t\.goal_id = \$1/;
+
+await test('countTasksWithoutCriterionLink: scoped to the goal, kind<>bug, NOT EXISTS a link', async () => {
+  const pool = fakePool((s) => (UNLINKED_SQL_RE.test(s) ? { rows: [{ n: 3 }] } : null));
+  const out = await countTasksWithoutCriterionLink(9, pool);
+  assert.equal(out, 3);
+  const sel = find(pool.queries, UNLINKED_SQL_RE);
+  assert.equal(sel.params[0], 9);
+  assert.match(sel.sql, /AND t\.kind <> 'bug'/, "a bug fix is the goal's fix category and needs no link (task 1003214/1003215)");
+  assert.match(sel.sql, /NOT EXISTS \(SELECT 1 FROM task_criteria tc WHERE tc\.task_id = t\.id\)/);
+});
+
+await test('countTasksWithoutCriterionLink: zero rows resolves to 0, not undefined', async () => {
+  const pool = fakePool(() => ({ rows: [{ n: 0 }] }));
+  assert.equal(await countTasksWithoutCriterionLink(9, pool), 0);
+});
+
+await test('countTasksWithoutCriterionLink: a missing row still resolves to 0 (defensive fallback)', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await countTasksWithoutCriterionLink(9, pool), 0);
+});
+
 // ---- POST /goals/:id/tasks — request-validation schema (the bounded-authoring
 // gate's DECISION logic + abuse matrix live in tests/goal_abuse_matrix.mjs) ----
 // The EXACT schema declared in goals.js's POST /goals/:id/tasks — keep in sync.