@bongos/core 1.19.555 → 1.19.557

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.555",
-  "core_contract": "1.19.555",
-  "source_commit": "24fee783e3642be3f89811525120bcc2714f4fe7",
+  "core_version": "1.19.557",
+  "core_contract": "1.19.557",
+  "source_commit": "07517c180e4fca730285ee6533c21d6b54f08273",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T16:20:21.615Z",
+  "built_at": "2026-09-06T16:32:40.671Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 443,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2019,
+    "functional_verbatim": 2020,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2486,
-  "tree_sha256": "d57c07e4504ac8b16360e27f874cfc39373a7dfc066c854f1da2e7cb84443a6f",
+  "file_count": 2487,
+  "tree_sha256": "a3c96b5cf7b985332e67132f9626118afc2968733a0e5cd2cf0a7fbe7d885540",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -392,7 +392,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "1b28c414b039d21ab8105d1687cf6d75cde078238ac84b920885772cd5e9bdbf"
+      "sha256": "24cbe2964b71993d9d6e55daaf0dc26c938f820c7c4f6c01579d9dd2508e89ba"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1782,7 +1782,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "60adc1a2c18e8237b1c7a6d261998aa77d08b0c699231d31551276d8621e5085"
+      "sha256": "1ad70f7f1cb7f53735f17fbd8e05287c9191a1d249493c928efb91692b491941"
     },
     {
       "path": "docs/architecture.md",
@@ -2657,7 +2657,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "4fbdf9b8a0c6ed21e403472dcec14bfc4cad53d58e43dd717e6bea8531a8cb47"
+      "sha256": "99b29fcf1f9a58ee17ba9d77e3c0c30b37940ee8af0c71396813f7514d960ba1"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5432,7 +5432,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "713b7165b1dbbfe43a77db5678ea98ebb03e17209d7b7bee5dbd1fc416be5cc2"
+      "sha256": "abba32642e123860fee7b33fe429294783480afd2e25a78f63f9d4af3b1613e8"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5637,7 +5637,7 @@
     {
       "path": "modules/lifecycle/routes/done-when.js",
       "mode": "0000644",
-      "sha256": "73dee3ef1546bf873a27bac8a160c8de64a6dbb5d0da6f3b68648d3a90e07d21"
+      "sha256": "25b18aa82f5b2951f3a9560fa5285dc2793556303ed68ae0aa9ea781ec2d45c9"
     },
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
@@ -5647,7 +5647,7 @@
     {
       "path": "modules/lifecycle/routes/goal-route-authz.js",
       "mode": "0000644",
-      "sha256": "be82985479547bd602dbad544b5e71a3c491cea3c7b0273394c136f1df675b37"
+      "sha256": "909686de2d34b184e9676370782e4b07179b784c72eb6db4af22399051b15642"
     },
     {
       "path": "modules/lifecycle/routes/goals.js",
@@ -5697,7 +5697,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "0a086a473b3e0267b4ad250a98a6551c952370da5bfdf5232738e04b0eaf59d6"
+      "sha256": "f8fb76f7aaf035974472c011a379b450ee001adc33c01c56ed8a38a3dc4a8fc8"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -7477,12 +7477,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "04c6a38f5cf60c8912b9254235861cc431f7af898d7ae34924248f34c9f62ac2"
+      "sha256": "248924f051a38d806cdf6818c66768dd3d1cf7f62196a01aee776f7f1849374e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "057cb53bcef464cfe8d189bbc80b9d9860a32c19b20e33a6ae58ce64b1aeb775"
+      "sha256": "3fac6b2004dd142b67afdce4e5939f5166ab777e74900e25b522af68568eb23f"
     },
     {
       "path": "public-docs/index.html",
@@ -9177,7 +9177,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "aa7e5a37bf8cdacca8bd176ac732662b81d868df50e21930a23517c040882534"
+      "sha256": "e0d8e56756e81c431cc74eaf5cea2ed87839bf7e6a222c98e43c279fd66d5beb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10247,7 +10247,7 @@
     {
       "path": "tests/goal_achievement.mjs",
       "mode": "0000644",
-      "sha256": "a6ddb674d4ce1f6da9eb7b653ef92b9f0fcc85387e70bdf5358aff84ef518824"
+      "sha256": "3e157d5bf44370e4935b70203fe59e40cf9120d12c472f24ed7bd85cb33cbe91"
     },
     {
       "path": "tests/goal_advisory.mjs",
@@ -11322,7 +11322,7 @@
     {
       "path": "tests/patch_gate_ordering.mjs",
       "mode": "0000644",
-      "sha256": "0412f6874d6046b7f74025b2b14c90cf345e904769502c2679365cd6d1fb8b11"
+      "sha256": "b0690cf28c30bfa4ef1ecc4ceffa7d4be1666dbb09a6605ceb02cc057d2a9cc4"
     },
     {
       "path": "tests/path_match.mjs",
@@ -12244,6 +12244,11 @@
       "mode": "0000644",
       "sha256": "514be815c0466e4e2865ad85cb7a2ca206e5b46abc7b345da2c36278667c8bb2"
     },
+    {
+      "path": "tests/task_goal_open_gate.mjs",
+      "mode": "0000644",
+      "sha256": "93a5d1e91bfea7af8487b409e60cd609ea25a690df9099d278ebd35f253abcb8"
+    },
     {
       "path": "tests/task_lib.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -243,7 +243,6 @@ export interface PostCostResponse { skipped?: boolean; reason?: unknown; id?: un
 export interface PostDependenciesResponse { ok: boolean; dependency: unknown }
 export interface PostDiscordChannelsReconcileResponse { ok: boolean; applied: unknown; failed: unknown; total: unknown; warnings: unknown }
 export interface PostDoneWhenCriterionIdSatisfyRequest { satisfied_by_task_id?: number }
-export interface PostDoneWhenCriterionIdSatisfyResponse { criterion: unknown; goal_achieved: unknown; goal: unknown }
 export interface PostDoneWhenCriterionIdUnsatisfyResponse { criterion: unknown }
 export interface PostGateApprovalsPrApproveResponse { ok: boolean; pr: unknown; already_clear?: boolean; message: unknown; head_sha?: unknown; status_set?: boolean; recheck?: unknown }
 export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "public" | "private" }
@@ -638,7 +637,7 @@ export interface BongosClient {
     /** PATCH /done-when/{criterionId} — rank: metic+archon */
     patchDoneWhenCriterionId(args: RequestArgs & { body: PatchDoneWhenCriterionIdRequest }): Promise<PatchDoneWhenCriterionIdResponse>;
     /** POST /done-when/{criterionId}/satisfy — rank: metic+archon */
-    postDoneWhenCriterionIdSatisfy(args?: RequestArgs & { body?: PostDoneWhenCriterionIdSatisfyRequest }): Promise<PostDoneWhenCriterionIdSatisfyResponse>;
+    postDoneWhenCriterionIdSatisfy(args?: RequestArgs & { body?: PostDoneWhenCriterionIdSatisfyRequest }): Promise<ApiResponse>;
     /** POST /done-when/{criterionId}/unsatisfy — rank: metic+archon */
     postDoneWhenCriterionIdUnsatisfy(args?: RequestArgs): Promise<PostDoneWhenCriterionIdUnsatisfyResponse>;
     /** GET /done-when/pending-review — rank: metic+archon */

package/docs/api/openapi.json

@@ -4397,14 +4397,7 @@
         },
         "responses": {
           "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostDoneWhenCriterionIdSatisfyResponse"
-                }
-              }
-            }
+            "description": "Success."
           },
           "400": {
             "$ref": "#/components/responses/ValidationFailed"
@@ -19629,19 +19622,6 @@
         },
         "additionalProperties": false
       },
-      "PostDoneWhenCriterionIdSatisfyResponse": {
-        "type": "object",
-        "properties": {
-          "criterion": {},
-          "goal_achieved": {},
-          "goal": {}
-        },
-        "required": [
-          "criterion",
-          "goal_achieved",
-          "goal"
-        ]
-      },
       "PostDoneWhenCriterionIdUnsatisfyResponse": {
         "type": "object",
         "properties": {
@@ -22460,8 +22440,8 @@
     }
   },
   "x-endpoint-count": 356,
-  "x-schema-count": 391,
+  "x-schema-count": 390,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 265,
+  "x-response-schemas": 264,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/module-api-changelog.md

@@ -1559,5 +1559,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.553 with no explicit bump. run 34044540046. (task 1002620)
   1.19.555 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.554 with no explicit bump. run 34045075186. (task 1002620)
+  1.19.556 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.555 with no explicit bump. run 34045323629. (task 1002620)
+  1.19.557 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.556 with no explicit bump. run 34045753301. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-goals.js

@@ -15,6 +15,7 @@ const { pool } = api;
 const doneWhen = require('./done-when.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { nonTerminalSql } = require('./task-status');
+const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 // -------------------------------------------------------------------------
 // Goals (ADR 0086 §2 / BV1.R56 — task 1510)
@@ -199,16 +200,32 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
   if (!goal || goal.status !== 'open') return { achieved: false, goal: goal ?? null };
   const { rows } = await activePool.query(
     `SELECT count(*)::int                              AS total,
-            count(*) FILTER (WHERE NOT satisfied)::int AS unsatisfied
+            count(*) FILTER (WHERE NOT satisfied)::int AS unsatisfied,
+            (SELECT count(*)::int FROM tasks t
+              WHERE t.goal_id = $1 AND ${nonTerminalSql()}
+                AND ${SMOKE_NOT_LIKE.replace(/title/, 't.title')}) AS unfinished_tasks
        FROM done_when_criteria
       WHERE goal_id = $1`,
     [goalId]
   );
   const total = rows[0]?.total ?? 0;
   const unsatisfied = rows[0]?.unsatisfied ?? 0;
+  const unfinishedTasks = rows[0]?.unfinished_tasks ?? 0;
   // Need ≥1 criterion and zero unsatisfied — confirming the LAST one is the
   // trigger. An empty goal stays open (nothing could complete it).
   if (total === 0 || unsatisfied > 0) return { achieved: false, goal };
+  // BV1.R08 (task 1003595, goal 1000086, ADR 0250 D2): AND no task in the goal is
+  // still non-terminal. Criteria alone were never the whole question — a task
+  // linked to NO criterion held nothing open, so a goal auto-achieved while
+  // carrying any number of backlog or ready tasks. Terminal is `shipped` or
+  // deliberately `abandoned` (task-status.js); `completed` and `confirmed` are
+  // mid-ship states that can still fail a grade or strand, so they hold the goal
+  // open too. Smoke rows are excluded the way version_progress excludes them — a
+  // test fixture must not be able to wedge a real goal open forever.
+  //
+  // This never blocks a SHIP; it declines only the goal's flip to achieved, and
+  // the goal simply stays open until its last task lands or is abandoned.
+  if (unfinishedTasks > 0) return { achieved: false, goal, unfinishedTasks };
   const updated = await setGoalStatus({ goalId, status: 'achieved' }, deps);
   return { achieved: true, goal: updated };
 }

package/modules/lifecycle/routes/done-when.js

@@ -212,7 +212,16 @@ module.exports = function buildDoneWhenRouter() {
     if (updated?.goal_id != null) {
       goalResult = await db.achieveGoalIfComplete({ goalId: updated.goal_id });
     }
-    res.json({ criterion: updated, goal_achieved: goalResult.achieved, goal: goalResult.goal });
+    // BV1.R08 (task 1003595): when the goal did NOT flip because it still holds
+    // unfinished work, say so. Confirming the last criterion and getting a bare
+    // `goal_achieved: false` back reads as a bug to the agent that just did it —
+    // it would retry, or file one. The count is the whole explanation.
+    res.json({
+      criterion: updated,
+      goal_achieved: goalResult.achieved,
+      goal: goalResult.goal,
+      ...(goalResult.unfinishedTasks ? { goal_held_open_by_tasks: goalResult.unfinishedTasks } : {}),
+    });
   }, { errorCode: 'satisfy_failed' }));
 
   // PATCH /done-when/:criterionId — correct a criterion's TEXT (task 1003102).

package/modules/lifecycle/routes/goal-route-authz.js

@@ -44,14 +44,36 @@ async function isMemberOrArchon(builder, goalId) {
 // (grader permission/route-rank pre-passes + serverSideGuards, gate-review
 // ESCALATE floor, post-push main-audit — ADR 0086 §7). Returns { ok:true } or
 // { ok:false, status, body } (the exact HTTP status + JSON the route sends).
+// goalNotOpenRefusal — the ONE definition of "this goal takes no new work", so the
+// three vectors that can put a task into a goal cannot drift apart (BV1.R05, task
+// 1003590, goal 1000086). Returns null when the goal is open, or the refusal's
+// parts when it is not; each caller renders them in its own idiom (this module's
+// { ok, status, body }, or res.fail in task-write-routes.js). Assumes the caller
+// has already established the goal EXISTS — a missing goal is a 404, a different
+// answer to a different question.
+//
+// Only 'open' takes new work: 'achieved' and 'archived' are closures, and a task
+// added to either is exactly how a goal that reported done silently reacquires
+// unfinished work.
+function goalNotOpenRefusal(goal) {
+  if (goal && goal.status === 'open') return null;
+  return {
+    status: 409,
+    error: 'goal_not_open',
+    goalStatus: goal ? goal.status : null,
+    message: 'Tasks can only be authored under an open goal.',
+  };
+}
+
 function authorizeGoalTaskCreate({ goal, version, isMember, builderRank, touches }) {
   if (!goal) {
     return { ok: false, status: 404, body: { error: 'goal_not_found' } };
   }
-  if (goal.status !== 'open') {
-    return { ok: false, status: 409, body: {
-      error: 'goal_not_open', status: goal.status,
-      message: 'Tasks can only be authored under an open goal.',
+  const notOpen = goalNotOpenRefusal(goal);
+  if (notOpen) {
+    return { ok: false, status: notOpen.status, body: {
+      error: notOpen.error, status: notOpen.goalStatus,
+      message: notOpen.message,
     } };
   }
   if (!isMember) {
@@ -445,6 +467,7 @@ module.exports = {
   authorizeRescindInvitation,
   authorizeWithdrawJoinRequest,
   decorateGoalScope,
+  goalNotOpenRefusal,
   isMemberOrArchon,
   protectedScopeAdmissionBlock,
 };

package/modules/lifecycle/routes/task-write-routes.js

@@ -26,6 +26,7 @@ const { classifyTaskKind, VALID_KINDS, VALID_DISCIPLINES, VOTABLE_TASK_STATUSES,
 const { isModuleKey, moduleKeys } = api.moduleScopeMap;
 const { validateOrRespond, LIMITS, parseId } = api;
 const { badKind, detectsMigration } = require('./task-route-helpers.js');
+const { goalNotOpenRefusal } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 
@@ -169,6 +170,16 @@ module.exports = function registerTaskWriteRoutes(router) {
       if (!goal || String(goal.version_id) !== String(body.version_id)) {
         return res.fail('bad_goal_id', { status: 400, message: `goal_id ${body.goal_id} does not exist on version '${body.version_id}'.` });
       }
+      // BV1.R05 (task 1003590, goal 1000086): a task may only be authored under
+      // an OPEN goal. `POST /goals/:id/tasks` has always refused this via
+      // authorizeGoalTaskCreate; this vector validated only existence + version,
+      // so the same task refused on the goal-scoped route landed in an achieved
+      // or archived goal when created here. Same named 409, deliberately, so a
+      // caller handles ONE code rather than learning which door it came through.
+      const notOpen = goalNotOpenRefusal(goal);
+      if (notOpen) {
+        return res.fail(notOpen.error, { status: notOpen.status, message: notOpen.message, details: { goal_status: notOpen.goalStatus } });
+      }
     }
     try {
       const task = await db.createTask({
@@ -401,6 +412,13 @@ module.exports = function registerTaskWriteRoutes(router) {
         if (String(goal.version_id) !== String(task.version_id)) {
           return res.fail('goal_version_mismatch', { status: 409, message: `Goal #${goalId} is in version '${goal.version_id}' but task #${id} is in '${task.version_id}'. A task can only join a goal in its own version.` });
         }
+        // BV1.R05 (task 1003590, goal 1000086): the same open-goal rule as the
+        // create vectors. Moving a task INTO a closed goal is how a goal that
+        // reported achieved silently reacquires unfinished work.
+        const notOpen = goalNotOpenRefusal(goal);
+        if (notOpen) {
+          return res.fail(notOpen.error, { status: notOpen.status, message: notOpen.message, details: { goal_status: notOpen.goalStatus } });
+        }
       } catch (err) {
         log.error('[gds] PATCH /tasks/:id goal_id', err);
         return res.fail('patch_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.555",
+  "version": "1.19.557",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.555",
+      "version": "1.19.557",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.555",
+  "version": "1.19.557",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.555'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.557'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_achievement.mjs

@@ -20,6 +20,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
 import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
@@ -47,7 +48,10 @@ const GOAL = (over = {}) => ({
 function goalHandler({ goal, counts }) {
   return (s) => {
     if (/^SELECT .*FROM goals WHERE id = \$1/.test(s)) return { rows: goal ? [goal] : [] };
-    if (/FROM done_when_criteria WHERE goal_id = \$1/.test(s)) return { rows: [counts] };
+    // BV1.R08: the criteria count and the unfinished-task count come back in ONE
+    // row. `unfinished_tasks` defaults to 0 so every pre-existing case below still
+    // means what it meant — criteria alone decide it when no task is open.
+    if (/FROM done_when_criteria WHERE goal_id = \$1/.test(s)) return { rows: [{ unfinished_tasks: 0, ...counts }] };
     if (/^UPDATE goals/.test(s)) return { rows: [{ ...goal, status: 'achieved', updated_at: 'T1' }] };
     return null;
   };
@@ -145,4 +149,63 @@ await test('listPendingReviewCriteria: SQL encodes the auto-flag (all shipped) +
 });
 
 // -------------------------------------------------------------------------
+
+// =========================================================================
+// BV1.R08 (task 1003595, goal 1000086, ADR 0250 D2) — criteria are not the whole
+// question: a goal cannot close while it still holds non-terminal work.
+//
+// The hole this shuts: achievement was computed from done_when_criteria alone, so
+// a task linked to NO criterion held nothing open and a goal auto-achieved while
+// carrying any number of backlog or ready tasks. Fourteen goals on the live
+// instance were in exactly that state, holding thirty-five tasks between them.
+// =========================================================================
+
+await test('R08: all criteria satisfied but ONE unfinished task remains → no flip', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 3, unsatisfied: 0, unfinished_tasks: 1 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, false, 'satisfied criteria are necessary, not sufficient');
+  assert.equal(out.goal.status, 'open', 'the goal stays open until the work lands');
+  assert.equal(out.unfinishedTasks, 1, 'and it reports WHY, so a caller can say so');
+  assert.equal(find(pool.queries, /^UPDATE goals/), undefined, 'must NOT flip the status');
+});
+
+await test('R08: the count is asked in the SAME round trip as the criteria count', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 1, unsatisfied: 0, unfinished_tasks: 0 } }));
+  await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  const q = find(pool.queries, /FROM done_when_criteria WHERE goal_id = \$1/);
+  const sql = String(q.sql).replace(/\s+/g, ' ');
+  assert.match(sql, /FROM tasks t WHERE t\.goal_id = \$1/, 'one query, not a second trip');
+  assert.match(sql, /t\.status NOT IN \('shipped', 'abandoned'\)/,
+    "the terminal set comes from task-status.js — mid-ship states hold the goal open");
+  assert.match(sql, /t\.title NOT LIKE/, 'a smoke fixture must not wedge a real goal open forever');
+  assert.deepEqual(q.params, [7], 'the goal id is bound once and reused');
+});
+
+await test('R08: zero unfinished tasks and all criteria satisfied → still flips', async () => {
+  // The rule must not become "goals never close". This is the whole happy path.
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 2, unsatisfied: 0, unfinished_tasks: 0 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, true, 'finished work + satisfied criteria = achieved');
+  assert.ok(find(pool.queries, /^UPDATE goals/), 'the flip is persisted');
+});
+
+await test('R08: an unsatisfied criterion still short-circuits before the task check', async () => {
+  // Ordering matters for the message, not the outcome: a goal with open criteria
+  // AND open tasks is refused on the criteria, and reports no task count.
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 3, unsatisfied: 2, unfinished_tasks: 9 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, false);
+  assert.equal(out.unfinishedTasks, undefined,
+    'the criteria refusal is the honest reason when both are true');
+});
+
+await test('R08: the satisfy route tells the caller a goal was held open by work', async () => {
+  // A bare goal_achieved:false after confirming the LAST criterion reads as a bug
+  // to the agent that just did it. The route names the reason when there is one.
+  const src = readFileSync(new URL('../modules/lifecycle/routes/done-when.js', import.meta.url), 'utf8');
+  assert.match(src, /goal_held_open_by_tasks: goalResult\.unfinishedTasks/);
+  assert.match(src, /\.\.\.\(goalResult\.unfinishedTasks \?/,
+    'and stays silent on the ordinary path, so the response shape is unchanged when nothing is held');
+});
+
 summary();

package/tests/patch_gate_ordering.mjs

@@ -42,6 +42,9 @@ const REFUSALS = [
   "'bad_goal_id'",
   "'goal_not_found'",
   "'goal_version_mismatch'",
+  // BV1.R05 (task 1003590): the open-goal refusal joins the list — it is
+  // rendered from goalNotOpenRefusal, so the pin looks for the call.
+  'goalNotOpenRefusal(goal)',
   "'bad_requires_rank'",
   'badKind(res)',
   "'bad_discipline'",

package/tests/task_goal_open_gate.mjs

@@ -0,0 +1,141 @@
+// tests/task_goal_open_gate.mjs — a task may only be authored under an OPEN goal,
+// on every vector that can put one there (BV1.R05, task 1003590, goal 1000086).
+//
+// THE ASYMMETRY THIS CLOSES. `POST /goals/:id/tasks` has always refused a closed
+// goal — it runs the ordered gate `authorizeGoalTaskCreate`, whose second check is
+// `goal_not_open`. The other two vectors did not: `POST /tasks` validated only that
+// the goal EXISTS and belongs to the version, and `PATCH /tasks/:id` only that the
+// versions match. So the very same task, refused at the goal-scoped door, landed in
+// an `achieved` or `archived` goal when created through the general one — which is
+// how a goal that reported done silently reacquires unfinished work, the failure
+// goal 1000086 exists to make impossible.
+//
+// The refusal is now ONE predicate, `goalNotOpenRefusal`, consumed by all three, so
+// a caller handles a single named 409 rather than learning which door it came
+// through — and the three cannot drift apart later. This file pins the predicate's
+// behaviour, that each vector actually consumes it, and that the shared 409 stays
+// named the same on the goal-scoped route.
+//
+// Run:  node --test tests/task_goal_open_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const authz = require('../modules/lifecycle/routes/goal-route-authz.js');
+const { goalNotOpenRefusal, authorizeGoalTaskCreate } = authz;
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const WRITE_ROUTES = src('modules/lifecycle/routes/task-write-routes.js');
+
+// The handler slices, so "the vector consumes the predicate" is asserted about the
+// right handler rather than anywhere in a 1,000-line file.
+function slice(source, start, end) {
+  const a = source.indexOf(start);
+  assert.notEqual(a, -1, 'handler not found: ' + start);
+  // `end` absent means the handler runs to the end of the file — PATCH /tasks/:id
+  // is currently the last route declared here, and a slice that silently came back
+  // empty would make every assertion below pass vacuously.
+  const b = end ? source.indexOf(end, a + 1) : source.length;
+  assert.notEqual(b, -1, 'no route follows: ' + start);
+  const out = source.slice(a, b);
+  assert.ok(out.length > 500, 'the slice must actually contain the handler');
+  return out;
+}
+const POST_TASKS = slice(WRITE_ROUTES, "router.post('/tasks'", "router.patch('/tasks/:id'");
+const PATCH_TASK = slice(WRITE_ROUTES, "router.patch('/tasks/:id'", null);
+
+// ---- the predicate ----------------------------------------------------------
+
+test('open takes new work; achieved and archived do not', () => {
+  assert.equal(goalNotOpenRefusal({ status: 'open' }), null,
+    'an open goal is the only one that takes new work');
+  for (const status of ['achieved', 'archived']) {
+    const r = goalNotOpenRefusal({ status });
+    assert.ok(r, status + ' must refuse');
+    assert.equal(r.status, 409);
+    assert.equal(r.error, 'goal_not_open');
+    assert.equal(r.goalStatus, status, 'the caller can say WHICH closure refused');
+  }
+});
+
+test('an unknown or absent status refuses — the predicate is fail-closed', () => {
+  // Not a hypothetical: a future goal status nobody taught this function about
+  // must not become a hole. Anything that is not exactly 'open' is refused.
+  assert.ok(goalNotOpenRefusal({ status: 'paused' }), 'an unknown status is not open');
+  assert.ok(goalNotOpenRefusal({}), 'a goal row with no status is not open');
+  assert.ok(goalNotOpenRefusal(null), 'a nullish goal is not open');
+  assert.equal(goalNotOpenRefusal(null).goalStatus, null,
+    'and it reports no status rather than throwing');
+});
+
+// ---- the three vectors ------------------------------------------------------
+
+test('POST /goals/:id/tasks — the ordered gate still renders the same 409', () => {
+  const out = authorizeGoalTaskCreate({
+    goal: { id: 1, status: 'archived', version_id: 'V1' },
+    version: { id: 'V1', status: 'building' },
+    isMember: true, builderRank: 'metic', touches: [],
+  });
+  assert.equal(out.ok, false);
+  assert.equal(out.status, 409);
+  assert.equal(out.body.error, 'goal_not_open');
+  assert.equal(out.body.status, 'archived',
+    "the goal-scoped route's body shape is unchanged by the extraction");
+});
+
+test('POST /tasks consumes the shared predicate and refuses with its code', () => {
+  assert.match(POST_TASKS, /const notOpen = goalNotOpenRefusal\(goal\);/,
+    'the general create vector must ask the same question');
+  assert.match(POST_TASKS, /res\.fail\(notOpen\.error, \{ status: notOpen\.status/,
+    'and render that answer, rather than a second hand-typed 409');
+});
+
+test('PATCH /tasks/:id consumes it too — moving INTO a closed goal is the same act', () => {
+  assert.match(PATCH_TASK, /const notOpen = goalNotOpenRefusal\(goal\);/);
+  assert.match(PATCH_TASK, /res\.fail\(notOpen\.error, \{ status: notOpen\.status/);
+});
+
+test('no task-authoring vector re-types the refusal behind the predicate', () => {
+  // The point of the extraction: three copies of `goal.status !== 'open'` is three
+  // things to forget to update. Scoped to the vectors that author a TASK — the
+  // other `goal_not_open` refusals in goal-route-authz.js (membership change,
+  // ownership transfer, join request, invitation accept) share the code but answer
+  // different questions with their own messages, and folding them into this
+  // predicate would flatten four distinct explanations into one.
+  const AUTHZ = src('modules/lifecycle/routes/goal-route-authz.js');
+  const gateStart = AUTHZ.indexOf('function authorizeGoalTaskCreate');
+  assert.notEqual(gateStart, -1);
+  const taskAuthoring = [
+    ['task-write-routes.js', WRITE_ROUTES],
+    ['authorizeGoalTaskCreate', AUTHZ.slice(gateStart, AUTHZ.indexOf('\nfunction ', gateStart + 1))],
+  ];
+  for (const [name, body] of taskAuthoring) {
+    const hand = body.match(/goal\.status !== 'open'/g) || [];
+    assert.equal(hand.length, 0,
+      name + ' must call goalNotOpenRefusal, not compare goal.status itself');
+  }
+  assert.match(AUTHZ, /goal && goal\.status === 'open'/,
+    'the one comparison lives inside the predicate');
+});
+
+// ---- the refusal is reachable, i.e. it precedes the write -------------------
+
+test('POST /tasks settles the refusal BEFORE it creates anything', () => {
+  const gate = POST_TASKS.indexOf('goalNotOpenRefusal');
+  const write = POST_TASKS.indexOf('await db.createTask(');
+  assert.notEqual(write, -1, 'the create call must be in this slice');
+  assert.ok(gate !== -1 && gate < write,
+    'a refusal after the insert is not a refusal — it is a row plus an error');
+});
+
+test('PATCH /tasks/:id settles it before the first update write (the G-22 rule)', () => {
+  const gate = PATCH_TASK.indexOf('goalNotOpenRefusal');
+  const write = PATCH_TASK.search(/await db\.updateTask\w+\(/);
+  assert.notEqual(write, -1, 'an updateTask* write must be in this slice');
+  assert.ok(gate !== -1 && gate < write,
+    'task 1002609 G-22: authorization settles before any field is written');
+});