@bongos/core 1.19.556 → 1.19.558

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.556",
-  "core_contract": "1.19.556",
-  "source_commit": "630915928321f40355bf907504db7d3808103819",
+  "core_version": "1.19.558",
+  "core_contract": "1.19.558",
+  "source_commit": "3f1c35f7e8595d597e7174a4b57801739138e35a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T16:24:47.828Z",
+  "built_at": "2026-09-06T16:50:32.542Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 443,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2487,
-  "tree_sha256": "8afebde5b8e0633b5f7bab9c710cf9377d7723223debe626b5d25141306945b8",
+  "tree_sha256": "cf1dadb6f0fb444dffe307f0e5b6d7ad76eb9e3fc7833a3e034f456f45ecf4c3",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -392,7 +392,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "1b28c414b039d21ab8105d1687cf6d75cde078238ac84b920885772cd5e9bdbf"
+      "sha256": "24cbe2964b71993d9d6e55daaf0dc26c938f820c7c4f6c01579d9dd2508e89ba"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1782,12 +1782,12 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "60adc1a2c18e8237b1c7a6d261998aa77d08b0c699231d31551276d8621e5085"
+      "sha256": "1ad70f7f1cb7f53735f17fbd8e05287c9191a1d249493c928efb91692b491941"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "10a4bda9248333a4a3bca3b015c70ae9d2f973772be75e790a800420e5d5e8bf"
+      "sha256": "1fe7548e94bd9b29642bdddc8dacb201072782f181b517be2bac5fed1b1cd356"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2657,7 +2657,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f11f56a37c620d20df67c30b4b52a4028f716ec76ab81f6089365a0177191095"
+      "sha256": "7fd202776ba59c21897773679f9f07221de79ba577a6d5e6500df52698b85386"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5432,7 +5432,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "713b7165b1dbbfe43a77db5678ea98ebb03e17209d7b7bee5dbd1fc416be5cc2"
+      "sha256": "abba32642e123860fee7b33fe429294783480afd2e25a78f63f9d4af3b1613e8"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5482,7 +5482,7 @@
     {
       "path": "modules/lifecycle/done-when.js",
       "mode": "0000644",
-      "sha256": "4e276151342f0eab3d4c0cea1ed55db8716a1d3d4b40568966be495f4892c1f4"
+      "sha256": "4e798aff55de6481ea9da3f8a08e68d99902f3eac4749e30d727517ff61176b5"
     },
     {
       "path": "modules/lifecycle/est-advisory.js",
@@ -5637,7 +5637,7 @@
     {
       "path": "modules/lifecycle/routes/done-when.js",
       "mode": "0000644",
-      "sha256": "73dee3ef1546bf873a27bac8a160c8de64a6dbb5d0da6f3b68648d3a90e07d21"
+      "sha256": "25b18aa82f5b2951f3a9560fa5285dc2793556303ed68ae0aa9ea781ec2d45c9"
     },
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
@@ -7477,12 +7477,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9572c814d88a40b50276ab717eda1552f5e5083f619aca169a1f769ab85605e1"
+      "sha256": "3d98dfe15e37d556fbb8b69fe49aefaa10ffb350560704361a420803e5bd1169"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6ce32885b125422348ef232ab9dc1aed9b542e40331f9c34d84b985e9dc69608"
+      "sha256": "94d2145a407d981305d11aa4f7b6fcb2997d831856b978836ceece7f91f48de5"
     },
     {
       "path": "public-docs/index.html",
@@ -9177,7 +9177,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "07e66085dcd49d32044edf2caca55c4a3f5ec8d9f150281ed0e97c5859a6cb6e"
+      "sha256": "8e9e2a140d38ec1307d8c062aeb950ee5cadc17a0a166d5e96ec41f3b202c375"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9437,7 +9437,7 @@
     {
       "path": "tests/auto_satisfy_criteria.mjs",
       "mode": "0000644",
-      "sha256": "548e6a477660bb5e5cb260a0d5821bc3e11201225e64cfa45611c2fae07c80b2"
+      "sha256": "d63beea7b680a194d163aa5ad11806c9aa860de93d614195a05a33082e9f8adb"
     },
     {
       "path": "tests/autonomous_fit_protected_paths.mjs",
@@ -10247,7 +10247,7 @@
     {
       "path": "tests/goal_achievement.mjs",
       "mode": "0000644",
-      "sha256": "a6ddb674d4ce1f6da9eb7b653ef92b9f0fcc85387e70bdf5358aff84ef518824"
+      "sha256": "3e157d5bf44370e4935b70203fe59e40cf9120d12c472f24ed7bd85cb33cbe91"
     },
     {
       "path": "tests/goal_advisory.mjs",

package/clients/bongos-client/index.d.ts

@@ -243,7 +243,6 @@ export interface PostCostResponse { skipped?: boolean; reason?: unknown; id?: un
 export interface PostDependenciesResponse { ok: boolean; dependency: unknown }
 export interface PostDiscordChannelsReconcileResponse { ok: boolean; applied: unknown; failed: unknown; total: unknown; warnings: unknown }
 export interface PostDoneWhenCriterionIdSatisfyRequest { satisfied_by_task_id?: number }
-export interface PostDoneWhenCriterionIdSatisfyResponse { criterion: unknown; goal_achieved: unknown; goal: unknown }
 export interface PostDoneWhenCriterionIdUnsatisfyResponse { criterion: unknown }
 export interface PostGateApprovalsPrApproveResponse { ok: boolean; pr: unknown; already_clear?: boolean; message: unknown; head_sha?: unknown; status_set?: boolean; recheck?: unknown }
 export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "public" | "private" }
@@ -638,7 +637,7 @@ export interface BongosClient {
     /** PATCH /done-when/{criterionId} — rank: metic+archon */
     patchDoneWhenCriterionId(args: RequestArgs & { body: PatchDoneWhenCriterionIdRequest }): Promise<PatchDoneWhenCriterionIdResponse>;
     /** POST /done-when/{criterionId}/satisfy — rank: metic+archon */
-    postDoneWhenCriterionIdSatisfy(args?: RequestArgs & { body?: PostDoneWhenCriterionIdSatisfyRequest }): Promise<PostDoneWhenCriterionIdSatisfyResponse>;
+    postDoneWhenCriterionIdSatisfy(args?: RequestArgs & { body?: PostDoneWhenCriterionIdSatisfyRequest }): Promise<ApiResponse>;
     /** POST /done-when/{criterionId}/unsatisfy — rank: metic+archon */
     postDoneWhenCriterionIdUnsatisfy(args?: RequestArgs): Promise<PostDoneWhenCriterionIdUnsatisfyResponse>;
     /** GET /done-when/pending-review — rank: metic+archon */

package/docs/api/openapi.json

@@ -4397,14 +4397,7 @@
         },
         "responses": {
           "200": {
-            "description": "Success.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PostDoneWhenCriterionIdSatisfyResponse"
-                }
-              }
-            }
+            "description": "Success."
           },
           "400": {
             "$ref": "#/components/responses/ValidationFailed"
@@ -19629,19 +19622,6 @@
         },
         "additionalProperties": false
       },
-      "PostDoneWhenCriterionIdSatisfyResponse": {
-        "type": "object",
-        "properties": {
-          "criterion": {},
-          "goal_achieved": {},
-          "goal": {}
-        },
-        "required": [
-          "criterion",
-          "goal_achieved",
-          "goal"
-        ]
-      },
       "PostDoneWhenCriterionIdUnsatisfyResponse": {
         "type": "object",
         "properties": {
@@ -22460,8 +22440,8 @@
     }
   },
   "x-endpoint-count": 356,
-  "x-schema-count": 391,
+  "x-schema-count": 390,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 265,
+  "x-response-schemas": 264,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/architecture.md

@@ -120,7 +120,8 @@ tasks(id, version_id, title, description, status, touches text[], est_minutes, e
     shipped   = merged to main + deployed; credits awarded here (credit_log.reason =
                 'task.shipped' — ADR 0120 pays on land, not on confirm; which streams
                 actually pay depends on the instance reward mode, ADR 0146)
-  indexes: (version_id, status), (priority), GIN(touches)
+  indexes: (version_id, status), (priority), GIN(touches), (goal_id), (parent_task_id),
+           (created_by), (shipped_by) WHERE needs_rebase
 task_blockers(task_id, blocker_ref)            -- markdown anchors are canonical
 claims(id, task_id, builder_id, worktree_name, claimed_at, released_at, outcome)
   UNIQUE INDEX uniq_active_claim_per_task ON (task_id) WHERE released_at IS NULL

package/docs/module-api-changelog.md

@@ -1561,5 +1561,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.554 with no explicit bump. run 34045075186. (task 1002620)
   1.19.556 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.555 with no explicit bump. run 34045323629. (task 1002620)
+  1.19.557 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.556 with no explicit bump. run 34045753301. (task 1002620)
+  1.19.558 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.557 with no explicit bump. run 34046699120. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-goals.js

@@ -15,6 +15,7 @@ const { pool } = api;
 const doneWhen = require('./done-when.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { nonTerminalSql } = require('./task-status');
+const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 // -------------------------------------------------------------------------
 // Goals (ADR 0086 §2 / BV1.R56 — task 1510)
@@ -199,16 +200,32 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
   if (!goal || goal.status !== 'open') return { achieved: false, goal: goal ?? null };
   const { rows } = await activePool.query(
     `SELECT count(*)::int                              AS total,
-            count(*) FILTER (WHERE NOT satisfied)::int AS unsatisfied
+            count(*) FILTER (WHERE NOT satisfied)::int AS unsatisfied,
+            (SELECT count(*)::int FROM tasks t
+              WHERE t.goal_id = $1 AND ${nonTerminalSql()}
+                AND ${SMOKE_NOT_LIKE.replace(/title/, 't.title')}) AS unfinished_tasks
        FROM done_when_criteria
       WHERE goal_id = $1`,
     [goalId]
   );
   const total = rows[0]?.total ?? 0;
   const unsatisfied = rows[0]?.unsatisfied ?? 0;
+  const unfinishedTasks = rows[0]?.unfinished_tasks ?? 0;
   // Need ≥1 criterion and zero unsatisfied — confirming the LAST one is the
   // trigger. An empty goal stays open (nothing could complete it).
   if (total === 0 || unsatisfied > 0) return { achieved: false, goal };
+  // BV1.R08 (task 1003595, goal 1000086, ADR 0250 D2): AND no task in the goal is
+  // still non-terminal. Criteria alone were never the whole question — a task
+  // linked to NO criterion held nothing open, so a goal auto-achieved while
+  // carrying any number of backlog or ready tasks. Terminal is `shipped` or
+  // deliberately `abandoned` (task-status.js); `completed` and `confirmed` are
+  // mid-ship states that can still fail a grade or strand, so they hold the goal
+  // open too. Smoke rows are excluded the way version_progress excludes them — a
+  // test fixture must not be able to wedge a real goal open forever.
+  //
+  // This never blocks a SHIP; it declines only the goal's flip to achieved, and
+  // the goal simply stays open until its last task lands or is abandoned.
+  if (unfinishedTasks > 0) return { achieved: false, goal, unfinishedTasks };
   const updated = await setGoalStatus({ goalId, status: 'achieved' }, deps);
   return { achieved: true, goal: updated };
 }

package/modules/lifecycle/done-when.js

@@ -25,6 +25,7 @@
 
 const { pool } = require('../../src/module-api');
 const { nonTerminalSql } = require('./task-status');
+const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 // isPendingReview — the ONE derivation of the "met — pending review" auto-flag
 // (ADR 0086 §6 / BV1.R63): a criterion with >=1 linked task, every one shipped,
@@ -445,8 +446,33 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null } = {}) {
   // Cascade. Deliberately re-derived from the table rather than from `criteria`:
   // a goal completes when ALL of its criteria are satisfied, and the ones that
   // closed in THIS call may not be all of them. Mirrors db.achieveGoalIfComplete
-  // exactly — open goals only, >=1 criterion, zero unsatisfied — but on `exec`,
-  // so it sees the flips above inside the same transaction.
+  // exactly — open goals only, >=1 criterion, zero unsatisfied, AND no unfinished
+  // task (BV1.R09, task 1003596) — but on `exec`, so it sees the flips above
+  // inside the same transaction.
+  //
+  // THE THIRD CLAUSE, and why it must run HERE and not only in db-goals.js. This
+  // is the path that actually fires on every ship (`db-ship.js`) and every
+  // reconciler tick (`publish-reconciler.js`); `achieveGoalIfComplete` covers the
+  // manual `POST /done-when/:id/satisfy`. The two are a DELIBERATE duplicate —
+  // collapsing them into one helper creates a require cycle (db-goals requires
+  // done-when) — so the rule is written twice on purpose and both copies must
+  // move together, or a goal closes correctly through one door and wrongly
+  // through the other. ADR 0250 D2.
+  //
+  // `exec` is load-bearing for THIS clause specifically. The shipping task's flip
+  // to `shipped` is uncommitted at this point in the ship transaction; on the
+  // module pool the subquery would still see it as `confirmed` — non-terminal —
+  // and refuse to close a goal whose last task just landed. Every goal would then
+  // need a second, later trigger to close at all.
+  //
+  // Shipping is NOT blocked by any of this: the ship's own writes are untouched
+  // and this UPDATE simply matches no row, leaving the goal open.
+  //
+  // The subquery is index-served: migration 228 added idx_tasks_goal ON tasks
+  // (goal_id), so this is a small index scan per candidate goal, and the candidate
+  // set is only the goals whose criteria just closed in this call. (Raised in
+  // review off docs/architecture.md, whose tasks index list predated 228 and has
+  // been corrected.)
   const goalIds = [...new Set(criteria.map((c) => c.goal_id).filter((g) => g != null))].map(Number);
   if (goalIds.length === 0) return { criteria, goals: [] };
   const { rows: goals } = await exec.query(
@@ -456,6 +482,9 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null } = {}) {
         AND g.status = 'open'
         AND EXISTS     (SELECT 1 FROM done_when_criteria d WHERE d.goal_id = g.id)
         AND NOT EXISTS (SELECT 1 FROM done_when_criteria d WHERE d.goal_id = g.id AND NOT d.satisfied)
+        AND NOT EXISTS (SELECT 1 FROM tasks t WHERE t.goal_id = g.id
+                          AND ${nonTerminalSql()}
+                          AND ${SMOKE_NOT_LIKE.replace(/title/, 't.title')})
      RETURNING g.id, g.title, g.version_id, g.status`,
     [goalIds]
   );

package/modules/lifecycle/routes/done-when.js

@@ -212,7 +212,16 @@ module.exports = function buildDoneWhenRouter() {
     if (updated?.goal_id != null) {
       goalResult = await db.achieveGoalIfComplete({ goalId: updated.goal_id });
     }
-    res.json({ criterion: updated, goal_achieved: goalResult.achieved, goal: goalResult.goal });
+    // BV1.R08 (task 1003595): when the goal did NOT flip because it still holds
+    // unfinished work, say so. Confirming the last criterion and getting a bare
+    // `goal_achieved: false` back reads as a bug to the agent that just did it —
+    // it would retry, or file one. The count is the whole explanation.
+    res.json({
+      criterion: updated,
+      goal_achieved: goalResult.achieved,
+      goal: goalResult.goal,
+      ...(goalResult.unfinishedTasks ? { goal_held_open_by_tasks: goalResult.unfinishedTasks } : {}),
+    });
   }, { errorCode: 'satisfy_failed' }));
 
   // PATCH /done-when/:criterionId — correct a criterion's TEXT (task 1003102).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.556",
+  "version": "1.19.558",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.556",
+      "version": "1.19.558",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.556",
+  "version": "1.19.558",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.556'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.558'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -213,7 +213,6 @@ await test('closeCompletedWorkForShip: silent on the common no-op, and logs what
   assert.match(loud[0], /shipTask 9/);
 });
 
-summary();
 
 // ---- 4. the terminal vocabulary has exactly one spelling (task 1003588) ----
 
@@ -233,3 +232,56 @@ await test('VOCABULARY: no consumer re-types the terminal set behind the constan
       f + ' must read the terminal set from task-status.js, not spell it again');
   }
 });
+
+// ---- 5. the cascade carries R08's rule too (BV1.R09, task 1003596) ---------
+//
+// The two achievement writers are a DELIBERATE duplicate — collapsing them makes
+// a require cycle (db-goals requires done-when) — so the danger is that only one
+// moves and a goal then closes correctly through the manual door and wrongly
+// through the ship. These cases pin the third clause on the path that actually
+// fires on every ship and every reconciler tick.
+
+await test('CASCADE (R09): an unfinished task in the goal blocks the flip', async () => {
+  const exec = fakeExec({ rows: [CRIT] }, { rows: [] });
+  await autoSatisfyShippedCriteria(exec, { taskId: 5 });
+  const cascade = String(exec.calls[1].sql).replace(/\s+/g, ' ');
+  assert.match(cascade, /NOT EXISTS \(SELECT 1 FROM tasks t WHERE t\.goal_id = g\.id/,
+    'satisfied criteria are necessary, not sufficient — ADR 0250 D2');
+  assert.match(cascade, /t\.status NOT IN \('shipped', 'abandoned'\)/,
+    'the terminal set is R01\'s, so completed/confirmed hold the goal open');
+  assert.match(cascade, /t\.title NOT LIKE/,
+    'a smoke fixture must not wedge a real goal open forever');
+});
+
+await test('CASCADE (R09): the rule matches db-goals.js — both writers or neither', () => {
+  // The duplicate is intentional; the DRIFT is the bug. Both copies must ask for
+  // the same terminal set and the same smoke exclusion.
+  const dbGoals = readFileSync(new URL('../modules/lifecycle/db-goals.js', import.meta.url), 'utf8');
+  const doneWhen = readFileSync(new URL('../modules/lifecycle/done-when.js', import.meta.url), 'utf8');
+  for (const [name, src] of [['db-goals.js', dbGoals], ['done-when.js', doneWhen]]) {
+    assert.match(src, /FROM tasks t/, name + ' must consult tasks at all');
+    assert.match(src, /\$\{nonTerminalSql\(\)\}/,
+      name + ' must read the terminal set from task-status.js, not re-type it');
+    assert.match(src, /SMOKE_NOT_LIKE\.replace/,
+      name + ' must exclude smoke rows the way version_progress does');
+  }
+});
+
+await test('CASCADE (R09): the check runs on the caller exec, never the module pool', async () => {
+  // Load-bearing for this clause specifically: the shipping task's flip to
+  // `shipped` is uncommitted here, so on the module pool the subquery would still
+  // read it as `confirmed` — non-terminal — and refuse to close a goal whose last
+  // task just landed.
+  const exec = fakeExec({ rows: [CRIT] }, { rows: [] });
+  await autoSatisfyShippedCriteria(exec, { taskId: 5 });
+  assert.equal(exec.calls.length, 2, 'both statements go through the passed exec');
+  assert.match(String(exec.calls[1].sql), /UPDATE goals g/,
+    'the cascade UPDATE is the second, and it is the one carrying the task check');
+  const src = readFileSync(new URL('../modules/lifecycle/done-when.js', import.meta.url), 'utf8');
+  const start = src.indexOf('async function autoSatisfyShippedCriteria');
+  const body = src.slice(start, src.indexOf('describeAutoClose', start));
+  assert.equal(/\bpool\.query\(/.test(body), false,
+    'nothing in this function may reach the module pool');
+});
+
+summary();

package/tests/goal_achievement.mjs

@@ -20,6 +20,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
 import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
 
 process.env.NODE_ENV = 'test';
@@ -47,7 +48,10 @@ const GOAL = (over = {}) => ({
 function goalHandler({ goal, counts }) {
   return (s) => {
     if (/^SELECT .*FROM goals WHERE id = \$1/.test(s)) return { rows: goal ? [goal] : [] };
-    if (/FROM done_when_criteria WHERE goal_id = \$1/.test(s)) return { rows: [counts] };
+    // BV1.R08: the criteria count and the unfinished-task count come back in ONE
+    // row. `unfinished_tasks` defaults to 0 so every pre-existing case below still
+    // means what it meant — criteria alone decide it when no task is open.
+    if (/FROM done_when_criteria WHERE goal_id = \$1/.test(s)) return { rows: [{ unfinished_tasks: 0, ...counts }] };
     if (/^UPDATE goals/.test(s)) return { rows: [{ ...goal, status: 'achieved', updated_at: 'T1' }] };
     return null;
   };
@@ -145,4 +149,63 @@ await test('listPendingReviewCriteria: SQL encodes the auto-flag (all shipped) +
 });
 
 // -------------------------------------------------------------------------
+
+// =========================================================================
+// BV1.R08 (task 1003595, goal 1000086, ADR 0250 D2) — criteria are not the whole
+// question: a goal cannot close while it still holds non-terminal work.
+//
+// The hole this shuts: achievement was computed from done_when_criteria alone, so
+// a task linked to NO criterion held nothing open and a goal auto-achieved while
+// carrying any number of backlog or ready tasks. Fourteen goals on the live
+// instance were in exactly that state, holding thirty-five tasks between them.
+// =========================================================================
+
+await test('R08: all criteria satisfied but ONE unfinished task remains → no flip', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 3, unsatisfied: 0, unfinished_tasks: 1 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, false, 'satisfied criteria are necessary, not sufficient');
+  assert.equal(out.goal.status, 'open', 'the goal stays open until the work lands');
+  assert.equal(out.unfinishedTasks, 1, 'and it reports WHY, so a caller can say so');
+  assert.equal(find(pool.queries, /^UPDATE goals/), undefined, 'must NOT flip the status');
+});
+
+await test('R08: the count is asked in the SAME round trip as the criteria count', async () => {
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 1, unsatisfied: 0, unfinished_tasks: 0 } }));
+  await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  const q = find(pool.queries, /FROM done_when_criteria WHERE goal_id = \$1/);
+  const sql = String(q.sql).replace(/\s+/g, ' ');
+  assert.match(sql, /FROM tasks t WHERE t\.goal_id = \$1/, 'one query, not a second trip');
+  assert.match(sql, /t\.status NOT IN \('shipped', 'abandoned'\)/,
+    "the terminal set comes from task-status.js — mid-ship states hold the goal open");
+  assert.match(sql, /t\.title NOT LIKE/, 'a smoke fixture must not wedge a real goal open forever');
+  assert.deepEqual(q.params, [7], 'the goal id is bound once and reused');
+});
+
+await test('R08: zero unfinished tasks and all criteria satisfied → still flips', async () => {
+  // The rule must not become "goals never close". This is the whole happy path.
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 2, unsatisfied: 0, unfinished_tasks: 0 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, true, 'finished work + satisfied criteria = achieved');
+  assert.ok(find(pool.queries, /^UPDATE goals/), 'the flip is persisted');
+});
+
+await test('R08: an unsatisfied criterion still short-circuits before the task check', async () => {
+  // Ordering matters for the message, not the outcome: a goal with open criteria
+  // AND open tasks is refused on the criteria, and reports no task count.
+  const pool = fakePool(goalHandler({ goal: GOAL(), counts: { total: 3, unsatisfied: 2, unfinished_tasks: 9 } }));
+  const out = await achieveGoalIfComplete({ goalId: 7 }, { pool });
+  assert.equal(out.achieved, false);
+  assert.equal(out.unfinishedTasks, undefined,
+    'the criteria refusal is the honest reason when both are true');
+});
+
+await test('R08: the satisfy route tells the caller a goal was held open by work', async () => {
+  // A bare goal_achieved:false after confirming the LAST criterion reads as a bug
+  // to the agent that just did it. The route names the reason when there is one.
+  const src = readFileSync(new URL('../modules/lifecycle/routes/done-when.js', import.meta.url), 'utf8');
+  assert.match(src, /goal_held_open_by_tasks: goalResult\.unfinishedTasks/);
+  assert.match(src, /\.\.\.\(goalResult\.unfinishedTasks \?/,
+    'and stays silent on the ordinary path, so the response shape is unchanged when nothing is held');
+});
+
 summary();