@bongos/core 1.19.557 → 1.19.558

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.557",
-  "core_contract": "1.19.557",
-  "source_commit": "07517c180e4fca730285ee6533c21d6b54f08273",
+  "core_version": "1.19.558",
+  "core_contract": "1.19.558",
+  "source_commit": "3f1c35f7e8595d597e7174a4b57801739138e35a",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T16:32:40.671Z",
+  "built_at": "2026-09-06T16:50:32.542Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 443,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2487,
-  "tree_sha256": "a3c96b5cf7b985332e67132f9626118afc2968733a0e5cd2cf0a7fbe7d885540",
+  "tree_sha256": "cf1dadb6f0fb444dffe307f0e5b6d7ad76eb9e3fc7833a3e034f456f45ecf4c3",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1787,7 +1787,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "10a4bda9248333a4a3bca3b015c70ae9d2f973772be75e790a800420e5d5e8bf"
+      "sha256": "1fe7548e94bd9b29642bdddc8dacb201072782f181b517be2bac5fed1b1cd356"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2657,7 +2657,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "99b29fcf1f9a58ee17ba9d77e3c0c30b37940ee8af0c71396813f7514d960ba1"
+      "sha256": "7fd202776ba59c21897773679f9f07221de79ba577a6d5e6500df52698b85386"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5482,7 +5482,7 @@
     {
       "path": "modules/lifecycle/done-when.js",
       "mode": "0000644",
-      "sha256": "4e276151342f0eab3d4c0cea1ed55db8716a1d3d4b40568966be495f4892c1f4"
+      "sha256": "4e798aff55de6481ea9da3f8a08e68d99902f3eac4749e30d727517ff61176b5"
     },
     {
       "path": "modules/lifecycle/est-advisory.js",
@@ -7477,12 +7477,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "248924f051a38d806cdf6818c66768dd3d1cf7f62196a01aee776f7f1849374e"
+      "sha256": "3d98dfe15e37d556fbb8b69fe49aefaa10ffb350560704361a420803e5bd1169"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3fac6b2004dd142b67afdce4e5939f5166ab777e74900e25b522af68568eb23f"
+      "sha256": "94d2145a407d981305d11aa4f7b6fcb2997d831856b978836ceece7f91f48de5"
     },
     {
       "path": "public-docs/index.html",
@@ -9177,7 +9177,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e0d8e56756e81c431cc74eaf5cea2ed87839bf7e6a222c98e43c279fd66d5beb"
+      "sha256": "8e9e2a140d38ec1307d8c062aeb950ee5cadc17a0a166d5e96ec41f3b202c375"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9437,7 +9437,7 @@
     {
       "path": "tests/auto_satisfy_criteria.mjs",
       "mode": "0000644",
-      "sha256": "548e6a477660bb5e5cb260a0d5821bc3e11201225e64cfa45611c2fae07c80b2"
+      "sha256": "d63beea7b680a194d163aa5ad11806c9aa860de93d614195a05a33082e9f8adb"
     },
     {
       "path": "tests/autonomous_fit_protected_paths.mjs",

package/docs/architecture.md

@@ -120,7 +120,8 @@ tasks(id, version_id, title, description, status, touches text[], est_minutes, e
     shipped   = merged to main + deployed; credits awarded here (credit_log.reason =
                 'task.shipped' — ADR 0120 pays on land, not on confirm; which streams
                 actually pay depends on the instance reward mode, ADR 0146)
-  indexes: (version_id, status), (priority), GIN(touches)
+  indexes: (version_id, status), (priority), GIN(touches), (goal_id), (parent_task_id),
+           (created_by), (shipped_by) WHERE needs_rebase
 task_blockers(task_id, blocker_ref)            -- markdown anchors are canonical
 claims(id, task_id, builder_id, worktree_name, claimed_at, released_at, outcome)
   UNIQUE INDEX uniq_active_claim_per_task ON (task_id) WHERE released_at IS NULL

package/docs/module-api-changelog.md

@@ -1563,5 +1563,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.555 with no explicit bump. run 34045323629. (task 1002620)
   1.19.557 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.556 with no explicit bump. run 34045753301. (task 1002620)
+  1.19.558 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.557 with no explicit bump. run 34046699120. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/done-when.js

@@ -25,6 +25,7 @@
 
 const { pool } = require('../../src/module-api');
 const { nonTerminalSql } = require('./task-status');
+const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 // isPendingReview — the ONE derivation of the "met — pending review" auto-flag
 // (ADR 0086 §6 / BV1.R63): a criterion with >=1 linked task, every one shipped,
@@ -445,8 +446,33 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null } = {}) {
   // Cascade. Deliberately re-derived from the table rather than from `criteria`:
   // a goal completes when ALL of its criteria are satisfied, and the ones that
   // closed in THIS call may not be all of them. Mirrors db.achieveGoalIfComplete
-  // exactly — open goals only, >=1 criterion, zero unsatisfied — but on `exec`,
-  // so it sees the flips above inside the same transaction.
+  // exactly — open goals only, >=1 criterion, zero unsatisfied, AND no unfinished
+  // task (BV1.R09, task 1003596) — but on `exec`, so it sees the flips above
+  // inside the same transaction.
+  //
+  // THE THIRD CLAUSE, and why it must run HERE and not only in db-goals.js. This
+  // is the path that actually fires on every ship (`db-ship.js`) and every
+  // reconciler tick (`publish-reconciler.js`); `achieveGoalIfComplete` covers the
+  // manual `POST /done-when/:id/satisfy`. The two are a DELIBERATE duplicate —
+  // collapsing them into one helper creates a require cycle (db-goals requires
+  // done-when) — so the rule is written twice on purpose and both copies must
+  // move together, or a goal closes correctly through one door and wrongly
+  // through the other. ADR 0250 D2.
+  //
+  // `exec` is load-bearing for THIS clause specifically. The shipping task's flip
+  // to `shipped` is uncommitted at this point in the ship transaction; on the
+  // module pool the subquery would still see it as `confirmed` — non-terminal —
+  // and refuse to close a goal whose last task just landed. Every goal would then
+  // need a second, later trigger to close at all.
+  //
+  // Shipping is NOT blocked by any of this: the ship's own writes are untouched
+  // and this UPDATE simply matches no row, leaving the goal open.
+  //
+  // The subquery is index-served: migration 228 added idx_tasks_goal ON tasks
+  // (goal_id), so this is a small index scan per candidate goal, and the candidate
+  // set is only the goals whose criteria just closed in this call. (Raised in
+  // review off docs/architecture.md, whose tasks index list predated 228 and has
+  // been corrected.)
   const goalIds = [...new Set(criteria.map((c) => c.goal_id).filter((g) => g != null))].map(Number);
   if (goalIds.length === 0) return { criteria, goals: [] };
   const { rows: goals } = await exec.query(
@@ -456,6 +482,9 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null } = {}) {
         AND g.status = 'open'
         AND EXISTS     (SELECT 1 FROM done_when_criteria d WHERE d.goal_id = g.id)
         AND NOT EXISTS (SELECT 1 FROM done_when_criteria d WHERE d.goal_id = g.id AND NOT d.satisfied)
+        AND NOT EXISTS (SELECT 1 FROM tasks t WHERE t.goal_id = g.id
+                          AND ${nonTerminalSql()}
+                          AND ${SMOKE_NOT_LIKE.replace(/title/, 't.title')})
      RETURNING g.id, g.title, g.version_id, g.status`,
     [goalIds]
   );

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.557",
+  "version": "1.19.558",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.557",
+      "version": "1.19.558",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.557",
+  "version": "1.19.558",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.557'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.558'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -213,7 +213,6 @@ await test('closeCompletedWorkForShip: silent on the common no-op, and logs what
   assert.match(loud[0], /shipTask 9/);
 });
 
-summary();
 
 // ---- 4. the terminal vocabulary has exactly one spelling (task 1003588) ----
 
@@ -233,3 +232,56 @@ await test('VOCABULARY: no consumer re-types the terminal set behind the constan
       f + ' must read the terminal set from task-status.js, not spell it again');
   }
 });
+
+// ---- 5. the cascade carries R08's rule too (BV1.R09, task 1003596) ---------
+//
+// The two achievement writers are a DELIBERATE duplicate — collapsing them makes
+// a require cycle (db-goals requires done-when) — so the danger is that only one
+// moves and a goal then closes correctly through the manual door and wrongly
+// through the ship. These cases pin the third clause on the path that actually
+// fires on every ship and every reconciler tick.
+
+await test('CASCADE (R09): an unfinished task in the goal blocks the flip', async () => {
+  const exec = fakeExec({ rows: [CRIT] }, { rows: [] });
+  await autoSatisfyShippedCriteria(exec, { taskId: 5 });
+  const cascade = String(exec.calls[1].sql).replace(/\s+/g, ' ');
+  assert.match(cascade, /NOT EXISTS \(SELECT 1 FROM tasks t WHERE t\.goal_id = g\.id/,
+    'satisfied criteria are necessary, not sufficient — ADR 0250 D2');
+  assert.match(cascade, /t\.status NOT IN \('shipped', 'abandoned'\)/,
+    'the terminal set is R01\'s, so completed/confirmed hold the goal open');
+  assert.match(cascade, /t\.title NOT LIKE/,
+    'a smoke fixture must not wedge a real goal open forever');
+});
+
+await test('CASCADE (R09): the rule matches db-goals.js — both writers or neither', () => {
+  // The duplicate is intentional; the DRIFT is the bug. Both copies must ask for
+  // the same terminal set and the same smoke exclusion.
+  const dbGoals = readFileSync(new URL('../modules/lifecycle/db-goals.js', import.meta.url), 'utf8');
+  const doneWhen = readFileSync(new URL('../modules/lifecycle/done-when.js', import.meta.url), 'utf8');
+  for (const [name, src] of [['db-goals.js', dbGoals], ['done-when.js', doneWhen]]) {
+    assert.match(src, /FROM tasks t/, name + ' must consult tasks at all');
+    assert.match(src, /\$\{nonTerminalSql\(\)\}/,
+      name + ' must read the terminal set from task-status.js, not re-type it');
+    assert.match(src, /SMOKE_NOT_LIKE\.replace/,
+      name + ' must exclude smoke rows the way version_progress does');
+  }
+});
+
+await test('CASCADE (R09): the check runs on the caller exec, never the module pool', async () => {
+  // Load-bearing for this clause specifically: the shipping task's flip to
+  // `shipped` is uncommitted here, so on the module pool the subquery would still
+  // read it as `confirmed` — non-terminal — and refuse to close a goal whose last
+  // task just landed.
+  const exec = fakeExec({ rows: [CRIT] }, { rows: [] });
+  await autoSatisfyShippedCriteria(exec, { taskId: 5 });
+  assert.equal(exec.calls.length, 2, 'both statements go through the passed exec');
+  assert.match(String(exec.calls[1].sql), /UPDATE goals g/,
+    'the cascade UPDATE is the second, and it is the one carrying the task check');
+  const src = readFileSync(new URL('../modules/lifecycle/done-when.js', import.meta.url), 'utf8');
+  const start = src.indexOf('async function autoSatisfyShippedCriteria');
+  const body = src.slice(start, src.indexOf('describeAutoClose', start));
+  assert.equal(/\bpool\.query\(/.test(body), false,
+    'nothing in this function may reach the module pool');
+});
+
+summary();