@bongos/core 1.19.557 → 1.19.559

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.557",
-  "core_contract": "1.19.557",
-  "source_commit": "07517c180e4fca730285ee6533c21d6b54f08273",
+  "core_version": "1.19.559",
+  "core_contract": "1.19.559",
+  "source_commit": "5a03a11dde038c01316ec0013d430fceee6b470c",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T16:32:40.671Z",
+  "built_at": "2026-09-06T17:00:29.990Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 443,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2020,
+    "functional_verbatim": 2022,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2487,
-  "tree_sha256": "a3c96b5cf7b985332e67132f9626118afc2968733a0e5cd2cf0a7fbe7d885540",
+  "file_count": 2489,
+  "tree_sha256": "b08a96dd47fdc32384cfc3f290607a768f383b389fd4856eb23ba1573206e9ba",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1787,7 +1787,7 @@
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "10a4bda9248333a4a3bca3b015c70ae9d2f973772be75e790a800420e5d5e8bf"
+      "sha256": "1fe7548e94bd9b29642bdddc8dacb201072782f181b517be2bac5fed1b1cd356"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2657,7 +2657,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "99b29fcf1f9a58ee17ba9d77e3c0c30b37940ee8af0c71396813f7514d960ba1"
+      "sha256": "0f460fce31df884314ef67a464a571dd268fd80e09135c2dd7918a0c83617894"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5482,7 +5482,7 @@
     {
       "path": "modules/lifecycle/done-when.js",
       "mode": "0000644",
-      "sha256": "4e276151342f0eab3d4c0cea1ed55db8716a1d3d4b40568966be495f4892c1f4"
+      "sha256": "4e798aff55de6481ea9da3f8a08e68d99902f3eac4749e30d727517ff61176b5"
     },
     {
       "path": "modules/lifecycle/est-advisory.js",
@@ -7477,12 +7477,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "248924f051a38d806cdf6818c66768dd3d1cf7f62196a01aee776f7f1849374e"
+      "sha256": "ea8aa9f5d4fa502d3d572540e1ee389972089112bc245cd0fd8f55056580800a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3fac6b2004dd142b67afdce4e5939f5166ab777e74900e25b522af68568eb23f"
+      "sha256": "dec482642d3b8ab9427292ae88990b4ad007f043f21923fc24d043aed110ad57"
     },
     {
       "path": "public-docs/index.html",
@@ -7917,7 +7917,7 @@
     {
       "path": "scripts/gds/fitness-ratchets.js",
       "mode": "0000644",
-      "sha256": "fa16d4c62a16b7827fe82d556dd6a5de327362ba17fc54cc9d86e1d34e2a45f5"
+      "sha256": "40f6cb65333235d35f6672c700ec91648549e57912ee7f522cff80af4b611fc2"
     },
     {
       "path": "scripts/gds/fitness.js",
@@ -7954,6 +7954,11 @@
       "mode": "0000644",
       "sha256": "26a3dcc15c98128229df015292b8f9e9d3a41152c8803555f858fa4bb6a26d53"
     },
+    {
+      "path": "scripts/gds/gds-literal-scan.js",
+      "mode": "0000644",
+      "sha256": "fe622c9abf848a668fe2672d699fef22141156f41bb2396523461d1484341ec1"
+    },
     {
       "path": "scripts/gds/gen-api-client.js",
       "mode": "0000644",
@@ -9177,7 +9182,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e0d8e56756e81c431cc74eaf5cea2ed87839bf7e6a222c98e43c279fd66d5beb"
+      "sha256": "95d3088b7661e4be4b1fd900805b075e1766cd4aeed428979e1d969f005a63fb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9437,7 +9442,7 @@
     {
       "path": "tests/auto_satisfy_criteria.mjs",
       "mode": "0000644",
-      "sha256": "548e6a477660bb5e5cb260a0d5821bc3e11201225e64cfa45611c2fae07c80b2"
+      "sha256": "d63beea7b680a194d163aa5ad11806c9aa860de93d614195a05a33082e9f8adb"
     },
     {
       "path": "tests/autonomous_fit_protected_paths.mjs",
@@ -10159,6 +10164,11 @@
       "mode": "0000644",
       "sha256": "5e5b53d5a1dce6b7ffacbea7198375aac6f77259ee948c00c24eb157f62a034d"
     },
+    {
+      "path": "tests/fitness_gds_ratchet.mjs",
+      "mode": "0000644",
+      "sha256": "10b3d6db55dd8d20de69fe8757575cf965ca8a14e91512c2f7b71b62ba3af855"
+    },
     {
       "path": "tests/fitness_ratchets.mjs",
       "mode": "0000644",

package/docs/architecture.md

@@ -120,7 +120,8 @@ tasks(id, version_id, title, description, status, touches text[], est_minutes, e
     shipped   = merged to main + deployed; credits awarded here (credit_log.reason =
                 'task.shipped' — ADR 0120 pays on land, not on confirm; which streams
                 actually pay depends on the instance reward mode, ADR 0146)
-  indexes: (version_id, status), (priority), GIN(touches)
+  indexes: (version_id, status), (priority), GIN(touches), (goal_id), (parent_task_id),
+           (created_by), (shipped_by) WHERE needs_rebase
 task_blockers(task_id, blocker_ref)            -- markdown anchors are canonical
 claims(id, task_id, builder_id, worktree_name, claimed_at, released_at, outcome)
   UNIQUE INDEX uniq_active_claim_per_task ON (task_id) WHERE released_at IS NULL

package/docs/module-api-changelog.md

@@ -1563,5 +1563,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.555 with no explicit bump. run 34045323629. (task 1002620)
   1.19.557 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.556 with no explicit bump. run 34045753301. (task 1002620)
+  1.19.558 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.557 with no explicit bump. run 34046699120. (task 1002620)
+  1.19.559 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.558 with no explicit bump. run 34047187381. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/done-when.js

@@ -25,6 +25,7 @@
 
 const { pool } = require('../../src/module-api');
 const { nonTerminalSql } = require('./task-status');
+const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 // isPendingReview — the ONE derivation of the "met — pending review" auto-flag
 // (ADR 0086 §6 / BV1.R63): a criterion with >=1 linked task, every one shipped,
@@ -445,8 +446,33 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null } = {}) {
   // Cascade. Deliberately re-derived from the table rather than from `criteria`:
   // a goal completes when ALL of its criteria are satisfied, and the ones that
   // closed in THIS call may not be all of them. Mirrors db.achieveGoalIfComplete
-  // exactly — open goals only, >=1 criterion, zero unsatisfied — but on `exec`,
-  // so it sees the flips above inside the same transaction.
+  // exactly — open goals only, >=1 criterion, zero unsatisfied, AND no unfinished
+  // task (BV1.R09, task 1003596) — but on `exec`, so it sees the flips above
+  // inside the same transaction.
+  //
+  // THE THIRD CLAUSE, and why it must run HERE and not only in db-goals.js. This
+  // is the path that actually fires on every ship (`db-ship.js`) and every
+  // reconciler tick (`publish-reconciler.js`); `achieveGoalIfComplete` covers the
+  // manual `POST /done-when/:id/satisfy`. The two are a DELIBERATE duplicate —
+  // collapsing them into one helper creates a require cycle (db-goals requires
+  // done-when) — so the rule is written twice on purpose and both copies must
+  // move together, or a goal closes correctly through one door and wrongly
+  // through the other. ADR 0250 D2.
+  //
+  // `exec` is load-bearing for THIS clause specifically. The shipping task's flip
+  // to `shipped` is uncommitted at this point in the ship transaction; on the
+  // module pool the subquery would still see it as `confirmed` — non-terminal —
+  // and refuse to close a goal whose last task just landed. Every goal would then
+  // need a second, later trigger to close at all.
+  //
+  // Shipping is NOT blocked by any of this: the ship's own writes are untouched
+  // and this UPDATE simply matches no row, leaving the goal open.
+  //
+  // The subquery is index-served: migration 228 added idx_tasks_goal ON tasks
+  // (goal_id), so this is a small index scan per candidate goal, and the candidate
+  // set is only the goals whose criteria just closed in this call. (Raised in
+  // review off docs/architecture.md, whose tasks index list predated 228 and has
+  // been corrected.)
   const goalIds = [...new Set(criteria.map((c) => c.goal_id).filter((g) => g != null))].map(Number);
   if (goalIds.length === 0) return { criteria, goals: [] };
   const { rows: goals } = await exec.query(
@@ -456,6 +482,9 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null } = {}) {
         AND g.status = 'open'
         AND EXISTS     (SELECT 1 FROM done_when_criteria d WHERE d.goal_id = g.id)
         AND NOT EXISTS (SELECT 1 FROM done_when_criteria d WHERE d.goal_id = g.id AND NOT d.satisfied)
+        AND NOT EXISTS (SELECT 1 FROM tasks t WHERE t.goal_id = g.id
+                          AND ${nonTerminalSql()}
+                          AND ${SMOKE_NOT_LIKE.replace(/title/, 't.title')})
      RETURNING g.id, g.title, g.version_id, g.status`,
     [goalIds]
   );

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.557",
+  "version": "1.19.559",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.557",
+      "version": "1.19.559",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.557",
+  "version": "1.19.559",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-ratchets.js

@@ -276,6 +276,17 @@ function readBaselines() {
 }
 
 // Pure ratchet verdict — exported for the hermetic test.
+// A metric whose name does not, by itself, tell the builder who tripped it what
+// to do gets one line of guidance here. Appended to the regression message only
+// — the ratchet-down warning already says exactly what to do.
+const METRIC_HINTS = {
+  legacy_gds_literals:
+    ' — a NEW "GDS" literal entered the tree (goal 1000073 C5: the rename cannot come back). '
+    + 'Write Bongos instead. Run `node scripts/gds/gds-literal-scan.js` to see every counted file. '
+    + 'Version ids (GDS-V##), docs/adr, docs/session-logs, docs/audits, limitations and migrations '
+    + 'are excluded by construction — if your literal is history, it belongs in one of those.',
+};
+
 function compareToBaselines(metrics, baselines) {
   const violations = [];
   const warnings = [];
@@ -285,7 +296,7 @@ function compareToBaselines(metrics, baselines) {
     if (floor === undefined) {
       warnings.push(`no baseline for "${name}" (value ${value}) — run --update-baselines`);
     } else if (value > floor) {
-      violations.push(`${name} regressed: ${value} > baseline ${floor} — fix the regression; never raise the baseline to pass`);
+      violations.push(`${name} regressed: ${value} > baseline ${floor} — fix the regression; never raise the baseline to pass${METRIC_HINTS[name] || ''}`);
     } else if (value < floor) {
       warnings.push(`ratchet-down available: ${name} improved to ${value} (baseline ${floor}) — lower the baseline in config/fitness-baselines.json`);
     }
@@ -293,6 +304,19 @@ function compareToBaselines(metrics, baselines) {
   return { violations, warnings };
 }
 
+// legacy_gds_literals — criterion C5 of goal 1000073, "the rename cannot come
+// back" (task 1003669). A shrink-only count of the GDS acronym outside the
+// frozen record, so a NEW literal reds the build the way any other regression
+// does. It rides the ratchet machinery rather than being its own check on
+// purpose: --update-baselines, the floors, and baseline-staleness then all
+// apply to it for free, and a metric outside `metrics` would be silently
+// dropped the next time anyone refreshed the file. Detector + the reasons for
+// every exclusion: scripts/gds/gds-literal-scan.js.
+function gdsMetrics() {
+  const { scanGdsLiterals } = require('./gds-literal-scan.js');
+  return { legacy_gds_literals: scanGdsLiterals().total };
+}
+
 function computeMetrics({ withDocs = true } = {}) {
   const files = trackedJsFiles();
   const contents = new Map(files.map((f) => [f, readRepoFile(f)]));
@@ -301,6 +325,7 @@ function computeMetrics({ withDocs = true } = {}) {
     duplicate_window_count: duplicateWindowCount(contents),
     require_cycle_count: countCycles(requireGraph(contents)),
     console_call_count: consoleCallCount(contents),
+    ...gdsMetrics(),
     ...(withDocs ? docMetrics() : {}),
   };
 }
@@ -314,7 +339,7 @@ function checkQualityRatchets() {
   // FIRST so it is the headline rather than buried under per-metric noise.
   if (baselineError) violations.unshift(baselineError);
   return {
-    name: 'quality ratchets — size, duplication, cycles, console, doc entropy only tighten (task 1003129)',
+    name: 'quality ratchets — size, duplication, cycles, console, doc entropy, legacy GDS literals only tighten (task 1003129)',
     hardFail: violations.length > 0,
     violations,
     warnings,

package/scripts/gds/gds-literal-scan.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+'use strict';
+// gds-literal-scan.js — the detector behind the GDS→Bongos rename ratchet
+// (criterion C5 of goal 1000073, "the rename cannot come back"; task 1003669).
+//
+// WHY THIS EXISTS. The rename is landing criterion by criterion, and the goal's
+// own sequencing says the ratchet lands SECOND — immediately after the prose
+// pass — because "a rename without a ratchet reappears within a release, which
+// is exactly how this term survived this long". This module is the measurement;
+// the gate is the `legacy_gds_literals` metric in fitness-ratchets.js, which
+// fails the build when the count RISES.
+//
+// WHY A COUNT AND NOT ZERO. Measured after C1 shipped (2026-09-06) there are
+// still ~1,400 GDS literals outside the historical record: the `GDS_*` env
+// names and the `scripts/gds/` + `/api/gds` paths are criterion C2's job, and
+// C2 deliberately lands BEHIND this ratchet because it is the risky one (hooks,
+// cron routines, .service files and CI all name those paths). A zero-tolerance
+// check could not be landed today and would red every unrelated ship. So this
+// holds the line instead: the number may fall, never rise.
+//
+// WHAT IS NEVER COUNTED. Four kinds of thing, for four different reasons:
+//
+//   1. THE FROZEN RECORD (path-excluded). ADRs, session logs, audits, shipped
+//      scope archives. The goal's rule is "rename what the project says about
+//      itself going forward; leave what it recorded about its past" — an ADR
+//      rewritten to today's vocabulary destroys the evidence that the words
+//      changed.
+//   2. APPLIED MIGRATION FILENAMES (path-excluded). schema_migrations is keyed
+//      by filename stem, so renaming an applied migration makes it look
+//      unapplied and RE-RUNS it. This one is an outage, not an aesthetic.
+//   3. VERSION IDS (token-excluded). `GDS-V3` / `GDS-V4` are row keys in the
+//      versions table, not vocabulary. They are stripped from every line before
+//      counting, so they stay legal even inside a file that is otherwise
+//      counted.
+//
+// Usage:
+//   node scripts/gds/gds-literal-scan.js            # count + the top offending files
+//   node scripts/gds/gds-literal-scan.js --files    # every file with its count
+//   node scripts/gds/gds-literal-scan.js --json
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+
+// The frozen record + applied migration filenames. Matched against the
+// repo-relative path, at any depth, so an instance's own migrations/ and a
+// module-owned migrations/ are covered by the same rule as the core's.
+const GDS_EXCLUDED_PATHS = [
+  /(^|\/)docs\/adr\//,
+  /(^|\/)docs\/session-logs\//,
+  /(^|\/)docs\/audits\//,
+  /(^|\/)limitations\//,
+  /(^|\/)migrations\//,
+];
+
+// Vendored / generated / third-party trees the budgets must not count — the
+// same exclusion fitness-ratchets.js applies to its own metrics.
+const GDS_EXCLUDED_TREES = /(^|\/)(node_modules|public-docs)\/|\.min\.js$|(^|\/)vendor\//;
+
+// The files that STATE the rule. Meta-commentary about a banned word has to be
+// able to name it, or the gate cannot explain itself — the same principle as
+// VOCAB_ALLOW's "the manifest states the rule itself" entry in
+// fitness-checks-vocabulary.js. Without this the detector counts its own
+// explanation, and improving a comment here would red the build.
+const GDS_RULE_FILES = new Set([
+  'scripts/gds/gds-literal-scan.js',      // this file
+  'scripts/gds/fitness-ratchets.js',      // the gate: names the metric and carries the builder-facing hint
+  'tests/fitness_gds_ratchet.mjs',        // its test, which must write the literal to prove the gate fires
+  'config/fitness-baselines.json',        // the baseline's own _comment explains what is counted
+]);
+
+// A version id is a row key, not vocabulary. Stripped before matching so it is
+// legal on any line in any counted file.
+const GDS_VERSION_ID_RE = /GDS-V\d+/g;
+
+// The literal itself: case-sensitive, so the lowercase path/env spellings that
+// criterion C2 owns (`scripts/gds/`, `/api/gds`, `gds_session`) are counted
+// only where they appear in their SHOUTING form. Case-sensitivity is the point
+// — `GDS` is the acronym a newcomer trips over.
+const GDS_LITERAL_RE = /GDS/g;
+
+function isExcludedPath(relPath) {
+  if (GDS_RULE_FILES.has(relPath)) return true;
+  if (GDS_EXCLUDED_TREES.test(relPath)) return true;
+  return GDS_EXCLUDED_PATHS.some((re) => re.test(relPath));
+}
+
+// countInText — occurrences of the literal in one file's text, with version ids
+// removed first. Exported so the test and any future sweep share ONE detector
+// (the checkErrorEnvelope precedent: a gate whose detector drifts from its
+// sweep is worse than no gate).
+function countInText(text) {
+  const stripped = text.replace(GDS_VERSION_ID_RE, '');
+  return (stripped.match(GDS_LITERAL_RE) || []).length;
+}
+
+function trackedFiles() {
+  const out = execFileSync('git', ['ls-files'], { cwd: ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  return out.split('\n').map((s) => s.trim()).filter(Boolean);
+}
+
+// scanGdsLiterals — { total, byFile } across every tracked, countable file.
+// Unreadable and binary files are skipped rather than guessed at: a NUL byte
+// means the "occurrences" would be meaningless anyway.
+//
+// `files` and `readFile` are both injectable so the test can exercise the real
+// aggregation — exclusions, counting, per-file totals — WITHOUT writing to the
+// repo. That is not tidiness: the unit lane runs test files in parallel, and an
+// earlier version of the test proved the point by temporarily editing
+// docs/architecture.md and breaking whichever suite happened to be scanning the
+// tree at that moment.
+function scanGdsLiterals({ files = null, readFile = null } = {}) {
+  const read = readFile || ((relPath) => fs.readFileSync(path.join(ROOT, relPath), 'utf8'));
+  const byFile = {};
+  let total = 0;
+  for (const relPath of files || trackedFiles()) {
+    if (isExcludedPath(relPath)) continue;
+    let text;
+    try {
+      text = read(relPath);
+    } catch {
+      continue;
+    }
+    if (text.includes(String.fromCharCode(0))) continue; // binary (a NUL byte)
+    const n = countInText(text);
+    if (n) {
+      byFile[relPath] = n;
+      total += n;
+    }
+  }
+  return { total, byFile };
+}
+
+function main() {
+  const { total, byFile } = scanGdsLiterals();
+  const ranked = Object.entries(byFile).sort((a, b) => b[1] - a[1]);
+  if (process.argv.includes('--json')) {
+    process.stdout.write(`${JSON.stringify({ total, byFile }, null, 2)}\n`);
+    return;
+  }
+  const show = process.argv.includes('--files') ? ranked : ranked.slice(0, 20);
+  console.log(`legacy GDS literals: ${total} across ${ranked.length} file(s)`);
+  console.log('(version ids GDS-V## are not counted; docs/adr, docs/session-logs, docs/audits, limitations and migrations are excluded by construction)');
+  console.log('');
+  for (const [f, n] of show) console.log(`  ${String(n).padStart(5)}  ${f}`);
+  if (show.length < ranked.length) console.log(`  … and ${ranked.length - show.length} more file(s) — pass --files for all`);
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  GDS_EXCLUDED_PATHS,
+  GDS_RULE_FILES,
+  GDS_EXCLUDED_TREES,
+  GDS_LITERAL_RE,
+  GDS_VERSION_ID_RE,
+  countInText,
+  isExcludedPath,
+  scanGdsLiterals,
+};

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.557'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.559'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -213,7 +213,6 @@ await test('closeCompletedWorkForShip: silent on the common no-op, and logs what
   assert.match(loud[0], /shipTask 9/);
 });
 
-summary();
 
 // ---- 4. the terminal vocabulary has exactly one spelling (task 1003588) ----
 
@@ -233,3 +232,56 @@ await test('VOCABULARY: no consumer re-types the terminal set behind the constan
       f + ' must read the terminal set from task-status.js, not spell it again');
   }
 });
+
+// ---- 5. the cascade carries R08's rule too (BV1.R09, task 1003596) ---------
+//
+// The two achievement writers are a DELIBERATE duplicate — collapsing them makes
+// a require cycle (db-goals requires done-when) — so the danger is that only one
+// moves and a goal then closes correctly through the manual door and wrongly
+// through the ship. These cases pin the third clause on the path that actually
+// fires on every ship and every reconciler tick.
+
+await test('CASCADE (R09): an unfinished task in the goal blocks the flip', async () => {
+  const exec = fakeExec({ rows: [CRIT] }, { rows: [] });
+  await autoSatisfyShippedCriteria(exec, { taskId: 5 });
+  const cascade = String(exec.calls[1].sql).replace(/\s+/g, ' ');
+  assert.match(cascade, /NOT EXISTS \(SELECT 1 FROM tasks t WHERE t\.goal_id = g\.id/,
+    'satisfied criteria are necessary, not sufficient — ADR 0250 D2');
+  assert.match(cascade, /t\.status NOT IN \('shipped', 'abandoned'\)/,
+    'the terminal set is R01\'s, so completed/confirmed hold the goal open');
+  assert.match(cascade, /t\.title NOT LIKE/,
+    'a smoke fixture must not wedge a real goal open forever');
+});
+
+await test('CASCADE (R09): the rule matches db-goals.js — both writers or neither', () => {
+  // The duplicate is intentional; the DRIFT is the bug. Both copies must ask for
+  // the same terminal set and the same smoke exclusion.
+  const dbGoals = readFileSync(new URL('../modules/lifecycle/db-goals.js', import.meta.url), 'utf8');
+  const doneWhen = readFileSync(new URL('../modules/lifecycle/done-when.js', import.meta.url), 'utf8');
+  for (const [name, src] of [['db-goals.js', dbGoals], ['done-when.js', doneWhen]]) {
+    assert.match(src, /FROM tasks t/, name + ' must consult tasks at all');
+    assert.match(src, /\$\{nonTerminalSql\(\)\}/,
+      name + ' must read the terminal set from task-status.js, not re-type it');
+    assert.match(src, /SMOKE_NOT_LIKE\.replace/,
+      name + ' must exclude smoke rows the way version_progress does');
+  }
+});
+
+await test('CASCADE (R09): the check runs on the caller exec, never the module pool', async () => {
+  // Load-bearing for this clause specifically: the shipping task's flip to
+  // `shipped` is uncommitted here, so on the module pool the subquery would still
+  // read it as `confirmed` — non-terminal — and refuse to close a goal whose last
+  // task just landed.
+  const exec = fakeExec({ rows: [CRIT] }, { rows: [] });
+  await autoSatisfyShippedCriteria(exec, { taskId: 5 });
+  assert.equal(exec.calls.length, 2, 'both statements go through the passed exec');
+  assert.match(String(exec.calls[1].sql), /UPDATE goals g/,
+    'the cascade UPDATE is the second, and it is the one carrying the task check');
+  const src = readFileSync(new URL('../modules/lifecycle/done-when.js', import.meta.url), 'utf8');
+  const start = src.indexOf('async function autoSatisfyShippedCriteria');
+  const body = src.slice(start, src.indexOf('describeAutoClose', start));
+  assert.equal(/\bpool\.query\(/.test(body), false,
+    'nothing in this function may reach the module pool');
+});
+
+summary();

package/tests/fitness_gds_ratchet.mjs

@@ -0,0 +1,152 @@
+// tests/fitness_gds_ratchet.mjs — the GDS→Bongos rename ratchet (task 1003669,
+// criterion C5 of goal 1000073, "the rename cannot come back").
+//
+// WHY. A gate nobody has watched FAIL is not a gate. The criterion's whole point
+// is that the old name cannot creep back, so the load-bearing assertion here is
+// the negative one: a newly-introduced literal must red the build, and the
+// exclusions must NOT swallow it. The positive case (today's tree passes) is the
+// cheap half — it would also pass if the detector were broken and returned zero.
+//
+// The detector is exercised directly rather than through the filesystem: it takes
+// an explicit `files` list, so a case can name exactly the paths under test
+// without writing into the repo or depending on what happens to be committed.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const scan = require(path.join(ROOT, 'scripts', 'gds', 'gds-literal-scan.js'));
+const ratchets = require(path.join(ROOT, 'scripts', 'gds', 'fitness-ratchets.js'));
+
+const LITERAL = ['G', 'D', 'S'].join(''); // built, not written, so this file needs no exemption of its own
+
+test('the detector COUNTS a bare literal — the gate is not a no-op', () => {
+  assert.equal(scan.countInText(`the ${LITERAL} is the old name`), 1);
+  assert.equal(scan.countInText(`${LITERAL} and ${LITERAL} again`), 2);
+  assert.equal(scan.countInText('Bongos all the way down'), 0);
+});
+
+test('a version id is NOT counted — it is a row key, not vocabulary', () => {
+  assert.equal(scan.countInText(`${LITERAL}-V3`), 0);
+  assert.equal(scan.countInText(`${LITERAL}-V4 shipped`), 0);
+  // …but a bare literal on the same line still counts: stripping the version id
+  // must not blind the detector to real drift beside it.
+  assert.equal(scan.countInText(`${LITERAL}-V3 and the ${LITERAL} acronym`), 1);
+});
+
+test('the frozen record is excluded — an ADR or session log may say the old name', () => {
+  for (const p of [
+    'docs/adr/0064-rename.md',
+    'docs/session-logs/2026-09-06-something.md',
+    'docs/audits/some-audit.md',
+    'limitations/v3-shipped.md',
+    'migrations/047_something.sql',
+    'modules/copy-desk/migrations/copy_desk_001_flags.sql', // a MODULE's migrations too
+  ]) {
+    assert.equal(scan.isExcludedPath(p), true, `expected excluded: ${p}`);
+  }
+});
+
+test('ordinary source and docs are NOT excluded — otherwise the gate guards nothing', () => {
+  for (const p of [
+    'docs/architecture.md',
+    'docs/recipes/self-host.md',
+    'src/bongos/routes/live.js',
+    'modules/discord/discord-bot.js',
+    '.claude/skills/builder-ship/SKILL.md',
+  ]) {
+    assert.equal(scan.isExcludedPath(p), false, `expected counted: ${p}`);
+  }
+});
+
+// A fake tree, so these cases touch no real file. See the note on
+// scanGdsLiterals's `readFile` parameter: the unit lane runs test files in
+// parallel, and a test that edits the repo to make its point breaks whichever
+// suite is reading the repo at the time.
+function fakeTree(contents) {
+  return {
+    files: Object.keys(contents),
+    readFile: (relPath) => contents[relPath],
+  };
+}
+
+test('a NEW literal in a counted file REDS the ratchet (the criterion itself)', () => {
+  const clean = fakeTree({ 'docs/architecture.md': 'The platform is Bongos.\n' });
+  const dirty = fakeTree({ 'docs/architecture.md': `The platform is Bongos.\nBut this line says ${LITERAL}.\n` });
+
+  const before = scan.scanGdsLiterals(clean).total;
+  const after = scan.scanGdsLiterals(dirty).total;
+  assert.equal(before, 0);
+  assert.equal(after, 1, 'a new literal must raise the count');
+
+  // …and a count above its baseline must be a VIOLATION, not a warning.
+  const { violations } = ratchets.compareToBaselines(
+    { legacy_gds_literals: after },
+    { legacy_gds_literals: before }
+  );
+  assert.equal(violations.length, 1, 'rising above the baseline must violate');
+  assert.match(violations[0], /legacy_gds_literals regressed/);
+  assert.match(violations[0], /rename cannot come back/, 'the message must tell the builder what rule they broke');
+});
+
+test('an edit to the FROZEN record never reds the build', () => {
+  const tree = fakeTree({
+    'docs/adr/README.md': `The ${LITERAL} was renamed; this line is history.\n`,
+    'docs/session-logs/2026-09-06-x.md': `A session that mentions ${LITERAL} twice: ${LITERAL}.\n`,
+    'migrations/047_x.sql': `-- ${LITERAL} era migration\n`,
+  });
+  assert.equal(
+    scan.scanGdsLiterals(tree).total,
+    0,
+    'the frozen record may name the old name freely — that is the goal\'s stated rule'
+  );
+});
+
+test('the aggregation is per-file and additive across a mixed tree', () => {
+  const tree = fakeTree({
+    'docs/architecture.md': `${LITERAL} and ${LITERAL}\n`,   // 2, counted
+    'src/bongos/routes/live.js': `// ${LITERAL}\n`,          // 1, counted
+    'docs/adr/0064-rename.md': `${LITERAL} ${LITERAL}\n`,    // excluded
+    'docs/recipes/self-host.md': 'Bongos only\n',            // 0
+  });
+  const { total, byFile } = scan.scanGdsLiterals(tree);
+  assert.equal(total, 3);
+  assert.deepEqual(byFile, { 'docs/architecture.md': 2, 'src/bongos/routes/live.js': 1 });
+});
+
+test('the ratchet only tightens — a FALLING count is a warning, never a failure', () => {
+  const { violations, warnings } = ratchets.compareToBaselines(
+    { legacy_gds_literals: 10 },
+    { legacy_gds_literals: 20 }
+  );
+  assert.equal(violations.length, 0);
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0], /ratchet-down available/);
+});
+
+test('the metric is MANAGED — it survives --update-baselines and has a committed baseline', () => {
+  // A metric outside computeMetrics() would be silently dropped the next time
+  // anyone refreshed the file, which is the failure mode this asserts against.
+  const metrics = ratchets.computeMetrics({ withDocs: false });
+  assert.ok(
+    Object.prototype.hasOwnProperty.call(metrics, 'legacy_gds_literals'),
+    'legacy_gds_literals must come from computeMetrics(), or --update-baselines will drop it'
+  );
+  assert.equal(typeof metrics.legacy_gds_literals, 'number');
+
+  const baselines = JSON.parse(fs.readFileSync(path.join(ROOT, 'config', 'fitness-baselines.json'), 'utf8'));
+  assert.equal(typeof baselines.metrics.legacy_gds_literals, 'number', 'the baseline must be committed');
+});
+
+test('the files that STATE the rule may name it', () => {
+  // Meta-commentary about a banned word has to be able to name the word, or the
+  // gate cannot explain itself to the person who tripped it.
+  for (const p of scan.GDS_RULE_FILES) {
+    assert.equal(scan.isExcludedPath(p), true, `rule-stating file must be exempt: ${p}`);
+    assert.ok(fs.existsSync(path.join(ROOT, p)), `rule-stating file must exist (stale exemption otherwise): ${p}`);
+  }
+});