@bongos/core 1.19.559 → 1.19.561

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.559",
-  "core_contract": "1.19.559",
-  "source_commit": "5a03a11dde038c01316ec0013d430fceee6b470c",
+  "core_version": "1.19.561",
+  "core_contract": "1.19.561",
+  "source_commit": "c3f698331dac2a2225920780b219c28b7a354dc6",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T17:00:29.990Z",
+  "built_at": "2026-09-06T17:18:36.999Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 443,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2022,
+    "functional_verbatim": 2024,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2489,
-  "tree_sha256": "b08a96dd47fdc32384cfc3f290607a768f383b389fd4856eb23ba1573206e9ba",
+  "file_count": 2491,
+  "tree_sha256": "e6f6d8606c0eeca8894673e7d1e73a986383fab212dc83aedbc0cb8a02f5a631",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2657,7 +2657,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0f460fce31df884314ef67a464a571dd268fd80e09135c2dd7918a0c83617894"
+      "sha256": "b6fc3c1b36687285aa44544babb749b5dfff005f8fb95428e771302ff2f3fe5e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5432,7 +5432,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "abba32642e123860fee7b33fe429294783480afd2e25a78f63f9d4af3b1613e8"
+      "sha256": "16c5f2ed9ae4b70a30eb47a4864c4ad6273afbe19e925edcac5f9d965e670f24"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5472,7 +5472,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "df5de732d9484e1bcf801c657c78b618d1a0353a912cdb1ee4fdd2c9f121749c"
+      "sha256": "e7f65fbc43a0963ab6a7e6d25e0b52521f46b82f05115ffef80ea64d9e9fac81"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5652,7 +5652,7 @@
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "1729e085b7d83b2e4579ada11ab2b51f75a9f92686cc1d48a19f34a839fe5b73"
+      "sha256": "9bef42b55351651b188e95e254814edd4e845e77cc67bc230960af77d0f6eaa2"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -7477,12 +7477,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ea8aa9f5d4fa502d3d572540e1ee389972089112bc245cd0fd8f55056580800a"
+      "sha256": "7dc793d8391910582ab02e387931d90ef58114fc118ed14954d15ee8c4697658"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "dec482642d3b8ab9427292ae88990b4ad007f043f21923fc24d043aed110ad57"
+      "sha256": "f70384732bde00c05eeb33f54faa28fcc77df835866cb35df9dcd8f812e01ed7"
     },
     {
       "path": "public-docs/index.html",
@@ -9182,7 +9182,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "95d3088b7661e4be4b1fd900805b075e1766cd4aeed428979e1d969f005a63fb"
+      "sha256": "84964fd2a837b5f09f4fc45abef8a9eea2e79cc9072292272e4219b6860af9d7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10264,6 +10264,11 @@
       "mode": "0000644",
       "sha256": "b8c179ae6c5ad962356e5d82a5c6aa89bd523913de10799e53de16279404d07d"
     },
+    {
+      "path": "tests/goal_archive_disposition.mjs",
+      "mode": "0000644",
+      "sha256": "d2056a3ae84b79d64409e6e43c477f6b160f202903be61710b40bc4fd06c00c9"
+    },
     {
       "path": "tests/goal_category.mjs",
       "mode": "0000644",
@@ -10279,6 +10284,11 @@
       "mode": "0000644",
       "sha256": "8d1f3511b8ecd0bb88f75a936ee29035d9f789a2be4f6aedabb46b9be5bd2385"
     },
+    {
+      "path": "tests/goal_closure_invariants.mjs",
+      "mode": "0000644",
+      "sha256": "eace8ebcf39f40683bf9cbcfbc0e554b115e73d1f72894ca57a89e82d119d357"
+    },
     {
       "path": "tests/goal_conflicts.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1567,5 +1567,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.557 with no explicit bump. run 34046699120. (task 1002620)
   1.19.559 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.558 with no explicit bump. run 34047187381. (task 1002620)
+  1.19.560 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.559 with no explicit bump. run 34047736326. (task 1002620)
+  1.19.561 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.560 with no explicit bump. run 34048169727. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-goals.js

@@ -324,6 +324,35 @@ async function listGoalMembers(goalId, deps = {}) {
 // "linked criteria" half of GET /goals/:id; projection matches done-when.js's
 // listCriteria so the hall renders goal + version criteria identically.
 
+// openTasksInGoal — the work a goal is still holding, newest-blocking-first, for
+// the archive preview (BV1.R10, task 1003597, goal 1000086, ADR 0250 D3).
+//
+// Archiving used to be a single call that checked only whether the goal was
+// ALREADY archived — no criterion check and no task check — which is how goal
+// 1000018 was archived with all seven of its tasks still open. It is the hole
+// that bypasses the R08/R09 closure rule entirely: the rule guards `achieved`,
+// and archive is the other way out.
+//
+// "Still holding" is the same question the closure rule asks — non-terminal per
+// task-status.js, smoke fixtures excluded — so a goal cannot be refused for work
+// that would not have held it open on the achieve path. `cap` bounds the returned
+// rows (the caller renders them); `total` is the true count, so a goal holding
+// forty tasks reports forty and shows the first few.
+async function openTasksInGoal(goalId, { cap = 50 } = {}, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const { rows } = await activePool.query(
+    `SELECT t.id::text, t.title, t.status,
+            count(*) OVER ()::int AS total
+       FROM tasks t
+      WHERE t.goal_id = $1
+        AND ${nonTerminalSql()}
+        AND ${SMOKE_NOT_LIKE.replace(/title/, 't.title')}
+      ORDER BY t.id
+      LIMIT $2`,
+    [goalId, cap]
+  );
+  return { total: rows[0]?.total ?? 0, tasks: rows.map(({ total, ...t }) => t) };
+}
 async function listCriteriaForGoal(goalId, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   // task 1002164: carry the linked-task counts so the caller can derive the
@@ -784,6 +813,7 @@ module.exports = {
   isGoalMember,
   listActiveClaimsForTasks,
   listCriteriaForGoal,
+  openTasksInGoal,
   listGoalMembers,
   listGoals,
   listInboxFor,

package/modules/lifecycle/db.js

@@ -78,6 +78,7 @@ const {
   isGoalMember,
   listActiveClaimsForTasks,
   listCriteriaForGoal,
+  openTasksInGoal,
   listGoalMembers,
   listGoals,
   listInboxFor,
@@ -243,6 +244,7 @@ module.exports = {
   listInboxFor,
   listPendingRequestsForGoal,
   listCriteriaForGoal,
+  openTasksInGoal,
   createTask,
   generalGoalIdForVersion,
   findTaskBySourceRef,

package/modules/lifecycle/routes/goals.js

@@ -1048,6 +1048,28 @@ module.exports = function buildGoalsRouter() {
       if (goal.status === 'archived') {
         return res.fail('already_archived', 409);
       }
+      // BV1.R10 (task 1003597, goal 1000086, ADR 0250 D3): archive is the OTHER
+      // way out of a goal, and it checked nothing — which is how goal 1000018 was
+      // archived with all seven of its tasks still open. R08/R09 guard `achieved`;
+      // without this, anyone refused there could archive instead and the work
+      // would vanish from every rollup just the same.
+      //
+      // The refusal RETURNS the work rather than merely naming a count, because
+      // the caller's next move is to decide what happens to each task — and an
+      // agent that has to go fetch the list first will guess instead. Applying a
+      // disposition (abandon with the archive's reason, or move to a named
+      // surviving goal) is task 1003601 (R14); until then the honest answer is
+      // "not without saying what happens to these", not a silent discard.
+      //
+      // A goal holding nothing open stays a single call, unchanged.
+      const held = await db.openTasksInGoal(id);
+      if (held.total > 0) {
+        return res.fail('goal_holds_open_tasks', {
+          status: 409,
+          message: `Goal #${id} still holds ${held.total} unfinished task(s). Ship or abandon them, or move them to another goal, before archiving it.`,
+          details: { total: held.total, shown: held.tasks.length, tasks: held.tasks },
+        });
+      }
       const updated = await db.setGoalStatus({ goalId: id, status: 'archived' });
       return res.json({ ok: true, goal: updated });
     } catch (err) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.559",
+  "version": "1.19.561",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.559",
+      "version": "1.19.561",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.559",
+  "version": "1.19.561",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.559'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.561'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_archive_disposition.mjs

@@ -0,0 +1,144 @@
+// tests/goal_archive_disposition.mjs — archiving a goal is a recorded decision,
+// not a silent discard (BV1.R10, task 1003597, goal 1000086, ADR 0250 D3).
+//
+// THE HOLE. `POST /goals/:id/archive` refused exactly one thing: a goal that was
+// ALREADY archived. No criterion check, no task check. R08/R09 guard the flip to
+// `achieved`, so archive was the other way out — anyone refused there could
+// archive instead and the work disappeared from every rollup just the same. Goal
+// 1000018 went that way with all seven of its tasks still open.
+//
+// "Still holding" must be the SAME question the closure rule asks — non-terminal
+// per task-status.js, smoke fixtures excluded — or the two doors disagree about
+// what unfinished means and a goal is refused here for work that would not have
+// held it open there. That equivalence is what most of this file pins.
+//
+// Run:  node --test tests/goal_archive_disposition.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { openTasksInGoal } = require('../modules/lifecycle/db.js');
+const { TERMINAL_STATUSES } = require('../modules/lifecycle/task-status.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+
+// The archive handler slice, so assertions land on the right route.
+const GOALS = src('modules/lifecycle/routes/goals.js');
+const ARCHIVE = (() => {
+  const a = GOALS.indexOf("router.post('/goals/:id/archive'");
+  assert.notEqual(a, -1, 'archive route not found');
+  const b = GOALS.indexOf("router.post('/goals/:id/reopen'", a);
+  assert.notEqual(b, -1, 'reopen route should follow archive');
+  return GOALS.slice(a, b);
+})();
+
+// ---- the read ---------------------------------------------------------------
+
+test('openTasksInGoal asks the SAME question the closure rule asks', async () => {
+  let seen = null;
+  const pool = fakePool((s) => { seen = s; return { rows: [] }; });
+  await openTasksInGoal(77, {}, { pool });
+  assert.match(seen, /FROM tasks t WHERE t\.goal_id = \$1/);
+  assert.match(seen, /t\.status NOT IN \('shipped', 'abandoned'\)/,
+    'the terminal set is task-status.js\'s, not a fourth hand-typed copy');
+  assert.match(seen, /t\.title NOT LIKE/,
+    'a smoke fixture must not be able to block an archive either');
+});
+
+test('openTasksInGoal reports the TRUE total even when it returns a capped page', async () => {
+  // A goal holding forty tasks must say forty. Returning only the page length
+  // would understate the decision the caller is about to make.
+  const rows = [
+    { id: '1', title: 'a', status: 'backlog', total: 40 },
+    { id: '2', title: 'b', status: 'ready', total: 40 },
+  ];
+  const pool = fakePool(() => ({ rows }));
+  const out = await openTasksInGoal(77, { cap: 2 }, { pool });
+  assert.equal(out.total, 40, 'the window count is the real total');
+  assert.equal(out.tasks.length, 2, 'and the page is what was asked for');
+  assert.deepEqual(Object.keys(out.tasks[0]), ['id', 'title', 'status'],
+    'the window column is stripped from the rows the caller renders');
+});
+
+test('openTasksInGoal binds the cap rather than interpolating it', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  await openTasksInGoal(77, { cap: 5 }, { pool });
+  assert.deepEqual(pool.queries[0].params, [77, 5]);
+  assert.match(String(pool.queries[0].sql), /LIMIT \$2/);
+});
+
+test('an empty goal reports nothing held — the single-call path stays open', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  const out = await openTasksInGoal(77, {}, { pool });
+  assert.deepEqual(out, { total: 0, tasks: [] });
+});
+
+// ---- the route --------------------------------------------------------------
+
+test('archive refuses with a NAMED 409 when the goal holds open work', () => {
+  assert.match(ARCHIVE, /const held = await db\.openTasksInGoal\(id\);/,
+    'the archive route must consult the work before discarding it');
+  assert.match(ARCHIVE, /res\.fail\('goal_holds_open_tasks', \{[\s\S]*?status: 409/,
+    'a named code an agent can branch on, not a bare 409');
+});
+
+test('the refusal RETURNS the tasks, so the caller can decide without a second fetch', () => {
+  assert.match(ARCHIVE, /details: \{ total: held\.total, shown: held\.tasks\.length, tasks: held\.tasks \}/,
+    'an agent that has to go fetch the list will guess instead');
+});
+
+test('the check runs AFTER identity/authorization and BEFORE the status write', () => {
+  const auth = ARCHIVE.indexOf('isMemberOrArchon');
+  const already = ARCHIVE.indexOf("'already_archived'");
+  const gate = ARCHIVE.indexOf('openTasksInGoal');
+  const write = ARCHIVE.indexOf('db.setGoalStatus');
+  assert.ok(auth !== -1 && already !== -1 && gate !== -1 && write !== -1, 'all four landmarks present');
+  assert.ok(auth < gate, 'a non-member must not learn what a goal is holding');
+  assert.ok(already < gate, 're-archiving an archived goal keeps its own answer');
+  assert.ok(gate < write, 'a refusal after the write is not a refusal');
+});
+
+test('archiving a goal that holds nothing is still ONE call', () => {
+  // The guard must not turn the ordinary case into a two-step. There is exactly
+  // one setGoalStatus in this handler and no second round trip in front of it.
+  assert.equal((ARCHIVE.match(/db\.setGoalStatus/g) || []).length, 1);
+  assert.equal(/disposition_required|preview=/.test(ARCHIVE), false,
+    'no extra confirm parameter on the empty-goal path');
+});
+
+// ---- the two doors agree ----------------------------------------------------
+
+test('archive and achieve mean the same thing by "unfinished"', () => {
+  // If these drift, a goal is refused on one door for work the other would have
+  // let through — the confusing half of a rule people then route around.
+  const dbGoals = src('modules/lifecycle/db-goals.js');
+  const openTasks = dbGoals.slice(dbGoals.indexOf('async function openTasksInGoal'));
+  const achieve = dbGoals.slice(dbGoals.indexOf('async function achieveGoalIfComplete'));
+  for (const [name, body] of [['openTasksInGoal', openTasks], ['achieveGoalIfComplete', achieve]]) {
+    assert.match(body, /\$\{nonTerminalSql\(\)\}/, name + ' must read the shared terminal set');
+    assert.match(body, /SMOKE_NOT_LIKE\.replace/, name + ' must exclude smoke rows');
+  }
+});
+
+test('every non-terminal status is one the archive gate would catch', () => {
+  // Stated as data rather than prose: the statuses that hold a goal open are
+  // exactly the ones absent from the terminal set, and archive filters on that
+  // same set, so the enumeration cannot drift out of step with the constant.
+  const HOLDS_OPEN = ['backlog', 'ready', 'blocked', 'active', 'completed', 'confirmed'];
+  for (const s of HOLDS_OPEN) {
+    assert.equal(TERMINAL_STATUSES.includes(s), false,
+      `'${s}' must not be terminal — it is unfinished work an archive would discard`);
+  }
+  assert.deepEqual([...TERMINAL_STATUSES].sort(), ['abandoned', 'shipped'],
+    'and the terminal set is exactly the two deliberate endings');
+});

package/tests/goal_closure_invariants.mjs

@@ -0,0 +1,332 @@
+// tests/goal_closure_invariants.mjs — the C2 invariant, pinned across BOTH
+// achievement writers (BV1.R13, task 1003600, goal 1000086, ADR 0250 D2).
+//
+// THE INVARIANT: a goal reaches `achieved` only when its criteria are satisfied
+// AND no task in it is left in a non-terminal state. Terminal is `shipped` or
+// deliberately `abandoned`; `backlog`, `ready`, `blocked`, `active`, `completed`
+// and `confirmed` all hold the goal open.
+//
+// WHY A DEDICATED SUITE. The rule is written TWICE on purpose — `db-goals.js`
+// `achieveGoalIfComplete` for the manual `POST /done-when/:id/satisfy`, and the
+// cascade inside `done-when.js` `autoSatisfyShippedCriteria` for the path that
+// fires on every ship and every reconciler tick. They cannot be collapsed into
+// one helper (db-goals requires done-when; sharing creates a require cycle), so
+// the failure mode is DRIFT: one writer moves, the other does not, and a goal
+// closes correctly through one door and wrongly through the other. That is
+// precisely how the two "finished" vocabularies drifted apart before task
+// 1003588. This file states the invariant once and asserts it of both.
+//
+// WHAT THIS FILE IS, AND IS NOT. It runs both writers against a small in-memory
+// model of the two statements they issue — the model implements the SQL's
+// SEMANTICS (who is terminal, which goals qualify) by hand, so what is proven
+// here is the behaviour and the wiring: which view each writer consults, what it
+// decides, and what it leaves alone. The literal SQL TEXT is pinned separately —
+// tests/auto_satisfy_criteria.mjs for the cascade, tests/goal_achievement.mjs for
+// the manual path — and neither file replaces the other. A change that alters the
+// SQL's meaning has to get past both.
+//
+// Run:  node --test tests/goal_closure_invariants.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { achieveGoalIfComplete } = require('../modules/lifecycle/db.js');
+const { autoSatisfyShippedCriteria, closeCompletedWorkForShip } =
+  require('../modules/lifecycle/done-when.js');
+const { TERMINAL_STATUSES } = require('../modules/lifecycle/task-status.js');
+
+// ---------------------------------------------------------------------------
+// The model. A `world` is { goals, criteria, tasks }, where a task carries
+// { id, goal_id, status, title } and a criterion { id, goal_id, satisfied,
+// task_ids }. `makeExec(world)` returns something shaped like a pg client whose
+// two statements answer FROM THAT WORLD — so handing two writers two different
+// worlds is how the uncommitted-flip case below is expressed.
+// ---------------------------------------------------------------------------
+
+const isTerminal = (t) => TERMINAL_STATUSES.includes(t.status);
+const isSmoke = (t) => String(t.title || '').startsWith('__smoke__');
+
+// The terminal set the STATEMENT asks for, read back out of its own text, so a
+// change to task-status.js flows into the model instead of being asserted twice.
+function terminalSetIn(sql) {
+  const m = sql.match(/t\.status NOT IN \(([^)]*)\)/);
+  assert.ok(m, 'the cascade must name a terminal set the model can read');
+  return m[1].split(',').map((x) => x.trim().replace(/^'|'$/g, ''));
+}
+// "Holds the goal open": not terminal, and not a test fixture.
+const holdsOpen = (t) => !isTerminal(t) && !isSmoke(t);
+
+function world({ goalStatus = 'open', criteria = [], tasks = [] } = {}) {
+  return {
+    goals: [{ id: 77, title: 'Strict versioning', version_id: 'BONGOS-V1', status: goalStatus }],
+    criteria: criteria.map((c, i) => ({
+      id: 100 + i, goal_id: 77, version_id: 'BONGOS-V1',
+      criterion_id: 'c' + i, criterion_md: 'x', satisfied: false, task_ids: [], ...c,
+    })),
+    tasks: tasks.map((t, i) => ({ id: 200 + i, goal_id: 77, title: 'task ' + i, ...t })),
+  };
+}
+
+function makeExec(w) {
+  const calls = [];
+  const taskById = (id) => w.tasks.find((t) => t.id === id);
+  return {
+    calls,
+    world: w,
+    async query(sql, params) {
+      const s = String(sql).replace(/\s+/g, ' ').trim();
+      calls.push({ sql: s, params });
+
+      // (1) close every unsatisfied criterion whose linked tasks are ALL terminal
+      // and at least one of which actually shipped (the delivery guard).
+      if (/UPDATE done_when_criteria/.test(s)) {
+        const scoped = params[0] == null ? null : Number(params[0]);
+        const closed = w.criteria.filter((c) => {
+          if (c.satisfied) return false;
+          if (scoped != null && !c.task_ids.includes(scoped)) return false;
+          const linked = c.task_ids.map(taskById).filter(Boolean);
+          if (linked.length === 0) return false;
+          return linked.every(isTerminal) && linked.some((t) => t.status === 'shipped');
+        });
+        closed.forEach((c) => { c.satisfied = true; });
+        return { rows: closed.map((c) => ({ ...c, satisfied_by_task_id: scoped })) };
+      }
+
+      // (2) the cascade. NOT hand-coded: the model reads the statement it was
+      // actually handed and honours only the clauses PRESENT in it — including
+      // the terminal set, parsed out of the SQL rather than imported. That is
+      // what keeps this suite non-vacuous. Delete the R09 clause from
+      // done-when.js and the model stops filtering on tasks, the goal closes,
+      // and these tests go red — which `the suite can actually fail` below
+      // demonstrates rather than asserts.
+      if (/UPDATE goals g/.test(s)) {
+        const ids = (params[0] || []).map(Number);
+        const flipped = w.goals.filter((g) => {
+          if (!ids.includes(g.id)) return false;
+          if (/g\.status = 'open'/.test(s) && g.status !== 'open') return false;
+          const crit = w.criteria.filter((c) => c.goal_id === g.id);
+          if (/EXISTS \(SELECT 1 FROM done_when_criteria/.test(s) && crit.length === 0) return false;
+          if (/AND NOT d\.satisfied\)/.test(s) && crit.some((c) => !c.satisfied)) return false;
+          if (/NOT EXISTS \(SELECT 1 FROM tasks t/.test(s)) {
+            const terminal = terminalSetIn(s);
+            const smokeFiltered = /t\.title NOT LIKE/.test(s);
+            const held = w.tasks.some((t) => t.goal_id === g.id
+              && !terminal.includes(t.status)
+              && !(smokeFiltered && isSmoke(t)));
+            if (held) return false;
+          }
+          return true;
+        });
+        flipped.forEach((g) => { g.status = 'achieved'; });
+        return { rows: flipped.map((g) => ({ ...g })) };
+      }
+
+      // The manual path: getGoal, then the combined criteria + task counts, then
+      // the status flip.
+      if (/FROM goals WHERE id = \$1/.test(s)) {
+        const g = w.goals.find((x) => x.id === Number(params[0]));
+        return { rows: g ? [g] : [] };
+      }
+      if (/FROM done_when_criteria WHERE goal_id = \$1/.test(s)) {
+        const crit = w.criteria.filter((c) => c.goal_id === Number(params[0]));
+        return { rows: [{
+          total: crit.length,
+          unsatisfied: crit.filter((c) => !c.satisfied).length,
+          unfinished_tasks: w.tasks.filter((t) => t.goal_id === Number(params[0]) && holdsOpen(t)).length,
+        }] };
+      }
+      if (/^UPDATE goals/.test(s)) {
+        const g = w.goals.find((x) => x.id === Number(params[0]));
+        g.status = params[1];
+        return { rows: [{ ...g }] };
+      }
+      return { rows: [] };
+    },
+  };
+}
+const asPool = (exec) => ({ query: (sql, p) => exec.query(sql, p), connect: async () => exec, calls: exec.calls });
+
+const SHIPPED = (over) => ({ status: 'shipped', ...over });
+
+// ---------------------------------------------------------------------------
+// 1. The invariant holds on BOTH writers, for every non-terminal status
+// ---------------------------------------------------------------------------
+
+const HOLDS_OPEN = ['backlog', 'ready', 'blocked', 'active', 'completed', 'confirmed'];
+
+for (const status of HOLDS_OPEN) {
+  test(`a '${status}' sibling holds the goal open — manual path`, async () => {
+    const w = world({
+      criteria: [{ satisfied: true, task_ids: [200] }],
+      tasks: [SHIPPED(), { status }],
+    });
+    const out = await achieveGoalIfComplete({ goalId: 77 }, { pool: asPool(makeExec(w)) });
+    assert.equal(out.achieved, false, `'${status}' is not finished work`);
+    assert.equal(w.goals[0].status, 'open', 'and the row is not flipped');
+  });
+
+  test(`a '${status}' sibling holds the goal open — cascade`, async () => {
+    const w = world({
+      criteria: [{ satisfied: false, task_ids: [200] }],
+      tasks: [SHIPPED(), { status }],
+    });
+    const out = await autoSatisfyShippedCriteria(makeExec(w), { taskId: 200 });
+    assert.equal(out.criteria.length, 1, 'the criterion itself still closes — ADR 0183 is untouched');
+    assert.deepEqual(out.goals, [], 'but the goal does not');
+    assert.equal(w.goals[0].status, 'open');
+  });
+}
+
+for (const status of TERMINAL_STATUSES) {
+  test(`a '${status}' sibling does NOT hold the goal open — both writers agree`, async () => {
+    const manual = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED(), { status }] });
+    const m = await achieveGoalIfComplete({ goalId: 77 }, { pool: asPool(makeExec(manual)) });
+    assert.equal(m.achieved, true, `'${status}' is finished with the project`);
+
+    const casc = world({ criteria: [{ satisfied: false, task_ids: [200] }], tasks: [SHIPPED(), { status }] });
+    const c = await autoSatisfyShippedCriteria(makeExec(casc), { taskId: 200 });
+    assert.equal(c.goals.length, 1, 'the cascade reaches the same verdict');
+    assert.equal(casc.goals[0].status, 'achieved');
+  });
+}
+
+test('a __smoke__ fixture cannot wedge a real goal open — both writers', async () => {
+  const smoke = { status: 'backlog', title: '__smoke__ probe' };
+  const manual = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED(), smoke] });
+  assert.equal((await achieveGoalIfComplete({ goalId: 77 }, { pool: asPool(makeExec(manual)) })).achieved, true);
+
+  const casc = world({ criteria: [{ satisfied: false, task_ids: [200] }], tasks: [SHIPPED(), smoke] });
+  assert.equal((await autoSatisfyShippedCriteria(makeExec(casc), { taskId: 200 })).goals.length, 1);
+});
+
+test('the rule does not become "goals never close": clean goal still achieves', async () => {
+  const w = world({ criteria: [{ satisfied: false, task_ids: [200, 201] }], tasks: [SHIPPED(), SHIPPED()] });
+  const out = await autoSatisfyShippedCriteria(makeExec(w), { taskId: 200 });
+  assert.equal(out.goals.length, 1, 'every task terminal + every criterion satisfied = achieved');
+  assert.equal(w.goals[0].status, 'achieved');
+});
+
+test('a task linked to NO criterion still holds the goal open — the original hole', async () => {
+  // This is the exact shape that produced 14 wrongly-closed goals on the live
+  // instance: achievement was computed from criteria alone, and an unlinked task
+  // was therefore invisible to it.
+  const w = world({
+    criteria: [{ satisfied: false, task_ids: [200] }],
+    tasks: [SHIPPED(), { status: 'backlog' }], // 201 is linked to nothing
+  });
+  const out = await autoSatisfyShippedCriteria(makeExec(w), { taskId: 200 });
+  assert.equal(out.criteria.length, 1, 'the criterion is satisfied — its own tasks all shipped');
+  assert.deepEqual(out.goals, [], 'and the unlinked backlog task still holds the goal open');
+});
+
+// ---------------------------------------------------------------------------
+// 2. The cascade sees the ship transaction's UNCOMMITTED flip
+// ---------------------------------------------------------------------------
+
+test('the cascade reads through the exec it was handed, so it sees the ship\'s own uncommitted flip', async () => {
+  // Two views of the same instant, mid-ship: the transaction has already flipped
+  // task 200 confirmed→shipped but has not committed, so anything reading the
+  // module pool still sees 'confirmed' — non-terminal.
+  const inTxn = world({ criteria: [{ satisfied: false, task_ids: [200] }], tasks: [SHIPPED()] });
+  const outsideTxn = world({ criteria: [{ satisfied: false, task_ids: [200] }], tasks: [{ status: 'confirmed' }] });
+
+  const viaTxn = await autoSatisfyShippedCriteria(makeExec(inTxn), { taskId: 200 });
+  assert.equal(viaTxn.goals.length, 1,
+    "the shipping task is terminal inside its own transaction, so the goal closes");
+  assert.equal(inTxn.goals[0].status, 'achieved');
+
+  const viaPool = await autoSatisfyShippedCriteria(makeExec(outsideTxn), { taskId: 200 });
+  assert.deepEqual(viaPool.goals, [],
+    'and on a pre-commit view it would NOT — which is the bug passing the pool would cause');
+  assert.equal(outsideTxn.goals[0].status, 'open');
+
+  // Both halves matter: the first alone would pass even if the function ignored
+  // its exec and the world were globally shipped. The pair proves the OUTCOME
+  // tracks the view handed in — i.e. that the reads go through `exec`.
+});
+
+test('every statement goes through the caller exec — none reaches the module pool', async () => {
+  const exec = makeExec(world({ criteria: [{ satisfied: false, task_ids: [200] }], tasks: [SHIPPED()] }));
+  await autoSatisfyShippedCriteria(exec, { taskId: 200 });
+  assert.equal(exec.calls.length, 2, 'the criterion close and the cascade, both on exec');
+  assert.match(exec.calls[0].sql, /UPDATE done_when_criteria/);
+  assert.match(exec.calls[1].sql, /UPDATE goals g/);
+});
+
+// ---------------------------------------------------------------------------
+// 3. A ship still LANDS while its goal is held open
+// ---------------------------------------------------------------------------
+
+test('a ship lands even though a sibling backlog task holds its goal open', async () => {
+  // The ship-time hook is the only thing the closure rule touches on the ship
+  // path. It must complete quietly: the criterion closes, the goal does not, and
+  // nothing is thrown into the transaction that is landing the task.
+  const w = world({
+    criteria: [{ satisfied: false, task_ids: [200] }],
+    tasks: [SHIPPED(), { status: 'backlog' }],
+  });
+  const logged = [];
+  const line = await closeCompletedWorkForShip(makeExec(w), 200, (m) => logged.push(m));
+  assert.ok(line, 'it reports what it closed');
+  assert.match(line, /criteri/i, 'namely the criterion');
+  assert.equal(w.goals[0].status, 'open', 'the goal is held open by the sibling');
+  assert.equal(w.tasks[0].status, 'shipped', 'and the ship itself is untouched');
+});
+
+test('the hook swallows a failure rather than failing the ship', async () => {
+  // Belt and braces on the same guarantee: even if the cascade throws outright,
+  // the ship must not. The reconciler's unscoped sweep retries every tick.
+  const exploding = { query: async () => { throw new Error('deadlock detected'); } };
+  const logged = [];
+  const line = await closeCompletedWorkForShip(exploding, 200, (m) => logged.push(m));
+  assert.match(line, /auto-satisfy skipped \(sweep retries\): deadlock detected/,
+    'the failure is reported, not raised');
+});
+
+// ---------------------------------------------------------------------------
+// 4. The two writers may not drift apart
+// ---------------------------------------------------------------------------
+
+test('the suite can actually fail: strip the R09 clause and the goal wrongly closes', async () => {
+  // A model that answers from its own logic would pass these tests no matter what
+  // the code said. This one interprets the statement it is handed, so removing the
+  // clause is observable — demonstrated here against the SAME world that is held
+  // open above, with the clause edited out of the SQL on its way in.
+  const w = world({ criteria: [{ satisfied: false, task_ids: [200] }], tasks: [SHIPPED(), { status: 'backlog' }] });
+  const base = makeExec(w);
+  const stripTaskClause = (sql) => {
+    const text = String(sql);
+    const from = text.indexOf('AND NOT EXISTS (SELECT 1 FROM tasks t');
+    if (from === -1) return text;
+    const to = text.indexOf('RETURNING', from);
+    assert.notEqual(to, -1, 'the clause is expected inside the cascade UPDATE');
+    return text.slice(0, from) + text.slice(to);
+  };
+  const crippled = { query: (sql, params) => base.query(stripTaskClause(sql), params) };
+  const out = await autoSatisfyShippedCriteria(crippled, { taskId: 200 });
+  assert.equal(out.goals.length, 1,
+    'without the clause the backlog sibling is invisible and the goal closes — the pre-R09 bug');
+  assert.equal(w.goals[0].status, 'achieved',
+    'so the passing tests above are load-bearing, not decorative');
+});
+
+test('both writers reach the SAME verdict on every status, one status at a time', async () => {
+  // The anti-drift assertion, stated as behaviour rather than as matching source
+  // text: for each task status, ask both writers and require they agree.
+  const ALL = [...HOLDS_OPEN, ...TERMINAL_STATUSES];
+  const disagreements = [];
+  for (const status of ALL) {
+    const m = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED(), { status }] });
+    const manual = (await achieveGoalIfComplete({ goalId: 77 }, { pool: asPool(makeExec(m)) })).achieved;
+
+    const c = world({ criteria: [{ satisfied: false, task_ids: [200] }], tasks: [SHIPPED(), { status }] });
+    const cascade = (await autoSatisfyShippedCriteria(makeExec(c), { taskId: 200 })).goals.length > 0;
+
+    if (manual !== cascade) disagreements.push(`${status}: manual=${manual} cascade=${cascade}`);
+  }
+  assert.deepEqual(disagreements, [],
+    'the duplicate is deliberate; the DRIFT is the bug — both writers or neither');
+});