@bongos/core 1.19.560 → 1.19.562

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.560",
-  "core_contract": "1.19.560",
-  "source_commit": "a65212ce04681b336f274effbd8962cf32ac11b2",
+  "core_version": "1.19.562",
+  "core_contract": "1.19.562",
+  "source_commit": "8812128543b799aea8050fb1d51256bbdd0fc717",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T17:10:29.635Z",
+  "built_at": "2026-09-06T17:33:48.313Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 443,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2023,
+    "functional_verbatim": 2025,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2490,
-  "tree_sha256": "7c9bed5bb4565d0f0fdc718c676b3af9993ddf1a8c7ea463815469c4c24d38f5",
+  "file_count": 2492,
+  "tree_sha256": "dc363435f4898d5c74509b25e810a61c1f3a4962b038c4f1c0c1527167e48217",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2657,7 +2657,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "56724ff4d04be88dd0a7a1f938d1620d71f843f5f3bc951b5b913e64f7794e08"
+      "sha256": "9c9e6c53ef623de12cdca7cd96dfc2221c19843f45d3a84a196862f4e195c908"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5432,7 +5432,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "abba32642e123860fee7b33fe429294783480afd2e25a78f63f9d4af3b1613e8"
+      "sha256": "16c5f2ed9ae4b70a30eb47a4864c4ad6273afbe19e925edcac5f9d965e670f24"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5472,7 +5472,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "df5de732d9484e1bcf801c657c78b618d1a0353a912cdb1ee4fdd2c9f121749c"
+      "sha256": "e7f65fbc43a0963ab6a7e6d25e0b52521f46b82f05115ffef80ea64d9e9fac81"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5647,12 +5647,12 @@
     {
       "path": "modules/lifecycle/routes/goal-route-authz.js",
       "mode": "0000644",
-      "sha256": "909686de2d34b184e9676370782e4b07179b784c72eb6db4af22399051b15642"
+      "sha256": "c380ad664c18beff53dd50e9bd5ad9ba78c05c18fae182cc0b0cc8ea41ee1a75"
     },
     {
       "path": "modules/lifecycle/routes/goals.js",
       "mode": "0000644",
-      "sha256": "1729e085b7d83b2e4579ada11ab2b51f75a9f92686cc1d48a19f34a839fe5b73"
+      "sha256": "9d3079d7f3f610aa5893f02fb4858f73ec98718d6096c423cd52c15d2b30d1ec"
     },
     {
       "path": "modules/lifecycle/routes/help-requests.js",
@@ -7477,12 +7477,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9c4d3a611995e84c828f539bf2f87ca6a92b6c165cffc4754e985513b1010080"
+      "sha256": "c9fb4551642e3a6cdd1db0e7795805314e2a62b413eb96d2b6ee981146d666c3"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3816fc5ab250ecfa35f68b9383e6357d900be8ddca3d3f6ae643fb48a2c5edca"
+      "sha256": "fe6556a8d666ce01124d6666fd07d7ad01920fe596ca3718398fb4bbcc885465"
     },
     {
       "path": "public-docs/index.html",
@@ -9182,7 +9182,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6a833a6e4e92f2675ea5e5a66a8134cb087bba01f6bba371109c953649535f0a"
+      "sha256": "c08cf2ff080e74afdd1c88cb06f4960909b4984bc803f6eeddab57abe14fed79"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10264,6 +10264,11 @@
       "mode": "0000644",
       "sha256": "b8c179ae6c5ad962356e5d82a5c6aa89bd523913de10799e53de16279404d07d"
     },
+    {
+      "path": "tests/goal_archive_disposition.mjs",
+      "mode": "0000644",
+      "sha256": "d2056a3ae84b79d64409e6e43c477f6b160f202903be61710b40bc4fd06c00c9"
+    },
     {
       "path": "tests/goal_category.mjs",
       "mode": "0000644",
@@ -10289,6 +10294,11 @@
       "mode": "0000644",
       "sha256": "1dd92e13f21ed2b029c64d07dcdd6c47aa4f59ce25e288786c4fa7245ba707c5"
     },
+    {
+      "path": "tests/goal_create_version_gate.mjs",
+      "mode": "0000644",
+      "sha256": "addd9fe7179236d24c316923fd47a60947c1a34f9e01eb1a4d47faa49b4fa18f"
+    },
     {
       "path": "tests/goal_criterion_confirm_ui.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1569,5 +1569,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.558 with no explicit bump. run 34047187381. (task 1002620)
   1.19.560 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.559 with no explicit bump. run 34047736326. (task 1002620)
+  1.19.561 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.560 with no explicit bump. run 34048169727. (task 1002620)
+  1.19.562 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.561 with no explicit bump. run 34048961786. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-goals.js

@@ -324,6 +324,35 @@ async function listGoalMembers(goalId, deps = {}) {
 // "linked criteria" half of GET /goals/:id; projection matches done-when.js's
 // listCriteria so the hall renders goal + version criteria identically.
 
+// openTasksInGoal — the work a goal is still holding, newest-blocking-first, for
+// the archive preview (BV1.R10, task 1003597, goal 1000086, ADR 0250 D3).
+//
+// Archiving used to be a single call that checked only whether the goal was
+// ALREADY archived — no criterion check and no task check — which is how goal
+// 1000018 was archived with all seven of its tasks still open. It is the hole
+// that bypasses the R08/R09 closure rule entirely: the rule guards `achieved`,
+// and archive is the other way out.
+//
+// "Still holding" is the same question the closure rule asks — non-terminal per
+// task-status.js, smoke fixtures excluded — so a goal cannot be refused for work
+// that would not have held it open on the achieve path. `cap` bounds the returned
+// rows (the caller renders them); `total` is the true count, so a goal holding
+// forty tasks reports forty and shows the first few.
+async function openTasksInGoal(goalId, { cap = 50 } = {}, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const { rows } = await activePool.query(
+    `SELECT t.id::text, t.title, t.status,
+            count(*) OVER ()::int AS total
+       FROM tasks t
+      WHERE t.goal_id = $1
+        AND ${nonTerminalSql()}
+        AND ${SMOKE_NOT_LIKE.replace(/title/, 't.title')}
+      ORDER BY t.id
+      LIMIT $2`,
+    [goalId, cap]
+  );
+  return { total: rows[0]?.total ?? 0, tasks: rows.map(({ total, ...t }) => t) };
+}
 async function listCriteriaForGoal(goalId, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   // task 1002164: carry the linked-task counts so the caller can derive the
@@ -784,6 +813,7 @@ module.exports = {
   isGoalMember,
   listActiveClaimsForTasks,
   listCriteriaForGoal,
+  openTasksInGoal,
   listGoalMembers,
   listGoals,
   listInboxFor,

package/modules/lifecycle/db.js

@@ -78,6 +78,7 @@ const {
   isGoalMember,
   listActiveClaimsForTasks,
   listCriteriaForGoal,
+  openTasksInGoal,
   listGoalMembers,
   listGoals,
   listInboxFor,
@@ -243,6 +244,7 @@ module.exports = {
   listInboxFor,
   listPendingRequestsForGoal,
   listCriteriaForGoal,
+  openTasksInGoal,
   createTask,
   generalGoalIdForVersion,
   findTaskBySourceRef,

package/modules/lifecycle/routes/goal-route-authz.js

@@ -15,6 +15,7 @@ const db = require('../db');
 const { isModuleKey, scopeIncludesProtected, moduleKeys } = api.moduleScopeMap;
 const goalScopeCheck = api.goalScopeCheck;
 const { isGoalOwner, authorizeGoalManagement } = require('../goal-authz');
+const { versionAcceptsNewWork } = require('../db-tasks.js');
 const METIC_PLUS = ['metic', 'archon'];
 
 async function isMemberOrArchon(builder, goalId) {
@@ -65,6 +66,62 @@ function goalNotOpenRefusal(goal) {
   };
 }
 
+// authorizeGoalCreate — PURE, FAIL-CLOSED. May a goal be created on this version?
+// (BV1.R03, task 1003591, goal 1000086, ADR 0250 D1.)
+//
+// THE RULE: a version's goal set closes when the version starts BUILDING. New
+// goals go on the `planning` version — that is what a planning version is for,
+// scoping the next one in advance and at leisure. `POST /goals` used to fetch the
+// version row and discard it after the null check, so a goal could be added to a
+// version that had been building for months, which is how a version's scope grew
+// without anyone deciding to widen it.
+//
+// Three answers, ordered fail-closed (an absent or unrecognised version denies):
+//   no version            → 404 version_not_found
+//   not open to work      → 409 version_closed      (shipped, or a status we
+//                                                    cannot vouch for)
+//   building              → 409 version_not_planning (the R07 override admits
+//                                                    ONE named goal, with a reason)
+//   planning              → ok
+//
+// The open-to-work question is `versionAcceptsNewWork` — the same predicate the
+// task-create path uses — rather than a second spelling of the status list, so
+// "a version we can still file into" has one definition. This gate is STRICTER
+// than that predicate on purpose: work may land on a building version, but its
+// SCOPE may not grow. Reusing the predicate for the first question and adding the
+// planning test on top is what keeps those two facts from being confused.
+//
+// `override` is the R07 Archon admission (task 1003594), which is not built yet.
+// It is a parameter here rather than a later edit to the signature so that R07
+// wires a decision in without reopening this ordering: pass true and a building
+// version is accepted. It does NOT bypass version_closed — a shipped version is
+// closed history, and no override makes it writable again.
+function authorizeGoalCreate({ version, override = false }) {
+  if (!version) {
+    return { ok: false, status: 404, body: {
+      error: 'version_not_found', message: 'No such version.',
+    } };
+  }
+  if (!versionAcceptsNewWork(version.status)) {
+    return { ok: false, status: 409, body: {
+      error: 'version_closed', status: version.status,
+      // Says which status refused rather than asserting 'shipped': the predicate
+      // is fail-closed, so it also catches null and any status added later, and
+      // telling someone their planning-adjacent version "has shipped" would be a
+      // confident lie about state they can see for themselves.
+      message: version.status === 'shipped'
+        ? `Version '${version.id}' has shipped — it is closed history and cannot take new goals.`
+        : `Version '${version.id}' is '${version.status}', which is not a state that takes new goals.`,
+    } };
+  }
+  if (version.status !== 'planning' && override !== true) {
+    return { ok: false, status: 409, body: {
+      error: 'version_not_planning', status: version.status,
+      message: `Version '${version.id}' is already building — its goal set is closed. Scope this goal onto the planning version instead, or ask an Archon to admit it with a reason.`,
+    } };
+  }
+  return { ok: true };
+}
 function authorizeGoalTaskCreate({ goal, version, isMember, builderRank, touches }) {
   if (!goal) {
     return { ok: false, status: 404, body: { error: 'goal_not_found' } };
@@ -458,6 +515,7 @@ function decorateGoalScope(goal) {
 
 module.exports = {
   authorizeCreateJoinRequest,
+  authorizeGoalCreate,
   authorizeGoalTaskCreate,
   authorizeInvitationAccept,
   authorizeInvitationResponse,

package/modules/lifecycle/routes/goals.js

@@ -63,7 +63,7 @@ const JOIN_REQUEST_RESPONSE_ACTIONS = ['approve', 'deny']; // an owner/manager/A
 // proceed; a false result means "not a member" → the route should 403. This is the
 // membership half of the wall; the protected-module rank check is enforced per-route
 // (scope is never self-granted).
-const { authorizeCreateJoinRequest, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, isMemberOrArchon, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
+const { authorizeCreateJoinRequest, authorizeGoalCreate, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, isMemberOrArchon, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 module.exports = function buildGoalsRouter() {
@@ -99,8 +99,13 @@ module.exports = function buildGoalsRouter() {
 
     try {
       const version = await db.getVersion(req.body.version_id);
-      if (!version) {
-        return res.fail('version_not_found', { status: 404, message: 'No such version.' });
+      // BV1.R03 (task 1003591, goal 1000086, ADR 0250 D1): the version row was
+      // fetched and then discarded after the null check — its status was never
+      // read, so a goal could be added to a version that had been building for
+      // months. The ordered, DB-free gate answers all of it, including the 404.
+      const versionDecision = authorizeGoalCreate({ version });
+      if (!versionDecision.ok) {
+        return res.status(versionDecision.status).json(versionDecision.body);
       }
       // Rescope carry-forward (ADR 0086 §6 / BV1.R64): a new-version goal may declare
       // the (achieved) goal it continues. Validate the predecessor exists BEFORE
@@ -1048,6 +1053,28 @@ module.exports = function buildGoalsRouter() {
       if (goal.status === 'archived') {
         return res.fail('already_archived', 409);
       }
+      // BV1.R10 (task 1003597, goal 1000086, ADR 0250 D3): archive is the OTHER
+      // way out of a goal, and it checked nothing — which is how goal 1000018 was
+      // archived with all seven of its tasks still open. R08/R09 guard `achieved`;
+      // without this, anyone refused there could archive instead and the work
+      // would vanish from every rollup just the same.
+      //
+      // The refusal RETURNS the work rather than merely naming a count, because
+      // the caller's next move is to decide what happens to each task — and an
+      // agent that has to go fetch the list first will guess instead. Applying a
+      // disposition (abandon with the archive's reason, or move to a named
+      // surviving goal) is task 1003601 (R14); until then the honest answer is
+      // "not without saying what happens to these", not a silent discard.
+      //
+      // A goal holding nothing open stays a single call, unchanged.
+      const held = await db.openTasksInGoal(id);
+      if (held.total > 0) {
+        return res.fail('goal_holds_open_tasks', {
+          status: 409,
+          message: `Goal #${id} still holds ${held.total} unfinished task(s). Ship or abandon them, or move them to another goal, before archiving it.`,
+          details: { total: held.total, shown: held.tasks.length, tasks: held.tasks },
+        });
+      }
       const updated = await db.setGoalStatus({ goalId: id, status: 'archived' });
       return res.json({ ok: true, goal: updated });
     } catch (err) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.560",
+  "version": "1.19.562",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.560",
+      "version": "1.19.562",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.560",
+  "version": "1.19.562",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.560'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.562'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_archive_disposition.mjs

@@ -0,0 +1,144 @@
+// tests/goal_archive_disposition.mjs — archiving a goal is a recorded decision,
+// not a silent discard (BV1.R10, task 1003597, goal 1000086, ADR 0250 D3).
+//
+// THE HOLE. `POST /goals/:id/archive` refused exactly one thing: a goal that was
+// ALREADY archived. No criterion check, no task check. R08/R09 guard the flip to
+// `achieved`, so archive was the other way out — anyone refused there could
+// archive instead and the work disappeared from every rollup just the same. Goal
+// 1000018 went that way with all seven of its tasks still open.
+//
+// "Still holding" must be the SAME question the closure rule asks — non-terminal
+// per task-status.js, smoke fixtures excluded — or the two doors disagree about
+// what unfinished means and a goal is refused here for work that would not have
+// held it open there. That equivalence is what most of this file pins.
+//
+// Run:  node --test tests/goal_archive_disposition.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { openTasksInGoal } = require('../modules/lifecycle/db.js');
+const { TERMINAL_STATUSES } = require('../modules/lifecycle/task-status.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+
+// The archive handler slice, so assertions land on the right route.
+const GOALS = src('modules/lifecycle/routes/goals.js');
+const ARCHIVE = (() => {
+  const a = GOALS.indexOf("router.post('/goals/:id/archive'");
+  assert.notEqual(a, -1, 'archive route not found');
+  const b = GOALS.indexOf("router.post('/goals/:id/reopen'", a);
+  assert.notEqual(b, -1, 'reopen route should follow archive');
+  return GOALS.slice(a, b);
+})();
+
+// ---- the read ---------------------------------------------------------------
+
+test('openTasksInGoal asks the SAME question the closure rule asks', async () => {
+  let seen = null;
+  const pool = fakePool((s) => { seen = s; return { rows: [] }; });
+  await openTasksInGoal(77, {}, { pool });
+  assert.match(seen, /FROM tasks t WHERE t\.goal_id = \$1/);
+  assert.match(seen, /t\.status NOT IN \('shipped', 'abandoned'\)/,
+    'the terminal set is task-status.js\'s, not a fourth hand-typed copy');
+  assert.match(seen, /t\.title NOT LIKE/,
+    'a smoke fixture must not be able to block an archive either');
+});
+
+test('openTasksInGoal reports the TRUE total even when it returns a capped page', async () => {
+  // A goal holding forty tasks must say forty. Returning only the page length
+  // would understate the decision the caller is about to make.
+  const rows = [
+    { id: '1', title: 'a', status: 'backlog', total: 40 },
+    { id: '2', title: 'b', status: 'ready', total: 40 },
+  ];
+  const pool = fakePool(() => ({ rows }));
+  const out = await openTasksInGoal(77, { cap: 2 }, { pool });
+  assert.equal(out.total, 40, 'the window count is the real total');
+  assert.equal(out.tasks.length, 2, 'and the page is what was asked for');
+  assert.deepEqual(Object.keys(out.tasks[0]), ['id', 'title', 'status'],
+    'the window column is stripped from the rows the caller renders');
+});
+
+test('openTasksInGoal binds the cap rather than interpolating it', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  await openTasksInGoal(77, { cap: 5 }, { pool });
+  assert.deepEqual(pool.queries[0].params, [77, 5]);
+  assert.match(String(pool.queries[0].sql), /LIMIT \$2/);
+});
+
+test('an empty goal reports nothing held — the single-call path stays open', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  const out = await openTasksInGoal(77, {}, { pool });
+  assert.deepEqual(out, { total: 0, tasks: [] });
+});
+
+// ---- the route --------------------------------------------------------------
+
+test('archive refuses with a NAMED 409 when the goal holds open work', () => {
+  assert.match(ARCHIVE, /const held = await db\.openTasksInGoal\(id\);/,
+    'the archive route must consult the work before discarding it');
+  assert.match(ARCHIVE, /res\.fail\('goal_holds_open_tasks', \{[\s\S]*?status: 409/,
+    'a named code an agent can branch on, not a bare 409');
+});
+
+test('the refusal RETURNS the tasks, so the caller can decide without a second fetch', () => {
+  assert.match(ARCHIVE, /details: \{ total: held\.total, shown: held\.tasks\.length, tasks: held\.tasks \}/,
+    'an agent that has to go fetch the list will guess instead');
+});
+
+test('the check runs AFTER identity/authorization and BEFORE the status write', () => {
+  const auth = ARCHIVE.indexOf('isMemberOrArchon');
+  const already = ARCHIVE.indexOf("'already_archived'");
+  const gate = ARCHIVE.indexOf('openTasksInGoal');
+  const write = ARCHIVE.indexOf('db.setGoalStatus');
+  assert.ok(auth !== -1 && already !== -1 && gate !== -1 && write !== -1, 'all four landmarks present');
+  assert.ok(auth < gate, 'a non-member must not learn what a goal is holding');
+  assert.ok(already < gate, 're-archiving an archived goal keeps its own answer');
+  assert.ok(gate < write, 'a refusal after the write is not a refusal');
+});
+
+test('archiving a goal that holds nothing is still ONE call', () => {
+  // The guard must not turn the ordinary case into a two-step. There is exactly
+  // one setGoalStatus in this handler and no second round trip in front of it.
+  assert.equal((ARCHIVE.match(/db\.setGoalStatus/g) || []).length, 1);
+  assert.equal(/disposition_required|preview=/.test(ARCHIVE), false,
+    'no extra confirm parameter on the empty-goal path');
+});
+
+// ---- the two doors agree ----------------------------------------------------
+
+test('archive and achieve mean the same thing by "unfinished"', () => {
+  // If these drift, a goal is refused on one door for work the other would have
+  // let through — the confusing half of a rule people then route around.
+  const dbGoals = src('modules/lifecycle/db-goals.js');
+  const openTasks = dbGoals.slice(dbGoals.indexOf('async function openTasksInGoal'));
+  const achieve = dbGoals.slice(dbGoals.indexOf('async function achieveGoalIfComplete'));
+  for (const [name, body] of [['openTasksInGoal', openTasks], ['achieveGoalIfComplete', achieve]]) {
+    assert.match(body, /\$\{nonTerminalSql\(\)\}/, name + ' must read the shared terminal set');
+    assert.match(body, /SMOKE_NOT_LIKE\.replace/, name + ' must exclude smoke rows');
+  }
+});
+
+test('every non-terminal status is one the archive gate would catch', () => {
+  // Stated as data rather than prose: the statuses that hold a goal open are
+  // exactly the ones absent from the terminal set, and archive filters on that
+  // same set, so the enumeration cannot drift out of step with the constant.
+  const HOLDS_OPEN = ['backlog', 'ready', 'blocked', 'active', 'completed', 'confirmed'];
+  for (const s of HOLDS_OPEN) {
+    assert.equal(TERMINAL_STATUSES.includes(s), false,
+      `'${s}' must not be terminal — it is unfinished work an archive would discard`);
+  }
+  assert.deepEqual([...TERMINAL_STATUSES].sort(), ['abandoned', 'shipped'],
+    'and the terminal set is exactly the two deliberate endings');
+});

package/tests/goal_create_version_gate.mjs

@@ -0,0 +1,136 @@
+// tests/goal_create_version_gate.mjs — a version's goal set closes when the
+// version starts building (BV1.R03, task 1003591, goal 1000086, ADR 0250 D1).
+//
+// THE HOLE. `POST /goals` fetched the version row and discarded it after the null
+// check. `version.status` was never read, so a goal could be added to a version
+// that had been building for months — which is how a version's scope grows
+// without anyone deciding to widen it, and why 64 goals accumulated on
+// BONGOS-V1. New goals belong on the `planning` version: that is what a planning
+// version is FOR, scoping the next one in advance.
+//
+// The gate is pure and DB-free (the `authorizeGoalTaskCreate` precedent), so its
+// whole truth table is exercised here without a database, and the route's only
+// job is to render the decision.
+//
+// Run:  node --test tests/goal_create_version_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { authorizeGoalCreate } = require('../modules/lifecycle/routes/goal-route-authz.js');
+const { versionAcceptsNewWork } = require('../modules/lifecycle/db-tasks.js');
+
+const V = (status) => ({ id: 'BONGOS-V1', status });
+const decide = (version, override) => authorizeGoalCreate({ version, override });
+
+// ---- the truth table --------------------------------------------------------
+
+test('planning accepts — that is what a planning version is for', () => {
+  assert.deepEqual(decide(V('planning')), { ok: true });
+});
+
+test('building refuses with a named 409 an agent can act on', () => {
+  const d = decide(V('building'));
+  assert.equal(d.ok, false);
+  assert.equal(d.status, 409);
+  assert.equal(d.body.error, 'version_not_planning');
+  assert.equal(d.body.status, 'building', 'the caller learns WHICH state refused');
+  assert.match(d.body.message, /planning version/,
+    'and where the goal should go instead — a refusal with no next move gets routed around');
+});
+
+test('shipped refuses as closed history, not as "not planning"', () => {
+  // Two different facts deserve two different codes: a building version might
+  // still admit this goal via an Archon override; a shipped one never will.
+  const d = decide(V('shipped'));
+  assert.equal(d.body.error, 'version_closed');
+  assert.match(d.body.message, /has shipped/);
+});
+
+test('a missing version is a 404, before any status reasoning', () => {
+  const d = decide(null);
+  assert.equal(d.status, 404);
+  assert.equal(d.body.error, 'version_not_found');
+});
+
+test('FAIL-CLOSED: a status nobody taught this gate about refuses', () => {
+  // A version status added later must not default to "sure, file it here".
+  for (const status of ['paused', 'draft', '', undefined, null, 42]) {
+    const d = decide(V(status));
+    assert.equal(d.ok, false, `'${String(status)}' must not be accepted`);
+    assert.equal(d.body.error, 'version_closed');
+  }
+});
+
+test('an unrecognised status is NOT described as shipped', () => {
+  // The fail-closed arm catches more than `shipped`, and telling someone their
+  // version "has shipped" when it says 'paused' is a confident lie about state
+  // they can see for themselves.
+  const d = decide(V('paused'));
+  assert.match(d.body.message, /is 'paused'/);
+  assert.equal(/has shipped/.test(d.body.message), false);
+});
+
+// ---- the override seam (R07 is not built yet) -------------------------------
+
+test('override admits a building version — the R07 seam, already shaped', () => {
+  assert.deepEqual(decide(V('building'), true), { ok: true });
+});
+
+test('override does NOT reopen a shipped version', () => {
+  // The escape hatch is for a scope decision, not for rewriting closed history.
+  assert.equal(decide(V('shipped'), true).body.error, 'version_closed');
+  assert.equal(decide(V('paused'), true).body.error, 'version_closed');
+});
+
+test('only a literal true overrides — a truthy value does not', () => {
+  for (const v of ['yes', 1, {}, [] ]) {
+    assert.equal(decide(V('building'), v).ok, false,
+      'a JSON body coercing to truthy must not open the gate');
+  }
+});
+
+// ---- one definition of "open to work" ---------------------------------------
+
+test('the gate reuses versionAcceptsNewWork rather than respelling the statuses', () => {
+  const src = readFileSync(new URL('../modules/lifecycle/routes/goal-route-authz.js', import.meta.url), 'utf8');
+  const body = src.slice(src.indexOf('function authorizeGoalCreate'), src.indexOf('function authorizeGoalTaskCreate'));
+  assert.match(body, /versionAcceptsNewWork\(version\.status\)/);
+  assert.equal(/'shipped'\s*,\s*'planning'|new Set\(\[/.test(body), false,
+    'no second copy of the status list lives in this gate');
+});
+
+test('the gate is STRICTER than versionAcceptsNewWork, deliberately', () => {
+  // Work may still LAND on a building version; its SCOPE may not grow. Those are
+  // two different questions and this pins that they give different answers.
+  assert.equal(versionAcceptsNewWork('building'), true, 'tasks may still be filed');
+  assert.equal(decide(V('building')).ok, false, 'but a new goal may not');
+  assert.equal(versionAcceptsNewWork('planning'), true);
+  assert.equal(decide(V('planning')).ok, true);
+});
+
+// ---- the route renders the decision and nothing else ------------------------
+
+test('POST /goals consults the gate and returns its exact status + body', () => {
+  const src = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
+  const start = src.indexOf("router.post('/goals'");
+  assert.notEqual(start, -1);
+  const body = src.slice(start, src.indexOf('router.', start + 20));
+  assert.match(body, /const versionDecision = authorizeGoalCreate\(\{ version \}\);/);
+  assert.match(body, /return res\.status\(versionDecision\.status\)\.json\(versionDecision\.body\);/,
+    'the route renders the decision, it does not re-derive one');
+  assert.equal(/version\.status\s*[=!]==/.test(body), false,
+    'and it must not compare the status itself — that is the gate\'s job');
+});
+
+test('the 404 moved INTO the gate, so the route has no second version check', () => {
+  const src = readFileSync(new URL('../modules/lifecycle/routes/goals.js', import.meta.url), 'utf8');
+  const start = src.indexOf("router.post('/goals'");
+  const body = src.slice(start, src.indexOf('router.', start + 20));
+  assert.equal(/if \(!version\)/.test(body), false,
+    'one ordered decision, not a null check here and a status check there');
+});