@bongos/core 1.19.569 → 1.19.570

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.569",
-  "core_contract": "1.19.569",
-  "source_commit": "5cdee5559949c616ec9d68e725884fb87424850e",
+  "core_version": "1.19.570",
+  "core_contract": "1.19.570",
+  "source_commit": "7f686cc8bf351a08ac85f77eea54525fa067509b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T20:34:30.476Z",
+  "built_at": "2026-09-06T21:14:46.455Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 449,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2038,
+    "functional_verbatim": 2039,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2511,
-  "tree_sha256": "5c3c486ba0465ca763a11d15487bb2b540558af8430a93ea27a07323d75352e1",
+  "file_count": 2512,
+  "tree_sha256": "e0096a8f2ab3ba5363c72d452787c803202d6f43c78964e74a36a079ff086f2e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2687,7 +2687,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5942f6c9fae093d6fbb85032ca496e5f0549cc5044d8ffa4ecb90c3c9d2695dd"
+      "sha256": "bfa90a0b7ff77b9befa37207824797d0268260fd83f960fb8e2f5ff52bf97e63"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3842,7 +3842,7 @@
     {
       "path": "modules/copy-desk/routes/copy-desk.js",
       "mode": "0000644",
-      "sha256": "7231f021bb49bd78cb247a6d8e8a0f6e9256ade52f2f9bb1438b54b6ddf400f8"
+      "sha256": "63ed245f47d15758ef0926a489ad1fc7ef56d8539e836ed9e319e09b99a4a38e"
     },
     {
       "path": "modules/copy-desk/tests/copy_flags.mjs",
@@ -5407,7 +5407,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "2192c61c606a37b4782db0646242ac969bcd318d4305b1247adf028b14f2e484"
+      "sha256": "d609ecb540af92f84e365fc7c4233b0b73517665939bcffe21d068de04167a6d"
     },
     {
       "path": "modules/lifecycle/claim-eligibility.js",
@@ -5492,7 +5492,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "cf646edc2f71e39aee26cb5648cc25915b5688c7d6356345c0365ada37fdb400"
+      "sha256": "e978cadb879a57d8d7e3bb84657a787ac7e83125666fa2d31013ac64b37b0d7a"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5577,7 +5577,7 @@
     {
       "path": "modules/lifecycle/kickoff-seed.js",
       "mode": "0000644",
-      "sha256": "f26a507ea55169df9f4841edb2347610f3dea9b7eac729c034c038a0edd1c7af"
+      "sha256": "d92124875d601a0ff7ad06bf140cdbce2f1160eb53ea950ccbb509b604733d1c"
     },
     {
       "path": "modules/lifecycle/lifecycle.js",
@@ -5727,7 +5727,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "f8fb76f7aaf035974472c011a379b450ee001adc33c01c56ed8a38a3dc4a8fc8"
+      "sha256": "87843c62d8ce7af3d7d6aa5772791bd52823afe5f2c4b9b7427ca9f00dd14c11"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -5872,7 +5872,7 @@
     {
       "path": "modules/onboarding/newcomer-restock.js",
       "mode": "0000644",
-      "sha256": "533933c98d500dcbad222308a0ec6a9ee8a5c88e1a3fdc3af238f3cc98c9ba10"
+      "sha256": "65f8f2de9ac4582a6672ddeddc78b23e98d9b32865f7748efe58057145712161"
     },
     {
       "path": "modules/onboarding/onboarding-state.js",
@@ -7537,12 +7537,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e2279fd35b142a93a9037638445d5e6e616c69cd8322d05fad2aa228a5de3515"
+      "sha256": "6460f782c667dc03846bfbc1dbf299a80e2825488f4eafa664b39767a5c78c47"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1ba4dccdc1e8d591a783bdac3b0ac4f0d121ad687fef73347ac56e32e69524f7"
+      "sha256": "e0c2ff1988ca94bcc1f36b6defa3e098b12db1fdcbcc1b7616441e492628bffe"
     },
     {
       "path": "public-docs/index.html",
@@ -9242,7 +9242,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6c1005562c9950b7cee858382e3cfd643f5c2be27918859de46927c2fbd29c06"
+      "sha256": "2679c7764d5c874f7f1ecc546e552276b9e540bb66ee9f40fb3a281b9294543f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11837,7 +11837,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "02236ab849caabdf886f99aff4821c813b9f7548839ab9ee3b548fa522b9f3fb"
+      "sha256": "1ed242c879472dd872c1327c8e7c91de61886dcb108ece3fa455ae6be4b4e025"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",
@@ -12364,6 +12364,11 @@
       "mode": "0000644",
       "sha256": "93a5d1e91bfea7af8487b409e60cd609ea25a690df9099d278ebd35f253abcb8"
     },
+    {
+      "path": "tests/task_goal_required.mjs",
+      "mode": "0000644",
+      "sha256": "915711866bc194d977225326511c55ac5084b52d10a45a855bc9d6da815f4b8b"
+    },
     {
       "path": "tests/task_lib.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1587,5 +1587,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.567 with no explicit bump. run 34058174866. (task 1002620)
   1.19.569 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.568 with no explicit bump. run 34058387853. (task 1002620)
+  1.19.570 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.569 with no explicit bump. run 34060442118. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/copy-desk/routes/copy-desk.js

@@ -415,6 +415,10 @@ module.exports = function buildCopyDeskRouter() {
       const body = proposals.proposalTaskBody(patch);
       const task = await lifecycle.createTask({
         versionId: building.id,
+        // BV1.R11 (task 1003598): no goal to name until the per-version maintenance
+        // goal exists (task 1003605, R18). Declared out loud rather than relying on
+        // a silent default — see createTask.
+        allowCatchAll: true,
         title: proposals.proposalTaskTitle(patch),
         description: flagRef
           ? `${body}\n\nRaised from copy-desk flag ${flagRef}.`

package/modules/lifecycle/cascade.js

@@ -242,7 +242,18 @@ function cascadeTaskSpec(rule, task) {
     + `the rule rather than only this task.`;
   return {
     versionId: task.version_id,
+    // A cascade INHERITS its parent's goal — the follow-up belongs wherever the
+    // work that triggered it belongs.
     goalId: task.goal_id != null ? Number(task.goal_id) : null,
+    // BV1.R11 (task 1003598): …and when the parent has none, says so. A shipped
+    // task can still be goal-less — the 53 legacy catch-all rows, or any task
+    // whose version had no general goal to fall into — and under the new guard a
+    // null goalId THROWS. That throw is caught by the per-rule try/catch below,
+    // so the ship is never at risk, but the cascade task would vanish with only a
+    // console line: a silent goal-less gap, which is the exact thing this rule
+    // exists to close. Declared only when inheritance actually failed, so a
+    // cascade off a normal task still names a real goal.
+    allowCatchAll: task.goal_id == null,
     title: String(rule.title(task) || '').trim(),
     description: `${preamble}\n\n${body}`,
     discipline: rule.discipline,

package/modules/lifecycle/db-tasks.js

@@ -116,6 +116,13 @@ async function createTask({
   // path with no builder in the request (a seed, a migration backfill) passes
   // nothing and the row honestly reads unattributed, never guessed.
   createdBy = null,
+  // BV1.R11 (task 1003598): the ESCAPE HATCH, and it is meant to be loud. A
+  // create with no goalId throws unless this is true. It exists for the two
+  // in-repo vectors that have no goal to name until the per-version
+  // maintenance goal lands (task 1003605, R18) — newcomer-restock and
+  // copy-desk. Grep for it before adding a third: the answer is almost always
+  // to name a goal instead.
+  allowCatchAll = false,
 }, deps = {}) { // deps.client enlists this INSERT in the CALLER'S transaction (task 1003065, BV1.R01); the argument for it is at modules/ideas/inbox.js routeIdeaToGoal
   // task 1498 / ADR 0085: every task carries a deliberate rank floor. Derive it
   // from touches + sensitivity, then let an explicit requiresRank override only
@@ -140,15 +147,38 @@ async function createTask({
   if (rewardMissing(creditsRewardEffective)) {
     creditsRewardEffective = suggestCreditsReward({ est_minutes: estMinutes, kind });
   }
-  // task 1763: every task belongs to a goal. The goal-authored vector (POST
-  // /goals/:id/tasks) passes goalId; every OTHER vector (POST /tasks, capture,
-  // newcomer-restock, discord-bugs, seeds) omits it — so default a goal-less task
-  // into its version's catch-all "<version> — general" goal here, at the lowest
-  // create layer, so the invariant holds for all of them without touching each
-  // caller. If the version has no general goal the fallback is null and the task
-  // is created goal-less exactly as before — a creator must never be broken.
+  // BV1.R11 (task 1003598, goal 1000086, ADR 0250 D4): a goal-less create is no
+  // longer SILENT. Task 1763 defaulted any create without a goalId into its
+  // version's catch-all "<version> — general" goal, here at the lowest layer, so
+  // no caller had to think about it — and that is exactly how 53 open tasks
+  // accumulated in two catch-alls that nobody reads. Unscoped work did not sneak
+  // past the rule; the rule quietly filed it out of sight.
+  //
+  // Now a caller either NAMES a goal or says out loud that it cannot, by passing
+  // `allowCatchAll: true`. Same landing place, same never-break-a-creator
+  // promise — but the exceptions are a one-command grep instead of an absence,
+  // and a new create vector added next year gets a thrown error at its first
+  // test run rather than a silent home in a bucket.
+  //
+  // WHY NOT DELETE THE FALLBACK OUTRIGHT, which is what R11 literally asks: two
+  // in-repo callers have no goal to name yet. `newcomer-restock` stamps the
+  // beginner queue from templates and `copy-desk` files copy proposals; the
+  // honest home for both is the per-version MAINTENANCE goal, which is task
+  // 1003605 (R18) and still behind R06 and R12. Deleting the fallback today
+  // would stop both — the newcomer queue would drain — so the silent half is
+  // removed now and the true deletion belongs to R18, which is when the last two
+  // opt-ins can name a real goal. Owner's call, recorded here so the remaining
+  // gap is not mistaken for an oversight.
   let goalIdEffective = goalId;
   if (goalIdEffective == null) {
+    if (allowCatchAll !== true) {
+      throw new Error(
+        'createTask: goalId is required — every task belongs to a goal (BV1.R11). ' +
+        'A vector that genuinely cannot name one yet must pass allowCatchAll: true, ' +
+        'which files into the version catch-all and is greppable until R18 gives it ' +
+        'a maintenance goal.'
+      );
+    }
     goalIdEffective = await generalGoalIdForVersion(versionId);
   }
   const { rows } = await (deps.client || pool).query(

package/modules/lifecycle/kickoff-seed.js

@@ -60,6 +60,11 @@ async function seedKickoffIfEmpty({ builderId = null } = {}, deps = {}) {
       discipline: t.discipline || 'engineer',
       source: 'first-sign-in',
       createdBy: builderId,
+      // BV1.R11 (task 1003598): this runs on an instance with zero tasks and, in
+      // the scaffold's own seed order, zero goals — there is literally nothing to
+      // name yet. Declared rather than defaulted; the founder's first board is the
+      // one place a catch-all is the honest answer.
+      allowCatchAll: true,
     });
     seeded += 1;
   }

package/modules/lifecycle/routes/task-write-routes.js

@@ -165,6 +165,18 @@ module.exports = function registerTaskWriteRoutes(router) {
     // Validate an explicit goal_id: it must exist AND belong to THIS version (a task
     // can't be parented under another version's goal). Absent → the default-goal
     // trigger files it under the version's catch-all goal, exactly as before.
+    // BV1.R11 (task 1003598, goal 1000086, ADR 0250 D4): goal_id is REQUIRED on
+    // this vector. It used to be optional and a goal-less task was filed into the
+    // version catch-all, which is how 53 open tasks ended up in two buckets
+    // nobody reads. This is the human/agent door, and it always has a goal to
+    // name — /builder-start lists work by goal, and POST /goals/:id/tasks has
+    // required one since BV1.R60.
+    if (body.goal_id == null) {
+      return res.fail('goal_id_required', {
+        status: 400,
+        message: 'goal_id is required — every task belongs to a goal. List them at GET /goals?version=<id>, or author under one directly with POST /goals/:id/tasks.',
+      });
+    }
     if (body.goal_id != null) {
       const goal = await db.getGoal(body.goal_id);
       if (!goal || String(goal.version_id) !== String(body.version_id)) {

package/modules/onboarding/newcomer-restock.js

@@ -156,6 +156,10 @@ async function restockTemplate(discipline, template, floors) {
     const seq = maxSeq + 1 + i;
     const task = await db.createTask({
       versionId: template.version_id,
+      // BV1.R11 (task 1003598): no goal to name until the per-version maintenance
+      // goal exists (task 1003605, R18). Declared out loud rather than relying on
+      // a silent default — see createTask.
+      allowCatchAll: true,
       title: template.title,
       description: buildDescription(template),
       status: 'ready',

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.569",
+  "version": "1.19.570",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.569",
+      "version": "1.19.570",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.569",
+  "version": "1.19.570",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.569'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.570'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/reward_gate.mjs

@@ -210,7 +210,7 @@ async function withStubbedCreatePool(run) {
 
 t('a task CREATED with NO reward is born with a positive, capped value', async () => {
   await withStubbedCreatePool(async (captured) => {
-    const row = await db.createTask({ versionId: 1, title: 't', kind: 'feature', estMinutes: 40 });
+    const row = await db.createTask({ versionId: 1, goalId: 77, title: 't', kind: 'feature', estMinutes: 40 });
     assert.ok(captured.creditsReward > 0, 'INSERT must bind a positive credits_reward');
     assert.equal(captured.creditsReward, 40, 'feature @40min -> 40 drachmae');
     assert.ok(captured.creditsReward <= db.REWARD_SUGGESTION_CAP, 'must respect the cap');
@@ -220,7 +220,7 @@ t('a task CREATED with NO reward is born with a positive, capped value', async (
 
 t('a task CREATED with credits_reward 0 (the route default) is auto-assigned', async () => {
   await withStubbedCreatePool(async (captured) => {
-    await db.createTask({ versionId: 1, title: 't', creditsReward: 0, kind: 'bug', estMinutes: 40 });
+    await db.createTask({ versionId: 1, goalId: 77, title: 't', creditsReward: 0, kind: 'bug', estMinutes: 40 });
     // bug weight 1.25 -> 50; 0 is treated as "unset" so the default kicks in.
     assert.equal(captured.creditsReward, 50);
   });
@@ -228,14 +228,14 @@ t('a task CREATED with credits_reward 0 (the route default) is auto-assigned', a
 
 t('a huge-est new task is CAPPED at creation, not ballooned', async () => {
   await withStubbedCreatePool(async (captured) => {
-    await db.createTask({ versionId: 1, title: 't', kind: 'feature', estMinutes: 9999 });
+    await db.createTask({ versionId: 1, goalId: 77, title: 't', kind: 'feature', estMinutes: 9999 });
     assert.equal(captured.creditsReward, db.REWARD_SUGGESTION_CAP);
   });
 });
 
 t('an EXPLICIT positive credits_reward is PRESERVED (never overridden)', async () => {
   await withStubbedCreatePool(async (captured) => {
-    await db.createTask({ versionId: 1, title: 't', creditsReward: 17, kind: 'feature', estMinutes: 40 });
+    await db.createTask({ versionId: 1, goalId: 77, title: 't', creditsReward: 17, kind: 'feature', estMinutes: 40 });
     assert.equal(captured.creditsReward, 17, 'author-set positive value must survive untouched');
   });
 });

package/tests/task_goal_required.mjs

@@ -0,0 +1,223 @@
+// tests/task_goal_required.mjs — a goal-less create is no longer SILENT
+// (BV1.R11, task 1003598, goal 1000086, ADR 0250 D4).
+//
+// WHAT WAS ACTUALLY WRONG. Task 1763 made `createTask` default any create with no
+// `goalId` into its version's catch-all "<version> — general" goal, at the lowest
+// layer, so that no caller had to think about it. The invariant "every task
+// belongs to a goal" then held — technically — while 53 open tasks accumulated in
+// two buckets nobody reads. Unscoped work never snuck past the rule; the rule
+// filed it out of sight.
+//
+// So the defect is the SILENCE, not the bucket. A caller now either names a goal
+// or says out loud that it cannot, by passing `allowCatchAll: true`: same landing
+// place, same never-break-a-creator promise, but the exceptions are a one-command
+// grep instead of an absence, and a create vector added next year gets a thrown
+// error at its first test run rather than a quiet home in a bucket.
+//
+// NOT FULLY DELETED, and that is a recorded decision rather than an oversight.
+// R11 literally asks for the fallback's deletion, but two in-repo vectors have no
+// goal to name yet — `newcomer-restock` (the beginner queue) and `copy-desk`
+// (copy proposals) — whose honest home is the per-version maintenance goal, task
+// 1003605 (R18), still behind R06 and R12. Deleting today would drain the
+// newcomer queue. The owner chose to remove the silent half now and leave the
+// true deletion to R18. This file pins the opt-in roster so it cannot grow
+// quietly in the meantime.
+//
+// Run:  node --test tests/task_goal_required.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { createTask } = require('../modules/lifecycle/db.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+
+// A pool that would happily create the row, so a rejection can only come from the
+// guard and never from a database that was never reached.
+const permissivePool = {
+  query: async () => ({ rows: [{ id: '1', goal_id: null, title: 'x' }] }),
+  connect: async () => ({ query: async () => ({ rows: [] }), release() {} }),
+};
+
+// ---- the guard --------------------------------------------------------------
+
+test('a create with no goalId THROWS instead of quietly filing into a bucket', async () => {
+  await assert.rejects(
+    () => createTask({ versionId: 'BONGOS-V1', title: 't' }, { pool: permissivePool }),
+    /goalId is required/,
+    'the old behaviour was to succeed and say nothing');
+});
+
+test('the error tells the caller both ways out', async () => {
+  const err = await createTask({ versionId: 'BONGOS-V1', title: 't' }, { pool: permissivePool })
+    .then(() => null, (e) => e);
+  assert.ok(err, 'must reject');
+  assert.match(err.message, /BV1\.R11/, 'names the rule, so the reason is findable');
+  assert.match(err.message, /allowCatchAll: true/, 'and the escape hatch, spelled exactly');
+});
+
+test('only a literal true opts in — a truthy value still throws', async () => {
+  for (const v of [1, 'yes', {}, 'true']) {
+    await assert.rejects(
+      () => createTask({ versionId: 'BONGOS-V1', title: 't', allowCatchAll: v }, { pool: permissivePool }),
+      /goalId is required/,
+      `${JSON.stringify(v)} must not open the hatch`);
+  }
+});
+
+test('naming a goal needs no flag at all', async () => {
+  // The ordinary path must stay ordinary: a caller with a goal never learns this
+  // parameter exists.
+  await createTask(
+    { versionId: 'BONGOS-V1', title: 't', goalId: 77 },
+    { pool: permissivePool, client: permissivePool },
+  );
+});
+
+// ---- the route --------------------------------------------------------------
+
+const WRITE = src('modules/lifecycle/routes/task-write-routes.js');
+const POST_TASKS = (() => {
+  const a = WRITE.indexOf("router.post('/tasks'");
+  assert.notEqual(a, -1);
+  return WRITE.slice(a, WRITE.indexOf("router.patch('/tasks/:id'"));
+})();
+
+test('POST /tasks refuses a body with no goal_id, as a 400 that says where to look', () => {
+  assert.match(POST_TASKS, /if \(body\.goal_id == null\) \{/);
+  assert.match(POST_TASKS, /res\.fail\('goal_id_required', \{[\s\S]*?status: 400/,
+    'a missing required field is the caller\'s mistake, not a conflict');
+  assert.match(POST_TASKS, /GET \/goals\?version=/,
+    'a refusal that does not say how to comply gets worked around');
+});
+
+test('the route refuses BEFORE it validates the goal it was not given', () => {
+  const required = POST_TASKS.indexOf("'goal_id_required'");
+  const validate = POST_TASKS.indexOf("'bad_goal_id'");
+  const create = POST_TASKS.indexOf('await db.createTask(');
+  assert.ok(required !== -1 && validate !== -1 && create !== -1);
+  assert.ok(required < validate, 'absent and wrong are different answers');
+  assert.ok(required < create);
+});
+
+test('POST /tasks does NOT pass the escape hatch — this door always has a goal', () => {
+  assert.equal(/allowCatchAll/.test(POST_TASKS), false,
+    '/builder-start lists work by goal; the human/agent vector can always name one');
+});
+
+// ---- the opt-in roster, pinned ----------------------------------------------
+
+const OPT_INS = [
+  ['modules/onboarding/newcomer-restock.js', 'the beginner queue, stamped from templates'],
+  ['modules/copy-desk/routes/copy-desk.js', 'copy-change proposals'],
+  ['modules/lifecycle/kickoff-seed.js', "the founder's first board, on an instance with no goals at all"],
+  ['modules/lifecycle/cascade.js', 'a follow-up off a parent task that is itself goal-less'],
+];
+
+test('exactly four vectors opt in, and each says why', () => {
+  for (const [file, why] of OPT_INS) {
+    const body = src(file);
+    assert.match(body, /allowCatchAll/, `${file} should opt in (${why})`);
+    assert.match(body, /BV1\.R11|1003605|R18/,
+      `${file} must explain itself — an undocumented opt-in is the silence again`);
+  }
+});
+
+test('cascade opts in ONLY when inheritance actually failed', () => {
+  // The others opt in unconditionally because they have no goal to name at all.
+  // A cascade normally inherits its parent's goal and must keep doing so — the
+  // hatch is for a goal-less PARENT (a legacy catch-all row), not for cascades in
+  // general. A blanket `true` here would quietly re-open the hole for every
+  // follow-up task the system files.
+  const body = src('modules/lifecycle/cascade.js');
+  assert.match(body, /allowCatchAll: task\.goal_id == null,/);
+  assert.equal(/allowCatchAll: true/.test(body), false,
+    'an unconditional hatch here would cover every cascade, not just the legacy ones');
+  assert.match(body, /goalId: task\.goal_id != null \? Number\(task\.goal_id\) : null,/,
+    'inheritance stays the primary path');
+});
+
+test('a goal-less parent does not silently lose its cascade task', async () => {
+  // The regression this pair of fixes closes: under the guard, a null goalId
+  // throws; the throw is caught per-rule so the ship is safe, and the cascade
+  // task would have vanished with only a console line — a silent goal-less gap,
+  // which is the exact thing this rule exists to close.
+  const { runCascadesForShip } = require('../modules/lifecycle/cascade.js');
+  const specs = [];
+  const report = await runCascadesForShip({ id: 5 }, {
+    getTask: async () => ({
+      id: 5, version_id: 'BONGOS-V1', goal_id: null, status: 'shipped',
+      discipline: 'artist', kind: 'feature', title: 'legacy', touches: [],
+    }),
+    findTaskBySourceRef: async () => null,
+    createTask: async (spec) => { specs.push(spec); return { id: 9 }; },
+  });
+  assert.deepEqual(report.errors, [], 'no rule may error on a goal-less parent');
+  for (const spec of specs) {
+    assert.equal(spec.goalId, null, 'nothing to inherit');
+    assert.equal(spec.allowCatchAll, true, 'so it declares the catch-all rather than throwing');
+  }
+});
+
+test('a cascade off a NORMAL parent inherits and does not open the hatch', async () => {
+  const { runCascadesForShip } = require('../modules/lifecycle/cascade.js');
+  const specs = [];
+  await runCascadesForShip({ id: 5 }, {
+    getTask: async () => ({
+      id: 5, version_id: 'BONGOS-V1', goal_id: 77, status: 'shipped',
+      discipline: 'artist', kind: 'feature', title: 'normal', touches: [],
+    }),
+    findTaskBySourceRef: async () => null,
+    createTask: async (spec) => { specs.push(spec); return { id: 9 }; },
+  });
+  for (const spec of specs) {
+    assert.equal(spec.goalId, 77, 'the follow-up belongs where the work belongs');
+    assert.equal(spec.allowCatchAll, false, 'and the hatch stays shut');
+  }
+});
+
+test('no FIFTH vector has appeared', () => {
+  // The roster is the point: if this fails, either a new create vector took the
+  // easy way out, or R18 landed and one of these can now name a real goal — in
+  // which case delete its opt-in and this line, do not extend the list.
+  const roster = new Set([...OPT_INS.map(([f]) => f), 'modules/lifecycle/db-tasks.js']);
+  const suspects = [
+    'modules/ideas/inbox.js', 'modules/lifecycle/routes/goals.js',
+    'modules/lifecycle/routes/task-write-routes.js',
+  ];
+  for (const f of suspects) {
+    if (roster.has(f)) continue;
+    assert.equal(/allowCatchAll/.test(src(f)), false,
+      `${f} must name a goal rather than opting out`);
+  }
+});
+test('the vectors that CAN name a goal still do', () => {
+  assert.match(src('modules/ideas/inbox.js'), /goalId: goal\.id/,
+    'idea routing names the goal it routed to');
+  assert.match(src('modules/lifecycle/routes/goals.js'), /db\.createTask\(\{/,
+    'and the goal-authored vector has stamped its goal since BV1.R60');
+});
+
+// ---- the fallback itself ----------------------------------------------------
+
+test('the catch-all resolver survives, reachable only through the declared hatch', () => {
+  const dbTasks = src('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /generalGoalIdForVersion\(versionId\)/,
+    'R18 is when this goes; deleting it today would drain the newcomer queue');
+  const guard = dbTasks.slice(dbTasks.indexOf('let goalIdEffective = goalId;'));
+  const hatch = guard.indexOf('allowCatchAll !== true');
+  const resolve = guard.indexOf('generalGoalIdForVersion(versionId)');
+  assert.ok(hatch !== -1 && hatch < resolve,
+    'the throw comes first — the resolver is unreachable without the flag');
+});
+
+test('the remaining gap is written down where the next reader will stand', () => {
+  const dbTasks = src('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /WHY NOT DELETE THE FALLBACK OUTRIGHT/,
+    'so the partial job reads as a decision, not an unfinished edit');
+  assert.match(dbTasks, /1003605/, 'and names the task that finishes it');
+});