@bongos/core 1.19.569 → 1.19.571

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.569",
-  "core_contract": "1.19.569",
-  "source_commit": "5cdee5559949c616ec9d68e725884fb87424850e",
+  "core_version": "1.19.571",
+  "core_contract": "1.19.571",
+  "source_commit": "342ef455a76142077c47deaa4ef6db7b76139f1e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-06T20:34:30.476Z",
+  "built_at": "2026-09-06T23:07:09.000Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 449,
+    "docs_redacted": 450,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2038,
+    "functional_verbatim": 2040,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2511,
-  "tree_sha256": "5c3c486ba0465ca763a11d15487bb2b540558af8430a93ea27a07323d75352e1",
+  "file_count": 2514,
+  "tree_sha256": "c508f7935f6abe6b6bdf02bab8820c895a17b9c1d3c689fab2c0e78ad6ce985b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1799,10 +1799,15 @@
       "mode": "0000644",
       "sha256": "4b7d5b4ca5ad92a128235a6c3407617f2d8b34c26ed6e1c8b2a72e63eed7adac"
     },
+    {
+      "path": "docs/adr/0257-auth-resolves-before-the-hall-mounts-anything.md",
+      "mode": "0000644",
+      "sha256": "5ebfaa564a125f2c5bb0b391b8ff01914f147c15c9ef3f4caa91bafa8bd2e8ed"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "52422b934d0b3245605ec0913049be65768a814a6f9aee5f7ad8149c4221a093"
+      "sha256": "e9b47055a52c284035c201fae3f172215c746caabf938922821f4efcda2e8980"
     },
     {
       "path": "docs/api-reference.md",
@@ -1837,12 +1842,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "375801be3c0c325da208e3f95fb6aa04e5a0136297673a562d143f61e4ca4c83"
+      "sha256": "8bdf39ea0b8ed9583f9ef68b0edae767eec9c2825f8ef355d678b3db3d08b5e1"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "5a2ff67ac4a1cf8edf959b02db2a1c226de24c16a8b7b98762cfc1863d1a8f52"
+      "sha256": "cd51497ccca735bf1f8178291b427f4166aff79870a080a4a9d036238f0ff90c"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2687,7 +2692,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "5942f6c9fae093d6fbb85032ca496e5f0549cc5044d8ffa4ecb90c3c9d2695dd"
+      "sha256": "64941aa45c872838ad9b962b98fd750eea92110cfdb9b40bb16b0c57748f09c3"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3842,7 +3847,7 @@
     {
       "path": "modules/copy-desk/routes/copy-desk.js",
       "mode": "0000644",
-      "sha256": "7231f021bb49bd78cb247a6d8e8a0f6e9256ade52f2f9bb1438b54b6ddf400f8"
+      "sha256": "63ed245f47d15758ef0926a489ad1fc7ef56d8539e836ed9e319e09b99a4a38e"
     },
     {
       "path": "modules/copy-desk/tests/copy_flags.mjs",
@@ -4642,7 +4647,7 @@
     {
       "path": "modules/hall-ui/public/builders.js",
       "mode": "0000644",
-      "sha256": "876c4f21b3aaa77fad298915afe7cc481a39b5235e846f61bcc7657a270dd227"
+      "sha256": "ac1252ef25e0fe8b5774ef3d6566970657437de1151cd3e9e194859067fee789"
     },
     {
       "path": "modules/hall-ui/public/chime.wav",
@@ -4822,7 +4827,7 @@
     {
       "path": "modules/hall-ui/public/goals.js",
       "mode": "0000644",
-      "sha256": "9cdbc14c1709dcc26fe9b8c85b2bfd08685a2925c9855758ca8e758455d1bc5c"
+      "sha256": "7800d109e109d61772edcf9fdd1f01dcd079a0937358f2ed8da6cbed361c1e9c"
     },
     {
       "path": "modules/hall-ui/public/goals.states.json",
@@ -5407,7 +5412,7 @@
     {
       "path": "modules/lifecycle/cascade.js",
       "mode": "0000644",
-      "sha256": "2192c61c606a37b4782db0646242ac969bcd318d4305b1247adf028b14f2e484"
+      "sha256": "d609ecb540af92f84e365fc7c4233b0b73517665939bcffe21d068de04167a6d"
     },
     {
       "path": "modules/lifecycle/claim-eligibility.js",
@@ -5492,7 +5497,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "cf646edc2f71e39aee26cb5648cc25915b5688c7d6356345c0365ada37fdb400"
+      "sha256": "e978cadb879a57d8d7e3bb84657a787ac7e83125666fa2d31013ac64b37b0d7a"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5577,7 +5582,7 @@
     {
       "path": "modules/lifecycle/kickoff-seed.js",
       "mode": "0000644",
-      "sha256": "f26a507ea55169df9f4841edb2347610f3dea9b7eac729c034c038a0edd1c7af"
+      "sha256": "d92124875d601a0ff7ad06bf140cdbce2f1160eb53ea950ccbb509b604733d1c"
     },
     {
       "path": "modules/lifecycle/lifecycle.js",
@@ -5727,7 +5732,7 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "f8fb76f7aaf035974472c011a379b450ee001adc33c01c56ed8a38a3dc4a8fc8"
+      "sha256": "87843c62d8ce7af3d7d6aa5772791bd52823afe5f2c4b9b7427ca9f00dd14c11"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
@@ -5872,7 +5877,7 @@
     {
       "path": "modules/onboarding/newcomer-restock.js",
       "mode": "0000644",
-      "sha256": "533933c98d500dcbad222308a0ec6a9ee8a5c88e1a3fdc3af238f3cc98c9ba10"
+      "sha256": "65f8f2de9ac4582a6672ddeddc78b23e98d9b32865f7748efe58057145712161"
     },
     {
       "path": "modules/onboarding/onboarding-state.js",
@@ -7537,12 +7542,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e2279fd35b142a93a9037638445d5e6e616c69cd8322d05fad2aa228a5de3515"
+      "sha256": "6e8b9fee606ca0b7f97205d2cd7eace56e341a525232e39e3da81e05390da456"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "1ba4dccdc1e8d591a783bdac3b0ac4f0d121ad687fef73347ac56e32e69524f7"
+      "sha256": "5a2e1030453e82c8b52575c904e816e833343788d90e07c5d1946f15207fe8a4"
     },
     {
       "path": "public-docs/index.html",
@@ -9242,7 +9247,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6c1005562c9950b7cee858382e3cfd643f5c2be27918859de46927c2fbd29c06"
+      "sha256": "a92eeea78188a9a1658c5d6dc928062720189bf23511e2ca50d9a4eac5ef91ef"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10714,6 +10719,11 @@
       "mode": "0000644",
       "sha256": "5654f4366ddcfcb61848a119a2dba3827f3fe19c0151005558a803c2e09db573"
     },
+    {
+      "path": "tests/hall_landing_boot.mjs",
+      "mode": "0000644",
+      "sha256": "36711b8d885203ecb2f70ecd6aaf18359bc6796d50300bc8b062485a24ba49a4"
+    },
     {
       "path": "tests/hall_nav.mjs",
       "mode": "0000644",
@@ -11837,7 +11847,7 @@
     {
       "path": "tests/reward_gate.mjs",
       "mode": "0000644",
-      "sha256": "02236ab849caabdf886f99aff4821c813b9f7548839ab9ee3b548fa522b9f3fb"
+      "sha256": "1ed242c879472dd872c1327c8e7c91de61886dcb108ece3fa455ae6be4b4e025"
     },
     {
       "path": "tests/reward_mode_cost_plus_only.mjs",
@@ -12364,6 +12374,11 @@
       "mode": "0000644",
       "sha256": "93a5d1e91bfea7af8487b409e60cd609ea25a690df9099d278ebd35f253abcb8"
     },
+    {
+      "path": "tests/task_goal_required.mjs",
+      "mode": "0000644",
+      "sha256": "915711866bc194d977225326511c55ac5084b52d10a45a855bc9d6da815f4b8b"
+    },
     {
       "path": "tests/task_lib.mjs",
       "mode": "0000644",

package/docs/adr/0257-auth-resolves-before-the-hall-mounts-anything.md

@@ -0,0 +1,84 @@
+# ADR 0257 — Auth resolves before the hall mounts anything, and a widget's boot read may never navigate
+
+- **Status:** accepted
+- **Date:** 2026-09-06
+- **Task:** [task 1003673](https://cloudbongos.com/builders#/task/1003673) (BONGOS-V1, goal 1000063 — *The front door*)
+- **Deciders:** Claude, under the Archon's standing scope
+- **Related:** [ADR 0050](<redacted>.md) (admission is invite-gated by default — the posture this defect made unusable) · [ADR 0194](<redacted>.md) + [ADR 0247](<redacted>.md) (the door the landing form renders) · [ADR 0062 §4](<redacted>.md) (the hall-widget registry)
+
+---
+
+## Context
+
+An owner stood up an instance, invited a colleague, and watched them sign in with
+GitHub. They got *"Sign-in failed — this account is not approved yet. New here?
+Request access first"*, whose one button goes to `/builders`. The owner then went
+looking for the approval queue and found nothing to approve: `GET /access-requests`
+answered `{"requests": []}`, and the hall hides the Access-requests panel when the
+queue is empty. Both halves are working as designed — **signing in does not file a
+request**; only the landing page's *Request access* form does.
+
+The landing page could not be reached. A signed-out visitor to `/builders` was
+bounced to GitHub, refused as a first-timer, and pointed back at `/builders` to be
+bounced again. A closed loop, and the form sat inside it. Every invite-only
+instance — the default posture since ADR 0050 — therefore had **no way to admit its
+first builder**, and the symptom pointed at the approval UI rather than at the door.
+
+Reproduced against `main` (not only against an old pin) by serving
+`modules/hall-ui/public` statically with every authenticated route answering 401:
+
+```
+GET /api/bongos/me            401   (soft — builders.js would renderLanding())
+GET /api/bongos/goals         401   -> window.location.assign(/auth/web/start)
+GET /api/bongos/auth/web/start      the dead end
+```
+
+`builders.js` was already careful: `/me` is read with `softAuth`, and a 401 there
+renders the landing rather than bouncing. But its `DOMContentLoaded` handler called
+`mountHallWidgets()` **first**, synchronously. `goals.js`'s `mount()` reads `/goals`
+through a `getJSON` with no `softAuth`, and that helper answers 401 by *navigating*.
+The widget's read therefore raced `renderLanding()` — and won.
+
+## Decision
+
+**1. The front door settles which page this is before anything else runs.**
+`builders.js` boots through `boot()`: read `/me` (soft), and only then choose.
+Signed out → `renderLanding()` and stop; nothing else mounts, nothing else fetches.
+Signed in → mount widgets, wire events, render the hall. The resolved `/me` payload
+is handed to `loadAll()` rather than re-fetched, so the page still asks once.
+
+Widgets are member surfaces — `renderLanding()` already hid every one of them after
+the fact — so not mounting them for a signed-out visitor removes a whole class of
+races rather than the one instance of it that was found.
+
+**2. A widget's own boot read may never navigate.** `goals.js`'s mount-time read is
+`softAuth`, and answers "no session" by rendering nothing. A 401 during page boot is
+not an error and not an instruction to go and sign in; it is the answer *this visitor
+has no session*, which the landing already handles. Only a user action may send
+someone to the sign-in flow.
+
+## Consequences
+
+- An invite-only instance can admit its first builder: the landing renders, the
+  request form is reachable, the queue fills, and the owner has something to approve.
+- The "Sign-in failed" page's CTA now lands somewhere useful — the loop is closed at
+  both ends.
+- `tests/hall_landing_boot.mjs` executes the real `builders.js` in a DOM stub and
+  asserts the invariant three ways: a signed-out boot never navigates, renders the
+  landing, and mounts no widgets; it asks for `/me` and nothing else; and a signed-in
+  boot still mounts the hall on a single `/me`. The guard was confirmed to FAIL
+  against the pre-fix file — a regression test that passes both ways guards nothing.
+- A widget added later can still reintroduce the class if it hard-redirects at mount
+  AND something mounts it while signed out. The boot order is what makes that
+  unreachable; the `softAuth` rule is the belt beside it.
+
+## Rejected
+
+- **Patch `goals.js` alone.** It was the widget that happened to fire first. Any
+  mount-time authenticated read can steal the page, so the fix belongs at the boot
+  order, not at whichever widget was caught doing it.
+- **Make the 401 → redirect helper soft everywhere.** A signed-in builder whose
+  session expires mid-visit *should* be sent to sign in. The distinction that matters
+  is boot versus user action, not the status code.
+- **Open enrollment** (`OPEN_XENOS_ENROLLMENT`) as the cure. That removes the gate
+  instead of repairing the door, and ADR 0050 chose the gate deliberately.

package/docs/adr/README.md

@@ -348,3 +348,4 @@ This keeps the decision history honest and traceable.
 | 0246 | [**Catalog membership is a projection of the provisioning row, not a side effect of federation** ([task 1003576](https://cloudbongos.com/builders#/task/1003576) · goal 1000046, criterion `proj-detail-interview` / C3). The BV1.R18 proof ([task 1002337](https://cloudbongos.com/builders#/task/1002337)) demonstrated C3 against live and found its last clause — “then it publishes” — structurally false: the owner’s verdict reads `provisioning_instances` while the public map reads `platform_identity_projects`, and the ONLY bridge was `federateInstance → registerClient → upsertProject`, which `shouldFederate` refuses for anything but `co-tenant` (the wizard hard-codes `standalone`) and which runs ONCE, at provision time, through a COALESCE. So a wizard-made project was never catalogued at all and a co-tenant one that answered later never updated — `publishable: true`, `{"projects": []}`, forever. The same missing row is [task 1003580](https://cloudbongos.com/builders#/task/1003580)’s GAP 1: `POST /projects/invite` resolves against `platform_identity_sso_clients`, whose only writer is that same `registerClient`. Underneath is one conflation — federation mints CREDENTIALS and was incidentally the only thing that minted MEMBERSHIP, while [ADR 0182](<redacted>.md) D4 already fixed the map’s gate at IDENTITY, which has nothing to do with hosting topology. **Decision: the catalog row is a PROJECTION of the provisioning row, re-derived at every write that can change its inputs** — two halves, neither sufficient alone. (1) THE ROW SHAPE: every control-plane project gets both rows whatever its hosting shape, and the client row carries NO credential (`secret_hash = ''`, `redirect_uris = '{}'`), so **the shape is the enforcement** rather than a flag a caller could forget — `redirectUriAllowed` refuses `/sso/authorize`, `clientSecretValid` refuses `/sso/token`, `/sso/membership/check-in` and `/sso/activity/rollup`, and the one leg that checked NEITHER (`/sso/device/start`, which resolves a client from a user-typed origin) grew an explicit `clientIsCredentialed` guard. (2) THE TIMING: re-taken on create, on `PATCH …/detail`, on `PATCH …/settings` when the door changes, and on `POST …/domain` (which re-keys the row, retiring the abandoned origin — [ADR 0181](0181-teardown-state-gate-and-address-retention.md) §2’s leak, in the catalog instead of DNS). **NO MIGRATION** — `secret_hash` is `NOT NULL` and `''` satisfies it while hashing to nothing. `description` and `visibility` are ASSIGNED, not COALESCEd (clearing a description must UN-publish); `featured`/`tagline`/`art_url`/`template` are curation and stay untouched, so [ADR 0182](<redacted>.md) D3 holds. It grants nothing — the row is attribution per [ADR 0238](<redacted>.md), ownership stays `provisioning_instances.owner_builder_id` — and because it writes rows keyed on owner-supplied values (a slug, a BYO domain) each write carries its **claim rule in the ON CONFLICT action’s own WHERE**: the client is refreshed only `WHERE secret_hash = ''` (a real client’s origin, which binds the CLI mint audience, can never be rewritten) and the project only `WHERE owner_github_id = EXCLUDED.owner_github_id` (`NULL = anything` is not true, so the hand-seeded rows cannot be claimed). Writing `visibility` does not contradict [ADR 0182](<redacted>.md) D5: the hub authorizes nothing — the authority already ran on the provisioning plane ([ADR 0238](<redacted>.md)’s own-scoped, audited PATCH), and a project the control plane does NOT own has no provisioning row, so D5’s instance report (R08) stays the only channel for those. `tearing_down`/`torn_down` project `hidden`; a `no_address` instance is not catalogued at all. Travels on the kernel port `project.catalog`, the `project.publishGate` seam in the other direction ([ADR 0083](<redacted>.md) forbids the import). Rejected: extending `shouldFederate` to every shape (hands a real secret to instances whose web.env the platform does not write, and keeps the once-at-standup bug); bridging only at the publish moment (leaves the invite with nothing to resolve); registering only at standup (the bug itself); a `catalog_only` boolean column (needs a migration and is weaker than the shape); letting the bridge write `featured`; and backfilling the three existing catalog rows from code.](<redacted>.md) | provisioning / project creation |
 
 > ⚠️ **Numbering collisions are now machine-enforced, not narrated.** Twenty numbers are shared by two ADRs each — assigned in parallel sessions before anything checked. The files keep their filenames (renumbering would break every existing citation, and a number once assigned is never reused), and this table disambiguates each pair as `NNNN-a` / `NNNN-b`. The authoritative list is `LEGACY_DUPLICATE_ADRS` in [`scripts/gds/adr-namespace.js`](../../scripts/gds/adr-namespace.js), frozen by exact filename: a **new** collision — or a third file joining a legacy number, or a rename of either half — hard-fails the `unit` CI gate, as does an index row that points at no file or an ADR with no row. The list may only shrink. This paragraph used to narrate the collisions one by one and had fallen eight behind reality; see [ADR 0195](<redacted>.md) for why the check exists and why the pairs are grandfathered rather than renumbered.
+| 0257 | [**Auth resolves before the hall mounts anything, and a widget's boot read may never navigate** ([task 1003673](https://cloudbongos.com/builders#/task/1003673) · goal 1000063 — *The front door*). An invite-only instance could not admit its FIRST builder, and the symptom lied about where the fault was: an owner saw an empty Access-requests queue and no approve button, because **signing in does not file a request** — only the landing's *Request access* form does, and that form was unreachable. A signed-out visitor to `/builders` was bounced to GitHub, refused as a first-timer ("request access first"), and pointed back at `/builders` to be bounced again. Reproduced against `main`, not just an old pin. `builders.js` was already careful — `/me` is read `softAuth` and a 401 there renders the landing — but `DOMContentLoaded` called `mountHallWidgets()` FIRST, synchronously, and `goals.js`'s mount-time read of `/goals` goes through a `getJSON` with no `softAuth`, which answers 401 by NAVIGATING. The widget's read raced `renderLanding()` and won. **Decision: the front door settles which page this is before anything else runs** — `boot()` reads `/me` (soft), then either renders the landing and stops (nothing mounts, nothing else fetches) or mounts the hall, handing the resolved payload to `loadAll()` so the page still asks once. Widgets are member surfaces (`renderLanding` hid them all after the fact anyway), so not mounting them while signed out removes the CLASS rather than the one instance of it that was found; **a widget's own boot read may never navigate** is the belt beside it (`goals.js` reads soft and renders nothing without a session). A 401 during boot is not an instruction to go and sign in — only a user action is. `tests/hall_landing_boot.mjs` executes the real `builders.js` in a DOM stub and was confirmed to FAIL against the pre-fix file. Rejected: patching `goals.js` alone (it was merely first); making the 401 redirect soft everywhere (an expired session mid-visit SHOULD be sent to sign in — the line is boot vs user action); open enrollment as the cure (removes the gate [ADR 0050](<redacted>.md) chose deliberately instead of repairing the door).](<redacted>.md) | hall-ui / admission / front door |

package/docs/copy-inventory.md

@@ -135,7 +135,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `1b326b0be1a4` | certain | A {…} — you are a {…}. Mingle pairs across crafts. | `modules/hall-ui/public/collab.js:196` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:46` |
 | `996edffc1966` | certain | Access requests | `modules/hall-ui/public/watch.html:61` |
-| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1154` |
+| `303f8d90266f` | certain | Achievements could not be loaded. | `modules/hall-ui/public/builders.js:1158` |
 | `6ca31dd5eb91` | certain | Acknowledge the primer | `modules/hall-ui/public/primer.html:99` |
 | `4461b13f95c2` | certain | Actions apply at once. Closing stops and deletes the box; you can start a fresh one anytime. | `modules/hall-ui/public/settings.html:209` |
 | `524188fe0078` | certain | Active sessions | `modules/hall-ui/public/settings.html:162` |
@@ -445,7 +445,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `529460e82058` | certain | Goal invitations to you | `modules/hall-ui/public/goal-inbox.js:113` |
 | `e2a9e33abe60` | certain | Goal tasks | `modules/hall-ui/public/goals.html:136` |
 | `e0bc28d10785` | certain | Goals could not be loaded. Refresh to try again. | `modules/hall-ui/public/goals-page.js:890` |
-| `4517f2253d0f` | certain | Goals couldn’t be loaded just now. Refresh to try again. | `modules/hall-ui/public/goals.js:112` |
+| `4517f2253d0f` | certain | Goals couldn’t be loaded just now. Refresh to try again. | `modules/hall-ui/public/goals.js:121` |
 | `6a85997bda21` | certain | Goals created | `modules/hall-ui/public/profile.html:145` |
 | `2ed2cb8fbffd` | certain | Goals page | `modules/hall-ui/public/goals.js:94` |
 | `320a0516a33e` | certain | Goals seeded — awaiting kickoff | `modules/hall-ui/public/roadmap.js:205` |
@@ -907,7 +907,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `381f29be7497` | certain | The most recently shipped tasks. | `modules/hall-ui/public/work.html:108` |
 | `82479c539fca` | certain | The name shown beside your work — in the roster, the leaderboard, and the work feed. Your sign-in and the cred | `modules/hall-ui/public/settings.html:75` |
 | `b88dd8b96b72` | certain | The next person to notice this sentence reads your note instead of re-litigating it. | `modules/hall-ui/public/copy-desk.html:135` |
-| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1396` |
+| `aa716f3dd551` | certain | The page could not be loaded. Try again. | `modules/hall-ui/public/builders.js:1425` |
 | `74bc22f38140` | certain | The platform confirmed this request came from the account it names. | `modules/hall-ui/public/watch.js:349` |
 | `6c3d88de42de` | certain | The primer | `modules/hall-ui/public/primer.html:41` |
 | `dea378cd4837` | certain | The primer did not load | `modules/hall-ui/public/primer.html:88` |

package/docs/copy-registry.json

@@ -2211,7 +2211,7 @@
       "surface": "builders-hall",
       "text": "Achievements could not be loaded.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1154,
+      "line": 1158,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5001,7 +5001,7 @@
       "surface": "builders-hall",
       "text": "Goals couldn’t be loaded just now. Refresh to try again.",
       "file": "modules/hall-ui/public/goals.js",
-      "line": 112,
+      "line": 121,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9159,7 +9159,7 @@
       "surface": "builders-hall",
       "text": "The page could not be loaded. Try again.",
       "file": "modules/hall-ui/public/builders.js",
-      "line": 1396,
+      "line": 1425,
       "origin": "js-notice",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -1587,5 +1587,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.567 with no explicit bump. run 34058174866. (task 1002620)
   1.19.569 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.568 with no explicit bump. run 34058387853. (task 1002620)
+  1.19.570 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.569 with no explicit bump. run 34060442118. (task 1002620)
+  1.19.571 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.570 with no explicit bump. run 34065943703. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/copy-desk/routes/copy-desk.js

@@ -415,6 +415,10 @@ module.exports = function buildCopyDeskRouter() {
       const body = proposals.proposalTaskBody(patch);
       const task = await lifecycle.createTask({
         versionId: building.id,
+        // BV1.R11 (task 1003598): no goal to name until the per-version maintenance
+        // goal exists (task 1003605, R18). Declared out loud rather than relying on
+        // a silent default — see createTask.
+        allowCatchAll: true,
         title: proposals.proposalTaskTitle(patch),
         description: flagRef
           ? `${body}\n\nRaised from copy-desk flag ${flagRef}.`

package/modules/hall-ui/public/builders.js

@@ -1044,16 +1044,20 @@
 
   // ---- bootstrap -----------------------------------------------------------
 
-  async function loadAll() {
+  // `prefetchedMe` is boot()'s already-resolved /me — the SAME payload, handed in
+  // so the page does not ask twice. Called with nothing (a re-render), it fetches.
+  async function loadAll(prefetchedMe) {
     // Profile first. If /me returns 401, render an unauth landing card with a
     // Sign-in button instead of bouncing straight to GitHub — gives the visitor
     // a beat of orientation about what they're walking into.
-    let me;
-    try {
-      me = await getJSON(`${API}/me`, { softAuth: true });
-    } catch (err) {
-      if (err && err.code === AUTH_NEEDED) { renderLanding(); return; }
-      throw err;
+    let me = prefetchedMe || null;
+    if (!me) {
+      try {
+        me = await getJSON(`${API}/me`, { softAuth: true });
+      } catch (err) {
+        if (err && err.code === AUTH_NEEDED) { renderLanding(); return; }
+        throw err;
+      }
     }
     // Signed in: drop the landing card if a previous unauth render left it up.
     const landingRoot = $('#landing-root');
@@ -1374,7 +1378,31 @@
     get newcomerGated() { return newcomerGated; },
   });
 
-  document.addEventListener('DOMContentLoaded', () => {
+  // boot — AUTH FIRST, then the page (task 1003673).
+  //
+  // The front door has exactly two shapes, and which one this is must be settled
+  // BEFORE anything else runs. A signed-out visitor gets the landing (the door:
+  // sign in, or request access) and nothing else; a builder gets the hall.
+  //
+  // Why the order is load-bearing: mountHallWidgets() mounts every registered
+  // widget, and a widget's mount() reads its own data. Any such read that treats
+  // a 401 as "go and sign in" NAVIGATES — and mounting before /me resolved gave
+  // those reads a head start on renderLanding(), so the signed-out visitor was
+  // bounced to GitHub, refused as a first-timer ("request access first"), and
+  // sent back here to be bounced again. A closed loop: the request form was
+  // unreachable, so an invite-only instance could never admit its first builder.
+  // Widgets are for members, so a signed-out visitor simply never mounts them
+  // (renderLanding hides those sections anyway) and nothing can steal the page.
+  async function boot() {
+    let me = null;
+    try {
+      me = await getJSON(`${API}/me`, { softAuth: true });
+    } catch (err) {
+      if (!(err && err.code === AUTH_NEEDED)) throw err;
+    }
+
+    if (!me) { renderLanding(); return; }
+
     // BV1.R75: stamp the registry's <section>s into <main> BEFORE wiring events —
     // wireEvents() + the data-render code address the widgets by their static ids,
     // which only exist once the registry has mounted them.
@@ -1386,11 +1414,12 @@
     // #731: the Discord connect/link card moved to /builders/settings, and the
     // OAuth callback now lands there — so the ?discord=joined|linked toast is
     // handled by settings.js, not here.
-    loadAll().then(() => {
-      // Only open the live channel once we're authenticated — loadAll() returns
-      // early (landing card) for an unauthenticated visitor, leaving selfId unset.
-      if (window.__buildersSelfId) startLiveUpdates();
-    }).catch((err) => {
+    await loadAll(me);
+    if (window.__buildersSelfId) startLiveUpdates();
+  }
+
+  document.addEventListener('DOMContentLoaded', () => {
+    boot().catch((err) => {
       if (err && err.message === 'redirecting to auth') return;
       console.error('[builders] load failed', err);
       toast('The page could not be loaded. Try again.');

package/modules/hall-ui/public/goals.js

@@ -101,7 +101,13 @@
         const me = await getJSON(`${API}/me`, { softAuth: true }).catch(() => null);
         myId = me && me.builder ? me.builder.id : null;
       }
-      const gres = await getJSON(`${API}/goals`);
+      // softAuth (task 1003673): a widget's own boot read may NEVER navigate.
+      // This ran at mount time and its 401 hard-redirected to GitHub, which is
+      // what stole the page from a signed-out visitor before the landing could
+      // paint. boot() no longer mounts widgets for a signed-out visitor; this
+      // keeps the widget itself harmless if it is ever mounted without a session
+      // (an expired cookie mid-visit), where the honest answer is to say nothing.
+      const gres = await getJSON(`${API}/goals`, { softAuth: true });
       const candidates = (gres.goals || []).filter((g) => g.status !== 'archived');
       const details = (await Promise.all(candidates.map((g) =>
         getJSON(`${API}/goals/${encodeURIComponent(g.id)}`).catch(() => null)))).filter(Boolean);
@@ -109,6 +115,9 @@
       render(joined);
     } catch (err) {
       const body = host.querySelector('#goals-body');
+      // Signed out is not a failure — it is simply nothing to show. Only a real
+      // error earns the retry line (and the console noise).
+      if (err && err.code === 'auth-needed') { if (body) body.innerHTML = ''; return; }
       if (body) body.innerHTML = '<p class="goal-empty">Goals couldn’t be loaded just now. Refresh to try again.</p>';
       console.error('[hall] goals load failed', err);
     }

package/modules/lifecycle/cascade.js

@@ -242,7 +242,18 @@ function cascadeTaskSpec(rule, task) {
     + `the rule rather than only this task.`;
   return {
     versionId: task.version_id,
+    // A cascade INHERITS its parent's goal — the follow-up belongs wherever the
+    // work that triggered it belongs.
     goalId: task.goal_id != null ? Number(task.goal_id) : null,
+    // BV1.R11 (task 1003598): …and when the parent has none, says so. A shipped
+    // task can still be goal-less — the 53 legacy catch-all rows, or any task
+    // whose version had no general goal to fall into — and under the new guard a
+    // null goalId THROWS. That throw is caught by the per-rule try/catch below,
+    // so the ship is never at risk, but the cascade task would vanish with only a
+    // console line: a silent goal-less gap, which is the exact thing this rule
+    // exists to close. Declared only when inheritance actually failed, so a
+    // cascade off a normal task still names a real goal.
+    allowCatchAll: task.goal_id == null,
     title: String(rule.title(task) || '').trim(),
     description: `${preamble}\n\n${body}`,
     discipline: rule.discipline,

package/modules/lifecycle/db-tasks.js

@@ -116,6 +116,13 @@ async function createTask({
   // path with no builder in the request (a seed, a migration backfill) passes
   // nothing and the row honestly reads unattributed, never guessed.
   createdBy = null,
+  // BV1.R11 (task 1003598): the ESCAPE HATCH, and it is meant to be loud. A
+  // create with no goalId throws unless this is true. It exists for the two
+  // in-repo vectors that have no goal to name until the per-version
+  // maintenance goal lands (task 1003605, R18) — newcomer-restock and
+  // copy-desk. Grep for it before adding a third: the answer is almost always
+  // to name a goal instead.
+  allowCatchAll = false,
 }, deps = {}) { // deps.client enlists this INSERT in the CALLER'S transaction (task 1003065, BV1.R01); the argument for it is at modules/ideas/inbox.js routeIdeaToGoal
   // task 1498 / ADR 0085: every task carries a deliberate rank floor. Derive it
   // from touches + sensitivity, then let an explicit requiresRank override only
@@ -140,15 +147,38 @@ async function createTask({
   if (rewardMissing(creditsRewardEffective)) {
     creditsRewardEffective = suggestCreditsReward({ est_minutes: estMinutes, kind });
   }
-  // task 1763: every task belongs to a goal. The goal-authored vector (POST
-  // /goals/:id/tasks) passes goalId; every OTHER vector (POST /tasks, capture,
-  // newcomer-restock, discord-bugs, seeds) omits it — so default a goal-less task
-  // into its version's catch-all "<version> — general" goal here, at the lowest
-  // create layer, so the invariant holds for all of them without touching each
-  // caller. If the version has no general goal the fallback is null and the task
-  // is created goal-less exactly as before — a creator must never be broken.
+  // BV1.R11 (task 1003598, goal 1000086, ADR 0250 D4): a goal-less create is no
+  // longer SILENT. Task 1763 defaulted any create without a goalId into its
+  // version's catch-all "<version> — general" goal, here at the lowest layer, so
+  // no caller had to think about it — and that is exactly how 53 open tasks
+  // accumulated in two catch-alls that nobody reads. Unscoped work did not sneak
+  // past the rule; the rule quietly filed it out of sight.
+  //
+  // Now a caller either NAMES a goal or says out loud that it cannot, by passing
+  // `allowCatchAll: true`. Same landing place, same never-break-a-creator
+  // promise — but the exceptions are a one-command grep instead of an absence,
+  // and a new create vector added next year gets a thrown error at its first
+  // test run rather than a silent home in a bucket.
+  //
+  // WHY NOT DELETE THE FALLBACK OUTRIGHT, which is what R11 literally asks: two
+  // in-repo callers have no goal to name yet. `newcomer-restock` stamps the
+  // beginner queue from templates and `copy-desk` files copy proposals; the
+  // honest home for both is the per-version MAINTENANCE goal, which is task
+  // 1003605 (R18) and still behind R06 and R12. Deleting the fallback today
+  // would stop both — the newcomer queue would drain — so the silent half is
+  // removed now and the true deletion belongs to R18, which is when the last two
+  // opt-ins can name a real goal. Owner's call, recorded here so the remaining
+  // gap is not mistaken for an oversight.
   let goalIdEffective = goalId;
   if (goalIdEffective == null) {
+    if (allowCatchAll !== true) {
+      throw new Error(
+        'createTask: goalId is required — every task belongs to a goal (BV1.R11). ' +
+        'A vector that genuinely cannot name one yet must pass allowCatchAll: true, ' +
+        'which files into the version catch-all and is greppable until R18 gives it ' +
+        'a maintenance goal.'
+      );
+    }
     goalIdEffective = await generalGoalIdForVersion(versionId);
   }
   const { rows } = await (deps.client || pool).query(

package/modules/lifecycle/kickoff-seed.js

@@ -60,6 +60,11 @@ async function seedKickoffIfEmpty({ builderId = null } = {}, deps = {}) {
       discipline: t.discipline || 'engineer',
       source: 'first-sign-in',
       createdBy: builderId,
+      // BV1.R11 (task 1003598): this runs on an instance with zero tasks and, in
+      // the scaffold's own seed order, zero goals — there is literally nothing to
+      // name yet. Declared rather than defaulted; the founder's first board is the
+      // one place a catch-all is the honest answer.
+      allowCatchAll: true,
     });
     seeded += 1;
   }

package/modules/lifecycle/routes/task-write-routes.js

@@ -165,6 +165,18 @@ module.exports = function registerTaskWriteRoutes(router) {
     // Validate an explicit goal_id: it must exist AND belong to THIS version (a task
     // can't be parented under another version's goal). Absent → the default-goal
     // trigger files it under the version's catch-all goal, exactly as before.
+    // BV1.R11 (task 1003598, goal 1000086, ADR 0250 D4): goal_id is REQUIRED on
+    // this vector. It used to be optional and a goal-less task was filed into the
+    // version catch-all, which is how 53 open tasks ended up in two buckets
+    // nobody reads. This is the human/agent door, and it always has a goal to
+    // name — /builder-start lists work by goal, and POST /goals/:id/tasks has
+    // required one since BV1.R60.
+    if (body.goal_id == null) {
+      return res.fail('goal_id_required', {
+        status: 400,
+        message: 'goal_id is required — every task belongs to a goal. List them at GET /goals?version=<id>, or author under one directly with POST /goals/:id/tasks.',
+      });
+    }
     if (body.goal_id != null) {
       const goal = await db.getGoal(body.goal_id);
       if (!goal || String(goal.version_id) !== String(body.version_id)) {

package/modules/onboarding/newcomer-restock.js

@@ -156,6 +156,10 @@ async function restockTemplate(discipline, template, floors) {
     const seq = maxSeq + 1 + i;
     const task = await db.createTask({
       versionId: template.version_id,
+      // BV1.R11 (task 1003598): no goal to name until the per-version maintenance
+      // goal exists (task 1003605, R18). Declared out loud rather than relying on
+      // a silent default — see createTask.
+      allowCatchAll: true,
       title: template.title,
       description: buildDescription(template),
       status: 'ready',

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.569",
+  "version": "1.19.571",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.569",
+      "version": "1.19.571",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.569",
+  "version": "1.19.571",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.569'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.571'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_landing_boot.mjs

@@ -0,0 +1,141 @@
+// tests/hall_landing_boot.mjs — the front door's boot order (task 1003673).
+//
+// Regression guard for the bug that locked every invite-only instance out of its
+// own first builder: a signed-out visitor to /builders never saw the landing.
+// builders.js mounted the hall widgets BEFORE /me resolved, a widget's own boot
+// read 401'd, that read treated 401 as "go and sign in" and NAVIGATED — so the
+// page bounced to GitHub, which refuses a first-timer with "request access
+// first" and points them back at /builders to be bounced again. The request form
+// sat behind that loop, unreachable, so the approval queue could never fill.
+//
+// The invariant this locks down: AUTH IS RESOLVED BEFORE THE HALL MOUNTS
+// ANYTHING. A signed-out visitor gets the landing and nothing else; only a
+// signed-in one mounts widgets. Executes the real builders.js in a minimal DOM
+// stub (the hall_signout.mjs / hall_nav.mjs pattern) and drives DOMContentLoaded.
+// Pure vm + file-read (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/builders.js'), 'utf8');
+
+// Boot builders.js against a /me that answers `meStatus`, then fire
+// DOMContentLoaded and let the microtasks drain. Returns what the page DID.
+async function boot({ meStatus }) {
+  const calls = { assign: [], requests: [], rendered: [] };
+
+  const makeEl = () => ({
+    dataset: {}, style: {}, title: '', textContent: '', hidden: false, value: '',
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; }, removeAttribute() {},
+    addEventListener() {}, querySelector() { return null; }, querySelectorAll() { return []; },
+    appendChild() {}, focus() {}, click() {}, closest() { return null; },
+    set innerHTML(_v) {}, get innerHTML() { return ''; },
+  });
+
+  const location = { pathname: '/builders', search: '', hash: '', href: 'https://x/builders', assign(u) { calls.assign.push(u); } };
+
+  const api = {
+    request(method, p) {
+      calls.requests.push(`${method} ${p}`);
+      const isMe = /\/me(\?|$)/.test(p);
+      const status = isMe ? meStatus : 200;
+      if (status === 401) return Promise.resolve({ status: 401, ok: false, data: null });
+      // A shape generic enough for the boot path; the renderers are spies below.
+      return Promise.resolve({ status: 200, ok: true, data: { builder: { id: '1', rank: 'metic' }, onboarding: null, tasks: [], goals: [], items: [] } });
+    },
+  };
+
+  const spy = (name) => (...args) => { calls.rendered.push(name); return args; };
+  const documentObj = {
+    body: { dataset: { page: 'home' } },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
+    getElementById() { return makeEl(); },
+    querySelector() { return makeEl(); },
+    querySelectorAll() { return []; },
+    createElement() { return makeEl(); },
+    listeners: {},
+    addEventListener(type, fn) { (this.listeners[type] || (this.listeners[type] = [])).push(fn); },
+    get cookie() { return ''; }, set cookie(_v) {},
+  };
+
+  const windowObj = {
+    __BRANDING__: { identity: { worldName: 'W', productName: 'W' }, currency: { label: 'credits' } },
+    __MODULES__: { enabled: {} },
+    BongosClient: { createClient: () => api },
+    OTB: {
+      moduleOn: () => true,
+      escapeHtml: (s) => String(s == null ? '' : s),
+      $: () => makeEl(),
+      fmtNum: (n) => String(n),
+      fmtDate: () => '',
+      rankLabel: (r) => String(r || '—'),
+      toast: () => {},
+      hallWidgets: () => [],
+      contributeHallWidget: () => {},
+    },
+    OTBKit: {
+      makePager: () => ({ page: 1, perPage: 10 }),
+      paginate: (rows) => rows,
+      wirePager: () => {},
+    },
+    OTBHallRender: () => ({
+      SETUP_CONFIG_KEY: 'k', analyticsState: {}, lbState: {}, onboardingBox: () => makeEl(),
+      shipState: {}, shipsPager: { page: 1 }, welcomeDismissalKey: () => 'k',
+      mountHallWidgets: spy('mountHallWidgets'),
+      renderLanding: spy('renderLanding'),
+      renderCurveBody: spy('renderCurveBody'), renderGreeting: spy('renderGreeting'),
+      renderNav: spy('renderNav'), renderOnboarding: spy('renderOnboarding'),
+      renderProfile: spy('renderProfile'), renderRecentShips: spy('renderRecentShips'),
+      renderWelcomeCore: spy('renderWelcomeCore'),
+    }),
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage: { getItem() { return null; }, setItem() {}, removeItem() {} },
+    location,
+    addEventListener() {},
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location, console,
+    setTimeout, clearTimeout, setInterval, clearInterval, fetch: () => Promise.reject(new Error('no network in this test')),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(SRC, sandbox, { filename: 'builders.js' });
+
+  for (const fn of documentObj.listeners.DOMContentLoaded || []) fn();
+  // Drain the boot promise chain (a handful of awaits, no timers).
+  for (let i = 0; i < 25; i += 1) await Promise.resolve();
+  return calls;
+}
+
+test('a signed-out visitor gets the landing — and is NEVER navigated away from it', async () => {
+  const calls = await boot({ meStatus: 401 });
+
+  assert.deepEqual(calls.assign, [],
+    'the signed-out front door navigated somewhere. That is the dead end: GitHub refuses a '
+    + 'first-timer and sends them back here, so the request-access form is unreachable and '
+    + 'an invite-only instance can never admit anyone.');
+  assert.ok(calls.rendered.includes('renderLanding'), 'the landing (sign in / request access) never rendered');
+  assert.ok(!calls.rendered.includes('mountHallWidgets'),
+    'widgets mounted for a signed-out visitor — each one boots its own authenticated read, '
+    + 'and any of those may navigate. The landing must be the whole page.');
+});
+
+test('auth is resolved BEFORE anything else is asked for', async () => {
+  const calls = await boot({ meStatus: 401 });
+  assert.equal(calls.requests.length, 1, `the page asked for more than /me while signed out: ${calls.requests.join(', ')}`);
+  assert.match(calls.requests[0], /\/me$/);
+});
+
+test('a signed-in builder still gets the hall', async () => {
+  const calls = await boot({ meStatus: 200 });
+  assert.ok(calls.rendered.includes('mountHallWidgets'), 'the hall did not mount for a signed-in builder');
+  assert.deepEqual(calls.assign, [], 'a signed-in boot navigated away');
+  assert.equal(calls.requests.filter((r) => /\/me$/.test(r)).length, 1,
+    'boot asked for /me more than once — the resolved payload is handed to loadAll, not re-fetched');
+});

package/tests/reward_gate.mjs

@@ -210,7 +210,7 @@ async function withStubbedCreatePool(run) {
 
 t('a task CREATED with NO reward is born with a positive, capped value', async () => {
   await withStubbedCreatePool(async (captured) => {
-    const row = await db.createTask({ versionId: 1, title: 't', kind: 'feature', estMinutes: 40 });
+    const row = await db.createTask({ versionId: 1, goalId: 77, title: 't', kind: 'feature', estMinutes: 40 });
     assert.ok(captured.creditsReward > 0, 'INSERT must bind a positive credits_reward');
     assert.equal(captured.creditsReward, 40, 'feature @40min -> 40 drachmae');
     assert.ok(captured.creditsReward <= db.REWARD_SUGGESTION_CAP, 'must respect the cap');
@@ -220,7 +220,7 @@ t('a task CREATED with NO reward is born with a positive, capped value', async (
 
 t('a task CREATED with credits_reward 0 (the route default) is auto-assigned', async () => {
   await withStubbedCreatePool(async (captured) => {
-    await db.createTask({ versionId: 1, title: 't', creditsReward: 0, kind: 'bug', estMinutes: 40 });
+    await db.createTask({ versionId: 1, goalId: 77, title: 't', creditsReward: 0, kind: 'bug', estMinutes: 40 });
     // bug weight 1.25 -> 50; 0 is treated as "unset" so the default kicks in.
     assert.equal(captured.creditsReward, 50);
   });
@@ -228,14 +228,14 @@ t('a task CREATED with credits_reward 0 (the route default) is auto-assigned', a
 
 t('a huge-est new task is CAPPED at creation, not ballooned', async () => {
   await withStubbedCreatePool(async (captured) => {
-    await db.createTask({ versionId: 1, title: 't', kind: 'feature', estMinutes: 9999 });
+    await db.createTask({ versionId: 1, goalId: 77, title: 't', kind: 'feature', estMinutes: 9999 });
     assert.equal(captured.creditsReward, db.REWARD_SUGGESTION_CAP);
   });
 });
 
 t('an EXPLICIT positive credits_reward is PRESERVED (never overridden)', async () => {
   await withStubbedCreatePool(async (captured) => {
-    await db.createTask({ versionId: 1, title: 't', creditsReward: 17, kind: 'feature', estMinutes: 40 });
+    await db.createTask({ versionId: 1, goalId: 77, title: 't', creditsReward: 17, kind: 'feature', estMinutes: 40 });
     assert.equal(captured.creditsReward, 17, 'author-set positive value must survive untouched');
   });
 });

package/tests/task_goal_required.mjs

@@ -0,0 +1,223 @@
+// tests/task_goal_required.mjs — a goal-less create is no longer SILENT
+// (BV1.R11, task 1003598, goal 1000086, ADR 0250 D4).
+//
+// WHAT WAS ACTUALLY WRONG. Task 1763 made `createTask` default any create with no
+// `goalId` into its version's catch-all "<version> — general" goal, at the lowest
+// layer, so that no caller had to think about it. The invariant "every task
+// belongs to a goal" then held — technically — while 53 open tasks accumulated in
+// two buckets nobody reads. Unscoped work never snuck past the rule; the rule
+// filed it out of sight.
+//
+// So the defect is the SILENCE, not the bucket. A caller now either names a goal
+// or says out loud that it cannot, by passing `allowCatchAll: true`: same landing
+// place, same never-break-a-creator promise, but the exceptions are a one-command
+// grep instead of an absence, and a create vector added next year gets a thrown
+// error at its first test run rather than a quiet home in a bucket.
+//
+// NOT FULLY DELETED, and that is a recorded decision rather than an oversight.
+// R11 literally asks for the fallback's deletion, but two in-repo vectors have no
+// goal to name yet — `newcomer-restock` (the beginner queue) and `copy-desk`
+// (copy proposals) — whose honest home is the per-version maintenance goal, task
+// 1003605 (R18), still behind R06 and R12. Deleting today would drain the
+// newcomer queue. The owner chose to remove the silent half now and leave the
+// true deletion to R18. This file pins the opt-in roster so it cannot grow
+// quietly in the meantime.
+//
+// Run:  node --test tests/task_goal_required.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { createTask } = require('../modules/lifecycle/db.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+
+// A pool that would happily create the row, so a rejection can only come from the
+// guard and never from a database that was never reached.
+const permissivePool = {
+  query: async () => ({ rows: [{ id: '1', goal_id: null, title: 'x' }] }),
+  connect: async () => ({ query: async () => ({ rows: [] }), release() {} }),
+};
+
+// ---- the guard --------------------------------------------------------------
+
+test('a create with no goalId THROWS instead of quietly filing into a bucket', async () => {
+  await assert.rejects(
+    () => createTask({ versionId: 'BONGOS-V1', title: 't' }, { pool: permissivePool }),
+    /goalId is required/,
+    'the old behaviour was to succeed and say nothing');
+});
+
+test('the error tells the caller both ways out', async () => {
+  const err = await createTask({ versionId: 'BONGOS-V1', title: 't' }, { pool: permissivePool })
+    .then(() => null, (e) => e);
+  assert.ok(err, 'must reject');
+  assert.match(err.message, /BV1\.R11/, 'names the rule, so the reason is findable');
+  assert.match(err.message, /allowCatchAll: true/, 'and the escape hatch, spelled exactly');
+});
+
+test('only a literal true opts in — a truthy value still throws', async () => {
+  for (const v of [1, 'yes', {}, 'true']) {
+    await assert.rejects(
+      () => createTask({ versionId: 'BONGOS-V1', title: 't', allowCatchAll: v }, { pool: permissivePool }),
+      /goalId is required/,
+      `${JSON.stringify(v)} must not open the hatch`);
+  }
+});
+
+test('naming a goal needs no flag at all', async () => {
+  // The ordinary path must stay ordinary: a caller with a goal never learns this
+  // parameter exists.
+  await createTask(
+    { versionId: 'BONGOS-V1', title: 't', goalId: 77 },
+    { pool: permissivePool, client: permissivePool },
+  );
+});
+
+// ---- the route --------------------------------------------------------------
+
+const WRITE = src('modules/lifecycle/routes/task-write-routes.js');
+const POST_TASKS = (() => {
+  const a = WRITE.indexOf("router.post('/tasks'");
+  assert.notEqual(a, -1);
+  return WRITE.slice(a, WRITE.indexOf("router.patch('/tasks/:id'"));
+})();
+
+test('POST /tasks refuses a body with no goal_id, as a 400 that says where to look', () => {
+  assert.match(POST_TASKS, /if \(body\.goal_id == null\) \{/);
+  assert.match(POST_TASKS, /res\.fail\('goal_id_required', \{[\s\S]*?status: 400/,
+    'a missing required field is the caller\'s mistake, not a conflict');
+  assert.match(POST_TASKS, /GET \/goals\?version=/,
+    'a refusal that does not say how to comply gets worked around');
+});
+
+test('the route refuses BEFORE it validates the goal it was not given', () => {
+  const required = POST_TASKS.indexOf("'goal_id_required'");
+  const validate = POST_TASKS.indexOf("'bad_goal_id'");
+  const create = POST_TASKS.indexOf('await db.createTask(');
+  assert.ok(required !== -1 && validate !== -1 && create !== -1);
+  assert.ok(required < validate, 'absent and wrong are different answers');
+  assert.ok(required < create);
+});
+
+test('POST /tasks does NOT pass the escape hatch — this door always has a goal', () => {
+  assert.equal(/allowCatchAll/.test(POST_TASKS), false,
+    '/builder-start lists work by goal; the human/agent vector can always name one');
+});
+
+// ---- the opt-in roster, pinned ----------------------------------------------
+
+const OPT_INS = [
+  ['modules/onboarding/newcomer-restock.js', 'the beginner queue, stamped from templates'],
+  ['modules/copy-desk/routes/copy-desk.js', 'copy-change proposals'],
+  ['modules/lifecycle/kickoff-seed.js', "the founder's first board, on an instance with no goals at all"],
+  ['modules/lifecycle/cascade.js', 'a follow-up off a parent task that is itself goal-less'],
+];
+
+test('exactly four vectors opt in, and each says why', () => {
+  for (const [file, why] of OPT_INS) {
+    const body = src(file);
+    assert.match(body, /allowCatchAll/, `${file} should opt in (${why})`);
+    assert.match(body, /BV1\.R11|1003605|R18/,
+      `${file} must explain itself — an undocumented opt-in is the silence again`);
+  }
+});
+
+test('cascade opts in ONLY when inheritance actually failed', () => {
+  // The others opt in unconditionally because they have no goal to name at all.
+  // A cascade normally inherits its parent's goal and must keep doing so — the
+  // hatch is for a goal-less PARENT (a legacy catch-all row), not for cascades in
+  // general. A blanket `true` here would quietly re-open the hole for every
+  // follow-up task the system files.
+  const body = src('modules/lifecycle/cascade.js');
+  assert.match(body, /allowCatchAll: task\.goal_id == null,/);
+  assert.equal(/allowCatchAll: true/.test(body), false,
+    'an unconditional hatch here would cover every cascade, not just the legacy ones');
+  assert.match(body, /goalId: task\.goal_id != null \? Number\(task\.goal_id\) : null,/,
+    'inheritance stays the primary path');
+});
+
+test('a goal-less parent does not silently lose its cascade task', async () => {
+  // The regression this pair of fixes closes: under the guard, a null goalId
+  // throws; the throw is caught per-rule so the ship is safe, and the cascade
+  // task would have vanished with only a console line — a silent goal-less gap,
+  // which is the exact thing this rule exists to close.
+  const { runCascadesForShip } = require('../modules/lifecycle/cascade.js');
+  const specs = [];
+  const report = await runCascadesForShip({ id: 5 }, {
+    getTask: async () => ({
+      id: 5, version_id: 'BONGOS-V1', goal_id: null, status: 'shipped',
+      discipline: 'artist', kind: 'feature', title: 'legacy', touches: [],
+    }),
+    findTaskBySourceRef: async () => null,
+    createTask: async (spec) => { specs.push(spec); return { id: 9 }; },
+  });
+  assert.deepEqual(report.errors, [], 'no rule may error on a goal-less parent');
+  for (const spec of specs) {
+    assert.equal(spec.goalId, null, 'nothing to inherit');
+    assert.equal(spec.allowCatchAll, true, 'so it declares the catch-all rather than throwing');
+  }
+});
+
+test('a cascade off a NORMAL parent inherits and does not open the hatch', async () => {
+  const { runCascadesForShip } = require('../modules/lifecycle/cascade.js');
+  const specs = [];
+  await runCascadesForShip({ id: 5 }, {
+    getTask: async () => ({
+      id: 5, version_id: 'BONGOS-V1', goal_id: 77, status: 'shipped',
+      discipline: 'artist', kind: 'feature', title: 'normal', touches: [],
+    }),
+    findTaskBySourceRef: async () => null,
+    createTask: async (spec) => { specs.push(spec); return { id: 9 }; },
+  });
+  for (const spec of specs) {
+    assert.equal(spec.goalId, 77, 'the follow-up belongs where the work belongs');
+    assert.equal(spec.allowCatchAll, false, 'and the hatch stays shut');
+  }
+});
+
+test('no FIFTH vector has appeared', () => {
+  // The roster is the point: if this fails, either a new create vector took the
+  // easy way out, or R18 landed and one of these can now name a real goal — in
+  // which case delete its opt-in and this line, do not extend the list.
+  const roster = new Set([...OPT_INS.map(([f]) => f), 'modules/lifecycle/db-tasks.js']);
+  const suspects = [
+    'modules/ideas/inbox.js', 'modules/lifecycle/routes/goals.js',
+    'modules/lifecycle/routes/task-write-routes.js',
+  ];
+  for (const f of suspects) {
+    if (roster.has(f)) continue;
+    assert.equal(/allowCatchAll/.test(src(f)), false,
+      `${f} must name a goal rather than opting out`);
+  }
+});
+test('the vectors that CAN name a goal still do', () => {
+  assert.match(src('modules/ideas/inbox.js'), /goalId: goal\.id/,
+    'idea routing names the goal it routed to');
+  assert.match(src('modules/lifecycle/routes/goals.js'), /db\.createTask\(\{/,
+    'and the goal-authored vector has stamped its goal since BV1.R60');
+});
+
+// ---- the fallback itself ----------------------------------------------------
+
+test('the catch-all resolver survives, reachable only through the declared hatch', () => {
+  const dbTasks = src('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /generalGoalIdForVersion\(versionId\)/,
+    'R18 is when this goes; deleting it today would drain the newcomer queue');
+  const guard = dbTasks.slice(dbTasks.indexOf('let goalIdEffective = goalId;'));
+  const hatch = guard.indexOf('allowCatchAll !== true');
+  const resolve = guard.indexOf('generalGoalIdForVersion(versionId)');
+  assert.ok(hatch !== -1 && hatch < resolve,
+    'the throw comes first — the resolver is unreachable without the flag');
+});
+
+test('the remaining gap is written down where the next reader will stand', () => {
+  const dbTasks = src('modules/lifecycle/db-tasks.js');
+  assert.match(dbTasks, /WHY NOT DELETE THE FALLBACK OUTRIGHT/,
+    'so the partial job reads as a decision, not an unfinished edit');
+  assert.match(dbTasks, /1003605/, 'and names the task that finishes it');
+});