@bongos/core 1.19.585 → 1.19.587

package/modules/ideas/inbox.js

@@ -20,6 +20,8 @@ const { pool } = api;
 // The landing matrix (task 1003065, BV1.R01) — pure, DB-free, its own file so
 // every cell is unit-testable without a Postgres. See ./routing.js.
 const { decideLanding, authorizeRoutedLanding, routedPriority } = require('./routing');
+// The home a goal-less bug lands in (task 1003691, ADR 0262).
+const { resolveHomelessHome } = require('./homeless-home');
 
 const VALID_KINDS = [
   'feature',
@@ -247,6 +249,9 @@ async function captureIdea({
   // anything). Ignored when `goalId` is already set, so every existing caller
   // is untouched.
   suggestedGoalId = null,
+  // WHICH DOOR this filing came through; absent is UNTRUSTED and stays an inbox
+  // row. Read by one rule — see routing.HOMELESS_ROUTING_VECTORS (ADR 0262).
+  vector = null,
 }, deps = {}) {
   if (!title || typeof title !== 'string') {
     throw { code: 'TITLE_REQUIRED' };
@@ -264,7 +269,7 @@ async function captureIdea({
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
 
   // The decision, before any write. Pure — see ./routing.js.
-  const landing = decideLanding({ goalId, kind: resolvedKind, grade, filerRank });
+  const landing = decideLanding({ goalId, kind: resolvedKind, grade, filerRank, vector });
   if (landing.route) {
     return routeIdeaToGoal({
       title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority,
@@ -315,6 +320,23 @@ async function routeIdeaToGoal({
   try {
     await client.query('BEGIN');
 
+    // The `lifecycle` PORT, resolved ONCE up here because two steps need it: the
+    // homeless-bug home at (a0) and the task insert at (c). Never an import of
+    // modules/lifecycle/ — the one-way module rule, ADR 0083.
+    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
+    if (!lifecycle || !lifecycle.createTask) {
+      // A vanilla instance without the lifecycle module cannot hold tasks at all,
+      // so there is nothing to route INTO. Refuse loudly rather than silently
+      // degrading to an inbox row the caller was told became a task.
+      throw { code: 'LIFECYCLE_UNAVAILABLE' };
+    }
+
+    // a0. A homeless bug gets the version's maintenance goal — ./homeless-home.js
+    //     says why that goal and not the catch-all, and why it fails closed.
+    const effectiveGoalId = landing.homeless
+      ? await resolveHomelessHome(lifecycle, client)
+      : goalId;
+
     // a. The goal must be a REAL, LIVE HOME. All three checks are inside the
     //    transaction and the row is locked FOR SHARE, so a goal cannot be
     //    archived out from under a route that is mid-flight.
@@ -330,17 +352,17 @@ async function routeIdeaToGoal({
          JOIN versions v ON v.id = g.version_id
         WHERE g.id = $1
         FOR SHARE OF g`,
-      [goalId]
+      [effectiveGoalId]
     );
-    if (goalRows.length === 0) throw { code: 'GOAL_NOT_FOUND', goal_id: goalId };
+    if (goalRows.length === 0) throw { code: 'GOAL_NOT_FOUND', goal_id: effectiveGoalId };
     const goal = goalRows[0];
     if (goal.status !== 'open') {
-      throw { code: 'GOAL_NOT_OPEN', goal_id: goalId, status: goal.status };
+      throw { code: 'GOAL_NOT_OPEN', goal_id: effectiveGoalId, status: goal.status };
     }
     if (goal.version_status !== 'building') {
       throw {
         code: 'VERSION_NOT_BUILDING',
-        goal_id: goalId,
+        goal_id: effectiveGoalId,
         version_id: goal.version_id,
         version_status: goal.version_status,
       };
@@ -357,7 +379,7 @@ async function routeIdeaToGoal({
                $7, now())
        RETURNING ${IDEA_COLS}`,
       [title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority, capturedBy,
-        goalId]
+        effectiveGoalId]
     );
     const idea = ideaRows[0];
 
@@ -384,7 +406,7 @@ async function routeIdeaToGoal({
     if (!authorized.ok) {
       throw {
         code: 'ROUTE_NOT_AUTHORIZED',
-        goal_id: goalId,
+        goal_id: effectiveGoalId,
         gate: authorized.code,
         reason: authorized.reason,
         details: authorized.details ?? null,
@@ -399,10 +421,10 @@ async function routeIdeaToGoal({
     //    The version is the GOAL'S, never a caller-supplied one, so
     //    "goal belongs to the version" is true by construction rather than by
     //    validation. (An idea's own `suggested_version` is kept on the idea row
-    //    as filed and does NOT override it — the goal is the binding home.) One
-    //    read stays outside this transaction by design: createTask's catch-all
-    //    goal fallback, which only runs when goalId is absent and so never on
-    //    this path.
+    //    as filed and does NOT override it — the goal is the binding home.)
+    //    createTask's catch-all fallback still never fires here: a goal is always
+    //    set by this line, named by the filer or resolved at (a0), so this path
+    //    never opts out of the goal requirement (task 1003691, ADR 0262).
     //
     //    `requiresRank` is passed ONLY as the R05 protected-scope floor computed
     //    above — never from anything the filer said. createTask still derives its
@@ -411,13 +433,6 @@ async function routeIdeaToGoal({
     //    default — createTask auto-assigns the capped suggestion) and
     //    `discipline` (left 'unclassified', exactly as the other non-authored
     //    create vectors leave it).
-    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
-    if (!lifecycle || !lifecycle.createTask) {
-      // A vanilla instance without the lifecycle module cannot hold tasks at all,
-      // so there is nothing to route INTO. Refuse loudly rather than silently
-      // degrading to an inbox row the caller was told became a task.
-      throw { code: 'LIFECYCLE_UNAVAILABLE' };
-    }
     const task = await lifecycle.createTask({
       versionId: goal.version_id,
       title,

package/modules/ideas/routes/inbox.js

@@ -148,6 +148,12 @@ module.exports = function buildInboxRouter() {
         goalId: body.goal_id ?? null,
         filerRank: req.builder?.rank ?? null,
         grade,
+        // task 1003691 (ADR 0262): the vector, hardcoded — NEVER read from the
+        // body. This route is the authenticated API door, so a bug filed here
+        // with no goal routes to the version's maintenance goal instead of
+        // parking in the inbox. Letting a caller name their own vector would
+        // hand every untrusted door the same power by typing one word.
+        vector: 'api',
       });
       let grade_warning;
       if (grade === 'full') {
@@ -272,6 +278,17 @@ module.exports = function buildInboxRouter() {
           // filer the way through: file it without a goal.
           err.code === 'ROUTE_NOT_AUTHORIZED' ? 403 :
           err.code === 'LIFECYCLE_UNAVAILABLE' ? 503 :
+          // task 1003691 (ADR 0262) — the HOMELESS-bug refusals. Both are 503 and
+          // NOT 4xx, because unlike every refusal above them they are not the
+          // filer's mistake and there is nothing they can change to get through:
+          // the filer named no goal (which is now the supported way to report a
+          // bug), and the project simply has no version open to work or no
+          // maintenance goal that can be made in it. That is a server-state
+          // problem an operator fixes, so it reads like LIFECYCLE_UNAVAILABLE
+          // beside it — a 400 would tell the reporter to correct a request that
+          // was correct.
+          err.code === 'NO_BUILDING_VERSION' ? 503 :
+          err.code === 'NO_MAINTENANCE_GOAL' ? 503 :
           500;
         return res.fail(err.code, status, { ...err });
       }

package/modules/ideas/routing.js

@@ -54,6 +54,32 @@ const METIC_PLUS = new Set(['metic', 'archon']);
 // 'quick' carry no such meaning and route normally.
 const NEVER_ROUTE_GRADE = 'full';
 
+// The vectors a HOMELESS bug may route from (task 1003691, ADR 0262). This is an
+// ALLOWLIST and the default is exclusion: a filing whose vector is absent or
+// unrecognised never routes without a goal, which is what keeps the homeless
+// branch below from becoming a second door into the queue.
+//
+// WHY THE VECTOR AND NOT THE KIND ALONE — the whole reason this set exists.
+// `kind` is not always a claim a human made. Discord #ideas passes no kind at
+// all, so inbox.classify() GUESSES one from keywords, and its bug pattern fires
+// on fix/broken/bug/crash/error anywhere in the text: "should we fix the copy on
+// the landing page" classifies as a bug. Routing on kind alone would let that
+// keyword guess mint work, which is exactly the ADR 0234 owner-interview
+// decision — "#ideas files with HINTS only, never routes" — that this task was
+// explicitly told to keep (pinned as F12 in tests/filing_abuse_matrix.mjs).
+//
+// Both members carry a human or a channel that means "this is broken":
+//   'api'           — POST /inbox, an authenticated builder naming the kind. This
+//                     is also how `scripts/gds/capture.js` files (it posts to the
+//                     route rather than calling this module), so the CLI inherits
+//                     it and needs no member of its own.
+//   'discord-bugs'  — the #bugs channel, where the CHANNEL is the classification
+//                     (modules/discord/discord-bugs.js forces kind='bug'), and
+//                     which already carries a rate cap + an unlinked-author guard.
+// 'discord-ideas' is deliberately ABSENT: it is an ideation channel, and the bug
+// reports that belong to Discord already have #bugs.
+const HOMELESS_ROUTING_VECTORS = new Set(['api', 'discord-bugs']);
+
 // decideLanding — the matrix, as one pure function.
 //
 // Returns { route: false, reason } when the thing belongs in the inbox, or
@@ -65,11 +91,47 @@ function decideLanding(input) {
   // a caller spreading an absent object hands over — would throw. A landing
   // decision that CRASHES is the worst of the three outcomes: it takes down the
   // capture that was supposed to fail closed. Normalise first, decide after.
-  const { goalId = null, kind = null, grade = null, filerRank = null } = input || {};
+  const { goalId = null, kind = null, grade = null, filerRank = null, vector = null } = input || {};
   // No goal named ⇒ the inbox is exactly right, and this is the DEFAULT PATH.
   // Every capture vector that never learns about goals keeps working unchanged;
   // routing is strictly additive (criterion C1 testable #5).
-  if (goalId == null || goalId === '') return { route: false, reason: 'no_goal' };
+  //
+  // THE ONE EXCEPTION: A BUG NEVER LANDS IN THE INBOX (task 1003691, ADR 0262).
+  // Until now this early return made the kind==='bug' branch below UNREACHABLE
+  // without a goal — `kind` only ever chose the routed task's STATUS, never
+  // whether it routed at all — so a reported defect sat in idea_inbox waiting for
+  // a human triage pass, which is the triage tax criterion C1 exists to remove.
+  //
+  // This does NOT re-open the goal-less task hole ADR 0250 D4 closed. A homeless
+  // bug is given a REAL, open goal — the version's maintenance goal, resolved by
+  // the caller (inbox.routeIdeaToGoal) — so "every task belongs to a goal" holds
+  // exactly as before. What changes is only WHO names it: the system, not the
+  // person reporting the defect. That is also what ADR 0235 already asked for:
+  // its "a fix needs no home to be filed correctly" is an ADVISORY exemption
+  // (goal-advisory.adviseGoal stays silent for a bug), and its actual decision is
+  // that a fix category IS kind='bug' on a task carrying a real goal_id.
+  //
+  // Fail-closed, in the posture of the rest of this file: the vector must be on
+  // the allowlist, the grade must not be a Full Idea (F8 — the Board Room's
+  // subject is never converted by its own filer), and an untrusted or absent rank
+  // still soft-lands at 'backlog' rather than reaching the claimable queue.
+  if (goalId == null || goalId === '') {
+    if (
+      HARD_LAND_KINDS.has(kind) &&
+      HOMELESS_ROUTING_VECTORS.has(vector) &&
+      String(grade || '').toLowerCase() !== NEVER_ROUTE_GRADE
+    ) {
+      // `homeless: true` is the instruction to the transaction: resolve the
+      // version's maintenance goal before the goal read. It is a separate field
+      // rather than an inferred `goalId == null` so the intent survives into the
+      // caller and into the tests, and so a future landing that happens to carry
+      // no goal cannot silently inherit the maintenance-goal behaviour.
+      return METIC_PLUS.has(String(filerRank || '').toLowerCase())
+        ? { route: true, status: 'ready', homeless: true, reason: 'bug_homeless_trusted_filer' }
+        : { route: true, status: 'backlog', homeless: true, reason: 'bug_homeless_awaiting_nod' };
+    }
+    return { route: false, reason: 'no_goal' };
+  }
 
   if (String(grade || '').toLowerCase() === NEVER_ROUTE_GRADE) {
     return { route: false, reason: 'full_idea_never_routes' };
@@ -228,5 +290,6 @@ module.exports = {
   DEFAULT_ROUTED_PRIORITY,
   HARD_LAND_KINDS,
   NEVER_ROUTE_KINDS,
+  HOMELESS_ROUTING_VECTORS,
   METIC_PLUS,
 };

package/modules/lifecycle/db-goals.js

@@ -15,6 +15,7 @@ const { pool } = api;
 const doneWhen = require('./done-when.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { nonTerminalSql } = require('./task-status');
+const { maintenanceGoalTitle } = require('./goal-advisory.js');
 const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 // -------------------------------------------------------------------------
@@ -82,6 +83,96 @@ async function createGoal(
   return rows[0];
 }
 
+// The maintenance goal's scope wall: deliberately EMPTY. Named rather than inlined
+// so the choice is greppable and the reasoning has one home (see the INSERT below).
+const MAINTENANCE_SCOPE_MODULES = [];
+
+// ensureMaintenanceGoal — find-or-create the version's maintenance goal, the home
+// a reported bug gets when its reporter named none (task 1003691, ADR 0262).
+// Returns the goal row, or null when the version cannot hold new work.
+//
+// WHY THIS IS A LIFECYCLE FUNCTION AND NOT AN ideas ONE. Goals and versions are
+// this module's tables; the ideas module may not import lifecycle (the one-way
+// module rule, ADR 0083), so it reaches this through the `lifecycle` port. Keeping
+// the SQL here also means the maintenance goal has ONE definition for the routing
+// path and for task 1003605 (BV1.R18) to build the rest of the feature on.
+//
+// IT RUNS INSIDE THE CALLER'S TRANSACTION (deps.client — the createTask seam).
+// That is load-bearing rather than tidy: routeIdeaToGoal's whole promise is that
+// the idea row, the task and the lineage row commit together or not at all, and a
+// goal created in its own connection would survive a rolled-back route as an
+// empty goal nobody asked for.
+//
+// THE RACE IS REAL AND IS HANDLED WITH A LOCK, NOT A PRAYER. `goals` has no unique
+// constraint on (version_id, title) — migration 160 used a NOT EXISTS guard, which
+// is safe for a one-shot backfill and NOT safe for a concurrent path: two bugs
+// reported in the same second would both see "no maintenance goal" and both insert
+// one, after which the title lookup is ambiguous forever. pg_advisory_xact_lock
+// serialises find-or-create per version and releases at COMMIT/ROLLBACK with no
+// unlock call to forget. It is keyed on a hash of the TITLE, so it collides only
+// with another writer of this same goal.
+//
+// The version must be open to work, checked here rather than trusted from the
+// caller: filing a defect into a shipped version's goal is the 1000771 bug
+// (bugs entombed where nobody looks), and the point of this path is to end that.
+async function ensureMaintenanceGoal(versionId, deps = {}) {
+  if (versionId == null) return null;
+  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
+  const title = maintenanceGoalTitle(versionId);
+
+  const { rows: vRows } = await exec.query(
+    `SELECT status FROM versions WHERE id = $1`,
+    [versionId]
+  );
+  if (!vRows[0] || vRows[0].status !== 'building') return null;
+
+  await exec.query(`SELECT pg_advisory_xact_lock(hashtext($1))`, [title]);
+
+  // MATCHED BY TITLE, because there is no column that says "this is the
+  // maintenance goal" — the same shape generalGoalIdForVersion uses for the
+  // catch-all, and it carries the same caveat: were a Metic+/Archon to hand-create
+  // a goal titled exactly this, routing would reuse THEIR goal and its scope
+  // rather than the zero-scope bucket below. That needs an already-trusted actor,
+  // so it is a provenance wrinkle rather than a way in, and task 1003605 (BV1.R18)
+  // is where a real flag belongs when the feature gets its own column.
+  //
+  // No index backs (version_id, title): goals are per-version and few, and this
+  // runs once per homeless bug. Revisit with R18 if either stops being true.
+  const { rows: found } = await exec.query(
+    `SELECT ${GOAL_COLS} FROM goals WHERE version_id = $1 AND title = $2 LIMIT 1`,
+    [versionId, title]
+  );
+  if (found[0]) return found[0];
+
+  // created_by NULL — system-attributed, the migration-160 posture: this goal has
+  // no owner and inserts no member row, so Archons act as one.
+  //
+  // scope_modules is deliberately EMPTY, and that is the one thing to understand
+  // before changing this: a defect can land in any module, so a wall listing every
+  // module is the same as no wall while also lying about intent. The consequence is
+  // real and accepted — scopeIncludesProtected([]) is false, so a Metic+ filer's
+  // homeless bug takes no protected-scope floor and lands claimable. That is the
+  // SAME grant abuse-matrix row P1 already makes for a Metic+ bug in any unscoped
+  // goal; what is new is only that this goal is auto-created. The protections that
+  // remain are the ones that were carrying the weight anyway: the matrix's rank
+  // split (sub-Metic lands 'backlog', never 'ready') and createTask's own derived
+  // floor. Do not "fix" this by inventing a scope list — narrow the GRANT instead,
+  // and write down why.
+  const { rows: made } = await exec.query(
+    `INSERT INTO goals (version_id, title, description, scope_modules, status, created_by, sort_order)
+     SELECT $1, $2, $3, $4, 'open', NULL, COALESCE(MAX(sort_order) + 1, 0)
+       FROM goals WHERE version_id = $1
+     RETURNING ${GOAL_COLS}`,
+    [versionId, title,
+      `Where a reported defect lands when its reporter named no goal (ADR 0262). ` +
+      `Auto-created by the bug-routing path; task 1003605 (BV1.R18) owns the rest of ` +
+      `the maintenance-goal feature — the close-exempt flag and carrying open bugs ` +
+      `forward to the successor version.`,
+      MAINTENANCE_SCOPE_MODULES]
+  );
+  return made[0] || null;
+}
+
 // listVersionAdmissions (BV1.R07, task 1003594) — every goal admitted into ONE
 // version, newest first. ADR 0250 §3: "the overrides are counted and shown on the
 // version" — a visible counter is what keeps the exception honest, because an
@@ -844,6 +935,7 @@ async function listPendingRequestsForGoal(goalId, deps = {}) {
 
 module.exports = {
   acceptMembershipRequestAndAddMember,
+  ensureMaintenanceGoal,
   achieveGoalIfComplete,
   addGoalMember,
   addGoalScopeModules,

package/modules/lifecycle/db-versions.js

@@ -131,8 +131,38 @@ async function createVersion({ id, name, status = 'planning', track = 'product',
   });
 }
 
+// currentBuildingVersionId — the version new work defaults into, or null when
+// none is open (task 1003691, ADR 0262). Consumed by the bug-routing path, which
+// has to name a version BEFORE it has a goal and so cannot derive one from the
+// goal the way every other routed filing does.
+//
+// THE TIEBREAK IS NOT NEW. More than one version may sit at 'building' — ADR 0250
+// D5 closes the PLANNING slot only, and refusing a second building version is
+// still unshipped work (task 1003606, BV1.R19) — so a rule was needed, and the
+// project already has one: scripts/gds/version-select.js pickDefaultVersion,
+// extracted to end nine hardcoded version literals and pinned by
+// tests/version_literals.mjs. This is that rule in SQL: building only, most
+// recently started first, a null started_at sorting LAST so a half-filled row
+// cannot decide the answer, and `id` breaking a remaining tie so the result is
+// deterministic rather than whatever the planner returns.
+//
+// Returns null rather than guessing when nothing is building — the caller must
+// fail closed, because inventing a version is how the 1000771 bug (every Discord
+// report filed into a SHIPPED version's catch-all) happened in the first place.
+async function currentBuildingVersionId(deps = {}) {
+  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
+  const { rows } = await exec.query(
+    `SELECT id FROM versions
+      WHERE status = 'building'
+      ORDER BY started_at DESC NULLS LAST, id
+      LIMIT 1`
+  );
+  return rows[0] ? rows[0].id : null;
+}
+
 module.exports = {
   createVersion,
+  currentBuildingVersionId,
   getVersion,
   listVersions,
   versionProgress,

package/modules/lifecycle/db.js

@@ -63,13 +63,14 @@ const {
   singleRungPromotionError,
   xenosClaimAllowed,
 } = require('./db-rank-authz.js');
-const { createVersion, getVersion, listVersions, versionProgress, versionsWithStatus } = require('./db-versions.js');
+const { createVersion, currentBuildingVersionId, getVersion, listVersions, versionProgress, versionsWithStatus } = require('./db-versions.js');
 const {
   acceptMembershipRequestAndAddMember,
   achieveGoalIfComplete,
   addGoalMember,
   addGoalScopeModules,
   createGoal,
+  ensureMaintenanceGoal,
   createMembershipRequest,
   getGoal,
   getGoalAdmission,
@@ -217,7 +218,9 @@ module.exports = {
   versionProgress,
   versionsWithStatus,
   createVersion,
+  currentBuildingVersionId,
   createGoal,
+  ensureMaintenanceGoal,
   getGoal,
   getGoalAdmission,
   listVersionAdmissions,

package/modules/lifecycle/goal-advisory.js

@@ -27,6 +27,22 @@ function generalGoalTitle(versionId) {
   return `${versionId} — general`;
 }
 
+// The per-version MAINTENANCE goal — where a defect against already-shipped work
+// lands when the reporter named no goal (task 1003691, ADR 0262). Same em-dash
+// rule as generalGoalTitle above, and the same reason: the title IS the lookup
+// key (there is no boolean column), so an ASCII hyphen or an en dash silently
+// creates a second, ordinary goal instead of matching this one.
+//
+// DELIBERATELY NOT the "<version> — general" catch-all. That bucket is what BV1.R11
+// (task 1003598) began deleting after 53 open tasks accumulated in two of them
+// unread; the maintenance goal is the honest home task 1003605 (BV1.R18) designs
+// for exactly this work. This constant is the half R18 and the bug-routing path
+// share — R18 still owns auto-creating it with every version, the close-exempt
+// flag, and carrying open bugs forward to the successor version on close.
+function maintenanceGoalTitle(versionId) {
+  return `${versionId} — maintenance`;
+}
+
 // adviseGoal — PURE, FAIL-OPEN. Returns null when the task has a real home, or the
 // advisory body when it does not. Three reasons, checked in order:
 //
@@ -177,4 +193,4 @@ async function buildGoalAdvisory({ db, versionId, task, hasCriterionLink = false
   }
 }
 
-module.exports = { adviseGoal, candidateGoals, generalGoalTitle, buildGoalAdvisory };
+module.exports = { adviseGoal, candidateGoals, generalGoalTitle, maintenanceGoalTitle, buildGoalAdvisory };

package/modules/lifecycle/lifecycle.js

@@ -43,6 +43,17 @@ module.exports = {
   // "which goal, on which version" is a lifecycle judgement and discord may not
   // import lifecycle (the one-way module rule).
   suggestGoalForCapture: (...a) => goalSuggest.suggestGoalForCapture(...a),
+  // ensureMaintenanceGoal + currentBuildingVersionId (task 1003691, ADR 0262):
+  // the home a REPORTED BUG gets when nobody named one. Consumer: the ideas
+  // routing transaction, which is the one filing path that must name a version
+  // BEFORE it has a goal — every other routed filing derives the version FROM the
+  // goal it was given. Both take `deps.client` so the find-or-create commits with
+  // the idea + task + lineage rows, or not at all.
+  //
+  // They live behind the port for the ordinary reason: `goals` and `versions` are
+  // lifecycle tables and the ideas module may not import lifecycle (ADR 0083).
+  ensureMaintenanceGoal: (...a) => db.ensureMaintenanceGoal(...a),
+  currentBuildingVersionId: (...a) => db.currentBuildingVersionId(...a),
 
   // --- work-tracking READS the staying-core read routes resolve --------------
   // public.js (the status surface): version/ship feed + grade trend.

package/modules/public-landing/public/projects.html

@@ -3408,13 +3408,29 @@ summary{min-height:24px;padding:3px 0;}
       return row ? row.bundle.slice() : [];
     }
     /* Why the preselect is what it is, in the owner's own words — one sentence per
-       rule that ACTUALLY moved something. Empty when nothing did, and empty once
-       the owner has answered for themselves: a reason given back for a toggle they
-       flipped reads as the panel arguing with them. */
+       rule that ACTUALLY moved something, and failing that the type's own summary.
+       Returns SENTENCES, not rule rows.
+
+       The fallback is the point (task 1003684). `adjustments` is a DELTA: a rule that
+       fires without changing anything claims nothing (ADR 0243). So for a type whose
+       bundle ALREADY contains what the rule would add — game is [dev-box, discord] and
+       the small-team rule adds dev-box — the delta is empty and the owner was shown a
+       tailored preselect with no reason beside it at all. That is the state ADR 0237
+       calls worse than no preselect: one the owner has to audit. Each bundle carries a
+       curated summary authored for exactly this, served on every row, and until now
+       never rendered anywhere (ADR 0261). It is the floor, not a replacement — an adjustment
+       still speaks for itself and wins.
+
+       Still empty once the owner has answered for themselves: a reason given back for
+       a toggle they flipped reads as the panel arguing with them. */
     function preselectReasons() {
       if (state.modules !== null) return [];
       var row = tailoredRow();
-      return row ? (row.adjustments || []) : [];
+      if (!row) return [];
+      var moved = (row.adjustments || []).map(function (a) { return a.reason; });
+      if (moved.length) return moved;
+      var b = bundleRow();
+      return b && b.summary ? [b.summary] : [];
     }
     /* What the panel paints and the review names: the owner's answer if they
        gave one, otherwise the type's preselect. */
@@ -3507,7 +3523,7 @@ summary{min-height:24px;padding:3px 0;}
       var why = $('modWhy');
       var reasons = preselectReasons();
       why.innerHTML = reasons.length
-        ? reasons.map(function (a) { return '<span>' + esc(a.reason) + '</span>'; }).join('')
+        ? reasons.map(function (r) { return '<span>' + esc(r) + '</span>'; }).join('')
         : '';
       why.classList.toggle('on', reasons.length > 0);
       var core = (starterBundles.core || []).length;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.585",
+  "version": "1.19.587",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.585",
+      "version": "1.19.587",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.585",
+  "version": "1.19.587",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.585'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.587'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');