@bongos/core 1.19.586 → 1.19.587

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.586",
-  "core_contract": "1.19.586",
-  "source_commit": "ac6f287b895b1259c7b9fcc6b3a13e4fe178fbc0",
+  "core_version": "1.19.587",
+  "core_contract": "1.19.587",
+  "source_commit": "cd407ba54d0bdbe3638949084ba731c21179c811",
   "source_ref": "HEAD",
-  "built_at": "2026-09-07T22:34:04.491Z",
+  "built_at": "2026-09-08T00:16:55.401Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 454,
+    "docs_redacted": 455,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2058,
+    "functional_verbatim": 2060,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2536,
-  "tree_sha256": "7986b516ffada3b257352c5ecedda7fbc33f7e216f58f11fd2cd8edf23920cae",
+  "file_count": 2539,
+  "tree_sha256": "20c7a1a223a182078ca9a6e5dc0b6ca8d715a6e8b0a47b08a9c4dcb8dac2c74a",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -182,7 +182,7 @@
     {
       "path": ".claude/skills/idea-triage/SKILL.md",
       "mode": "0000644",
-      "sha256": "2519755269ff2d55e3c060569f7d16c440428ba005d206a3bf12fe2275830285"
+      "sha256": "348bb6e8d27610848fb5f31b672c2c762f56cfb17141f7abe1a8dee0b5030bdd"
     },
     {
       "path": ".claude/skills/ideate/SKILL.md",
@@ -1824,10 +1824,15 @@
       "mode": "0000644",
       "sha256": "04382d76f04c9317b565fb72951b36503e67acc95981a388d5c45efc80faaa26"
     },
+    {
+      "path": "docs/adr/0262-a-bug-never-lands-in-the-inbox.md",
+      "mode": "0000644",
+      "sha256": "cc30ad9de02409b6e3db26517bef2966133b3362903a984b65d94ea289fd0d88"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "6d2df0c7c0e6cfd3381935d14a703f8cfa7854d107a6add03bc743e631823ada"
+      "sha256": "9d58f1a823a763141df272149e58b2182aa2289dd94d69ba0b3999789d8fc743"
     },
     {
       "path": "docs/api-reference.md",
@@ -2712,7 +2717,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "3474ae19a143b381a4da0091daa41c301338dac6ffd97e7ef396079803589160"
+      "sha256": "3e6075bb21834fc14b6201155cac3f4b51e262d86d6ccbed2505f593831f59f9"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4197,7 +4202,7 @@
     {
       "path": "modules/discord/discord-bugs.js",
       "mode": "0000644",
-      "sha256": "083569e4fe2a621dc6c8663fafc5ec1d6f5e1e1893a3b4a9bdb74ecf4854cd24"
+      "sha256": "52b463955cd7e57f8d194c161a76e2ade83481f3ee0a16759019a5b1f873b374"
     },
     {
       "path": "modules/discord/discord-channels.js",
@@ -4207,7 +4212,7 @@
     {
       "path": "modules/discord/discord-inbound.js",
       "mode": "0000644",
-      "sha256": "06937afc2ac299c8b6572cf296bbaed4e1e078802f9d3fc7a81e5851a639d5f3"
+      "sha256": "86099070386ff606ec14330375ac8c3145365307ae2ac354539731aebcc16563"
     },
     {
       "path": "modules/discord/discord-message-buffer.js",
@@ -5364,10 +5369,15 @@
       "mode": "0000644",
       "sha256": "07e5666362c91f92d34388b4f6f4507cc5387866d317970478e6cae417c19975"
     },
+    {
+      "path": "modules/ideas/homeless-home.js",
+      "mode": "0000644",
+      "sha256": "363598b5905c850967b407f20110a1d9e9d5b1090a958700cb6a4ed5cea70d80"
+    },
     {
       "path": "modules/ideas/inbox.js",
       "mode": "0000644",
-      "sha256": "5ebd1524a5593b70f74a83bdaa3a6d772eb820ea3d962f48dedace970efcc119"
+      "sha256": "8c0792629df6d9587bce828a0f3743b8c86bdb31ba226d31211b9c6623574395"
     },
     {
       "path": "modules/ideas/migrations/ideas_001_grades.sql",
@@ -5412,12 +5422,12 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "a092eea43d9030eb55a23b60bd1ad5673132b83a3a2649961413cd505fd685ef"
+      "sha256": "8dec7682099d131ca050487dafe259bf4c9b511103c472cd0cbce54b4b9a898f"
     },
     {
       "path": "modules/ideas/routing.js",
       "mode": "0000644",
-      "sha256": "2ca0adb68b0fd44a65b9637c177848648ecd20ecd8ef67e65527c17b7a46414d"
+      "sha256": "ddedb76f43edbe3e7c918578fda94b97cb3822d97074af33393791fb1ec1cbef"
     },
     {
       "path": "modules/ideas/templates.js",
@@ -5492,7 +5502,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "31f39ea088b03feb217af4ce2fbf0b4dba0d8dad3e8eec625cf11e0dd4cb4228"
+      "sha256": "f50a54a0e0f0cdeac5a2321b14757e52d9d9507417b1d1962aa09cdc6a222832"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5527,12 +5537,12 @@
     {
       "path": "modules/lifecycle/db-versions.js",
       "mode": "0000644",
-      "sha256": "9f777643c44ebeef8b668a8120bf74d369564f904b2cb1aff54711bd5825c9c5"
+      "sha256": "8214d4a7c2e97b12e8cd9ba866b6560ac6e67446af5dcf28a0055838e32897f5"
     },
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "61ed58e2d0dbe9aa0b889d27b6a9c38df024a40bc797f22b0ff766fedf85a9de"
+      "sha256": "6d69634ad12510f81727eeed0a8fdde4eac618fedc23e43e2c1aa5835aaf0388"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5557,7 +5567,7 @@
     {
       "path": "modules/lifecycle/goal-advisory.js",
       "mode": "0000644",
-      "sha256": "b9138fa63ef324b9353354e4c5398150d576dd7e3547bb6889f2f83ebd7b995f"
+      "sha256": "d17e49302bde2677927467c01acc40060f0abfcb7d8361354f9b092dd9859b55"
     },
     {
       "path": "modules/lifecycle/goal-authz.js",
@@ -5612,7 +5622,7 @@
     {
       "path": "modules/lifecycle/lifecycle.js",
       "mode": "0000644",
-      "sha256": "6d94121968be4164151a913971f7a5e248104511ebc41ff5a95f5a1ee05af5a6"
+      "sha256": "db5e823ab382d44d4ae41266cec8ff76a98d6e636fd175cea0f1a04135eec7c9"
     },
     {
       "path": "modules/lifecycle/merge-lock.js",
@@ -7582,12 +7592,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d60a7d4e330cfd6154a5dea888aa9062d7571dee2d62aafc73cadb19b4afa604"
+      "sha256": "2b1a6ffdd207887a187f1574571de67e3f8ba851e80e433d463e932316b36e16"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "14e7286fe47165dabdc74cb24b6bb5afdc1e7b949ae612b2f72c7a56107a246b"
+      "sha256": "0caa3d71c5b02c8a41cebc7e59a6af2d68b50eb419311c7d444b0daa30df8430"
     },
     {
       "path": "public-docs/index.html",
@@ -9297,7 +9307,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b3b115c1a4652247daebb85a6c393400361c2269cb047e691121193c45a63648"
+      "sha256": "6a4b0d97d9bc67728886e879359cf1f657dd81f865d141d8a1c6cd6e41877012"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10287,7 +10297,7 @@
     {
       "path": "tests/filing_abuse_matrix.mjs",
       "mode": "0000644",
-      "sha256": "dd63216406ff8d76a6250944c03fb8e0f2028c599d01ee4720ba3dd79d547a63"
+      "sha256": "2a6de0e7411bb4796fe4f301af77c33f08a99307f2298ed83cd32c38cf059dc5"
     },
     {
       "path": "tests/first_admin_bootstrap.mjs",
@@ -11012,7 +11022,7 @@
     {
       "path": "tests/idea_routing.mjs",
       "mode": "0000644",
-      "sha256": "39bdd91984e584f7f81f6dc096093a7a273c483e845b7c821a389472684114a3"
+      "sha256": "d4d4e6ce60f1524e821e0c6c9f2844c7ba791b5502072dc00496224404afa990"
     },
     {
       "path": "tests/idea_spark_hall.mjs",
@@ -11234,6 +11244,11 @@
       "mode": "0000644",
       "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
     },
+    {
+      "path": "tests/maintenance_goal.mjs",
+      "mode": "0000644",
+      "sha256": "645fe3e9093abcb1425a59602d6a92a6d90669775aa3503ae435a54c79eca5c1"
+    },
     {
       "path": "tests/manage_manifest_shared_read.mjs",
       "mode": "0000644",
@@ -12477,7 +12492,7 @@
     {
       "path": "tests/task_goal_required.mjs",
       "mode": "0000644",
-      "sha256": "915711866bc194d977225326511c55ac5084b52d10a45a855bc9d6da815f4b8b"
+      "sha256": "2e311d02f87c562c2e8ed7cec24100efe3d1c750cb145e9e9e6bb1dac8043228"
     },
     {
       "path": "tests/task_lib.mjs",

package/.claude/skills/idea-triage/SKILL.md

@@ -1,18 +1,38 @@
 ---
 name: idea-triage
-description: Daily walk through the Bongos idea_inbox, which since task 1003071 holds only HOMELESS work — bugs and goal-bound captures now route to a task at filing time and never reach the inbox. For each open idea, prompt to promote (→ task, naming a goal), discard, or merge with another idea. Triggers when the user says "/idea-triage", "triage ideas", "review the inbox", "walk the idea inbox", or runs as a scheduled daily task. Metic+ rank only (Metic and Archon; not Xenos).
+description: >-
+  Daily walk of the Bongos idea_inbox, which holds only HOMELESS work: a capture
+  naming a goal, and since ADR 0262 a bug from a trusted vector, become a task at
+  filing time and never reach it. Promote, discard or merge each open idea.
+  Triggers on "/idea-triage", "triage ideas", "review the inbox", "walk the idea
+  inbox", or a scheduled daily run. Metic+ only.
 ---
 
 You are running the daily idea-triage session for Example. Open ideas in the Bongos `idea_inbox` table get walked one-at-a-time and verdicted, so the inbox doesn't accumulate stale entries.
 
-## The inbox is HOMELESS-ONLY now (task 1003071 / R13, goal 1000071)
+## The inbox is HOMELESS-ONLY now (task 1003065 / R01 + task 1003691, goal 1000071)
 
-**What changed.** Since R01 (task 1003065) a bug or goal-bound capture ROUTES at
-filing time — it becomes a task in its goal, in one transaction, and never appears
+**What changed.** Since R01 (task 1003065) a capture that NAMES A GOAL routes at
+filing time — it becomes a task in that goal, in one transaction, and never appears
 here. The inbox is therefore no longer "everything anyone filed"; it holds only
 **work with no home yet**. Expect it to be smaller, and read what IS in it as
 work that genuinely needs a decision rather than a queue to clear.
 
+**Bugs (task 1003691, [ADR 0262](../../../docs/adr/<redacted>.md)).**
+A `kind='bug'` now routes even with NO goal named: the system files it into the
+version's maintenance goal rather than making the reporter know the goal map. So a
+bug should not appear in this queue — with **one deliberate exception**. Routing is
+gated on the VECTOR, and Discord `#ideas` is not on the allowlist: it passes no
+kind, so the classifier GUESSES one from keywords ("we should fix the copy" reads
+as a bug), and a guess must not mint work (ADR 0234's owner-interview decision).
+Bug reports from Discord have their own channel, `#bugs`, which does route.
+
+> An earlier version of this section claimed bugs "never appear here" and credited
+> task 1003071. That was false when written — 1003071 only touched the
+> triage/promote path (commit `dab7e314`), while capture-time routing was 1003065,
+> whose no-goal early return made the bug branch unreachable. If you are triaging a
+> bug today, it arrived from `#ideas` or from a vector predating ADR 0262.
+
 **Two consequences for how you run this skill:**
 
 1. **Every promote names a goal.** The promote step now asks for one, defaulted

package/docs/adr/0262-a-bug-never-lands-in-the-inbox.md

@@ -0,0 +1,96 @@
+# ADR 0262 — A bug never lands in the inbox: the system names the home the reporter didn't
+
+**Status:** Accepted · 2026-09-07 · task 1003691
+**Supersedes nothing. Amends nothing.** It makes the explicit decision [ADR 0235](<redacted>.md) §6 said would be needed, and it keeps [ADR 0234](<redacted>.md)'s `#ideas` interview decision and [ADR 0250](<redacted>.md) D4's invariant both intact.
+
+## Context
+
+A reported defect could still end up parked in `idea_inbox`, waiting for a human triage pass — the exact tax criterion C1 of goal 1000071 was opened to remove.
+
+The cause is one line. `modules/ideas/routing.js` `decideLanding()` opened with:
+
+```js
+if (goalId == null || goalId === '') return { route: false, reason: 'no_goal' };
+```
+
+The `kind === 'bug'` hard-land branch sat **nine lines below** it and was therefore **unreachable without a goal**. `kind` only ever chose the routed task's *status* (`ready` for a trusted filer, `backlog` otherwise); it never chose whether the filing routed at all. So "bugs are urgent-true" was true only for a reporter who already knew which goal the defect belonged to — which is precisely the knowledge criterion C5 promises a filer never needs.
+
+### The conflict this task was filed over does not exist
+
+The task was opened on the premise that two accepted ADRs contradict each other, and that one had to lose:
+
+- **ADR 0250 D4** — "Every task belongs to a real, open goal. `goal_id` becomes required at creation." Enforced: `modules/lifecycle/db-tasks.js` throws, `POST /tasks` 400s `goal_id_required`.
+- **ADR 0235** — read as exempting `kind='bug'` from needing a goal at all, on the strength of the phrase *"a fix needs no home to be filed correctly."*
+
+**That reading of 0235 is wrong, and checking it was the first thing this task did.** ADR 0235's headline decision is the opposite:
+
+> **A fix category is `kind='bug'` on a task that carries a real `goal_id`** — no schema change, no new column, no new goal type.
+
+The quoted phrase describes `adviseGoal()` in `modules/lifecycle/goal-advisory.js:64`, which returns `null` — stays silent — for a `kind='bug'` task on its `no_goal`, `catch_all` and `no_criterion_link` branches. It is an **advisory suppression**: it stops the system nagging a bug about its goal. It grants nothing, and it changes no schema.
+
+So both ADRs already require a real goal, nothing loses, and no amendment is owed. What ADR 0235 *did* anticipate is this task — §6 Consequences:
+
+> giving `kind='bug'` more weight than an advisory exemption "is a new, explicit decision needing its own ADR."
+
+This is that ADR.
+
+## Decision
+
+**A `kind='bug'` filed from a trusted vector with no goal becomes a task in the version's maintenance goal, at the status the existing rank split already assigns.** Two halves, and both are load-bearing.
+
+### D1 — The home is the per-version MAINTENANCE goal, find-or-created
+
+The reporter does not name a home; the system does. `modules/ideas/homeless-home.js` resolves the current building version (`lifecycle.currentBuildingVersionId`), then find-or-creates `"<version> — maintenance"` (`lifecycle.ensureMaintenanceGoal`).
+
+**Not the `"<version> — general"` catch-all**, which is the obvious-looking choice and the wrong one. BV1.R11 (task 1003598) began *deleting* that fallback after 53 open tasks accumulated unread in two of them, and `db-tasks.js` warns against adding a third caller to the `allowCatchAll` opt-out it left behind. The maintenance goal is the home task 1003605 (BV1.R18) already designs for exactly this — *"where a defect against already-shipped work lands"* — so routing points at the destination the roadmap was already heading for rather than repopulating the bucket being drained. **This vector adds no `allowCatchAll` caller**, pinned by `tests/task_goal_required.mjs`.
+
+ADR 0250 D4's invariant therefore holds exactly: the task carries a real, open `goal_id`. What changes is only *who names it*.
+
+Three mechanics that are decisions, not implementation detail:
+
+- **The version tiebreak is not new.** More than one version may sit at `building` — ADR 0250 D5 closes the *planning* slot only, and refusing a second building version is still unshipped (task 1003606, BV1.R19). The rule reused is `pickDefaultVersion` from `scripts/gds/version-select.js`, expressed in SQL: building only, `started_at DESC`, nulls last, `id` breaking a remaining tie.
+- **Find-or-create takes a `pg_advisory_xact_lock`.** `goals` has no unique constraint on `(version_id, title)` — migration 160 used a `NOT EXISTS` guard, safe for a one-shot backfill and unsafe for a concurrent path, where two bugs reported in the same second would both insert and leave the title lookup permanently ambiguous.
+- **It runs inside the caller's transaction.** A goal created on its own connection would outlive a rolled-back route as an empty goal nobody asked for.
+
+**It fails closed.** No building version (`NO_BUILDING_VERSION`), or a version whose maintenance goal cannot be made (`NO_MAINTENANCE_GOAL`), refuses the filing and rolls back. Inventing a version is idea 1000771's exact failure — every Discord report entombed in a shipped version's catch-all — and this path exists to end that, not to repeat it.
+
+### D2 — The gate is the VECTOR, not the kind alone
+
+Routing keys on an allowlist, `routing.HOMELESS_ROUTING_VECTORS = {'api', 'discord-bugs'}`, and **absent or unrecognised is untrusted**.
+
+This is the half that keeps ADR 0234 whole. Its owner-interview decision — *"Discord `#ideas` files with HINTS only, never routes"* — is not an incidental detail: `#ideas` passes **no kind at all**, so `inbox.classify()` guesses one from keywords, and its bug pattern fires on `fix|broken|bug|regression|crash|error` anywhere in the text. *"We should fix the copy on the landing page"* classifies as a bug. Gating on kind alone would let a keyword guess mint work and would have killed an explicit owner decision as a side effect.
+
+The two trusted members each carry a human or a channel that means *this is broken*:
+
+| Vector | Why it is trusted |
+|---|---|
+| `api` | `POST /inbox`, authenticated builder, explicit `kind`. `scripts/gds/capture.js` posts to this route, so the CLI inherits it and needs no member of its own. |
+| `discord-bugs` | The **channel is the classification** (`discord-bugs.js` forces `kind='bug'`), and it already carries an unlinked-author guard, a per-builder hourly rate cap, and a body screen. |
+
+`discord-ideas` is named explicitly at its call site so its exclusion is a written fact rather than an absence someone has to notice. The vector is **server-set at every call site and never read from a request body**, which is what makes forging it a non-move.
+
+#### A vector is claimed by a call site, so the call site must still check identity
+
+`#bugs` sets `vector: builder ? 'discord-bugs' : null` — **conditional, not the bare string.** The first cut of this ADR set it unconditionally and that was a trust-boundary regression caught as a grader blocker, worth recording because the shape will recur.
+
+The channel earns its place on the allowlist through two guards that are both **identity-bound**: the rank-aware landing needs a rank, and the rolling rate cap is counted per builder id. An unlinked Discord author has neither — `filerRank` is null and the goal is only sought `if (builder)` — so an unconditional vector meant they took the homeless-bug branch and minted a real `backlog` task, with the per-builder rate limiter not running at all for them. That is unattributed task creation at no cost, and it contradicts the promise at the top of `discord-bugs.js` that ADR 0047 bought: *"an unlinked author cannot inject claimable work… it no longer mints anything."*
+
+The general rule: **being on the allowlist is a property of the DOOR, not of everyone who walks through it.** A vector attests "filings from here carry a human who means *this is broken*"; where a door admits both identified and anonymous traffic, it may only claim the vector for the identified half. With no vector the filing falls back to the inbox exactly as before — the report is kept, its images re-hosted, a human still sees it in triage. Pinned as F16, mutation-verified against the unconditional form.
+
+Everything else the matrix already decided is unchanged and still applies to this path: the Metic+ rank split (`ready` vs `backlog`), the Full Idea refusal, and the judgment kinds. **Only bugs get a free home** — a homeless feature or cleanup is exactly the work the inbox is *for*, and fabricating homes for it would empty the inbox by lying.
+
+## Consequences
+
+- **The inbox's stated identity becomes true.** `.claude/skills/idea-triage/SKILL.md` claimed bugs "never appear here" and credited task 1003071 — which only touched the triage/promote path (commit `dab7e314`); capture-time routing was task 1003065. The claim was false when written and is corrected alongside this ADR; it is now true for the `api` and `discord-bugs` vectors.
+- **A bug reported in Discord `#ideas` still lands in the inbox.** That is deliberate, and it is not a gap: bug reports from Discord have their own channel, `#bugs`, which routes.
+- **`#bugs`' bad-guess fallback got better.** It re-files with `goalId: null` when a suggested goal refuses the landing; that path now reaches the maintenance goal instead of the inbox, so dropping a wrong guess costs a triage pass rather than the whole report.
+- **Task 1003605 (BV1.R18) is partly delivered and still owed.** This ships the maintenance goal's title, find-or-create and routing. R18 still owns auto-creating it with every version, the close-exempt flag R16 reads, and carrying open bugs forward to the successor version on close.
+- **A new file on the create path** — `modules/ideas/homeless-home.js`, added to the `tests/task_goal_required.mjs` roster so the anti-drift pin covers it.
+
+## Alternatives rejected
+
+- **Let a goal-less bug create a goal-less task** (an `allowCatchAll`-style escape hatch for bugs). Breaks ADR 0250 D4 one day after it was accepted, and every consumer assuming `goal_id` is non-null would need auditing. The invariant is worth more than the shortcut.
+- **Reject a bug with no goal, listing open goals to pick from.** One rule, no exceptions — but a rejected report does not land *at all*, and Discord's bot fires and forgets, so every inbound bug from a channel that cannot retry would be silently lost. It also directly contradicts the thing being asked for.
+- **Route into the `"<version> — general"` catch-all.** Smallest diff, reuses shipped machinery, and repopulates the exact buckets BV1.R11 was filed to drain. R18 would then have to undo it.
+- **Build R18 whole first, then route.** The cleanest end state, and substantially more scope than the defect being fixed; the close-exempt flag and version-close carry-forward are independent of whether a reported bug finds a home today.
+- **Gate on `kind` alone.** Cheapest fix, and it silently overturns ADR 0234's owner-interview decision by letting a keyword classifier mint tasks from an ideation channel.

package/docs/adr/README.md

@@ -353,3 +353,4 @@ This keeps the decision history honest and traceable.
 | 0259 | [**A project’s departure from the public list is public, and the copy says so** ([task 1003672](https://cloudbongos.com/builders#/task/1003672) · goal 1000046 — *Project creation*). Decides the leak [ADR 0255](<redacted>.md) §6.2 deliberately filed rather than implied fixed. The public projects feed publishes a named list plus a count of anonymous rows, so when a project flips to stealth its named row LEAVES the identified block while the count RISES BY ONE — *“Mercury is gone, and there is one more black hole”* names it, and the moment, from a single diff of two snapshots. **Everything [ADR 0182](<redacted>.md) D2a does is defeated by it**, because the identity was never carried ON the anonymous row (`STEALTH_ANONYMOUS_KEEPS` is an allow-list precisely so a column added next year is anonymous by default) — it is carried by the ABSENCE of the named row that used to sit beside it. **Larger than the channel 0255 closed**, which needed repeated sampling and correlation; this one is exact and needs two reads. No `ORDER BY` change touches it: it is inherent in publishing a named list at all, so every fix is a product decision with a visible cost and the owner’s call, not a builder’s. **Decision: accept it, and make the copy say so.** Two reasons it is the right end of the trade and not merely the cheapest — (1) it is ALREADY the honest reading of the existing promise, since D2a made existence and count public *by design*, and a count that is public and truthful is a count whose CHANGES are public; (2) both alternatives damage the control they defend. A **delay window** means the owner clicks the privacy setting and is not private yet *without knowing it*, converting an information leak into a false belief — strictly worse, and the wrong direction for a privacy control. **Decoys** spend the count’s truthfulness (it is truthful today) on a guarantee that is still only probabilistic, and a decoy scheme needs some way to tell padding from real rows — the exact stable per-project key D2a forbids. The promise stealth actually keeps is about the project’s CONTENTS, not the TRANSITION: an anonymous row stays anonymous (no name, tagline, art, origin, or key surviving to the next snapshot); what is not private is stepping off a published list readers may keep copies of. So the copy — which read *“its name, and everything else about it, stay yours”*, every clause true and the paragraph as a whole overselling, because a reader takes it to cover the switch — now names the boundary in BOTH places an owner meets the setting (the choice’s blurb and the what-changes fold), in the plain register 0182’s interview fixed for this card. **A privacy control that oversells is worse than one that admits a limit**, the same standard 0255 §6 set for itself. **No behaviour changes** in `projects-feed.js` — the feed, the redaction allow-list and the keyed rotating permutation are decided FINISHED, not insufficient. `tests/projects_hub.mjs` pins the sentence in both surfaces (the copy IS the fix, so a future edit tightening the blurb must not quietly drop it) and re-applies the no-space-metaphor ban to it. Carries 0255 §6.3’s smaller residual so both live in one place: within one 24h epoch the permutation is stable, so same-day snapshots tell black holes apart (not name them) — accepted on the same reasoning, since the fix is a per-request permutation, which breaks pagination exactly as `ORDER BY random()` was rejected for. Guards recorded for any future attempt: no stable per-project key on an anonymous row, and no anonymous ordering an observer can predict or correlate. Rejected: the delay; decoys; dropping the named list (protects a privacy nobody asked for at the cost of the feature); and saying nothing, which is the failure mode this closes.](<redacted>.md) | platform-identity / privacy boundary / copy honesty |
 | 0260 | [**An application IS the consent, and the hub’s own echo is the gate** ([task 1002972](https://cloudbongos.com/builders#/task/1002972) · goal 1000045, criterion C4). Privacy spec **D7** asks that a reviewer see what the applicant’s OWN profile rules would already show, evaluated LIVE at review time. The rule is ONE port composing the two EXISTING views — `getPublicProfileExtras` for a public account, `recruiter-sliver`’s own `sliverShapeFor` for a private one — because a third five-key lookalike **is** the new disclosure class D7 forbids. **The one deliberate difference from the D3 sliver:** `getRecruiterSliver` floors on recruiting REACH, and reusing it verbatim would be wrong in the direction that looks safe — `recruiter_discoverable` defaults to FALSE for a private account, so a private builder who deliberately applied would show their reviewer NOTHING and C4 would be satisfied by an empty box. D7 settles it: *“applying is an explicit act”*. The swap relaxes REACH only; `accountActiveSql` (active **and** terms accepted) and `hide_stats` still floor it, and the proof asserts both directions on the same account so the tempting refactor cannot pass quietly. **The federated route’s gate is the whole security story** ([ADR 0205](<redacted>.md) / security report 1000027): client credentials name a PROJECT and never a person, so `POST /sso/applicant-profile` authenticated alone is a bulk disclosure oracle over every account on the platform, private ones included. `applicationBacksProfileRead` demands a HUB-WRITTEN echo for exactly (this account, this client) inside the same 30-day window — a row only the hub’s own join relay creates — refusing **404, never 403**, and BEFORE any account is read (asserted on the statement log, because a gate that refuses after reading has already done the disclosure work). LIVE means nothing is stored at either end; the queue keys on the VOUCH and never on `github_login` (the one PUBLIC unauthenticated write makes an unvouched login an impersonation surface); and the hub client secret stays in core behind a narrow doorway port. **The path is complete but DORMANT until R09 ([task 1002285](https://cloudbongos.com/builders#/task/1002285)) ships the vouch writer** — nothing writes `applicant_github_id` today, and that dependency was missing from 1002972’s graph. Rejected: routing the port through `getRecruiterSliver`, a snapshot at apply time, resolving by `github_login`, and putting `loadIdpConfig` on the doorway.](<redacted>.md) | platform identity / privacy |
 | 0261 | [**A preselect always carries a reason; the bundle’s summary is the floor** ([task 1003684](https://cloudbongos.com/builders#/task/1003684) · goal 1000046 — *Project creation*). Resolves a collision between two rules that were each right alone. [ADR 0243](<redacted>.md) made `adjustments` a **delta** — a team-shape rule that fires without moving anything claims nothing, because a sentence explaining a change that did not happen is a claim the owner cannot check. [ADR 0237](<redacted>.md) says a preselect the owner cannot see a reason for is one they must audit, which is worse than no preselect at all. The two collide whenever a type’s bundle **already contains** what a rule would add: `game` is `[dev-box, discord]` and the `small-team` rule adds `dev-box`, so the rule fires, moves nothing, and correctly reports `adjustments: []`. Confirmed on live core 1.19.580 — `byTeamShape[small-team]` = `{"bundle":["dev-box","discord"],"adjustments":[]}`. The owner then reached step 4 and saw **two extras switched on with no reason beside them**, `#modWhy` an empty hidden div: exactly what 0237 exists to prevent, produced by 0243 behaving correctly. Filed as a dropped adjustment; it was not — the engine is right, and the panel simply had ONE voice and fell silent when the rule had nothing to say. **Decision: the why-line has two voices and the type’s is the floor.** A real adjustment still speaks for itself and is never displaced; when none moved, the type’s own curated `summary` explains the preselect; when the owner has answered the picker themselves the panel stays silent (unchanged — a reason handed back for a toggle they just flipped reads as the panel arguing with them); a bundle with no summary still says nothing, because a floor is not an invention. **No new copy, endpoint or field** — the summary was authored for this job in `starter-bundles.js`, served on every row of `GET /provisioning/starter-bundles`, and rendered NOWHERE in the product until now. 0243 is not weakened: the delta stays a delta and no rule is credited with a change it did not make. The pin `tests/projects_hub_module_picker.mjs` carried a fixture with **no `summary` field**, which made four “no adjustment, no sentence” cases pass for the wrong reason; the fixture now carries the real summaries and those cases assert the new contract, including explicitly that no RULE sentence is invented for a change that did not happen. Rejected: making the rule claim a no-op change (re-introduces the unverifiable claim 0243 removed); widening the bundles so no rule is ever redundant (contorts curated presets for a rendering concern, and the redundancy returns on the next edit); and leaving it silent, declined by the owner once the trade-off was put to them directly.](<redacted>.md) | provisioning / starter bundles / owner-facing copy |
+| 0262 | [**A bug never lands in the inbox: the system names the home the reporter didn't** ([task 1003691](https://cloudbongos.com/builders#/task/1003691) · goal 1000086 — *Strict versioning*). `routing.js` returned early on a goal-less filing, so its own `kind='bug'` hard-land branch was UNREACHABLE without a goal — `kind` only ever chose a routed task's STATUS, never whether it routed — and a reported defect sat in `idea_inbox` awaiting the triage pass criterion C1 exists to remove. The premise that [ADR 0250](<redacted>.md) D4 and [ADR 0235](<redacted>.md) contradict each other is FALSE: 0235's exemption is an advisory silence in `goal-advisory.adviseGoal`, and its actual decision already requires a real `goal_id`. So nothing is amended; this is the explicit decision 0235 §6 said would be needed. **D1** a homeless bug gets the version's MAINTENANCE goal (R18's design), find-or-created under an advisory lock inside the route's own transaction — not the catch-all R11 is deleting, and adding no `allowCatchAll` caller. **D2** the gate is the VECTOR (`api`, `discord-bugs`), not the kind: `#ideas` passes no kind, so the classifier guesses one from keywords, and gating on kind alone would silently overturn [ADR 0234](<redacted>.md)'s owner-interview decision. Rejected: goal-less bug tasks (breaks D4 a day after it landed); rejecting the filing (Discord cannot retry, so the report is lost); the catch-all (repopulates the bucket being drained); building R18 whole first.](<redacted>.md) | work intake / idea routing / the version-goal invariant |

package/docs/module-api-changelog.md

@@ -1621,5 +1621,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.584 with no explicit bump. run 34165392436. (task 1002620)
   1.19.586 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.585 with no explicit bump. run 34167072966. (task 1002620)
+  1.19.587 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.586 with no explicit bump. run 34172785860. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/discord/discord-bugs.js

@@ -248,6 +248,22 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
       filerRank,
       goalId: goal ? goal.id : null,
       suggestedPriority: 3,
+      // task 1003691 (ADR 0262): the trusted-vector claim, and it is claimed ONLY
+      // FOR A LINKED BUILDER — `builder &&`, not the bare string.
+      //
+      // This channel earns the vector through guard 2 and guard 3 above, and both
+      // are identity-bound: the rank-aware landing needs a rank, and the rolling
+      // rate cap is counted per builder id. An UNLINKED author has neither. Handing
+      // them the vector unconditionally would let anyone who can post here mint
+      // unattributed backlog tasks at no cost — breaking guard 1's promise at the
+      // top of this file ("an unlinked author cannot inject claimable work... it no
+      // longer mints anything"), which is the security property ADR 0047 bought.
+      //
+      // With no vector the filing falls back to the inbox exactly as it did before
+      // ADR 0262: the report is still kept, still re-hosts its images, and still
+      // reaches a human through triage. Nothing is lost except the ability to write
+      // to the task table without an identity. Pinned as F16.
+      vector: builder ? 'discord-bugs' : null,
     };
 
     // THE HOME IS A SUGGESTION, NOT A CONDITION OF BEING HEARD. routeIdeaToGoal is
@@ -255,8 +271,13 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
     // scope-wall verdict, a goal archived mid-flight — rolls the idea row back too
     // and the report is gone. That is the exact failure this task exists to end, and
     // it would be caused by a goal WE guessed at, not by anything the reporter did.
-    // So a refusal drops the guess and files the report homeless: it lands in the
-    // inbox for triage, which is strictly what would have happened before we tried.
+    // So a refusal drops the guess and re-files the report with no goal at all.
+    //
+    // Since task 1003691 that no longer means the inbox: a homeless bug from a
+    // trusted vector routes to the version's MAINTENANCE goal, so dropping a bad
+    // guess costs the reporter a triage pass rather than the whole report. A
+    // sub-Metic refused from a protected-scope goal therefore still gets a real
+    // task — at 'backlog', in an unscoped goal, with the protected goal untouched.
     let idea;
     try {
       idea = await deps.captureIdea(capture);

package/modules/discord/discord-inbound.js

@@ -189,6 +189,15 @@ async function recordInboundIdea({ discordUserId, content, imageUrls = [], messa
       // tests/filing_abuse_matrix.mjs, which greps this exact call for it).
       suggestedGoalId: hint ? hint.id : null,
       suggestedVersion,
+      // task 1003691 (ADR 0262): named EXPLICITLY so this vector's exclusion is a
+      // written fact rather than an absence someone has to notice. '#ideas' is not
+      // on routing.HOMELESS_ROUTING_VECTORS, so a filing here NEVER becomes a task
+      // — which is ADR 0234's owner-interview decision ("#ideas files with hints
+      // only, never routes"), and the reason it holds even now that a homeless bug
+      // routes elsewhere: the kind here is a KEYWORD GUESS (inbox.classify fires
+      // 'bug' on fix/broken/crash), and a guess must not mint work. Bug reports
+      // from Discord have their own channel, #bugs, which does route.
+      vector: 'discord-ideas',
     });
 
     await auditDiscordBot(deps, {

package/modules/ideas/homeless-home.js

@@ -0,0 +1,51 @@
+'use strict';
+
+// modules/ideas/homeless-home.js — WHERE A REPORTED BUG GOES WHEN NOBODY NAMED A
+// GOAL (task 1003691, [ADR 0262](../../docs/adr/0262-a-bug-never-lands-in-the-inbox.md)).
+//
+// THE PROBLEM THIS ANSWERS. routing.decideLanding returned early on a goal-less
+// filing, which made its own kind==='bug' branch unreachable without a goal: a
+// reported defect parked in idea_inbox waiting for the triage pass criterion C1
+// exists to remove. Letting bugs route required answering "route into WHAT", and
+// that answer is here.
+//
+// THE ANSWER IS THE VERSION'S MAINTENANCE GOAL, and deliberately NOT the
+// "<version> — general" catch-all. The catch-all is what BV1.R11 (task 1003598)
+// began deleting after 53 open tasks accumulated in two of them unread, and
+// db-tasks.js warns against a third caller of its opt-out hatch. The maintenance
+// goal is the home task 1003605 (BV1.R18) designs for exactly this — "where a
+// defect against already-shipped work lands" — so a homeless bug gets a REAL,
+// open goal and ADR 0250 D4 ("every task belongs to a goal") holds intact.
+//
+// ITS OWN FILE because inbox.js sits at the fitness line cap with no headroom, and
+// because the concept deserves a name: this is one question ("what home does a
+// homeless bug get") with one answer, and a reader looking for it should find a
+// file rather than a paragraph inside a transaction.
+
+// resolveHomelessHome — the goal id a homeless bug lands in, or a thrown refusal.
+//
+// TWO PROPERTIES, both load-bearing:
+//
+//   * IT RUNS ON THE CALLER'S TRANSACTION CLIENT. Both port calls take it, so the
+//     find-or-create commits with the idea + task + lineage rows or not at all. A
+//     goal created on its own connection would outlive a rolled-back route as an
+//     empty goal nobody asked for.
+//   * IT FAILS CLOSED. No building version, or a version whose maintenance goal
+//     cannot be made, means there is nowhere honest to file — so it refuses rather
+//     than inventing a version. Filing a defect into a version not open to work is
+//     idea 1000771's exact failure (every Discord report entombed in a shipped
+//     version's catch-all), and this path exists to end that, not to repeat it.
+//
+// It resolves the VERSION first, which inverts the usual order: every other routed
+// filing reads the version off the goal it was handed. There is no goal here yet,
+// so the version has to come first — and once this returns, everything downstream
+// runs unchanged against a real goal id.
+async function resolveHomelessHome(lifecycle, client) {
+  const versionId = await lifecycle.currentBuildingVersionId({ client });
+  if (!versionId) throw { code: 'NO_BUILDING_VERSION' };
+  const home = await lifecycle.ensureMaintenanceGoal(versionId, { client });
+  if (!home) throw { code: 'NO_MAINTENANCE_GOAL', version_id: versionId };
+  return home.id;
+}
+
+module.exports = { resolveHomelessHome };

package/modules/ideas/inbox.js

@@ -20,6 +20,8 @@ const { pool } = api;
 // The landing matrix (task 1003065, BV1.R01) — pure, DB-free, its own file so
 // every cell is unit-testable without a Postgres. See ./routing.js.
 const { decideLanding, authorizeRoutedLanding, routedPriority } = require('./routing');
+// The home a goal-less bug lands in (task 1003691, ADR 0262).
+const { resolveHomelessHome } = require('./homeless-home');
 
 const VALID_KINDS = [
   'feature',
@@ -247,6 +249,9 @@ async function captureIdea({
   // anything). Ignored when `goalId` is already set, so every existing caller
   // is untouched.
   suggestedGoalId = null,
+  // WHICH DOOR this filing came through; absent is UNTRUSTED and stays an inbox
+  // row. Read by one rule — see routing.HOMELESS_ROUTING_VECTORS (ADR 0262).
+  vector = null,
 }, deps = {}) {
   if (!title || typeof title !== 'string') {
     throw { code: 'TITLE_REQUIRED' };
@@ -264,7 +269,7 @@ async function captureIdea({
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
 
   // The decision, before any write. Pure — see ./routing.js.
-  const landing = decideLanding({ goalId, kind: resolvedKind, grade, filerRank });
+  const landing = decideLanding({ goalId, kind: resolvedKind, grade, filerRank, vector });
   if (landing.route) {
     return routeIdeaToGoal({
       title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority,
@@ -315,6 +320,23 @@ async function routeIdeaToGoal({
   try {
     await client.query('BEGIN');
 
+    // The `lifecycle` PORT, resolved ONCE up here because two steps need it: the
+    // homeless-bug home at (a0) and the task insert at (c). Never an import of
+    // modules/lifecycle/ — the one-way module rule, ADR 0083.
+    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
+    if (!lifecycle || !lifecycle.createTask) {
+      // A vanilla instance without the lifecycle module cannot hold tasks at all,
+      // so there is nothing to route INTO. Refuse loudly rather than silently
+      // degrading to an inbox row the caller was told became a task.
+      throw { code: 'LIFECYCLE_UNAVAILABLE' };
+    }
+
+    // a0. A homeless bug gets the version's maintenance goal — ./homeless-home.js
+    //     says why that goal and not the catch-all, and why it fails closed.
+    const effectiveGoalId = landing.homeless
+      ? await resolveHomelessHome(lifecycle, client)
+      : goalId;
+
     // a. The goal must be a REAL, LIVE HOME. All three checks are inside the
     //    transaction and the row is locked FOR SHARE, so a goal cannot be
     //    archived out from under a route that is mid-flight.
@@ -330,17 +352,17 @@ async function routeIdeaToGoal({
          JOIN versions v ON v.id = g.version_id
         WHERE g.id = $1
         FOR SHARE OF g`,
-      [goalId]
+      [effectiveGoalId]
     );
-    if (goalRows.length === 0) throw { code: 'GOAL_NOT_FOUND', goal_id: goalId };
+    if (goalRows.length === 0) throw { code: 'GOAL_NOT_FOUND', goal_id: effectiveGoalId };
     const goal = goalRows[0];
     if (goal.status !== 'open') {
-      throw { code: 'GOAL_NOT_OPEN', goal_id: goalId, status: goal.status };
+      throw { code: 'GOAL_NOT_OPEN', goal_id: effectiveGoalId, status: goal.status };
     }
     if (goal.version_status !== 'building') {
       throw {
         code: 'VERSION_NOT_BUILDING',
-        goal_id: goalId,
+        goal_id: effectiveGoalId,
         version_id: goal.version_id,
         version_status: goal.version_status,
       };
@@ -357,7 +379,7 @@ async function routeIdeaToGoal({
                $7, now())
        RETURNING ${IDEA_COLS}`,
       [title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority, capturedBy,
-        goalId]
+        effectiveGoalId]
     );
     const idea = ideaRows[0];
 
@@ -384,7 +406,7 @@ async function routeIdeaToGoal({
     if (!authorized.ok) {
       throw {
         code: 'ROUTE_NOT_AUTHORIZED',
-        goal_id: goalId,
+        goal_id: effectiveGoalId,
         gate: authorized.code,
         reason: authorized.reason,
         details: authorized.details ?? null,
@@ -399,10 +421,10 @@ async function routeIdeaToGoal({
     //    The version is the GOAL'S, never a caller-supplied one, so
     //    "goal belongs to the version" is true by construction rather than by
     //    validation. (An idea's own `suggested_version` is kept on the idea row
-    //    as filed and does NOT override it — the goal is the binding home.) One
-    //    read stays outside this transaction by design: createTask's catch-all
-    //    goal fallback, which only runs when goalId is absent and so never on
-    //    this path.
+    //    as filed and does NOT override it — the goal is the binding home.)
+    //    createTask's catch-all fallback still never fires here: a goal is always
+    //    set by this line, named by the filer or resolved at (a0), so this path
+    //    never opts out of the goal requirement (task 1003691, ADR 0262).
     //
     //    `requiresRank` is passed ONLY as the R05 protected-scope floor computed
     //    above — never from anything the filer said. createTask still derives its
@@ -411,13 +433,6 @@ async function routeIdeaToGoal({
     //    default — createTask auto-assigns the capped suggestion) and
     //    `discipline` (left 'unclassified', exactly as the other non-authored
     //    create vectors leave it).
-    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
-    if (!lifecycle || !lifecycle.createTask) {
-      // A vanilla instance without the lifecycle module cannot hold tasks at all,
-      // so there is nothing to route INTO. Refuse loudly rather than silently
-      // degrading to an inbox row the caller was told became a task.
-      throw { code: 'LIFECYCLE_UNAVAILABLE' };
-    }
     const task = await lifecycle.createTask({
       versionId: goal.version_id,
       title,