@bongos/core 1.19.586 → 1.19.587

package/modules/ideas/routes/inbox.js

@@ -148,6 +148,12 @@ module.exports = function buildInboxRouter() {
         goalId: body.goal_id ?? null,
         filerRank: req.builder?.rank ?? null,
         grade,
+        // task 1003691 (ADR 0262): the vector, hardcoded — NEVER read from the
+        // body. This route is the authenticated API door, so a bug filed here
+        // with no goal routes to the version's maintenance goal instead of
+        // parking in the inbox. Letting a caller name their own vector would
+        // hand every untrusted door the same power by typing one word.
+        vector: 'api',
       });
       let grade_warning;
       if (grade === 'full') {
@@ -272,6 +278,17 @@ module.exports = function buildInboxRouter() {
           // filer the way through: file it without a goal.
           err.code === 'ROUTE_NOT_AUTHORIZED' ? 403 :
           err.code === 'LIFECYCLE_UNAVAILABLE' ? 503 :
+          // task 1003691 (ADR 0262) — the HOMELESS-bug refusals. Both are 503 and
+          // NOT 4xx, because unlike every refusal above them they are not the
+          // filer's mistake and there is nothing they can change to get through:
+          // the filer named no goal (which is now the supported way to report a
+          // bug), and the project simply has no version open to work or no
+          // maintenance goal that can be made in it. That is a server-state
+          // problem an operator fixes, so it reads like LIFECYCLE_UNAVAILABLE
+          // beside it — a 400 would tell the reporter to correct a request that
+          // was correct.
+          err.code === 'NO_BUILDING_VERSION' ? 503 :
+          err.code === 'NO_MAINTENANCE_GOAL' ? 503 :
           500;
         return res.fail(err.code, status, { ...err });
       }

package/modules/ideas/routing.js

@@ -54,6 +54,32 @@ const METIC_PLUS = new Set(['metic', 'archon']);
 // 'quick' carry no such meaning and route normally.
 const NEVER_ROUTE_GRADE = 'full';
 
+// The vectors a HOMELESS bug may route from (task 1003691, ADR 0262). This is an
+// ALLOWLIST and the default is exclusion: a filing whose vector is absent or
+// unrecognised never routes without a goal, which is what keeps the homeless
+// branch below from becoming a second door into the queue.
+//
+// WHY THE VECTOR AND NOT THE KIND ALONE — the whole reason this set exists.
+// `kind` is not always a claim a human made. Discord #ideas passes no kind at
+// all, so inbox.classify() GUESSES one from keywords, and its bug pattern fires
+// on fix/broken/bug/crash/error anywhere in the text: "should we fix the copy on
+// the landing page" classifies as a bug. Routing on kind alone would let that
+// keyword guess mint work, which is exactly the ADR 0234 owner-interview
+// decision — "#ideas files with HINTS only, never routes" — that this task was
+// explicitly told to keep (pinned as F12 in tests/filing_abuse_matrix.mjs).
+//
+// Both members carry a human or a channel that means "this is broken":
+//   'api'           — POST /inbox, an authenticated builder naming the kind. This
+//                     is also how `scripts/gds/capture.js` files (it posts to the
+//                     route rather than calling this module), so the CLI inherits
+//                     it and needs no member of its own.
+//   'discord-bugs'  — the #bugs channel, where the CHANNEL is the classification
+//                     (modules/discord/discord-bugs.js forces kind='bug'), and
+//                     which already carries a rate cap + an unlinked-author guard.
+// 'discord-ideas' is deliberately ABSENT: it is an ideation channel, and the bug
+// reports that belong to Discord already have #bugs.
+const HOMELESS_ROUTING_VECTORS = new Set(['api', 'discord-bugs']);
+
 // decideLanding — the matrix, as one pure function.
 //
 // Returns { route: false, reason } when the thing belongs in the inbox, or
@@ -65,11 +91,47 @@ function decideLanding(input) {
   // a caller spreading an absent object hands over — would throw. A landing
   // decision that CRASHES is the worst of the three outcomes: it takes down the
   // capture that was supposed to fail closed. Normalise first, decide after.
-  const { goalId = null, kind = null, grade = null, filerRank = null } = input || {};
+  const { goalId = null, kind = null, grade = null, filerRank = null, vector = null } = input || {};
   // No goal named ⇒ the inbox is exactly right, and this is the DEFAULT PATH.
   // Every capture vector that never learns about goals keeps working unchanged;
   // routing is strictly additive (criterion C1 testable #5).
-  if (goalId == null || goalId === '') return { route: false, reason: 'no_goal' };
+  //
+  // THE ONE EXCEPTION: A BUG NEVER LANDS IN THE INBOX (task 1003691, ADR 0262).
+  // Until now this early return made the kind==='bug' branch below UNREACHABLE
+  // without a goal — `kind` only ever chose the routed task's STATUS, never
+  // whether it routed at all — so a reported defect sat in idea_inbox waiting for
+  // a human triage pass, which is the triage tax criterion C1 exists to remove.
+  //
+  // This does NOT re-open the goal-less task hole ADR 0250 D4 closed. A homeless
+  // bug is given a REAL, open goal — the version's maintenance goal, resolved by
+  // the caller (inbox.routeIdeaToGoal) — so "every task belongs to a goal" holds
+  // exactly as before. What changes is only WHO names it: the system, not the
+  // person reporting the defect. That is also what ADR 0235 already asked for:
+  // its "a fix needs no home to be filed correctly" is an ADVISORY exemption
+  // (goal-advisory.adviseGoal stays silent for a bug), and its actual decision is
+  // that a fix category IS kind='bug' on a task carrying a real goal_id.
+  //
+  // Fail-closed, in the posture of the rest of this file: the vector must be on
+  // the allowlist, the grade must not be a Full Idea (F8 — the Board Room's
+  // subject is never converted by its own filer), and an untrusted or absent rank
+  // still soft-lands at 'backlog' rather than reaching the claimable queue.
+  if (goalId == null || goalId === '') {
+    if (
+      HARD_LAND_KINDS.has(kind) &&
+      HOMELESS_ROUTING_VECTORS.has(vector) &&
+      String(grade || '').toLowerCase() !== NEVER_ROUTE_GRADE
+    ) {
+      // `homeless: true` is the instruction to the transaction: resolve the
+      // version's maintenance goal before the goal read. It is a separate field
+      // rather than an inferred `goalId == null` so the intent survives into the
+      // caller and into the tests, and so a future landing that happens to carry
+      // no goal cannot silently inherit the maintenance-goal behaviour.
+      return METIC_PLUS.has(String(filerRank || '').toLowerCase())
+        ? { route: true, status: 'ready', homeless: true, reason: 'bug_homeless_trusted_filer' }
+        : { route: true, status: 'backlog', homeless: true, reason: 'bug_homeless_awaiting_nod' };
+    }
+    return { route: false, reason: 'no_goal' };
+  }
 
   if (String(grade || '').toLowerCase() === NEVER_ROUTE_GRADE) {
     return { route: false, reason: 'full_idea_never_routes' };
@@ -228,5 +290,6 @@ module.exports = {
   DEFAULT_ROUTED_PRIORITY,
   HARD_LAND_KINDS,
   NEVER_ROUTE_KINDS,
+  HOMELESS_ROUTING_VECTORS,
   METIC_PLUS,
 };

package/modules/lifecycle/db-goals.js

@@ -15,6 +15,7 @@ const { pool } = api;
 const doneWhen = require('./done-when.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { nonTerminalSql } = require('./task-status');
+const { maintenanceGoalTitle } = require('./goal-advisory.js');
 const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 // -------------------------------------------------------------------------
@@ -82,6 +83,96 @@ async function createGoal(
   return rows[0];
 }
 
+// The maintenance goal's scope wall: deliberately EMPTY. Named rather than inlined
+// so the choice is greppable and the reasoning has one home (see the INSERT below).
+const MAINTENANCE_SCOPE_MODULES = [];
+
+// ensureMaintenanceGoal — find-or-create the version's maintenance goal, the home
+// a reported bug gets when its reporter named none (task 1003691, ADR 0262).
+// Returns the goal row, or null when the version cannot hold new work.
+//
+// WHY THIS IS A LIFECYCLE FUNCTION AND NOT AN ideas ONE. Goals and versions are
+// this module's tables; the ideas module may not import lifecycle (the one-way
+// module rule, ADR 0083), so it reaches this through the `lifecycle` port. Keeping
+// the SQL here also means the maintenance goal has ONE definition for the routing
+// path and for task 1003605 (BV1.R18) to build the rest of the feature on.
+//
+// IT RUNS INSIDE THE CALLER'S TRANSACTION (deps.client — the createTask seam).
+// That is load-bearing rather than tidy: routeIdeaToGoal's whole promise is that
+// the idea row, the task and the lineage row commit together or not at all, and a
+// goal created in its own connection would survive a rolled-back route as an
+// empty goal nobody asked for.
+//
+// THE RACE IS REAL AND IS HANDLED WITH A LOCK, NOT A PRAYER. `goals` has no unique
+// constraint on (version_id, title) — migration 160 used a NOT EXISTS guard, which
+// is safe for a one-shot backfill and NOT safe for a concurrent path: two bugs
+// reported in the same second would both see "no maintenance goal" and both insert
+// one, after which the title lookup is ambiguous forever. pg_advisory_xact_lock
+// serialises find-or-create per version and releases at COMMIT/ROLLBACK with no
+// unlock call to forget. It is keyed on a hash of the TITLE, so it collides only
+// with another writer of this same goal.
+//
+// The version must be open to work, checked here rather than trusted from the
+// caller: filing a defect into a shipped version's goal is the 1000771 bug
+// (bugs entombed where nobody looks), and the point of this path is to end that.
+async function ensureMaintenanceGoal(versionId, deps = {}) {
+  if (versionId == null) return null;
+  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
+  const title = maintenanceGoalTitle(versionId);
+
+  const { rows: vRows } = await exec.query(
+    `SELECT status FROM versions WHERE id = $1`,
+    [versionId]
+  );
+  if (!vRows[0] || vRows[0].status !== 'building') return null;
+
+  await exec.query(`SELECT pg_advisory_xact_lock(hashtext($1))`, [title]);
+
+  // MATCHED BY TITLE, because there is no column that says "this is the
+  // maintenance goal" — the same shape generalGoalIdForVersion uses for the
+  // catch-all, and it carries the same caveat: were a Metic+/Archon to hand-create
+  // a goal titled exactly this, routing would reuse THEIR goal and its scope
+  // rather than the zero-scope bucket below. That needs an already-trusted actor,
+  // so it is a provenance wrinkle rather than a way in, and task 1003605 (BV1.R18)
+  // is where a real flag belongs when the feature gets its own column.
+  //
+  // No index backs (version_id, title): goals are per-version and few, and this
+  // runs once per homeless bug. Revisit with R18 if either stops being true.
+  const { rows: found } = await exec.query(
+    `SELECT ${GOAL_COLS} FROM goals WHERE version_id = $1 AND title = $2 LIMIT 1`,
+    [versionId, title]
+  );
+  if (found[0]) return found[0];
+
+  // created_by NULL — system-attributed, the migration-160 posture: this goal has
+  // no owner and inserts no member row, so Archons act as one.
+  //
+  // scope_modules is deliberately EMPTY, and that is the one thing to understand
+  // before changing this: a defect can land in any module, so a wall listing every
+  // module is the same as no wall while also lying about intent. The consequence is
+  // real and accepted — scopeIncludesProtected([]) is false, so a Metic+ filer's
+  // homeless bug takes no protected-scope floor and lands claimable. That is the
+  // SAME grant abuse-matrix row P1 already makes for a Metic+ bug in any unscoped
+  // goal; what is new is only that this goal is auto-created. The protections that
+  // remain are the ones that were carrying the weight anyway: the matrix's rank
+  // split (sub-Metic lands 'backlog', never 'ready') and createTask's own derived
+  // floor. Do not "fix" this by inventing a scope list — narrow the GRANT instead,
+  // and write down why.
+  const { rows: made } = await exec.query(
+    `INSERT INTO goals (version_id, title, description, scope_modules, status, created_by, sort_order)
+     SELECT $1, $2, $3, $4, 'open', NULL, COALESCE(MAX(sort_order) + 1, 0)
+       FROM goals WHERE version_id = $1
+     RETURNING ${GOAL_COLS}`,
+    [versionId, title,
+      `Where a reported defect lands when its reporter named no goal (ADR 0262). ` +
+      `Auto-created by the bug-routing path; task 1003605 (BV1.R18) owns the rest of ` +
+      `the maintenance-goal feature — the close-exempt flag and carrying open bugs ` +
+      `forward to the successor version.`,
+      MAINTENANCE_SCOPE_MODULES]
+  );
+  return made[0] || null;
+}
+
 // listVersionAdmissions (BV1.R07, task 1003594) — every goal admitted into ONE
 // version, newest first. ADR 0250 §3: "the overrides are counted and shown on the
 // version" — a visible counter is what keeps the exception honest, because an
@@ -844,6 +935,7 @@ async function listPendingRequestsForGoal(goalId, deps = {}) {
 
 module.exports = {
   acceptMembershipRequestAndAddMember,
+  ensureMaintenanceGoal,
   achieveGoalIfComplete,
   addGoalMember,
   addGoalScopeModules,

package/modules/lifecycle/db-versions.js

@@ -131,8 +131,38 @@ async function createVersion({ id, name, status = 'planning', track = 'product',
   });
 }
 
+// currentBuildingVersionId — the version new work defaults into, or null when
+// none is open (task 1003691, ADR 0262). Consumed by the bug-routing path, which
+// has to name a version BEFORE it has a goal and so cannot derive one from the
+// goal the way every other routed filing does.
+//
+// THE TIEBREAK IS NOT NEW. More than one version may sit at 'building' — ADR 0250
+// D5 closes the PLANNING slot only, and refusing a second building version is
+// still unshipped work (task 1003606, BV1.R19) — so a rule was needed, and the
+// project already has one: scripts/gds/version-select.js pickDefaultVersion,
+// extracted to end nine hardcoded version literals and pinned by
+// tests/version_literals.mjs. This is that rule in SQL: building only, most
+// recently started first, a null started_at sorting LAST so a half-filled row
+// cannot decide the answer, and `id` breaking a remaining tie so the result is
+// deterministic rather than whatever the planner returns.
+//
+// Returns null rather than guessing when nothing is building — the caller must
+// fail closed, because inventing a version is how the 1000771 bug (every Discord
+// report filed into a SHIPPED version's catch-all) happened in the first place.
+async function currentBuildingVersionId(deps = {}) {
+  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
+  const { rows } = await exec.query(
+    `SELECT id FROM versions
+      WHERE status = 'building'
+      ORDER BY started_at DESC NULLS LAST, id
+      LIMIT 1`
+  );
+  return rows[0] ? rows[0].id : null;
+}
+
 module.exports = {
   createVersion,
+  currentBuildingVersionId,
   getVersion,
   listVersions,
   versionProgress,

package/modules/lifecycle/db.js

@@ -63,13 +63,14 @@ const {
   singleRungPromotionError,
   xenosClaimAllowed,
 } = require('./db-rank-authz.js');
-const { createVersion, getVersion, listVersions, versionProgress, versionsWithStatus } = require('./db-versions.js');
+const { createVersion, currentBuildingVersionId, getVersion, listVersions, versionProgress, versionsWithStatus } = require('./db-versions.js');
 const {
   acceptMembershipRequestAndAddMember,
   achieveGoalIfComplete,
   addGoalMember,
   addGoalScopeModules,
   createGoal,
+  ensureMaintenanceGoal,
   createMembershipRequest,
   getGoal,
   getGoalAdmission,
@@ -217,7 +218,9 @@ module.exports = {
   versionProgress,
   versionsWithStatus,
   createVersion,
+  currentBuildingVersionId,
   createGoal,
+  ensureMaintenanceGoal,
   getGoal,
   getGoalAdmission,
   listVersionAdmissions,

package/modules/lifecycle/goal-advisory.js

@@ -27,6 +27,22 @@ function generalGoalTitle(versionId) {
   return `${versionId} — general`;
 }
 
+// The per-version MAINTENANCE goal — where a defect against already-shipped work
+// lands when the reporter named no goal (task 1003691, ADR 0262). Same em-dash
+// rule as generalGoalTitle above, and the same reason: the title IS the lookup
+// key (there is no boolean column), so an ASCII hyphen or an en dash silently
+// creates a second, ordinary goal instead of matching this one.
+//
+// DELIBERATELY NOT the "<version> — general" catch-all. That bucket is what BV1.R11
+// (task 1003598) began deleting after 53 open tasks accumulated in two of them
+// unread; the maintenance goal is the honest home task 1003605 (BV1.R18) designs
+// for exactly this work. This constant is the half R18 and the bug-routing path
+// share — R18 still owns auto-creating it with every version, the close-exempt
+// flag, and carrying open bugs forward to the successor version on close.
+function maintenanceGoalTitle(versionId) {
+  return `${versionId} — maintenance`;
+}
+
 // adviseGoal — PURE, FAIL-OPEN. Returns null when the task has a real home, or the
 // advisory body when it does not. Three reasons, checked in order:
 //
@@ -177,4 +193,4 @@ async function buildGoalAdvisory({ db, versionId, task, hasCriterionLink = false
   }
 }
 
-module.exports = { adviseGoal, candidateGoals, generalGoalTitle, buildGoalAdvisory };
+module.exports = { adviseGoal, candidateGoals, generalGoalTitle, maintenanceGoalTitle, buildGoalAdvisory };

package/modules/lifecycle/lifecycle.js

@@ -43,6 +43,17 @@ module.exports = {
   // "which goal, on which version" is a lifecycle judgement and discord may not
   // import lifecycle (the one-way module rule).
   suggestGoalForCapture: (...a) => goalSuggest.suggestGoalForCapture(...a),
+  // ensureMaintenanceGoal + currentBuildingVersionId (task 1003691, ADR 0262):
+  // the home a REPORTED BUG gets when nobody named one. Consumer: the ideas
+  // routing transaction, which is the one filing path that must name a version
+  // BEFORE it has a goal — every other routed filing derives the version FROM the
+  // goal it was given. Both take `deps.client` so the find-or-create commits with
+  // the idea + task + lineage rows, or not at all.
+  //
+  // They live behind the port for the ordinary reason: `goals` and `versions` are
+  // lifecycle tables and the ideas module may not import lifecycle (ADR 0083).
+  ensureMaintenanceGoal: (...a) => db.ensureMaintenanceGoal(...a),
+  currentBuildingVersionId: (...a) => db.currentBuildingVersionId(...a),
 
   // --- work-tracking READS the staying-core read routes resolve --------------
   // public.js (the status surface): version/ship feed + grade trend.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.586",
+  "version": "1.19.587",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.586",
+      "version": "1.19.587",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.586",
+  "version": "1.19.587",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.586'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.587'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/filing_abuse_matrix.mjs

@@ -33,8 +33,12 @@
 //   F16 file through #bugs as an UNLINKED author               → an inbox row, never work
 //   F13 declare touches[] outside the goal to widen blast area → the real wall refuses
 //   F14 file against a SHIPPED version's goal                  → refused (version not building)
+//   F17 get a keyword-guessed 'bug' from #ideas to mint work   → cannot: vector not trusted
+//   F18 forge/omit the vector to reach the homeless-bug door   → fail-closed, an inbox row
+//   F19 file a homeless NON-bug hoping for a free home         → inbox; only bugs get one
 //   P1  a Metic+ files a bug in an ordinary goal               → 'ready' (the C1 grant)
 //   P2  a Metic+ files into protected scope                    → allowed, floored to metic
+//   P3  a Metic+ files a HOMELESS bug from a trusted vector    → 'ready', in the maintenance goal
 //
 // AND THE ANTI-DRIFT PIN (the point of the file, really). The rows above are true
 // of the capture vectors that exist TODAY. Nothing stops a fifth being added
@@ -337,6 +341,101 @@ await test('[F16] an unlinked #bugs author gets an inbox row and CANNOT reach wo
   const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
   assert.match(code, /if \(builder\) \{[\s\S]{0,200}suggestGoalForCapture/,
     'a goal is only ever sought for a LINKED builder');
+
+  // ADR 0262 REOPENED THIS AND IT HAD TO BE CLOSED AGAIN — a grader blocker on
+  // task 1003691, and the reason the vector is CONDITIONAL at the call site.
+  //
+  // The rows above pass a rank but no VECTOR, so they kept passing while the real
+  // path had already changed: #bugs briefly set `vector: 'discord-bugs'`
+  // unconditionally, which meant an unlinked poster (filerRank null, goalId null —
+  // the goal is only sought `if (builder)`) took the homeless-bug branch and minted
+  // a real backlog task. Worse, the rolling rate cap is counted per builder id and
+  // so does not run at all for them: unattributed task creation at no cost.
+  //
+  // Both halves are pinned now — the decision, and the call site that feeds it.
+  assert.equal(
+    decideLanding({ goalId: null, kind: 'bug', filerRank: null, vector: 'discord-bugs' }).route,
+    true,
+    'sanity: the vector DOES open the homeless branch, so the gate below is what protects it'
+  );
+  assert.match(code, /vector:\s*builder\s*\?\s*'discord-bugs'\s*:\s*null/,
+    'the trusted vector is claimed ONLY for a linked builder — never the bare string');
+  assert.ok(!/vector:\s*'discord-bugs'\s*,/.test(code),
+    'an unconditional vector here is the blocker this row exists to catch');
+});
+
+// =========================================================================
+// F17–F19 + P3 — the HOMELESS-BUG door (task 1003691, ADR 0262)
+//
+// ADR 0262 opened one new way for a filing to become work: a kind='bug' with NO
+// goal now routes to the version's maintenance goal instead of parking in the
+// inbox. A new door is a new attack surface, so it gets its own rows.
+//
+// THE ATTACKER'S BEST MOVE HERE is not rank — it is the VECTOR. #ideas passes no
+// kind, so inbox.classify() guesses one from keywords, and its bug pattern fires
+// on fix/broken/bug/crash/error anywhere in the text. If the kind alone opened the
+// door, "we should fix the copy on the landing page" would mint a task, and ADR
+// 0234's owner-interview decision ("#ideas files with HINTS only, never routes")
+// would be dead without anyone deciding to kill it.
+// =========================================================================
+
+await test('[F17] a keyword-guessed bug from #ideas still cannot mint work', () => {
+  // The guess is real: prove the classifier does fire, then prove it buys nothing.
+  const inbox = require('../modules/ideas/inbox.js');
+  for (const text of ['we should fix the copy on the landing page',
+    'the onboarding flow feels broken to me',
+    'error messages could be friendlier']) {
+    assert.equal(inbox.classify(text, ''), 'bug', `classifier guesses bug for: ${text}`);
+  }
+  // …and #ideas's vector is not on the allowlist, so every one of them is an inbox row.
+  assert.deepEqual(
+    decideLanding({ goalId: null, kind: 'bug', filerRank: 'archon', vector: 'discord-ideas' }),
+    { route: false, reason: 'no_goal' },
+    'ADR 0234 holds: #ideas files hints, never work'
+  );
+});
+
+await test('[F18] the vector fails CLOSED — forged, absent or unknown never opens the door', () => {
+  for (const vector of [undefined, null, '', 'api ', 'API', 'discord_bugs', 'cli',
+    'internal', 'trusted', true, 1, {}, ['api']]) {
+    assert.equal(
+      decideLanding({ goalId: null, kind: 'bug', filerRank: 'archon', vector }).route,
+      false,
+      `vector ${JSON.stringify(vector)} must not route`
+    );
+  }
+  // The allowlist is exactly two members, and both are server-set at their call
+  // site — never read from a request body, which is what makes forging it a
+  // non-move rather than a merely-hard one.
+  assert.deepEqual([...routing.HOMELESS_ROUTING_VECTORS].sort(), ['api', 'discord-bugs']);
+  const routeSrc = read('modules/ideas/routes/inbox.js');
+  assert.match(routeSrc, /vector: 'api'/, 'the route hardcodes its own vector');
+  assert.ok(!/vector:\s*body\.|vector:\s*req\.body/.test(routeSrc),
+    'and never takes it from the request body');
+});
+
+await test('[F19] only a BUG gets a free home — every other homeless kind stays in the inbox', () => {
+  // Otherwise the door empties the inbox by fabricating homes for work that
+  // genuinely has none, which is the opposite of what ADR 0262 decided.
+  for (const kind of ['feature', 'cleanup', 'refactor', 'infra', 'spike',
+    'learning-capture', 'blocker-resolution', 'unclassified',
+    'criterion-proposal', 'decision']) {
+    assert.equal(
+      decideLanding({ goalId: null, kind, filerRank: 'archon', vector: 'api' }).route,
+      false,
+      `kind ${kind}`
+    );
+  }
+});
+
+await test('[P3] a Metic+ homeless bug IS claimable — the grant the door exists for', () => {
+  const d = decideLanding({ goalId: null, kind: 'bug', filerRank: 'metic', vector: 'api' });
+  assert.equal(d.route, true);
+  assert.equal(d.status, 'ready', 'no triage stop between reported and in the queue (C1)');
+  assert.equal(d.homeless, true, 'and it is flagged, so the transaction knows to resolve a home');
+  // A sub-Metic gets the same door but not the same speed.
+  assert.equal(decideLanding({ goalId: null, kind: 'bug', filerRank: 'xenos', vector: 'api' }).status,
+    'backlog');
 });
 
 // =========================================================================