@bongos/core 1.19.586 → 1.19.588

package/docs/adr/README.md

@@ -353,3 +353,5 @@ This keeps the decision history honest and traceable.
 | 0259 | [**A project’s departure from the public list is public, and the copy says so** ([task 1003672](https://cloudbongos.com/builders#/task/1003672) · goal 1000046 — *Project creation*). Decides the leak [ADR 0255](<redacted>.md) §6.2 deliberately filed rather than implied fixed. The public projects feed publishes a named list plus a count of anonymous rows, so when a project flips to stealth its named row LEAVES the identified block while the count RISES BY ONE — *“Mercury is gone, and there is one more black hole”* names it, and the moment, from a single diff of two snapshots. **Everything [ADR 0182](<redacted>.md) D2a does is defeated by it**, because the identity was never carried ON the anonymous row (`STEALTH_ANONYMOUS_KEEPS` is an allow-list precisely so a column added next year is anonymous by default) — it is carried by the ABSENCE of the named row that used to sit beside it. **Larger than the channel 0255 closed**, which needed repeated sampling and correlation; this one is exact and needs two reads. No `ORDER BY` change touches it: it is inherent in publishing a named list at all, so every fix is a product decision with a visible cost and the owner’s call, not a builder’s. **Decision: accept it, and make the copy say so.** Two reasons it is the right end of the trade and not merely the cheapest — (1) it is ALREADY the honest reading of the existing promise, since D2a made existence and count public *by design*, and a count that is public and truthful is a count whose CHANGES are public; (2) both alternatives damage the control they defend. A **delay window** means the owner clicks the privacy setting and is not private yet *without knowing it*, converting an information leak into a false belief — strictly worse, and the wrong direction for a privacy control. **Decoys** spend the count’s truthfulness (it is truthful today) on a guarantee that is still only probabilistic, and a decoy scheme needs some way to tell padding from real rows — the exact stable per-project key D2a forbids. The promise stealth actually keeps is about the project’s CONTENTS, not the TRANSITION: an anonymous row stays anonymous (no name, tagline, art, origin, or key surviving to the next snapshot); what is not private is stepping off a published list readers may keep copies of. So the copy — which read *“its name, and everything else about it, stay yours”*, every clause true and the paragraph as a whole overselling, because a reader takes it to cover the switch — now names the boundary in BOTH places an owner meets the setting (the choice’s blurb and the what-changes fold), in the plain register 0182’s interview fixed for this card. **A privacy control that oversells is worse than one that admits a limit**, the same standard 0255 §6 set for itself. **No behaviour changes** in `projects-feed.js` — the feed, the redaction allow-list and the keyed rotating permutation are decided FINISHED, not insufficient. `tests/projects_hub.mjs` pins the sentence in both surfaces (the copy IS the fix, so a future edit tightening the blurb must not quietly drop it) and re-applies the no-space-metaphor ban to it. Carries 0255 §6.3’s smaller residual so both live in one place: within one 24h epoch the permutation is stable, so same-day snapshots tell black holes apart (not name them) — accepted on the same reasoning, since the fix is a per-request permutation, which breaks pagination exactly as `ORDER BY random()` was rejected for. Guards recorded for any future attempt: no stable per-project key on an anonymous row, and no anonymous ordering an observer can predict or correlate. Rejected: the delay; decoys; dropping the named list (protects a privacy nobody asked for at the cost of the feature); and saying nothing, which is the failure mode this closes.](<redacted>.md) | platform-identity / privacy boundary / copy honesty |
 | 0260 | [**An application IS the consent, and the hub’s own echo is the gate** ([task 1002972](https://cloudbongos.com/builders#/task/1002972) · goal 1000045, criterion C4). Privacy spec **D7** asks that a reviewer see what the applicant’s OWN profile rules would already show, evaluated LIVE at review time. The rule is ONE port composing the two EXISTING views — `getPublicProfileExtras` for a public account, `recruiter-sliver`’s own `sliverShapeFor` for a private one — because a third five-key lookalike **is** the new disclosure class D7 forbids. **The one deliberate difference from the D3 sliver:** `getRecruiterSliver` floors on recruiting REACH, and reusing it verbatim would be wrong in the direction that looks safe — `recruiter_discoverable` defaults to FALSE for a private account, so a private builder who deliberately applied would show their reviewer NOTHING and C4 would be satisfied by an empty box. D7 settles it: *“applying is an explicit act”*. The swap relaxes REACH only; `accountActiveSql` (active **and** terms accepted) and `hide_stats` still floor it, and the proof asserts both directions on the same account so the tempting refactor cannot pass quietly. **The federated route’s gate is the whole security story** ([ADR 0205](<redacted>.md) / security report 1000027): client credentials name a PROJECT and never a person, so `POST /sso/applicant-profile` authenticated alone is a bulk disclosure oracle over every account on the platform, private ones included. `applicationBacksProfileRead` demands a HUB-WRITTEN echo for exactly (this account, this client) inside the same 30-day window — a row only the hub’s own join relay creates — refusing **404, never 403**, and BEFORE any account is read (asserted on the statement log, because a gate that refuses after reading has already done the disclosure work). LIVE means nothing is stored at either end; the queue keys on the VOUCH and never on `github_login` (the one PUBLIC unauthenticated write makes an unvouched login an impersonation surface); and the hub client secret stays in core behind a narrow doorway port. **The path is complete but DORMANT until R09 ([task 1002285](https://cloudbongos.com/builders#/task/1002285)) ships the vouch writer** — nothing writes `applicant_github_id` today, and that dependency was missing from 1002972’s graph. Rejected: routing the port through `getRecruiterSliver`, a snapshot at apply time, resolving by `github_login`, and putting `loadIdpConfig` on the doorway.](<redacted>.md) | platform identity / privacy |
 | 0261 | [**A preselect always carries a reason; the bundle’s summary is the floor** ([task 1003684](https://cloudbongos.com/builders#/task/1003684) · goal 1000046 — *Project creation*). Resolves a collision between two rules that were each right alone. [ADR 0243](<redacted>.md) made `adjustments` a **delta** — a team-shape rule that fires without moving anything claims nothing, because a sentence explaining a change that did not happen is a claim the owner cannot check. [ADR 0237](<redacted>.md) says a preselect the owner cannot see a reason for is one they must audit, which is worse than no preselect at all. The two collide whenever a type’s bundle **already contains** what a rule would add: `game` is `[dev-box, discord]` and the `small-team` rule adds `dev-box`, so the rule fires, moves nothing, and correctly reports `adjustments: []`. Confirmed on live core 1.19.580 — `byTeamShape[small-team]` = `{"bundle":["dev-box","discord"],"adjustments":[]}`. The owner then reached step 4 and saw **two extras switched on with no reason beside them**, `#modWhy` an empty hidden div: exactly what 0237 exists to prevent, produced by 0243 behaving correctly. Filed as a dropped adjustment; it was not — the engine is right, and the panel simply had ONE voice and fell silent when the rule had nothing to say. **Decision: the why-line has two voices and the type’s is the floor.** A real adjustment still speaks for itself and is never displaced; when none moved, the type’s own curated `summary` explains the preselect; when the owner has answered the picker themselves the panel stays silent (unchanged — a reason handed back for a toggle they just flipped reads as the panel arguing with them); a bundle with no summary still says nothing, because a floor is not an invention. **No new copy, endpoint or field** — the summary was authored for this job in `starter-bundles.js`, served on every row of `GET /provisioning/starter-bundles`, and rendered NOWHERE in the product until now. 0243 is not weakened: the delta stays a delta and no rule is credited with a change it did not make. The pin `tests/projects_hub_module_picker.mjs` carried a fixture with **no `summary` field**, which made four “no adjustment, no sentence” cases pass for the wrong reason; the fixture now carries the real summaries and those cases assert the new contract, including explicitly that no RULE sentence is invented for a change that did not happen. Rejected: making the rule claim a no-op change (re-introduces the unverifiable claim 0243 removed); widening the bundles so no rule is ever redundant (contorts curated presets for a rendering concern, and the redundancy returns on the next edit); and leaving it silent, declined by the owner once the trade-off was put to them directly.](<redacted>.md) | provisioning / starter bundles / owner-facing copy |
+| 0262 | [**A bug never lands in the inbox: the system names the home the reporter didn't** ([task 1003691](https://cloudbongos.com/builders#/task/1003691) · goal 1000086 — *Strict versioning*). `routing.js` returned early on a goal-less filing, so its own `kind='bug'` hard-land branch was UNREACHABLE without a goal — `kind` only ever chose a routed task's STATUS, never whether it routed — and a reported defect sat in `idea_inbox` awaiting the triage pass criterion C1 exists to remove. The premise that [ADR 0250](<redacted>.md) D4 and [ADR 0235](<redacted>.md) contradict each other is FALSE: 0235's exemption is an advisory silence in `goal-advisory.adviseGoal`, and its actual decision already requires a real `goal_id`. So nothing is amended; this is the explicit decision 0235 §6 said would be needed. **D1** a homeless bug gets the version's MAINTENANCE goal (R18's design), find-or-created under an advisory lock inside the route's own transaction — not the catch-all R11 is deleting, and adding no `allowCatchAll` caller. **D2** the gate is the VECTOR (`api`, `discord-bugs`), not the kind: `#ideas` passes no kind, so the classifier guesses one from keywords, and gating on kind alone would silently overturn [ADR 0234](<redacted>.md)'s owner-interview decision. Rejected: goal-less bug tasks (breaks D4 a day after it landed); rejecting the filing (Discord cannot retry, so the report is lost); the catch-all (repopulates the bucket being drained); building R18 whole first.](<redacted>.md) | work intake / idea routing / the version-goal invariant |
+| 0263 | [**How a version closes: auto, early, roll-forward, and the maintenance exemption** ([task 1003593](https://cloudbongos.com/builders#/task/1003593) · goal 1000086 — *Strict versioning*). [ADR 0250](<redacted>.md) D5 decided a version *can* close; this is the design pass that makes its five build tasks mechanical, so they do not each invent their own refusal codes and payload shapes and meet only in production. **The asymmetry that shrinks the feature:** auto-close fires when the last non-maintenance goal achieves — so by construction every non-maintenance goal is already closed and the set needing a disposition is EMPTY. All the machinery (the disposition map, the refusal that returns the goals, successor lineage) belongs to EARLY close alone; R16 is small and R12 carries the weight. **Auto-close hangs off BOTH achievement writers** (`db-goals.achieveGoalIfComplete` and the `done-when` cascade — the deliberate duplicate D2 already governs, a require cycle being the reason they are not one helper), on the caller `exec` so it sees the ship's uncommitted flip, and **may never fail a ship**: wrapped and swallowed like `closeCompletedWorkForShip`, idempotent under `WHERE status='building'`, so a failure leaves a version un-closed (self-healing on the next reconciler sweep) and never half-closed. **Early close** is the R10 archive two-step verbatim in spirit — refuse with `version_holds_open_goals` **returning the goals**, then proceed with a per-goal `roll_forward`/`abandon` map and a required `reason`; six named codes, because the callers are agents. **Two briefs are corrected by measurement:** the lineage column is `succeeded_by_goal_id` (migration 160, on the OLD row pointing forward) — not the `succeeds_goal_id` both 0250 and R17's brief name, so R17 needs NO migration; and R18's `is_maintenance` flag is load-bearing rather than cosmetic, because answering the close count with a `title NOT LIKE` would let a hand-titled goal silently exempt itself from the gate that decides when a VERSION closes. Promotion runs inside the close txn and BEFORE roll-forward (`ensureMaintenanceGoal` returns null for a non-`building` version, so a carry-over run first silently carries nothing); zero planning versions is not an error; R19's one migration should carry the `building` AND `planning` partial unique indexes so the promotion race resolves like a 23505 rather than a prayer. Rejected: auto-creating the successor version inside a close (the "fake hotfix version" escape hatch 0250 built the override counter to prevent), writing `limitations/<version>-shipped.md` from the route (file I/O in a ship transaction — it stays R23's CLI work), and a version reopen.](<redacted>.md) | version lifecycle / scope closure |

package/docs/module-api-changelog.md

@@ -1621,5 +1621,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.584 with no explicit bump. run 34165392436. (task 1002620)
   1.19.586 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.585 with no explicit bump. run 34167072966. (task 1002620)
+  1.19.587 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.586 with no explicit bump. run 34172785860. (task 1002620)
+  1.19.588 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.587 with no explicit bump. run 34178696372. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/discord/discord-bugs.js

@@ -248,6 +248,22 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
       filerRank,
       goalId: goal ? goal.id : null,
       suggestedPriority: 3,
+      // task 1003691 (ADR 0262): the trusted-vector claim, and it is claimed ONLY
+      // FOR A LINKED BUILDER — `builder &&`, not the bare string.
+      //
+      // This channel earns the vector through guard 2 and guard 3 above, and both
+      // are identity-bound: the rank-aware landing needs a rank, and the rolling
+      // rate cap is counted per builder id. An UNLINKED author has neither. Handing
+      // them the vector unconditionally would let anyone who can post here mint
+      // unattributed backlog tasks at no cost — breaking guard 1's promise at the
+      // top of this file ("an unlinked author cannot inject claimable work... it no
+      // longer mints anything"), which is the security property ADR 0047 bought.
+      //
+      // With no vector the filing falls back to the inbox exactly as it did before
+      // ADR 0262: the report is still kept, still re-hosts its images, and still
+      // reaches a human through triage. Nothing is lost except the ability to write
+      // to the task table without an identity. Pinned as F16.
+      vector: builder ? 'discord-bugs' : null,
     };
 
     // THE HOME IS A SUGGESTION, NOT A CONDITION OF BEING HEARD. routeIdeaToGoal is
@@ -255,8 +271,13 @@ async function recordInboundBug({ discordUserId, content, imageUrls = [], messag
     // scope-wall verdict, a goal archived mid-flight — rolls the idea row back too
     // and the report is gone. That is the exact failure this task exists to end, and
     // it would be caused by a goal WE guessed at, not by anything the reporter did.
-    // So a refusal drops the guess and files the report homeless: it lands in the
-    // inbox for triage, which is strictly what would have happened before we tried.
+    // So a refusal drops the guess and re-files the report with no goal at all.
+    //
+    // Since task 1003691 that no longer means the inbox: a homeless bug from a
+    // trusted vector routes to the version's MAINTENANCE goal, so dropping a bad
+    // guess costs the reporter a triage pass rather than the whole report. A
+    // sub-Metic refused from a protected-scope goal therefore still gets a real
+    // task — at 'backlog', in an unscoped goal, with the protected goal untouched.
     let idea;
     try {
       idea = await deps.captureIdea(capture);

package/modules/discord/discord-inbound.js

@@ -189,6 +189,15 @@ async function recordInboundIdea({ discordUserId, content, imageUrls = [], messa
       // tests/filing_abuse_matrix.mjs, which greps this exact call for it).
       suggestedGoalId: hint ? hint.id : null,
       suggestedVersion,
+      // task 1003691 (ADR 0262): named EXPLICITLY so this vector's exclusion is a
+      // written fact rather than an absence someone has to notice. '#ideas' is not
+      // on routing.HOMELESS_ROUTING_VECTORS, so a filing here NEVER becomes a task
+      // — which is ADR 0234's owner-interview decision ("#ideas files with hints
+      // only, never routes"), and the reason it holds even now that a homeless bug
+      // routes elsewhere: the kind here is a KEYWORD GUESS (inbox.classify fires
+      // 'bug' on fix/broken/crash), and a guess must not mint work. Bug reports
+      // from Discord have their own channel, #bugs, which does route.
+      vector: 'discord-ideas',
     });
 
     await auditDiscordBot(deps, {

package/modules/ideas/homeless-home.js

@@ -0,0 +1,51 @@
+'use strict';
+
+// modules/ideas/homeless-home.js — WHERE A REPORTED BUG GOES WHEN NOBODY NAMED A
+// GOAL (task 1003691, [ADR 0262](../../docs/adr/0262-a-bug-never-lands-in-the-inbox.md)).
+//
+// THE PROBLEM THIS ANSWERS. routing.decideLanding returned early on a goal-less
+// filing, which made its own kind==='bug' branch unreachable without a goal: a
+// reported defect parked in idea_inbox waiting for the triage pass criterion C1
+// exists to remove. Letting bugs route required answering "route into WHAT", and
+// that answer is here.
+//
+// THE ANSWER IS THE VERSION'S MAINTENANCE GOAL, and deliberately NOT the
+// "<version> — general" catch-all. The catch-all is what BV1.R11 (task 1003598)
+// began deleting after 53 open tasks accumulated in two of them unread, and
+// db-tasks.js warns against a third caller of its opt-out hatch. The maintenance
+// goal is the home task 1003605 (BV1.R18) designs for exactly this — "where a
+// defect against already-shipped work lands" — so a homeless bug gets a REAL,
+// open goal and ADR 0250 D4 ("every task belongs to a goal") holds intact.
+//
+// ITS OWN FILE because inbox.js sits at the fitness line cap with no headroom, and
+// because the concept deserves a name: this is one question ("what home does a
+// homeless bug get") with one answer, and a reader looking for it should find a
+// file rather than a paragraph inside a transaction.
+
+// resolveHomelessHome — the goal id a homeless bug lands in, or a thrown refusal.
+//
+// TWO PROPERTIES, both load-bearing:
+//
+//   * IT RUNS ON THE CALLER'S TRANSACTION CLIENT. Both port calls take it, so the
+//     find-or-create commits with the idea + task + lineage rows or not at all. A
+//     goal created on its own connection would outlive a rolled-back route as an
+//     empty goal nobody asked for.
+//   * IT FAILS CLOSED. No building version, or a version whose maintenance goal
+//     cannot be made, means there is nowhere honest to file — so it refuses rather
+//     than inventing a version. Filing a defect into a version not open to work is
+//     idea 1000771's exact failure (every Discord report entombed in a shipped
+//     version's catch-all), and this path exists to end that, not to repeat it.
+//
+// It resolves the VERSION first, which inverts the usual order: every other routed
+// filing reads the version off the goal it was handed. There is no goal here yet,
+// so the version has to come first — and once this returns, everything downstream
+// runs unchanged against a real goal id.
+async function resolveHomelessHome(lifecycle, client) {
+  const versionId = await lifecycle.currentBuildingVersionId({ client });
+  if (!versionId) throw { code: 'NO_BUILDING_VERSION' };
+  const home = await lifecycle.ensureMaintenanceGoal(versionId, { client });
+  if (!home) throw { code: 'NO_MAINTENANCE_GOAL', version_id: versionId };
+  return home.id;
+}
+
+module.exports = { resolveHomelessHome };

package/modules/ideas/inbox.js

@@ -20,6 +20,8 @@ const { pool } = api;
 // The landing matrix (task 1003065, BV1.R01) — pure, DB-free, its own file so
 // every cell is unit-testable without a Postgres. See ./routing.js.
 const { decideLanding, authorizeRoutedLanding, routedPriority } = require('./routing');
+// The home a goal-less bug lands in (task 1003691, ADR 0262).
+const { resolveHomelessHome } = require('./homeless-home');
 
 const VALID_KINDS = [
   'feature',
@@ -247,6 +249,9 @@ async function captureIdea({
   // anything). Ignored when `goalId` is already set, so every existing caller
   // is untouched.
   suggestedGoalId = null,
+  // WHICH DOOR this filing came through; absent is UNTRUSTED and stays an inbox
+  // row. Read by one rule — see routing.HOMELESS_ROUTING_VECTORS (ADR 0262).
+  vector = null,
 }, deps = {}) {
   if (!title || typeof title !== 'string') {
     throw { code: 'TITLE_REQUIRED' };
@@ -264,7 +269,7 @@ async function captureIdea({
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
 
   // The decision, before any write. Pure — see ./routing.js.
-  const landing = decideLanding({ goalId, kind: resolvedKind, grade, filerRank });
+  const landing = decideLanding({ goalId, kind: resolvedKind, grade, filerRank, vector });
   if (landing.route) {
     return routeIdeaToGoal({
       title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority,
@@ -315,6 +320,23 @@ async function routeIdeaToGoal({
   try {
     await client.query('BEGIN');
 
+    // The `lifecycle` PORT, resolved ONCE up here because two steps need it: the
+    // homeless-bug home at (a0) and the task insert at (c). Never an import of
+    // modules/lifecycle/ — the one-way module rule, ADR 0083.
+    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
+    if (!lifecycle || !lifecycle.createTask) {
+      // A vanilla instance without the lifecycle module cannot hold tasks at all,
+      // so there is nothing to route INTO. Refuse loudly rather than silently
+      // degrading to an inbox row the caller was told became a task.
+      throw { code: 'LIFECYCLE_UNAVAILABLE' };
+    }
+
+    // a0. A homeless bug gets the version's maintenance goal — ./homeless-home.js
+    //     says why that goal and not the catch-all, and why it fails closed.
+    const effectiveGoalId = landing.homeless
+      ? await resolveHomelessHome(lifecycle, client)
+      : goalId;
+
     // a. The goal must be a REAL, LIVE HOME. All three checks are inside the
     //    transaction and the row is locked FOR SHARE, so a goal cannot be
     //    archived out from under a route that is mid-flight.
@@ -330,17 +352,17 @@ async function routeIdeaToGoal({
          JOIN versions v ON v.id = g.version_id
         WHERE g.id = $1
         FOR SHARE OF g`,
-      [goalId]
+      [effectiveGoalId]
     );
-    if (goalRows.length === 0) throw { code: 'GOAL_NOT_FOUND', goal_id: goalId };
+    if (goalRows.length === 0) throw { code: 'GOAL_NOT_FOUND', goal_id: effectiveGoalId };
     const goal = goalRows[0];
     if (goal.status !== 'open') {
-      throw { code: 'GOAL_NOT_OPEN', goal_id: goalId, status: goal.status };
+      throw { code: 'GOAL_NOT_OPEN', goal_id: effectiveGoalId, status: goal.status };
     }
     if (goal.version_status !== 'building') {
       throw {
         code: 'VERSION_NOT_BUILDING',
-        goal_id: goalId,
+        goal_id: effectiveGoalId,
         version_id: goal.version_id,
         version_status: goal.version_status,
       };
@@ -357,7 +379,7 @@ async function routeIdeaToGoal({
                $7, now())
        RETURNING ${IDEA_COLS}`,
       [title, bodyMd, resolvedKind, suggestedVersion, suggestedPriority, capturedBy,
-        goalId]
+        effectiveGoalId]
     );
     const idea = ideaRows[0];
 
@@ -384,7 +406,7 @@ async function routeIdeaToGoal({
     if (!authorized.ok) {
       throw {
         code: 'ROUTE_NOT_AUTHORIZED',
-        goal_id: goalId,
+        goal_id: effectiveGoalId,
         gate: authorized.code,
         reason: authorized.reason,
         details: authorized.details ?? null,
@@ -399,10 +421,10 @@ async function routeIdeaToGoal({
     //    The version is the GOAL'S, never a caller-supplied one, so
     //    "goal belongs to the version" is true by construction rather than by
     //    validation. (An idea's own `suggested_version` is kept on the idea row
-    //    as filed and does NOT override it — the goal is the binding home.) One
-    //    read stays outside this transaction by design: createTask's catch-all
-    //    goal fallback, which only runs when goalId is absent and so never on
-    //    this path.
+    //    as filed and does NOT override it — the goal is the binding home.)
+    //    createTask's catch-all fallback still never fires here: a goal is always
+    //    set by this line, named by the filer or resolved at (a0), so this path
+    //    never opts out of the goal requirement (task 1003691, ADR 0262).
     //
     //    `requiresRank` is passed ONLY as the R05 protected-scope floor computed
     //    above — never from anything the filer said. createTask still derives its
@@ -411,13 +433,6 @@ async function routeIdeaToGoal({
     //    default — createTask auto-assigns the capped suggestion) and
     //    `discipline` (left 'unclassified', exactly as the other non-authored
     //    create vectors leave it).
-    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
-    if (!lifecycle || !lifecycle.createTask) {
-      // A vanilla instance without the lifecycle module cannot hold tasks at all,
-      // so there is nothing to route INTO. Refuse loudly rather than silently
-      // degrading to an inbox row the caller was told became a task.
-      throw { code: 'LIFECYCLE_UNAVAILABLE' };
-    }
     const task = await lifecycle.createTask({
       versionId: goal.version_id,
       title,

package/modules/ideas/routes/inbox.js

@@ -148,6 +148,12 @@ module.exports = function buildInboxRouter() {
         goalId: body.goal_id ?? null,
         filerRank: req.builder?.rank ?? null,
         grade,
+        // task 1003691 (ADR 0262): the vector, hardcoded — NEVER read from the
+        // body. This route is the authenticated API door, so a bug filed here
+        // with no goal routes to the version's maintenance goal instead of
+        // parking in the inbox. Letting a caller name their own vector would
+        // hand every untrusted door the same power by typing one word.
+        vector: 'api',
       });
       let grade_warning;
       if (grade === 'full') {
@@ -272,6 +278,17 @@ module.exports = function buildInboxRouter() {
           // filer the way through: file it without a goal.
           err.code === 'ROUTE_NOT_AUTHORIZED' ? 403 :
           err.code === 'LIFECYCLE_UNAVAILABLE' ? 503 :
+          // task 1003691 (ADR 0262) — the HOMELESS-bug refusals. Both are 503 and
+          // NOT 4xx, because unlike every refusal above them they are not the
+          // filer's mistake and there is nothing they can change to get through:
+          // the filer named no goal (which is now the supported way to report a
+          // bug), and the project simply has no version open to work or no
+          // maintenance goal that can be made in it. That is a server-state
+          // problem an operator fixes, so it reads like LIFECYCLE_UNAVAILABLE
+          // beside it — a 400 would tell the reporter to correct a request that
+          // was correct.
+          err.code === 'NO_BUILDING_VERSION' ? 503 :
+          err.code === 'NO_MAINTENANCE_GOAL' ? 503 :
           500;
         return res.fail(err.code, status, { ...err });
       }

package/modules/ideas/routing.js

@@ -54,6 +54,32 @@ const METIC_PLUS = new Set(['metic', 'archon']);
 // 'quick' carry no such meaning and route normally.
 const NEVER_ROUTE_GRADE = 'full';
 
+// The vectors a HOMELESS bug may route from (task 1003691, ADR 0262). This is an
+// ALLOWLIST and the default is exclusion: a filing whose vector is absent or
+// unrecognised never routes without a goal, which is what keeps the homeless
+// branch below from becoming a second door into the queue.
+//
+// WHY THE VECTOR AND NOT THE KIND ALONE — the whole reason this set exists.
+// `kind` is not always a claim a human made. Discord #ideas passes no kind at
+// all, so inbox.classify() GUESSES one from keywords, and its bug pattern fires
+// on fix/broken/bug/crash/error anywhere in the text: "should we fix the copy on
+// the landing page" classifies as a bug. Routing on kind alone would let that
+// keyword guess mint work, which is exactly the ADR 0234 owner-interview
+// decision — "#ideas files with HINTS only, never routes" — that this task was
+// explicitly told to keep (pinned as F12 in tests/filing_abuse_matrix.mjs).
+//
+// Both members carry a human or a channel that means "this is broken":
+//   'api'           — POST /inbox, an authenticated builder naming the kind. This
+//                     is also how `scripts/gds/capture.js` files (it posts to the
+//                     route rather than calling this module), so the CLI inherits
+//                     it and needs no member of its own.
+//   'discord-bugs'  — the #bugs channel, where the CHANNEL is the classification
+//                     (modules/discord/discord-bugs.js forces kind='bug'), and
+//                     which already carries a rate cap + an unlinked-author guard.
+// 'discord-ideas' is deliberately ABSENT: it is an ideation channel, and the bug
+// reports that belong to Discord already have #bugs.
+const HOMELESS_ROUTING_VECTORS = new Set(['api', 'discord-bugs']);
+
 // decideLanding — the matrix, as one pure function.
 //
 // Returns { route: false, reason } when the thing belongs in the inbox, or
@@ -65,11 +91,47 @@ function decideLanding(input) {
   // a caller spreading an absent object hands over — would throw. A landing
   // decision that CRASHES is the worst of the three outcomes: it takes down the
   // capture that was supposed to fail closed. Normalise first, decide after.
-  const { goalId = null, kind = null, grade = null, filerRank = null } = input || {};
+  const { goalId = null, kind = null, grade = null, filerRank = null, vector = null } = input || {};
   // No goal named ⇒ the inbox is exactly right, and this is the DEFAULT PATH.
   // Every capture vector that never learns about goals keeps working unchanged;
   // routing is strictly additive (criterion C1 testable #5).
-  if (goalId == null || goalId === '') return { route: false, reason: 'no_goal' };
+  //
+  // THE ONE EXCEPTION: A BUG NEVER LANDS IN THE INBOX (task 1003691, ADR 0262).
+  // Until now this early return made the kind==='bug' branch below UNREACHABLE
+  // without a goal — `kind` only ever chose the routed task's STATUS, never
+  // whether it routed at all — so a reported defect sat in idea_inbox waiting for
+  // a human triage pass, which is the triage tax criterion C1 exists to remove.
+  //
+  // This does NOT re-open the goal-less task hole ADR 0250 D4 closed. A homeless
+  // bug is given a REAL, open goal — the version's maintenance goal, resolved by
+  // the caller (inbox.routeIdeaToGoal) — so "every task belongs to a goal" holds
+  // exactly as before. What changes is only WHO names it: the system, not the
+  // person reporting the defect. That is also what ADR 0235 already asked for:
+  // its "a fix needs no home to be filed correctly" is an ADVISORY exemption
+  // (goal-advisory.adviseGoal stays silent for a bug), and its actual decision is
+  // that a fix category IS kind='bug' on a task carrying a real goal_id.
+  //
+  // Fail-closed, in the posture of the rest of this file: the vector must be on
+  // the allowlist, the grade must not be a Full Idea (F8 — the Board Room's
+  // subject is never converted by its own filer), and an untrusted or absent rank
+  // still soft-lands at 'backlog' rather than reaching the claimable queue.
+  if (goalId == null || goalId === '') {
+    if (
+      HARD_LAND_KINDS.has(kind) &&
+      HOMELESS_ROUTING_VECTORS.has(vector) &&
+      String(grade || '').toLowerCase() !== NEVER_ROUTE_GRADE
+    ) {
+      // `homeless: true` is the instruction to the transaction: resolve the
+      // version's maintenance goal before the goal read. It is a separate field
+      // rather than an inferred `goalId == null` so the intent survives into the
+      // caller and into the tests, and so a future landing that happens to carry
+      // no goal cannot silently inherit the maintenance-goal behaviour.
+      return METIC_PLUS.has(String(filerRank || '').toLowerCase())
+        ? { route: true, status: 'ready', homeless: true, reason: 'bug_homeless_trusted_filer' }
+        : { route: true, status: 'backlog', homeless: true, reason: 'bug_homeless_awaiting_nod' };
+    }
+    return { route: false, reason: 'no_goal' };
+  }
 
   if (String(grade || '').toLowerCase() === NEVER_ROUTE_GRADE) {
     return { route: false, reason: 'full_idea_never_routes' };
@@ -228,5 +290,6 @@ module.exports = {
   DEFAULT_ROUTED_PRIORITY,
   HARD_LAND_KINDS,
   NEVER_ROUTE_KINDS,
+  HOMELESS_ROUTING_VECTORS,
   METIC_PLUS,
 };

package/modules/lifecycle/db-goals.js

@@ -15,6 +15,7 @@ const { pool } = api;
 const doneWhen = require('./done-when.js');
 const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { nonTerminalSql } = require('./task-status');
+const { maintenanceGoalTitle } = require('./goal-advisory.js');
 const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 // -------------------------------------------------------------------------
@@ -82,6 +83,96 @@ async function createGoal(
   return rows[0];
 }
 
+// The maintenance goal's scope wall: deliberately EMPTY. Named rather than inlined
+// so the choice is greppable and the reasoning has one home (see the INSERT below).
+const MAINTENANCE_SCOPE_MODULES = [];
+
+// ensureMaintenanceGoal — find-or-create the version's maintenance goal, the home
+// a reported bug gets when its reporter named none (task 1003691, ADR 0262).
+// Returns the goal row, or null when the version cannot hold new work.
+//
+// WHY THIS IS A LIFECYCLE FUNCTION AND NOT AN ideas ONE. Goals and versions are
+// this module's tables; the ideas module may not import lifecycle (the one-way
+// module rule, ADR 0083), so it reaches this through the `lifecycle` port. Keeping
+// the SQL here also means the maintenance goal has ONE definition for the routing
+// path and for task 1003605 (BV1.R18) to build the rest of the feature on.
+//
+// IT RUNS INSIDE THE CALLER'S TRANSACTION (deps.client — the createTask seam).
+// That is load-bearing rather than tidy: routeIdeaToGoal's whole promise is that
+// the idea row, the task and the lineage row commit together or not at all, and a
+// goal created in its own connection would survive a rolled-back route as an
+// empty goal nobody asked for.
+//
+// THE RACE IS REAL AND IS HANDLED WITH A LOCK, NOT A PRAYER. `goals` has no unique
+// constraint on (version_id, title) — migration 160 used a NOT EXISTS guard, which
+// is safe for a one-shot backfill and NOT safe for a concurrent path: two bugs
+// reported in the same second would both see "no maintenance goal" and both insert
+// one, after which the title lookup is ambiguous forever. pg_advisory_xact_lock
+// serialises find-or-create per version and releases at COMMIT/ROLLBACK with no
+// unlock call to forget. It is keyed on a hash of the TITLE, so it collides only
+// with another writer of this same goal.
+//
+// The version must be open to work, checked here rather than trusted from the
+// caller: filing a defect into a shipped version's goal is the 1000771 bug
+// (bugs entombed where nobody looks), and the point of this path is to end that.
+async function ensureMaintenanceGoal(versionId, deps = {}) {
+  if (versionId == null) return null;
+  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
+  const title = maintenanceGoalTitle(versionId);
+
+  const { rows: vRows } = await exec.query(
+    `SELECT status FROM versions WHERE id = $1`,
+    [versionId]
+  );
+  if (!vRows[0] || vRows[0].status !== 'building') return null;
+
+  await exec.query(`SELECT pg_advisory_xact_lock(hashtext($1))`, [title]);
+
+  // MATCHED BY TITLE, because there is no column that says "this is the
+  // maintenance goal" — the same shape generalGoalIdForVersion uses for the
+  // catch-all, and it carries the same caveat: were a Metic+/Archon to hand-create
+  // a goal titled exactly this, routing would reuse THEIR goal and its scope
+  // rather than the zero-scope bucket below. That needs an already-trusted actor,
+  // so it is a provenance wrinkle rather than a way in, and task 1003605 (BV1.R18)
+  // is where a real flag belongs when the feature gets its own column.
+  //
+  // No index backs (version_id, title): goals are per-version and few, and this
+  // runs once per homeless bug. Revisit with R18 if either stops being true.
+  const { rows: found } = await exec.query(
+    `SELECT ${GOAL_COLS} FROM goals WHERE version_id = $1 AND title = $2 LIMIT 1`,
+    [versionId, title]
+  );
+  if (found[0]) return found[0];
+
+  // created_by NULL — system-attributed, the migration-160 posture: this goal has
+  // no owner and inserts no member row, so Archons act as one.
+  //
+  // scope_modules is deliberately EMPTY, and that is the one thing to understand
+  // before changing this: a defect can land in any module, so a wall listing every
+  // module is the same as no wall while also lying about intent. The consequence is
+  // real and accepted — scopeIncludesProtected([]) is false, so a Metic+ filer's
+  // homeless bug takes no protected-scope floor and lands claimable. That is the
+  // SAME grant abuse-matrix row P1 already makes for a Metic+ bug in any unscoped
+  // goal; what is new is only that this goal is auto-created. The protections that
+  // remain are the ones that were carrying the weight anyway: the matrix's rank
+  // split (sub-Metic lands 'backlog', never 'ready') and createTask's own derived
+  // floor. Do not "fix" this by inventing a scope list — narrow the GRANT instead,
+  // and write down why.
+  const { rows: made } = await exec.query(
+    `INSERT INTO goals (version_id, title, description, scope_modules, status, created_by, sort_order)
+     SELECT $1, $2, $3, $4, 'open', NULL, COALESCE(MAX(sort_order) + 1, 0)
+       FROM goals WHERE version_id = $1
+     RETURNING ${GOAL_COLS}`,
+    [versionId, title,
+      `Where a reported defect lands when its reporter named no goal (ADR 0262). ` +
+      `Auto-created by the bug-routing path; task 1003605 (BV1.R18) owns the rest of ` +
+      `the maintenance-goal feature — the close-exempt flag and carrying open bugs ` +
+      `forward to the successor version.`,
+      MAINTENANCE_SCOPE_MODULES]
+  );
+  return made[0] || null;
+}
+
 // listVersionAdmissions (BV1.R07, task 1003594) — every goal admitted into ONE
 // version, newest first. ADR 0250 §3: "the overrides are counted and shown on the
 // version" — a visible counter is what keeps the exception honest, because an
@@ -844,6 +935,7 @@ async function listPendingRequestsForGoal(goalId, deps = {}) {
 
 module.exports = {
   acceptMembershipRequestAndAddMember,
+  ensureMaintenanceGoal,
   achieveGoalIfComplete,
   addGoalMember,
   addGoalScopeModules,

package/modules/lifecycle/db-versions.js

@@ -131,8 +131,38 @@ async function createVersion({ id, name, status = 'planning', track = 'product',
   });
 }
 
+// currentBuildingVersionId — the version new work defaults into, or null when
+// none is open (task 1003691, ADR 0262). Consumed by the bug-routing path, which
+// has to name a version BEFORE it has a goal and so cannot derive one from the
+// goal the way every other routed filing does.
+//
+// THE TIEBREAK IS NOT NEW. More than one version may sit at 'building' — ADR 0250
+// D5 closes the PLANNING slot only, and refusing a second building version is
+// still unshipped work (task 1003606, BV1.R19) — so a rule was needed, and the
+// project already has one: scripts/gds/version-select.js pickDefaultVersion,
+// extracted to end nine hardcoded version literals and pinned by
+// tests/version_literals.mjs. This is that rule in SQL: building only, most
+// recently started first, a null started_at sorting LAST so a half-filled row
+// cannot decide the answer, and `id` breaking a remaining tie so the result is
+// deterministic rather than whatever the planner returns.
+//
+// Returns null rather than guessing when nothing is building — the caller must
+// fail closed, because inventing a version is how the 1000771 bug (every Discord
+// report filed into a SHIPPED version's catch-all) happened in the first place.
+async function currentBuildingVersionId(deps = {}) {
+  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
+  const { rows } = await exec.query(
+    `SELECT id FROM versions
+      WHERE status = 'building'
+      ORDER BY started_at DESC NULLS LAST, id
+      LIMIT 1`
+  );
+  return rows[0] ? rows[0].id : null;
+}
+
 module.exports = {
   createVersion,
+  currentBuildingVersionId,
   getVersion,
   listVersions,
   versionProgress,

package/modules/lifecycle/db.js

@@ -63,13 +63,14 @@ const {
   singleRungPromotionError,
   xenosClaimAllowed,
 } = require('./db-rank-authz.js');
-const { createVersion, getVersion, listVersions, versionProgress, versionsWithStatus } = require('./db-versions.js');
+const { createVersion, currentBuildingVersionId, getVersion, listVersions, versionProgress, versionsWithStatus } = require('./db-versions.js');
 const {
   acceptMembershipRequestAndAddMember,
   achieveGoalIfComplete,
   addGoalMember,
   addGoalScopeModules,
   createGoal,
+  ensureMaintenanceGoal,
   createMembershipRequest,
   getGoal,
   getGoalAdmission,
@@ -217,7 +218,9 @@ module.exports = {
   versionProgress,
   versionsWithStatus,
   createVersion,
+  currentBuildingVersionId,
   createGoal,
+  ensureMaintenanceGoal,
   getGoal,
   getGoalAdmission,
   listVersionAdmissions,

package/modules/lifecycle/goal-advisory.js

@@ -27,6 +27,22 @@ function generalGoalTitle(versionId) {
   return `${versionId} — general`;
 }
 
+// The per-version MAINTENANCE goal — where a defect against already-shipped work
+// lands when the reporter named no goal (task 1003691, ADR 0262). Same em-dash
+// rule as generalGoalTitle above, and the same reason: the title IS the lookup
+// key (there is no boolean column), so an ASCII hyphen or an en dash silently
+// creates a second, ordinary goal instead of matching this one.
+//
+// DELIBERATELY NOT the "<version> — general" catch-all. That bucket is what BV1.R11
+// (task 1003598) began deleting after 53 open tasks accumulated in two of them
+// unread; the maintenance goal is the honest home task 1003605 (BV1.R18) designs
+// for exactly this work. This constant is the half R18 and the bug-routing path
+// share — R18 still owns auto-creating it with every version, the close-exempt
+// flag, and carrying open bugs forward to the successor version on close.
+function maintenanceGoalTitle(versionId) {
+  return `${versionId} — maintenance`;
+}
+
 // adviseGoal — PURE, FAIL-OPEN. Returns null when the task has a real home, or the
 // advisory body when it does not. Three reasons, checked in order:
 //
@@ -177,4 +193,4 @@ async function buildGoalAdvisory({ db, versionId, task, hasCriterionLink = false
   }
 }
 
-module.exports = { adviseGoal, candidateGoals, generalGoalTitle, buildGoalAdvisory };
+module.exports = { adviseGoal, candidateGoals, generalGoalTitle, maintenanceGoalTitle, buildGoalAdvisory };

package/modules/lifecycle/lifecycle.js

@@ -43,6 +43,17 @@ module.exports = {
   // "which goal, on which version" is a lifecycle judgement and discord may not
   // import lifecycle (the one-way module rule).
   suggestGoalForCapture: (...a) => goalSuggest.suggestGoalForCapture(...a),
+  // ensureMaintenanceGoal + currentBuildingVersionId (task 1003691, ADR 0262):
+  // the home a REPORTED BUG gets when nobody named one. Consumer: the ideas
+  // routing transaction, which is the one filing path that must name a version
+  // BEFORE it has a goal — every other routed filing derives the version FROM the
+  // goal it was given. Both take `deps.client` so the find-or-create commits with
+  // the idea + task + lineage rows, or not at all.
+  //
+  // They live behind the port for the ordinary reason: `goals` and `versions` are
+  // lifecycle tables and the ideas module may not import lifecycle (ADR 0083).
+  ensureMaintenanceGoal: (...a) => db.ensureMaintenanceGoal(...a),
+  currentBuildingVersionId: (...a) => db.currentBuildingVersionId(...a),
 
   // --- work-tracking READS the staying-core read routes resolve --------------
   // public.js (the status surface): version/ship feed + grade trend.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.586",
+  "version": "1.19.588",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.586",
+      "version": "1.19.588",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",