@bongos/core 1.19.588 → 1.19.590

package/modules/lifecycle/routes/goal-route-authz.js

@@ -519,7 +519,140 @@ function decorateGoalScope(goal) {
 }
 
 
+// planGoalArchiveDispositions — the PURE decision behind the second half of the
+// archive two-step (BV1.R14, task 1003601, goal 1000086, ADR 0250 D3).
+//
+// R10 (task 1003597) made `POST /goals/:id/archive` REFUSE a goal that still
+// holds unfinished tasks and hand the caller the list. This is the other half:
+// the caller comes back saying what happens to each, and this decides whether
+// what they said is a complete, well-formed answer.
+//
+// THE CONSTRAINT IS "NOTHING IS DISCARDED WITHOUT A DECISION", so the map must be
+// TOTAL. A partial map is refused rather than applied-as-far-as-it-goes, because
+// a half-applied disposition leaves the goal un-archivable AND some of its work
+// already abandoned — the caller then cannot tell, from the outside, which half
+// happened. Total-or-nothing is what makes the call safe to retry.
+//
+// PURE + exported for the reason its siblings are: a decision expressed as a pure
+// function has its whole truth table exercised by a DB-free unit test, including
+// the shapes a live-Postgres test would never bother to set up (a verb of the
+// wrong case, a move naming the goal being archived, a map with an extra id for a
+// task that already shipped while the caller was deciding).
+//
+// Inputs: `openTasks` is R10's own `openTasksInGoal(...).tasks` — [{ id, title,
+// status }] — and `dispositions` is the caller's map, keyed by task id. `goalId`
+// is the goal being archived, `reason` the archive's reason.
+//
+// Returns { ok: true, plan: [{ taskId, verb, toGoalId }] } — the plan ORDERED to
+// match `openTasks`, so the writer's audit trail reads in a stable order — or
+// { ok: false, status, body } (the exact HTTP status + JSON the route sends).
+//
+// It deliberately does NOT check that a `move` target exists or is open: that is
+// a database fact, and this function has no database. The route resolves the
+// named goals and applies `goalNotOpenRefusal` to each, which is the ONE
+// definition of "this goal takes no new work" (BV1.R05) and must not be
+// re-implemented here in a second, drifting form.
+const ARCHIVE_DISPOSITION_VERBS = new Set(['abandon', 'move']);
+
+function planGoalArchiveDispositions({ goalId, openTasks = [], dispositions = null, reason = '' }) {
+  const held = Array.isArray(openTasks) ? openTasks.filter(Boolean) : [];
+  if (held.length === 0) return { ok: true, plan: [] };
+
+  // A goal holding open work may not be archived on a bare call. This is R10's
+  // refusal, reproduced here so the two steps cannot drift: same code, same
+  // shape, and it RETURNS the work rather than naming a count.
+  if (!dispositions || typeof dispositions !== 'object' || Array.isArray(dispositions)) {
+    return {
+      ok: false,
+      status: 409,
+      body: {
+        error: 'goal_holds_open_tasks',
+        message: `Goal #${goalId} still holds ${held.length} unfinished task(s). Re-submit with a \`dispositions\` map saying what happens to each — {"<task id>":{"verb":"abandon"}} or {"<task id>":{"verb":"move","goal_id":<id>}}.`,
+        details: { total: held.length, shown: held.length, tasks: held },
+      },
+    };
+  }
+
+  // An abandon stamps its reason onto the task, and an abandon with no reason is
+  // exactly the silent discard D3 exists to prevent — so the reason is required
+  // as soon as anything is being dispositioned, not merely encouraged.
+  if (typeof reason !== 'string' || reason.trim().length === 0) {
+    return {
+      ok: false,
+      status: 400,
+      body: {
+        error: 'archive_reason_required',
+        message: 'Archiving a goal that holds open work records why. Pass a non-empty `reason`; it is stamped onto every task abandoned by this call.',
+      },
+    };
+  }
+
+  const plan = [];
+  const missing = [];
+  for (const t of held) {
+    const key = String(t.id);
+    const d = dispositions[key];
+    if (!d || typeof d !== 'object') { missing.push(t); continue; }
+    const verb = typeof d.verb === 'string' ? d.verb : null;
+    if (!ARCHIVE_DISPOSITION_VERBS.has(verb)) {
+      return {
+        ok: false,
+        status: 400,
+        body: {
+          error: 'bad_disposition',
+          message: `Task #${key}: verb must be "abandon" or "move".`,
+          details: { task_id: key, verb: d.verb ?? null, valid: Array.from(ARCHIVE_DISPOSITION_VERBS) },
+        },
+      };
+    }
+    if (verb === 'abandon') { plan.push({ taskId: Number(t.id), verb, toGoalId: null }); continue; }
+
+    const toGoalId = Number(d.goal_id);
+    if (!Number.isInteger(toGoalId) || toGoalId <= 0) {
+      return {
+        ok: false,
+        status: 400,
+        body: {
+          error: 'bad_disposition',
+          message: `Task #${key}: a "move" names the surviving goal it moves to — pass \`goal_id\`.`,
+          details: { task_id: key, goal_id: d.goal_id ?? null },
+        },
+      };
+    }
+    // Moving a task INTO the goal being archived is the disposition that looks
+    // like a decision and is not: the task would be archived-with-the-goal a
+    // moment later, which is the silent discard by another name.
+    if (toGoalId === Number(goalId)) {
+      return {
+        ok: false,
+        status: 400,
+        body: {
+          error: 'bad_disposition',
+          message: `Task #${key}: cannot move a task into the goal being archived. Abandon it, or name a surviving goal.`,
+          details: { task_id: key, goal_id: toGoalId },
+        },
+      };
+    }
+    plan.push({ taskId: Number(t.id), verb, toGoalId });
+  }
+
+  if (missing.length > 0) {
+    return {
+      ok: false,
+      status: 400,
+      body: {
+        error: 'disposition_incomplete',
+        message: `${missing.length} of ${held.length} unfinished task(s) have no disposition. Every one needs a decision — nothing is discarded by omission.`,
+        details: { total: held.length, undecided: missing.length, tasks: missing },
+      },
+    };
+  }
+  return { ok: true, plan };
+}
+
+
 module.exports = {
+  ARCHIVE_DISPOSITION_VERBS,
   authorizeCreateJoinRequest,
   authorizeGoalCreate,
   authorizeGoalTaskCreate,
@@ -533,5 +666,6 @@ module.exports = {
   decorateGoalScope,
   goalNotOpenRefusal,
   isMemberOrArchon,
+  planGoalArchiveDispositions,
   protectedScopeAdmissionBlock,
 };

package/modules/lifecycle/routes/goals.js

@@ -49,6 +49,14 @@ const goalConflicts = require('../goal-conflicts');
 const { isGoalOwner, authorizeGoalManagement } = require('../goal-authz');
 
 const VALID_GOAL_STATUSES = ['open', 'achieved', 'archived'];
+
+// ARCHIVE_DISPOSITION_MAX — how many unfinished tasks one archive call will
+// disposition (BV1.R14). A ceiling rather than an unbounded read because the
+// whole plan is validated in memory and applied in ONE transaction, and a goal
+// holding thousands of open tasks is a data problem to fix before archiving, not
+// a payload to stream. Sized well above anything real: the largest bucket on the
+// live instance is a per-version catch-all at ~53 (ADR 0250 §7).
+const ARCHIVE_DISPOSITION_MAX = 500;
 const VALID_MEMBERSHIP_KINDS = ['lead', 'member'];
 const METIC_PLUS = ['metic', 'archon'];
 const RESOLVE_ACTIONS = ['sequence', 'flag_release', 'rescope'];
@@ -63,7 +71,7 @@ const JOIN_REQUEST_RESPONSE_ACTIONS = ['approve', 'deny']; // an owner/manager/A
 // proceed; a false result means "not a member" → the route should 403. This is the
 // membership half of the wall; the protected-module rank check is enforced per-route
 // (scope is never self-granted).
-const { authorizeCreateJoinRequest, authorizeGoalCreate, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, isMemberOrArchon, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
+const { authorizeCreateJoinRequest, authorizeGoalCreate, authorizeGoalTaskCreate, authorizeInvitationAccept, authorizeInvitationResponse, authorizeJoinRequestResponse, authorizeMembershipKindChange, authorizeOwnershipTransfer, authorizeRescindInvitation, authorizeWithdrawJoinRequest, decorateGoalScope, goalNotOpenRefusal, isMemberOrArchon, planGoalArchiveDispositions, protectedScopeAdmissionBlock } = require('./goal-route-authz.js');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('lifecycle');
 module.exports = function buildGoalsRouter() {
@@ -1075,6 +1083,17 @@ module.exports = function buildGoalsRouter() {
   // skill reaches for once a goal is achieved (ADR 0086 §6 / BV1.R64).
   // rank: metic+archon — a goal member (Metic+) or an Archon dispositions the goal.
   router.post('/goals/:id/archive', auth.requireBuilder, auth.requirePermission('goal.archive'), async (req, res) => {
+    // ADR 0118 / R12: every write route that reads a body declares it, so an
+    // unknown field is REJECTED rather than silently ignored — a typo'd
+    // `disposition` (singular) must not read as "no disposition given" and take
+    // the refusal branch, which is exactly the shape that trains a caller to
+    // believe the map was applied. `dispositions` is a dynamic-key map (task id →
+    // verb) so the schema bounds its TYPE here and its CONTENTS are validated by
+    // planGoalArchiveDispositions, which refuses every malformed entry by name.
+    if (validateOrRespond(req, res, {
+      reason: { type: 'string', maxLength: 2000 },
+      dispositions: { type: 'object' },
+    })) return;
     const id = parseId(req, res, { code: 'bad_goal_id' });
     if (id === null) return;
     try {
@@ -1100,17 +1119,96 @@ module.exports = function buildGoalsRouter() {
       // "not without saying what happens to these", not a silent discard.
       //
       // A goal holding nothing open stays a single call, unchanged.
-      const held = await db.openTasksInGoal(id);
-      if (held.total > 0) {
-        return res.fail('goal_holds_open_tasks', {
+      //
+      // BV1.R14 (task 1003601) is the second half: the caller comes back with a
+      // `dispositions` map saying what happens to each open task, and the archive
+      // APPLIES it. R10 shipped the refusal one task ahead of its own remedy, so
+      // between the two every archive of a goal holding work was impossible —
+      // which is also why the ADR 0264 goal cut could not start until this landed.
+      //
+      // The decision is the pure planGoalArchiveDispositions (the sibling of
+      // authorizeGoalCreate / authorizeVersionCreate): the route gathers the
+      // facts, that decides, the route renders the verdict verbatim.
+      //
+      // THE CAP MATTERS HERE AND NOT IN R10. `openTasksInGoal` defaults to 50 rows
+      // (with the true count in `.total`), which is right for a refusal that only
+      // has to show the caller what is in the way. This call must plan over EVERY
+      // open task — a plan built from a truncated list would validate as complete,
+      // and the transaction's final re-count would then roll the whole archive back
+      // with a confusing "still holds N" on a caller who dispositioned everything
+      // they were shown. So: read wide when a disposition is being applied, and
+      // refuse above the ceiling with a code that says what to do.
+      const wantsDisposition = req.body?.dispositions != null;
+      const held = await db.openTasksInGoal(id, wantsDisposition ? { cap: ARCHIVE_DISPOSITION_MAX } : undefined);
+      if (wantsDisposition && held.total > ARCHIVE_DISPOSITION_MAX) {
+        return res.fail('too_many_open_tasks', {
           status: 409,
-          message: `Goal #${id} still holds ${held.total} unfinished task(s). Ship or abandon them, or move them to another goal, before archiving it.`,
-          details: { total: held.total, shown: held.tasks.length, tasks: held.tasks },
+          message: `Goal #${id} holds ${held.total} unfinished tasks — more than the ${ARCHIVE_DISPOSITION_MAX} this call dispositions at once. Move or abandon some first, then archive.`,
+          details: { total: held.total, max: ARCHIVE_DISPOSITION_MAX },
         });
       }
-      const updated = await db.setGoalStatus({ goalId: id, status: 'archived' });
-      return res.json({ ok: true, goal: updated });
+      const reason = typeof req.body?.reason === 'string' ? req.body.reason.slice(0, 2000) : '';
+      const plan = planGoalArchiveDispositions({
+        goalId: id, openTasks: held.tasks, dispositions: req.body?.dispositions ?? null, reason,
+      });
+      if (!plan.ok) return res.status(plan.status).json(plan.body);
+
+      // A goal holding nothing open never had a plan to apply — keep it the one
+      // untouched call it has always been, rather than routing it through a
+      // transaction that would do nothing.
+      if (plan.plan.length === 0) {
+        const updated = await db.setGoalStatus({ goalId: id, status: 'archived' });
+        return res.json({ ok: true, goal: updated, applied: [] });
+      }
+
+      // Move targets are resolved HERE, before the write, so a bad target is a
+      // 400 about the caller's request rather than a rollback mid-archive. The
+      // open test is goalNotOpenRefusal — the ONE definition of "this goal takes
+      // no new work" (BV1.R05) — never a second spelling of the status list.
+      const targets = [...new Set(plan.plan.filter((p) => p.verb === 'move').map((p) => p.toGoalId))];
+      for (const t of targets) {
+        const dest = await db.getGoal(t);
+        if (!dest) {
+          return res.fail('bad_disposition', { status: 400, message: `Move target goal #${t} does not exist.`, details: { goal_id: String(t) } });
+        }
+        const notOpen = goalNotOpenRefusal(dest);
+        if (notOpen) {
+          return res.fail('bad_disposition', {
+            status: 409,
+            message: `Move target goal #${t} is '${dest.status}' — a task cannot be moved into a closed goal.`,
+            details: { goal_id: String(t), goal_status: dest.status },
+          });
+        }
+      }
+
+      const result = await db.archiveGoalWithDispositions({ goalId: id, plan: plan.plan, reason });
+      return res.json({ ok: true, goal: result.goal, applied: result.applied });
     } catch (err) {
+      // An actively-claimed task must not be abandoned out from under whoever is
+      // working it — the same refusal POST /tasks/:id/abandon makes, surfaced with
+      // the task named so the caller knows which claim to chase.
+      if (err && err.code === 'TASK_HAS_ACTIVE_CLAIM') {
+        return res.fail('task_has_active_claim', {
+          status: 409,
+          message: `Task #${err.taskId} has an active claim — release it before archiving this goal.`,
+          details: { task_id: err.taskId, task_title: err.taskTitle },
+        });
+      }
+      if (err && (err.code === 'MOVE_TARGET_NOT_FOUND' || err.code === 'MOVE_TARGET_NOT_OPEN')) {
+        return res.fail('bad_disposition', {
+          status: 409,
+          message: `Move target goal #${err.toGoalId} changed while the archive was running — nothing was applied. Re-read and retry.`,
+          details: { goal_id: err.toGoalId, goal_status: err.targetStatus ?? null },
+        });
+      }
+      if (err && err.code === 'DISPOSITION_INCOMPLETE_AFTER_APPLY') {
+        return res.fail('goal_holds_open_tasks', {
+          status: 409,
+          message: `Goal #${id} still held ${err.remaining} unfinished task(s) after the dispositions were applied — nothing was changed. Re-read the goal and retry.`,
+          details: { remaining: err.remaining },
+        });
+      }
+      if (err && err.code === 'GOAL_NOT_FOUND') return res.fail('goal_not_found', 404);
       log.error('[gds] POST /goals/:id/archive', err);
       return res.fail('archive_failed', { status: 500, message: 'internal error' });
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.588",
+  "version": "1.19.590",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.588",
+      "version": "1.19.590",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.588",
+  "version": "1.19.590",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.588'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.590'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_archive_disposition.mjs

@@ -24,6 +24,8 @@ process.env.NODE_ENV = 'test';
 const require = createRequire(import.meta.url);
 const { openTasksInGoal } = require('../modules/lifecycle/db.js');
 const { TERMINAL_STATUSES } = require('../modules/lifecycle/task-status.js');
+const { planGoalArchiveDispositions } = require('../modules/lifecycle/routes/goal-route-authz.js');
+const { archiveGoalWithDispositions } = require('../modules/lifecycle/db.js');
 
 const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
 
@@ -86,15 +88,24 @@ test('an empty goal reports nothing held — the single-call path stays open', a
 // ---- the route --------------------------------------------------------------
 
 test('archive refuses with a NAMED 409 when the goal holds open work', () => {
-  assert.match(ARCHIVE, /const held = await db\.openTasksInGoal\(id\);/,
+  // R14 (task 1003601) moved this refusal OUT of the route and into the pure
+  // planner, so it is asserted on behaviour now rather than on route source —
+  // a strictly better pin, and the reason these two tests changed shape.
+  assert.match(ARCHIVE, /const held = await db\.openTasksInGoal\(id/,
     'the archive route must consult the work before discarding it');
-  assert.match(ARCHIVE, /res\.fail\('goal_holds_open_tasks', \{[\s\S]*?status: 409/,
-    'a named code an agent can branch on, not a bare 409');
+  const r = planGoalArchiveDispositions({
+    goalId: 7, openTasks: [{ id: '1', title: 't', status: 'ready' }], dispositions: null, reason: 'x',
+  });
+  assert.equal(r.ok, false);
+  assert.equal(r.status, 409);
+  assert.equal(r.body.error, 'goal_holds_open_tasks', 'a named code an agent can branch on, not a bare 409');
 });
 
 test('the refusal RETURNS the tasks, so the caller can decide without a second fetch', () => {
-  assert.match(ARCHIVE, /details: \{ total: held\.total, shown: held\.tasks\.length, tasks: held\.tasks \}/,
-    'an agent that has to go fetch the list will guess instead');
+  const held = [{ id: '1', title: 'one', status: 'ready' }, { id: '2', title: 'two', status: 'active' }];
+  const r = planGoalArchiveDispositions({ goalId: 7, openTasks: held, dispositions: null, reason: 'x' });
+  assert.deepEqual(r.body.details.tasks, held, 'an agent that has to go fetch the list will guess instead');
+  assert.equal(r.body.details.total, 2);
 });
 
 test('the check runs AFTER identity/authorization and BEFORE the status write', () => {
@@ -111,9 +122,14 @@ test('the check runs AFTER identity/authorization and BEFORE the status write',
 test('archiving a goal that holds nothing is still ONE call', () => {
   // The guard must not turn the ordinary case into a two-step. There is exactly
   // one setGoalStatus in this handler and no second round trip in front of it.
-  assert.equal((ARCHIVE.match(/db\.setGoalStatus/g) || []).length, 1);
+  assert.equal((ARCHIVE.match(/db\.setGoalStatus/g) || []).length, 1,
+    'the empty-goal path still writes through the plain setter, not the transaction');
   assert.equal(/disposition_required|preview=/.test(ARCHIVE), false,
     'no extra confirm parameter on the empty-goal path');
+  // And the planner agrees: nothing held means an empty plan, never a refusal.
+  const r = planGoalArchiveDispositions({ goalId: 7, openTasks: [], dispositions: null, reason: '' });
+  assert.equal(r.ok, true);
+  assert.deepEqual(r.plan, []);
 });
 
 // ---- the two doors agree ----------------------------------------------------
@@ -142,3 +158,188 @@ test('every non-terminal status is one the archive gate would catch', () => {
   assert.deepEqual([...TERMINAL_STATUSES].sort(), ['abandoned', 'shipped'],
     'and the terminal set is exactly the two deliberate endings');
 });
+
+// ---- R14: the disposition is APPLIED (task 1003601) --------------------------
+//
+// The second half of the two-step. R10 built the refusal; this is the answer to
+// it. The property under test throughout is TOTALITY: a map that does not cover
+// every open task is refused outright rather than applied as far as it goes,
+// because a half-applied disposition leaves the goal un-archivable AND some of
+// its work already abandoned, with no way for the caller to tell which happened.
+
+const TASKS = (...st) => st.map((s, i) => ({ id: String(i + 1), title: `t${i + 1}`, status: s }));
+const plan = (over = {}) => planGoalArchiveDispositions({
+  goalId: 7, openTasks: TASKS('ready', 'active'), reason: 'cut in the ten-areas review', ...over,
+});
+
+test('a partial map is refused — nothing is discarded by omission', () => {
+  const r = plan({ dispositions: { 1: { verb: 'abandon' } } });   // task 2 undecided
+  assert.equal(r.ok, false);
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error, 'disposition_incomplete');
+  assert.equal(r.body.details.undecided, 1);
+  assert.deepEqual(r.body.details.tasks.map((t) => t.id), ['2'],
+    'the refusal names WHICH task is undecided, not merely how many');
+});
+
+test('a complete map plans one step per task, in the order the tasks came in', () => {
+  const r = plan({ dispositions: { 1: { verb: 'abandon' }, 2: { verb: 'move', goal_id: 42 } } });
+  assert.equal(r.ok, true);
+  assert.deepEqual(r.plan, [
+    { taskId: 1, verb: 'abandon', toGoalId: null },
+    { taskId: 2, verb: 'move', toGoalId: 42 },
+  ]);
+});
+
+test('an abandon with no reason is refused — that is the silent discard D3 forbids', () => {
+  for (const reason of ['', '   ', null, undefined]) {
+    const r = plan({ dispositions: { 1: { verb: 'abandon' }, 2: { verb: 'abandon' } }, reason });
+    assert.equal(r.ok, false, `reason ${JSON.stringify(reason)} must not pass`);
+    assert.equal(r.body.error, 'archive_reason_required');
+  }
+});
+
+test('only abandon and move are verbs; anything else is a named 400', () => {
+  for (const verb of ['delete', 'ABANDON', 'skip', '', null, 42]) {
+    const r = plan({ dispositions: { 1: { verb }, 2: { verb: 'abandon' } } });
+    assert.equal(r.ok, false, `verb ${JSON.stringify(verb)} must not pass`);
+    assert.equal(r.body.error, 'bad_disposition');
+  }
+});
+
+test('a move must name where it moves to', () => {
+  for (const goal_id of [undefined, null, 0, -1, 'forty-two', 1.5]) {
+    const r = plan({ dispositions: { 1: { verb: 'move', goal_id }, 2: { verb: 'abandon' } } });
+    assert.equal(r.ok, false, `goal_id ${JSON.stringify(goal_id)} must not pass`);
+    assert.equal(r.body.error, 'bad_disposition');
+  }
+});
+
+test('a task cannot be moved INTO the goal being archived', () => {
+  // The disposition that looks like a decision and is not: the task would be
+  // archived along with the goal a moment later — the silent discard renamed.
+  const r = plan({ dispositions: { 1: { verb: 'move', goal_id: 7 }, 2: { verb: 'abandon' } } });
+  assert.equal(r.ok, false);
+  assert.equal(r.body.error, 'bad_disposition');
+  assert.match(r.body.message, /into the goal being archived/);
+});
+
+test('a disposition for a task that is not open is simply unused, never an error', () => {
+  // The caller may hold a stale list; extra keys are harmless because the plan is
+  // built from the OPEN TASKS, not from the map.
+  const r = plan({ dispositions: { 1: { verb: 'abandon' }, 2: { verb: 'abandon' }, 999: { verb: 'move' } } });
+  assert.equal(r.ok, true);
+  assert.deepEqual(r.plan.map((p) => p.taskId), [1, 2]);
+});
+
+// ---- R14: the write is one transaction --------------------------------------
+
+function txPool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { connect: c.connect, query: (sql, params) => c._client.query(sql, params), queries: c._client.queries };
+}
+const flat = (q) => String(q.sql).replace(/\s+/g, ' ').trim();
+
+test('the whole disposition + archive runs inside ONE transaction', async () => {
+  const pool = txPool((sql) => {
+    const q = String(sql).replace(/\s+/g, ' ');
+    if (/^SELECT .* FROM goals WHERE id = \$1 FOR UPDATE/.test(q.trim())) return { rows: [{ id: 7, status: 'open' }] };
+    if (/FROM tasks WHERE id = \$1 AND goal_id = \$2 FOR UPDATE/.test(q)) return { rows: [{ id: 1, title: 't1', status: 'ready' }] };
+    if (/FROM claims WHERE task_id/.test(q)) return { rows: [] };
+    if (/count\(\*\)::int AS n FROM tasks/.test(q)) return { rows: [{ n: 0 }] };
+    if (/UPDATE goals SET status = 'archived'/.test(q)) return { rows: [{ id: 7, status: 'archived' }] };
+    return { rows: [] };
+  });
+  const out = await archiveGoalWithDispositions(
+    { goalId: 7, plan: [{ taskId: 1, verb: 'abandon', toGoalId: null }], reason: 'cut' },
+    { pool }
+  );
+  assert.equal(out.goal.status, 'archived');
+  const sqls = pool.queries.map(flat);
+  assert.equal(sqls.filter((q) => q === 'BEGIN').length, 1, 'exactly one BEGIN');
+  assert.equal(sqls.filter((q) => q === 'COMMIT').length, 1, 'exactly one COMMIT');
+  assert.ok(sqls.indexOf('BEGIN') < sqls.findIndex((q) => /UPDATE tasks SET status = 'abandoned'/.test(q)),
+    'the task writes are inside the transaction');
+  assert.ok(sqls.findIndex((q) => /UPDATE goals SET status = 'archived'/.test(q)) < sqls.indexOf('COMMIT'),
+    'so is the archive');
+});
+
+test('the goal row is locked BEFORE the plan is applied', async () => {
+  // Without FOR UPDATE on the goal, a concurrent POST /goals/:id/tasks can slip a
+  // new task in between the plan validating and the archive landing.
+  const pool = txPool((sql) => {
+    const q = String(sql).replace(/\s+/g, ' ');
+    if (/FROM goals WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: 7, status: 'open' }] };
+    if (/FROM tasks WHERE id = \$1 AND goal_id = \$2 FOR UPDATE/.test(q)) return { rows: [{ id: 1, title: 't', status: 'ready' }] };
+    if (/FROM claims/.test(q)) return { rows: [] };
+    if (/count\(\*\)::int AS n/.test(q)) return { rows: [{ n: 0 }] };
+    if (/UPDATE goals/.test(q)) return { rows: [{ id: 7, status: 'archived' }] };
+    return { rows: [] };
+  });
+  await archiveGoalWithDispositions({ goalId: 7, plan: [{ taskId: 1, verb: 'abandon', toGoalId: null }], reason: 'r' }, { pool });
+  const sqls = pool.queries.map(flat);
+  const lock = sqls.findIndex((q) => /FROM goals WHERE id = \$1 FOR UPDATE/.test(q));
+  const firstWrite = sqls.findIndex((q) => /^UPDATE tasks/.test(q));
+  assert.ok(lock !== -1 && firstWrite !== -1 && lock < firstWrite, 'lock the goal, then apply');
+});
+
+test('an actively-claimed task stops the archive and rolls it back', async () => {
+  const pool = txPool((sql) => {
+    const q = String(sql).replace(/\s+/g, ' ');
+    if (/FROM goals WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: 7, status: 'open' }] };
+    if (/FROM tasks WHERE id = \$1 AND goal_id = \$2 FOR UPDATE/.test(q)) return { rows: [{ id: 1, title: 'busy', status: 'active' }] };
+    if (/FROM claims WHERE task_id/.test(q)) return { rows: [{ id: 99 }] };   // someone is on it
+    return { rows: [] };
+  });
+  await assert.rejects(
+    archiveGoalWithDispositions({ goalId: 7, plan: [{ taskId: 1, verb: 'abandon', toGoalId: null }], reason: 'r' }, { pool }),
+    (e) => e.code === 'TASK_HAS_ACTIVE_CLAIM'
+  );
+  const sqls = pool.queries.map(flat);
+  assert.ok(sqls.includes('ROLLBACK'), 'nothing is left applied');
+  assert.equal(sqls.some((q) => /UPDATE goals SET status = 'archived'/.test(q)), false, 'and the goal is not archived');
+});
+
+test('the invariant is re-checked against committed state, not against the plan', async () => {
+  // The one check a bug in the planner cannot fool: if anything is still
+  // non-terminal after the writes, the archive rolls back rather than recreating
+  // exactly the condition goal 1000086 exists to make impossible.
+  const pool = txPool((sql) => {
+    const q = String(sql).replace(/\s+/g, ' ');
+    if (/FROM goals WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: 7, status: 'open' }] };
+    if (/FROM tasks WHERE id = \$1 AND goal_id = \$2 FOR UPDATE/.test(q)) return { rows: [{ id: 1, title: 't', status: 'ready' }] };
+    if (/FROM claims/.test(q)) return { rows: [] };
+    if (/count\(\*\)::int AS n FROM tasks/.test(q)) return { rows: [{ n: 3 }] };   // three snuck in
+    return { rows: [] };
+  });
+  await assert.rejects(
+    archiveGoalWithDispositions({ goalId: 7, plan: [{ taskId: 1, verb: 'abandon', toGoalId: null }], reason: 'r' }, { pool }),
+    (e) => e.code === 'DISPOSITION_INCOMPLETE_AFTER_APPLY' && e.remaining === 3
+  );
+  assert.ok(pool.queries.map(flat).includes('ROLLBACK'));
+});
+
+test('the re-check asks the SAME question the refusal asked', () => {
+  // Same terminal set, same smoke exclusion — or the transaction rolls back work
+  // the gate in front of it had already accepted.
+  const dbGoals = src('modules/lifecycle/db-goals.js');
+  const body = dbGoals.slice(dbGoals.indexOf('async function archiveGoalWithDispositions'));
+  assert.match(body, /\$\{nonTerminalSql\(\)\}/);
+  assert.match(body, /SMOKE_NOT_LIKE\.replace/);
+});
+
+test('an abandon stamps the archive reason, the way POST /tasks/:id/abandon does', () => {
+  const dbGoals = src('modules/lifecycle/db-goals.js');
+  const body = dbGoals.slice(dbGoals.indexOf('async function archiveGoalWithDispositions'));
+  assert.match(body, /`Abandoned: \$\{reason\}`/,
+    'the same stamp abandonTask writes, so the ledger reads identically whichever door was used');
+});
+
+test('a move into a closed goal is refused, via the ONE definition of "not open"', () => {
+  // The route resolves move targets and applies goalNotOpenRefusal (BV1.R05)
+  // rather than re-typing the status list — two spellings of "open" is how the
+  // three task-create vectors drifted apart in the first place.
+  assert.match(ARCHIVE, /goalNotOpenRefusal\(dest\)/);
+  assert.equal(/dest\.status === 'open'|dest\.status !== 'open'/.test(ARCHIVE), false,
+    'the route must not re-implement the open test');
+});