@bongos/core 1.19.591 → 1.19.593

package/modules/lifecycle/routes/versions.js

@@ -23,7 +23,7 @@ const auth = api;
 const db = require('../db');
 const versionClose = require('../version-close');
 const doneWhen = require('../done-when');
-const { authorizeVersionCreate } = require('./version-route-authz.js');
+const { authorizeVersionCreate, authorizeVersionBuild, planVersionClose, rollForwardNeedsPlanningVersion } = require('./version-route-authz.js');
 const { asyncHandler, validateOrRespond } = api;
 
 // versions.status CHECK (migration 003). A new version starts 'planning' or
@@ -128,15 +128,11 @@ module.exports = function buildVersionsRouter() {
     // sibling of R03's authorizeGoalCreate — the route gathers the facts and
     // renders the verdict, it does not carry the rule.
     //
-    // RACE, ACCEPTED AND UNMITIGATED: this is check-then-insert, and no database
-    // constraint backs it — two concurrent POST /versions with status=planning
-    // could both pass. Unlike the id collision above, which Postgres catches on
-    // the primary key, nothing catches this one. The real fix is a partial unique
-    // index (`ON versions (status) WHERE status = 'planning'`), which is a
-    // migration this task did not reserve a number for; task 1003606 (R19) adds
-    // the second-BUILDING-version rule of the same shape and is the natural place
-    // to add the index for both. Until then the exposure is bounded by the route
-    // being Archon-gated and used a few times a year — small, not zero.
+    // THE RACE IS CLOSED (BV1.R19, task 1003606, migration core_233): this is
+    // still check-then-insert, but `versions_one_planning_idx` now backs it, so a
+    // race-loser gets a 23505 that the catch below translates into this same
+    // refusal. R04 shipped this check documenting that nothing caught it; that is
+    // no longer true for the planning slot.
     const versionDecision = authorizeVersionCreate({
       status,
       planning: status === 'planning' ? await db.versionsWithStatus('planning') : [],
@@ -144,6 +140,27 @@ module.exports = function buildVersionsRouter() {
     if (!versionDecision.ok) {
       return res.status(versionDecision.status).json(versionDecision.body);
     }
+
+    // BV1.R19 (task 1003606, goal 1000086, ADR 0250 D5, ADR 0263 §9): the other
+    // half of the same rule. Exactly one version builds at a time — with two,
+    // "the current version" has no meaning and R03's goal-set gate has two
+    // answers depending on which row `currentBuildingVersionId`'s LIMIT 1 picked.
+    //
+    // NOT BACKED BY AN INDEX YET, and that is a data problem rather than an
+    // oversight: BONGOS-V1 and CB-V1 are both `building` on the live instance
+    // today, so `versions_one_building_idx` cannot be created until task 1003614
+    // (R27) folds them. core_233's header records why shipping it early — either
+    // unconditionally, which wedges the deploy, or skipped-with-a-NOTICE, which
+    // marks the migration applied and never arms — is worse than shipping it with
+    // the cutover. Until then this check-then-insert carries the rule alone, with
+    // the same bounded exposure R04 accepted: an Archon-gated route used a few
+    // times a year.
+    const buildDecision = authorizeVersionBuild({
+      building: status === 'building' ? await db.versionsWithStatus('building') : [],
+    });
+    if (!buildDecision.ok) {
+      return res.status(buildDecision.status).json(buildDecision.body);
+    }
     // Normalize criteria: each { criterion_id, criterion_md } (+ optional sort_order).
     const rawCriteria = Array.isArray(body.criteria) ? body.criteria : [];
     const criteria = [];
@@ -176,6 +193,31 @@ module.exports = function buildVersionsRouter() {
       // returns, instead of letting asyncHandler surface a 500 (hacker dispatch,
       // task 1204).
       if (err && err.code === '23505') {
+        // TWO unique constraints can raise here now, and they mean different
+        // things (BV1.R19, migration core_233). `versions_one_planning_idx` is
+        // the race-loser of the one-planning-version rule — the pre-check above
+        // passed because the winner had not committed yet — and must render as
+        // that rule's refusal, not as "this id is taken", which would send the
+        // caller off to rename a version that was never the problem. Matched on
+        // the constraint name rather than the message text, which is localised.
+        if (String(err.constraint || '') === 'versions_one_planning_idx') {
+          // Re-read rather than reuse the pre-check's rows: the winner has
+          // committed by now, so this read is what names it.
+          //
+          // The refusal is still rendered BY THE GATE, not written here — this
+          // route must never carry a second copy of the rule's wording, which is
+          // what tests/one_planning_version.mjs pins. The index only raises when
+          // a planning row exists, so the re-read is non-empty in every real
+          // case; the fallback row covers the one interleaving where the winner
+          // was deleted between the raise and this read, and exists solely so the
+          // gate cannot be handed an empty list and return `ok` with no body.
+          const planningNow = await db.versionsWithStatus('planning');
+          const raced = authorizeVersionCreate({
+            status: 'planning',
+            planning: planningNow.length ? planningNow : [{ id: '(a concurrent create)', name: '' }],
+          });
+          return res.status(raced.status).json(raced.body);
+        }
         return res.fail('version_exists', { status: 409, message: `Version '${id}' already exists.` });
       }
       throw err;
@@ -183,5 +225,83 @@ module.exports = function buildVersionsRouter() {
     res.status(201).json({ version, criteria: created });
   }, { errorCode: 'create_version_failed' }));
 
+
+  // POST /versions/:id/close — the move a version has never had (BV1.R12, task
+  // 1003599, goal 1000086, ADR 0250 D5, ADR 0263 §5).
+  //
+  // The hierarchy had a bottom and no top: tasks close, criteria close, goals
+  // close, and a version only ever moved by hand-run SQL on the droplet —
+  // `scripts/gds/version-close.js` still PRINTS that the API cannot do this (task
+  // 1003610, R23, points it here). A thing with no closing move does not close,
+  // which is how two versions ended up building at once.
+  //
+  // Archon-only, behind the `version.close` permission that has existed at that
+  // floor since BV1.R105 and that, until now, NOTHING referenced.
+  //
+  // THE TWO-STEP IS R14's ARCHIVE, in spirit and in shape: call it bare and a
+  // version holding open goals refuses with the GOALS ATTACHED; re-submit with a
+  // total `dispositions` map and it closes. Agents already know that interaction,
+  // and a second idiom for the same thing is how two surfaces drift apart.
+  //
+  // Auto-close (task 1003603, R16) reaches `db.closeVersion` with an EMPTY plan
+  // and never touches this route: by construction it fires only when the last
+  // non-maintenance goal achieved, so nothing is left to disposition (ADR 0263 §3).
+  // rank: archon — the disposition that finalises a version's scope-truth.
+  router.post('/versions/:id/close', auth.requireBuilder, auth.requirePermission('version.close'), asyncHandler('POST /versions/:id/close', async (req, res) => {
+    // ADR 0118 / R12: declare the body, so a typo'd `disposition` (singular) is
+    // REJECTED rather than read as "none given" — which would take the refusal
+    // branch and tell a caller who sent a complete map that the version holds open
+    // goals. Contents are validated by planVersionClose, which names every
+    // malformed entry.
+    if (validateOrRespond(req, res, {
+      reason: { type: 'string', maxLength: 2000 },
+      dispositions: { type: 'object' },
+    })) return;
+    const versionId = String(req.params.id || '').trim();
+    if (!versionId) return res.fail('version_id_required', 400);
+
+    const version = await db.getVersion(versionId);
+    const reason = typeof req.body?.reason === 'string' ? req.body.reason.slice(0, 2000) : '';
+    // The maintenance goal is filtered out by the READ (ADR 0263 §7): it is exempt
+    // from the close count and always carries forward, so it is never the caller's
+    // decision and must not appear in a refusal asking them to make one.
+    const openGoals = version ? await db.openNonMaintenanceGoals(versionId) : [];
+
+    const plan = planVersionClose({ version, openGoals, dispositions: req.body?.dispositions ?? null, reason });
+    if (!plan.ok) return res.status(plan.status).json(plan.body);
+
+    // A roll_forward needs a planning version to roll INTO, and its absence is a
+    // REFUSAL rather than an auto-create: cutting the successor is a scope
+    // decision with its own criteria, and doing it implicitly inside a close is
+    // the "fake hotfix version" ADR 0250 §3 built the override counter to prevent.
+    const needsPlanning = rollForwardNeedsPlanningVersion({
+      plan: plan.plan,
+      planning: plan.plan.some((p) => p.verb === 'roll_forward') ? await db.versionsWithStatus('planning') : [],
+    });
+    if (needsPlanning) return res.status(needsPlanning.status).json(needsPlanning.body);
+
+    try {
+      const out = await db.closeVersion({ versionId, plan: plan.plan, reason });
+      return res.json({ ok: true, version: out.version, applied: out.applied });
+    } catch (err) {
+      if (err && err.code === 'VERSION_NOT_FOUND') return res.fail('version_not_found', 404);
+      if (err && err.code === 'VERSION_NOT_BUILDING') {
+        return res.fail('version_not_building', {
+          status: 409,
+          message: `Version '${versionId}' changed to '${err.versionStatus}' while the close was running — nothing was applied.`,
+          details: { status: err.versionStatus },
+        });
+      }
+      if (err && err.code === 'CLOSE_INCOMPLETE_AFTER_APPLY') {
+        return res.fail('version_holds_open_goals', {
+          status: 409,
+          message: `Version '${versionId}' still held ${err.remaining} open goal(s) after the dispositions were applied — nothing was changed. Re-read and retry.`,
+          details: { remaining: err.remaining },
+        });
+      }
+      throw err;
+    }
+  }, { errorCode: 'close_version_failed' }));
+
   return router;
 };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.591",
+  "version": "1.19.593",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.591",
+      "version": "1.19.593",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.591",
+  "version": "1.19.593",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/triage.js

@@ -220,15 +220,37 @@ async function resolveGoalDefault(idea, versionId, { client = cliClient } = {})
 // default — declining has to be said ('-' or 'none'), because silently dropping a
 // real default on a bare Enter is how work ends up in the general bucket by
 // accident. Declining is legal: the server then applies the catch-all itself.
+// applyGoalAnswer — read the operator's goal answer at the triage prompt.
+//
+// BV1.R22 (task 1003609, goal 1000086): THE GENERAL BUCKET IS GONE. Every branch
+// that used to resolve to `goalId: null` did so because a goal-less create fell
+// into the version's catch-all "<version> — general" goal. R11 (task 1003598)
+// deleted that fallback and made `goal_id` required, so `null` is no longer an
+// opt-out — it is a `400 goal_id_required` from the server, arriving after the
+// operator has typed a title, a description and a priority, and losing all of it.
+//
+// So the two escapes become refusals, and they refuse HERE, before the round trip:
+//   '-' / 'none'  — was "file it in the general bucket"; there is no bucket.
+//   a junk answer — was silently downgraded to the bucket with a warning, which
+//                   is the worse of the two: a typo'd goal id read as a decision.
+//
+// `ok: false` means re-ask. The caller loops rather than aborting the whole
+// triage run, because the operator's other answers are still good.
 function applyGoalAnswer(defaultGoalId, rawAnswer) {
   const answer = String(rawAnswer == null ? '' : rawAnswer).trim();
-  if (answer === '') return { goalId: defaultGoalId, warn: null };
-  if (answer === '-' || answer.toLowerCase() === 'none') return { goalId: null, warn: null };
+  if (answer === '') {
+    return defaultGoalId != null
+      ? { ok: true, goalId: defaultGoalId, warn: null }
+      : { ok: false, goalId: null, warn: 'a goal is required — every task belongs to one. Enter a goal id (GET /goals?version=<id> lists them), or "s" to skip this idea.' };
+  }
+  if (answer === '-' || answer.toLowerCase() === 'none') {
+    return { ok: false, goalId: null, warn: 'the version\'s "general" catch-all no longer exists (task 1003598) — a task must name a real goal. Enter a goal id, or "s" to skip this idea.' };
+  }
   const parsed = Number(answer);
   if (!Number.isInteger(parsed) || parsed <= 0) {
-    return { goalId: null, warn: "not a goal id — falling back to the version's general bucket" };
+    return { ok: false, goalId: null, warn: `"${answer}" is not a goal id. Enter a number, or "s" to skip this idea.` };
   }
-  return { goalId: parsed, warn: null };
+  return { ok: true, goalId: parsed, warn: null };
 }
 
 async function createTask({ versionId, title, description, priority, sourceRef, goalId = null }) {
@@ -239,13 +261,13 @@ async function createTask({ versionId, title, description, priority, sourceRef,
   // make, and the server classifier still runs. Corrected rather than deleted so
   // the next reader does not re-derive it.)
   //
-  // task 1003071 (R13): goal_id is the point of this task. Omitting it does NOT
-  // leave the task goal-less — db.createTask (modules/lifecycle/db.js) defaults a
-  // goal-less create into the version's catch-all "<version> — general" goal. That
-  // bucket is the actual defect: it carries no done-when criteria, so since ADR
-  // 0183 made criteria close themselves off LINKED tasks, work parked there can
-  // never advance anything, and it does not read as real goal work on the board.
-  // Naming the goal here is what stops a triaged promotion falling into it.
+  // task 1003071 (R13) named the goal here; BV1.R22 (task 1003609) makes it
+  // MANDATORY. R11 (task 1003598) deleted the "<version> — general" catch-all that
+  // a goal-less create used to fall into, so omitting goal_id is now a server
+  // `400 goal_id_required` rather than a quiet mis-filing. Reaching this function
+  // without one is a bug in the caller, and it throws rather than posting: the
+  // prompt above re-asks until it has a real id, so the only way here with null is
+  // a new call site that forgot — which should fail at its author, not in prod.
   const body = {
     version_id: versionId,
     title,
@@ -255,7 +277,10 @@ async function createTask({ versionId, title, description, priority, sourceRef,
     source: 'idea_inbox',
     source_ref: sourceRef ?? null,
   };
-  if (goalId != null) body.goal_id = Number(goalId);
+  if (goalId == null) {
+    throw new Error('createTask: goal_id is required — every task belongs to a goal (task 1003598 deleted the catch-all fallback).');
+  }
+  body.goal_id = Number(goalId);
   const api = await cliClient();
   const r = await api.tasks.postTasks({ body });
   if (!r.ok) {
@@ -612,21 +637,30 @@ async function main() {
           const title = titleAns || idea.title;
 
           // task 1003071 (R13): a triaged promotion NAMES its goal. The default
-          // comes from the stored hint, else the R07 suggester; '-' opts out
-          // explicitly, which falls through to the version's catch-all "general"
-          // bucket — now a choice someone typed rather than the silent default.
-          // The EFFECTIVE title, not idea.title: the suggester matches on title
-          // terms, and the operator may just have retitled this.
+          // comes from the stored hint, else the R07 suggester. The EFFECTIVE
+          // title, not idea.title: the suggester matches on title terms, and the
+          // operator may just have retitled this.
+          //
+          // BV1.R22 (task 1003609): the opt-out is gone, so this RE-ASKS instead of
+          // falling through. Skipping is still available and is now spelled 's' —
+          // it leaves the idea open for the next pass rather than filing it
+          // somewhere it does not belong, which is what the general bucket was.
           const gd = await resolveGoalDefault({ ...idea, title }, versionId);
           if (gd.source === 'suggester') console.log(`  suggested goal: ${gd.label}`);
-          if (gd.source === 'unavailable') console.log('  (goal suggester unreachable — enter a goal id, or "-" to accept the general bucket)');
-          const goalPrompt = gd.goalId != null
-            ? `  goal [${gd.goalId}] ("-" for the version's general bucket): `
-            : '  goal (blank/"-" for the version\'s general bucket): ';
-          const goalAns = (await prompt(rl, goalPrompt)).trim();
-          const picked = applyGoalAnswer(gd.goalId, goalAns);
-          if (picked.warn) console.log(`  ! ${picked.warn}`);
-          const goalId = picked.goalId;
+          if (gd.source === 'unavailable') console.log('  (goal suggester unreachable — enter a goal id yourself; GET /goals?version=<id> lists them)');
+          let goalId = null;
+          let skipIdea = false;
+          for (;;) {
+            const goalPrompt = gd.goalId != null
+              ? `  goal [${gd.goalId}] ("s" to skip this idea): `
+              : '  goal id ("s" to skip this idea): ';
+            const goalAns = (await prompt(rl, goalPrompt)).trim();
+            if (goalAns.toLowerCase() === 's') { skipIdea = true; break; }
+            const picked = applyGoalAnswer(gd.goalId, goalAns);
+            if (picked.ok) { goalId = picked.goalId; break; }
+            console.log(`  ! ${picked.warn}`);
+          }
+          if (skipIdea) { console.log('  – skipped (still open in the inbox)'); summary.skipped++; continue; }
 
           try {
             const task = await createTask({
@@ -644,7 +678,7 @@ async function main() {
             });
             summary.promoted++;
             promotedIds.push({ ideaId: idea.id, taskId: task.id });
-            console.log(`  ✓ promoted #${idea.id} → task #${task.id} (${versionId}, P${priority}${goalId != null ? `, goal ${goalId}` : ', → general bucket'})`);
+            console.log(`  ✓ promoted #${idea.id} → task #${task.id} (${versionId}, P${priority}, goal ${goalId})`);
           } catch (err) {
             console.error(`  ! ${err.message}`);
           }

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.591'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.593'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_archive_hall.mjs

@@ -0,0 +1,198 @@
+// tests/goal_archive_hall.mjs — the goal page tells the truth about what is
+// holding a goal open, and walks the archive two-step without curl
+// (BV1.R24, task 1003611, goal 1000086, ADR 0250 D2/D3).
+//
+// TWO THINGS THIS PAGE COULD NOT SAY BEFORE.
+//
+//   1. WHY A GOAL IS STILL OPEN. Until R08/R09 (tasks 1003595, 1003596) a goal
+//      closed on its criteria alone, so "N of M criteria satisfied" was the whole
+//      answer. ADR 0250 D2 added "AND no task in it is non-terminal" — and a task
+//      linked to NO criterion appears nowhere in that rollup. A builder could read
+//      5-of-5 satisfied, watch the goal stay open, and find nothing on the page
+//      explaining it. That reads as a bug in the gate rather than the gate working.
+//
+//   2. HOW TO RETIRE ONE. R10 made archive refuse and return the work; R14 made it
+//      apply a disposition. Both were API-only, so the only way to retire a goal
+//      holding work was hand-written JSON — which is why the ADR 0264 goal cut
+//      needed a terminal.
+//
+// Static assertions over the shipped browser source, the promote_goal_id.mjs
+// precedent: these are DOM strings a unit test cannot invoke, and the properties
+// worth pinning are structural — which read feeds the panel, what the move-target
+// filter excludes, and that the server's refusal is shown rather than paraphrased.
+//
+// Run:  node tests/goal_archive_hall.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { makeRunner } from './helpers.mjs';
+
+const { test, summary } = makeRunner();
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const RENDER = src('modules/hall-ui/public/goals-render.js');
+const CSS = src('modules/hall-ui/public/goals.css');
+const ROUTES = src('modules/lifecycle/routes/goals.js');
+
+// ---- the server hands the page the same facts the refusal uses --------------
+
+await test('GET /goals/:id carries the open tasks, from the SAME read the refusal returns', () => {
+  const detail = ROUTES.slice(ROUTES.indexOf("router.get('/goals/:id'"), ROUTES.indexOf("router.get('/goals/:id/suggest-criteria'"));
+  assert.match(detail, /db\.openTasksInGoal\(id\)/,
+    'the page must not compute "what is in the way" a second way');
+  assert.match(detail, /open_tasks: openTasks/, 'and it must reach the client');
+  // If the page used a different read, it could show a builder a list the archive
+  // refusal then disagrees with — the exact confusion the two-step exists to end.
+  const archive = ROUTES.slice(ROUTES.indexOf("router.post('/goals/:id/archive'"));
+  assert.match(archive, /db\.openTasksInGoal\(id/, 'the refusal reads it too');
+});
+
+// ---- 1. why the goal is open ------------------------------------------------
+
+await test('the completion band names the unfinished work, with each task status', () => {
+  const fn = RENDER.slice(RENDER.indexOf('function heldOpenHtml'), RENDER.indexOf('function completionSummaryHtml'));
+  assert.match(fn, /holding this goal open/, 'it has to say what the tasks are doing, not merely list them');
+  assert.match(fn, /held__status/,
+    'the status is the surprising part — `completed` and `confirmed` still hold a goal open');
+  assert.match(fn, /#\/task\//, 'and each is reachable, so the next move is one click');
+});
+
+await test('it is SILENT when nothing is held, and on a closed goal', () => {
+  const fn = RENDER.slice(RENDER.indexOf('function heldOpenHtml'), RENDER.indexOf('function completionSummaryHtml'));
+  assert.match(fn, /if \(!openTasks \|\| !openTasks\.total \|\| g\.status !== 'open'\) return '';/,
+    'an empty "0 tasks" row on the common goal is noise, and this band renders on every goal');
+});
+
+await test('the summary line stops claiming criteria are the only thing left', () => {
+  const fn = RENDER.slice(RENDER.indexOf('function completionSummaryHtml'), RENDER.indexOf('function critListHtml'));
+  assert.match(fn, /const held = openTasks && openTasks\.total \? openTasks\.total : 0;/);
+  assert.match(fn, /still will not close while work is unfinished/,
+    'satisfied criteria plus an open goal is exactly the state that reads as a bug unexplained');
+  // The old sentence must survive for the case it is still true for.
+  assert.match(fn, /a criterion becomes confirmable once every task linked to it has shipped/);
+});
+
+await test('both the band and the full view are passed the open tasks', () => {
+  // A detail view that renders the summary WITHOUT them silently drops the
+  // explanation on the surface a builder opens to investigate.
+  const calls = RENDER.match(/completionSummaryHtml\(g, crit, sat, \d+, d\.criterionless_task_count, d\.open_tasks\)/g) || [];
+  assert.equal(calls.length, 2, 'the compact band and the full view');
+});
+
+// ---- 2. the archive two-step ------------------------------------------------
+
+await test('the Archive control appears only for someone who can manage an OPEN goal', () => {
+  const fn = RENDER.slice(RENDER.indexOf('function renderActions'), RENDER.indexOf('function archiveRowHtml'));
+  assert.match(fn, /if \(canManage && g\.status === 'open'\) \{/,
+    'a Xenos sees the state, not the control — the server enforces either way');
+  assert.match(fn, /id="goal-archive-btn"/);
+});
+
+await test('a goal holding NOTHING archives in one step, with an optional reason', () => {
+  const fn = RENDER.slice(RENDER.indexOf('async function openArchivePanel'), RENDER.indexOf('async function submitArchive'));
+  assert.match(fn, /held\.total === 0/, 'the common case must not become a two-step');
+  assert.match(fn, /Why \(optional\)/);
+  assert.match(fn, /reversible/, 'and say so — an archive that reads as permanent is one nobody uses');
+});
+
+await test('move targets exclude closed goals AND the goal being archived', () => {
+  const fn = RENDER.slice(RENDER.indexOf('async function openArchivePanel'), RENDER.indexOf('async function submitArchive'));
+  assert.match(fn, /o\.status === 'open' && !sameId\(o\.id, g\.id\)/,
+    'a closed goal takes no new work, and moving INTO the goal being archived is the silent discard renamed');
+});
+
+await test('every task needs a decision before the panel will submit', () => {
+  const fn = RENDER.slice(RENDER.indexOf('async function submitArchive'));
+  assert.match(fn, /undecided\.push\(id\)/);
+  assert.match(fn, /a decision: \$\{undecided\.map/, 'and the refusal names WHICH');
+  assert.match(fn, /if \(!reason\) return say\(/, 'an abandon without a reason is the silent discard D3 forbids');
+});
+
+await test('the client check is a courtesy — the server refusal is shown VERBATIM', () => {
+  const fn = RENDER.slice(RENDER.indexOf('async function submitArchive'));
+  assert.match(fn, /say\(\(e && e\.message\)/,
+    'the server knows things this panel does not — a task claimed since load, a target that just closed');
+  // A UI that believes it is the enforcement is how a second, drifting copy of a
+  // rule gets written — the panel's own header says so, above the flow.
+  const flow = RENDER.slice(RENDER.indexOf('// ---- BV1.R24: the archive two-step'));
+  assert.match(flow, /COURTESY, never the gate/);
+});
+
+await test('the disposition payload is exactly the shape the route validates', () => {
+  const fn = RENDER.slice(RENDER.indexOf('async function submitArchive'));
+  assert.match(fn, /\{ verb: 'abandon' \}/);
+  assert.match(fn, /\{ verb: 'move', goal_id: Number\(v\) \}/);
+  assert.match(fn, /body\.dispositions = dispositions;/);
+  // The route declares `reason` and `dispositions` and rejects anything else
+  // (ADR 0118), so an extra field here would 400 the whole call.
+  const sent = fn.slice(0, fn.indexOf('postJSON'));
+  assert.equal(/body\.(?!dispositions|reason)[a-z_]+ =/.test(sent), false, 'no field the route does not declare');
+});
+
+await test('archiving re-reads the goal rather than patching the page from the response', () => {
+  const fn = RENDER.slice(RENDER.indexOf('async function submitArchive'));
+  assert.match(fn, /loadDetail\(g\.id, \{ force: true \}\)/,
+    'the archive moved tasks between goals — a local patch would leave the page lying about both');
+});
+
+await test('the panel uses the page\'s own tokens, not colours of its own', () => {
+  const block = CSS.slice(CSS.indexOf('.arch-panel {'));
+  assert.equal(/#[0-9a-fA-F]{6}/.test(block.slice(0, block.indexOf('.arch-panel__err'))), false,
+    'a panel that announces itself is one people click by accident');
+  assert.match(CSS, /\.held-open \{/);
+  assert.match(CSS, /\.arch-row__verb \{/);
+});
+
+// ---- 3. it actually RENDERS ------------------------------------------------
+//
+// The assertions above prove the source contains the right strings. These run the
+// two pure builders and check the MARKUP — grammar, escaping, the overflow line,
+// and that no verb is preselected. A static regex passes just as happily on a
+// function that throws.
+
+const escapeHtmlFn = (x) => String(x).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+const fmtNumFn = (n) => String(n);
+const lift = (name, end, args, vals) => new Function(...args, `${RENDER.slice(RENDER.indexOf(`function ${name}`), RENDER.indexOf(end))}; return ${name};`)(...vals);
+const heldOpenHtml = lift('heldOpenHtml', 'function completionSummaryHtml', ['escapeHtml', 'fmtNum'], [escapeHtmlFn, fmtNumFn]);
+const archiveRowHtml = lift('archiveRowHtml', 'async function openArchivePanel', ['escapeHtml'], [escapeHtmlFn]);
+const OPEN = { status: 'open' };
+
+await test('RENDERS: a goal holding nothing produces no band at all', () => {
+  assert.equal(heldOpenHtml(OPEN, { total: 0, tasks: [] }), '');
+  assert.equal(heldOpenHtml(OPEN, null), '');
+});
+
+await test('RENDERS: an archived goal shows no band even while holding work', () => {
+  assert.equal(heldOpenHtml({ status: 'archived' }, { total: 3, tasks: [{ id: 1, title: 'x', status: 'ready' }] }), '');
+});
+
+await test('RENDERS: held tasks come out linked, status-tagged and ESCAPED', () => {
+  const html = heldOpenHtml(OPEN, { total: 2, tasks: [
+    { id: 1001, title: 'The <b>unescaped</b> one', status: 'confirmed' },
+    { id: 1002, title: 'second', status: 'ready' },
+  ] });
+  assert.match(html, /2 unfinished tasks are holding this goal open/);
+  assert.match(html, /#\/task\/1001/);
+  assert.match(html, /confirmed/, 'the mid-ship status is the surprising part and must show');
+  assert.doesNotMatch(html, /<b>unescaped<\/b>/, 'a task title is user input on a page everyone reads');
+  assert.match(html, /&lt;b&gt;/);
+});
+
+await test('RENDERS: the grammar is singular for one', () => {
+  const one = heldOpenHtml(OPEN, { total: 1, tasks: [{ id: 5, title: 'solo', status: 'active' }] });
+  assert.match(one, /1 unfinished task is holding this goal open/);
+});
+
+await test('RENDERS: a long list is capped and says how many are hidden', () => {
+  const many = heldOpenHtml(OPEN, { total: 30, tasks: Array.from({ length: 8 }, (_, i) => ({ id: i, title: 't', status: 'ready' })) });
+  assert.match(many, /and 22 more/, 'a truncated list that does not say it is truncated is a wrong answer');
+});
+
+await test('RENDERS: an archive row preselects NOTHING and offers each open goal', () => {
+  const row = archiveRowHtml({ id: 77, title: 'row', status: 'blocked' }, [{ id: 42, title: 'survivor' }]);
+  assert.match(row, /value="" selected/, 'a preselected verb is a decision nobody made');
+  assert.match(row, /value="abandon"/);
+  assert.match(row, /move → #42 survivor/);
+  assert.match(row, /data-task="77"/, 'the row carries its id, which is how the map is collected');
+});
+
+summary();

package/tests/government_require_permission.mjs

@@ -231,6 +231,13 @@ test('over the four seeded ranks, requirePermission admits exactly who requireRa
   const REPLACED_ARCHON = [
     'dependency.cross_tier.manage', 'gate_approval.decide',
     'task.confirm.grade_bypass', 'access_request.review',
+    // BV1.R21 (task 1003608): `version.create` RETURNED here. ADR 0157 had lowered it
+    // to metic on "authoring delegates, disposition does not"; ADR 0250 §6 amends that
+    // for this one key, because D1 makes the version boundary the scope gate and
+    // cutting a version is then the way AROUND the gate rather than authoring. Moving
+    // it back is an owner decision, which is exactly what this hand-written oracle
+    // exists to require — a floor that moved without one still reds the build.
+    'version.create',
   ];
   // ADR 0157 (owner decision, 2026-08-05) — "the Archon rank is responsible for rank and
   // identity only". Each of these replaced a requireRank('archon') gate in R104/R105 and
@@ -249,9 +256,6 @@ test('over the four seeded ranks, requirePermission admits exactly who requireRa
     'task.peer_votes.tally', 'override_request.decide', 'memory.read.any',
     'project.curate', 'provisioning.fleet.manage', 'security.report.adjudicate',
     'session.search',
-    // Minted by R105 (POST /versions had no atom); ADR 0157 then lowered it to metic.
-    // Its sibling `version.close` stayed archon — authoring delegates, disposition does not.
-    'version.create',
     // Minted BY ADR 0157, splitting the Gate page's READ off `gate_approval.decide` so a
     // Metic can open /gate while approving a held PR stays Archon.
     'gate_approval.read',