@bongos/core 1.19.591 → 1.19.593

package/tests/government_seed.mjs

@@ -74,6 +74,53 @@ function grantBlocksForRole(role) {
   return blocks;
 }
 
+// REVOCATIONS (BV1.R21, task 1003608). The union model below was append-only, and
+// the guard said in advance what would happen if that stopped being true: "A
+// future migration that REVOKES (raising a floor) would make the union overstate
+// what the DB holds." `government_012_version_create_archon.sql` is the first one
+// — ADR 0250 §6 raises `version.create` back to the Archon floor, reversing the
+// ADR 0157 delegation — so the model now subtracts.
+//
+// Matches BOTH table spellings on purpose. The old revoke-detector watched only
+// `governance_role_permissions`, but government_001_rename_from_governance renamed
+// it to `government_rank_permissions` with no shim, so a DELETE written against
+// the CURRENT table name would have sailed straight past the tripwire that exists
+// to catch exactly this. A guard that only recognises the historical spelling is
+// not a guard.
+const REVOKE_RE =
+  /DELETE\s+FROM\s+govern(?:ance_role|ment_rank)_permissions\s+WHERE\s+(?:rank_key|role_key)\s*=\s*'([^']+)'\s+AND\s+permission_key\s*=\s*'([^']+)'/gi;
+
+function revokeBlocksForRole(role) {
+  const blocks = [];
+  for (const [file, sql] of grantSqlByFile) {
+    const code = sql.replace(/--[^\n]*/g, '');
+    for (const m of code.matchAll(new RegExp(REVOKE_RE.source, 'gi'))) {
+      if (m[1] === role) blocks.push({ file, key: m[2] });
+    }
+  }
+  return blocks;
+}
+
+// The EFFECTIVE grant set: walk the migrations in filename order, adding each
+// file's grants and removing its revocations, so a key granted early and revoked
+// later ends up absent — and one revoked and then deliberately re-granted ends up
+// present. A set-difference over the whole union would get the first case right
+// and the second silently wrong.
+function effectiveKeysForRole(role) {
+  const grantRe = new RegExp(`SELECT '${role}', unnest\\(ARRAY\\[([\\s\\S]*?)\\]\\)`, 'g');
+  const held = new Set();
+  for (const [, sql] of grantSqlByFile) {
+    const code = sql.replace(/--[^\n]*/g, '');
+    for (const m of code.matchAll(grantRe)) {
+      for (const k of [...m[1].matchAll(/'([^']+)'/g)].map((x) => x[1])) held.add(RENAMED_KEYS.get(k) || k);
+    }
+    for (const m of code.matchAll(new RegExp(REVOKE_RE.source, 'gi'))) {
+      if (m[1] === role) held.delete(RENAMED_KEYS.get(m[2]) || m[2]);
+    }
+  }
+  return held;
+}
+
 test('the union of every grant migration matches RANK_SEED exactly (no drift)', () => {
   for (const role of RANK_ORDER) {
     const blocks = grantBlocksForRole(role);
@@ -82,26 +129,64 @@ test('the union of every grant migration matches RANK_SEED exactly (no drift)',
       assert.equal(b.keys.length, new Set(b.keys).size, `${role}: duplicate permission in the ${b.file} array`);
     }
     const granted = applyRenames(blocks.flatMap((b) => b.keys));
+    // The EFFECTIVE set — grants minus revocations, applied in file order. Since
+    // BV1.R21 (task 1003608) this is no longer the same thing as the union of the
+    // INSERTs: `version.create` is granted to metic by governance_007 and taken
+    // back by government_012.
+    const effective = effectiveKeysForRole(role);
     // set-equality (order in SQL is illustrative; the grant set is what matters)
-    assert.deepEqual(new Set(granted), new Set(RANK_SEED[role]),
+    assert.deepEqual(effective, new Set(RANK_SEED[role]),
       `${role}: grant migrations drift from catalog RANK_SEED`);
     // no key re-granted in a LATER migration (a no-op INSERT that muddies the ledger)
     assert.equal(granted.length, new Set(granted).size, `${role}: the same permission is granted twice across migrations`);
-    assert.equal(new Set(granted).size, RANK_SEED[role].length, `${role}: grant count mismatch`);
+    assert.equal(effective.size, RANK_SEED[role].length, `${role}: grant count mismatch`);
   }
 });
 
-// The union model above is only faithful while grant migrations are ADDITIVE. A future
-// migration that REVOKES (raising a floor) would make the union overstate what the DB
-// holds, so fail loudly here rather than let the guard quietly go wrong.
-test('no grant migration revokes — the union model stays faithful', () => {
+// This test used to assert that NO migration revokes, with the note: "teach
+// grantBlocksForRole to subtract before allowing this". BV1.R21 (task 1003608) is
+// the first revocation and the subtraction is now taught, so the tripwire becomes
+// its own follow-through: every DELETE in a grant migration must be in the exact
+// shape effectiveKeysForRole can read. A revoke the model cannot parse is worse
+// than one it forbids — it would leave the union overstating the DB while every
+// test stayed green, which is the failure the original note was written to avoid.
+test('every revoking migration is in the shape the union model subtracts', () => {
   for (const [file, sql] of grantSqlByFile) {
     const code = sql.replace(/--[^\n]*/g, '');
-    assert.ok(!/DELETE\s+FROM\s+governance_role_permissions/i.test(code),
-      `${file} revokes a grant — teach grantBlocksForRole to subtract before allowing this`);
+    // Only DELETEs against the PERMISSION tables matter here. A migration may
+    // legitimately delete from the ASSIGNMENT tables — governance_005 re-syncs
+    // `governance_builder_roles`, which is who holds a rank, not what a rank
+    // holds — and that has nothing to do with the grant union.
+    const deletes = [...code.matchAll(/DELETE\s+FROM\s+(govern(?:ance_role|ment_rank)_permissions)\b/gi)];
+    if (deletes.length === 0) continue;
+    const parsed = [...code.matchAll(new RegExp(REVOKE_RE.source, 'gi'))];
+    assert.equal(parsed.length, deletes.length,
+      `${file}: ${deletes.length} DELETE(s) but only ${parsed.length} parseable by REVOKE_RE — `
+      + 'the union model would silently overstate the grant set. Match the '
+      + "`DELETE FROM government_rank_permissions WHERE rank_key = '…' AND permission_key = '…'` shape.");
+    for (const m of parsed) {
+      assert.ok(RANK_ORDER.includes(m[1]), `${file}: revokes from unknown rank '${m[1]}'`);
+    }
   }
 });
 
+test('a revocation actually removes the key from the effective set', () => {
+  // The specific fact BV1.R21 turned on, asserted directly rather than only as a
+  // consequence of the drift comparison: governance_007 grants `version.create`
+  // to metic, government_012 takes it back, and the effective set must not hold
+  // it — while archon, which was granted it by governance_006, keeps it.
+  assert.equal(effectiveKeysForRole('metic').has('version.create'), false,
+    'ADR 0250 §6 raised version.create to the archon floor — a metic grant row would make that floor decorative');
+  assert.equal(effectiveKeysForRole('archon').has('version.create'), true,
+    'archon must still hold it, or POST /versions is unreachable by anyone');
+  // …and the raw union still CONTAINS it, which is the whole reason the model
+  // needed to change: if this ever stops being true the revoke migration was
+  // edited away rather than superseded.
+  const rawUnion = applyRenames(grantBlocksForRole('metic').flatMap((b) => b.keys));
+  assert.ok(rawUnion.includes('version.create'),
+    'the historical grant must remain in governance_007 — migrations are run-once and are never rewritten');
+});
+
 test('the seed inserts exactly the four seeded rank-roles', () => {
   const roleRows = [...seedSql.matchAll(/\('(xenos|thetes|metic|archon)',\s*'[^']+',/g)].map((m) => m[1]);
   assert.deepEqual(new Set(roleRows), new Set(RANK_ORDER));
@@ -140,7 +225,14 @@ test('later grant migrations are idempotent + transactional', () => {
     const code = stripComments(sql);
     const inserts = code.match(/INSERT INTO/g) || [];
     const onConflict = code.match(/ON CONFLICT/g) || [];
-    assert.ok(inserts.length > 0, `${file}: a grant migration must INSERT something`);
+    const revokes = [...code.matchAll(new RegExp(REVOKE_RE.source, 'gi'))];
+    // A migration must DO something to the grant set — but since BV1.R21 (task
+    // 1003608) "something" includes taking a permission away, not only adding
+    // one. A REVOKE-only migration inserts nothing by design and needs no ON
+    // CONFLICT: deleting a row that is not there affects zero rows and raises
+    // nothing, so it is already naturally re-runnable.
+    assert.ok(inserts.length > 0 || revokes.length > 0,
+      `${file}: a grant migration must INSERT or REVOKE something`);
     assert.equal(inserts.length, onConflict.length, `${file}: every INSERT must be ON CONFLICT DO NOTHING`);
     assert.ok(/BEGIN;/.test(code) && /COMMIT;/.test(code), `${file}: must be transactional`);
   }

package/tests/one_planning_version.mjs

@@ -141,14 +141,31 @@ test('the default status is planning, so an unqualified create hits the gate', (
   assert.match(ROUTE, /const status = body\.status \|\| 'planning';/);
 });
 
-test('the accepted race is described as unmitigated, because it is', () => {
-  // An earlier draft of this comment said the race was "left to a partial unique
-  // index" — which reads as though one exists. It does not, and a future reader
-  // taking that at face value would believe two concurrent creates cannot both
-  // slip through. Pinned so the honest wording cannot quietly regress.
-  assert.match(ROUTE, /RACE, ACCEPTED AND UNMITIGATED/);
-  assert.match(ROUTE, /no database\s*\n?\s*\/\/ constraint backs it/,
-    'the comment must say plainly that nothing catches it');
+test('the planning race is now BACKED, and the comment says so honestly', () => {
+  // WHAT THIS TEST USED TO ASSERT, AND WHY IT FLIPPED. Until BV1.R19 (task
+  // 1003606) this pinned the words "RACE, ACCEPTED AND UNMITIGATED", because an
+  // earlier draft of the comment claimed the race was "left to a partial unique
+  // index" when no such index existed — a future reader taking that at face
+  // value would have believed two concurrent creates could not both slip
+  // through. R19 shipped the index (migration core_233), so the old wording is
+  // now the dishonest one. The TEST'S PURPOSE is unchanged: the comment must
+  // describe the mitigation that actually exists, no more and no less.
+  assert.match(ROUTE, /THE RACE IS CLOSED/);
+  assert.match(ROUTE, /versions_one_planning_idx/,
+    'the comment must name the index that backs it, so the claim is checkable');
+  assert.equal(/RACE, ACCEPTED AND UNMITIGATED/.test(ROUTE), false,
+    'the planning race is mitigated as of R19 — the old wording would now under-claim');
+});
+
+test('the BUILDING half is still unmitigated, and the comment does not pretend otherwise', () => {
+  // The other half of the same honesty rule, and the one that matters now. R19
+  // could only ship ONE of ADR 0263 §9's two indexes: the live instance has two
+  // `building` versions, so `versions_one_building_idx` cannot be created until
+  // task 1003614 (R27) folds them. The building slot is therefore guarded by a
+  // check-then-insert with nothing behind it — exactly the state the planning
+  // slot was in before — and a reader who assumed symmetry would be wrong.
+  assert.match(ROUTE, /NOT BACKED BY AN INDEX YET/);
+  assert.match(ROUTE, /1003614/, 'the comment must name the task that makes the index legal');
 });
 
 // ---- the rule is one half of a pair ----------------------------------------

package/tests/promote_goal_id.mjs

@@ -122,29 +122,61 @@ await test('BEHAVIOUR: a non-ok or empty response is "none", distinct from "unav
   assert.equal(notOk.source, 'none', 'the two are reported differently because the operator advice differs');
 });
 
-await test('BEHAVIOUR: blank ACCEPTS the default; only "-"/"none" declines', () => {
-  assert.deepEqual(triage.applyGoalAnswer(1000071, ''), { goalId: 1000071, warn: null });
-  assert.deepEqual(triage.applyGoalAnswer(1000071, '   '), { goalId: 1000071, warn: null },
+await test('BEHAVIOUR: blank ACCEPTS the default when there is one', () => {
+  assert.deepEqual(triage.applyGoalAnswer(1000071, ''), { ok: true, goalId: 1000071, warn: null });
+  assert.deepEqual(triage.applyGoalAnswer(1000071, '   '), { ok: true, goalId: 1000071, warn: null },
     'whitespace is a bare Enter, not a decision');
-  assert.deepEqual(triage.applyGoalAnswer(1000071, '-'), { goalId: null, warn: null });
-  assert.deepEqual(triage.applyGoalAnswer(1000071, 'none'), { goalId: null, warn: null });
-  assert.deepEqual(triage.applyGoalAnswer(1000071, 'NONE'), { goalId: null, warn: null });
-  assert.deepEqual(triage.applyGoalAnswer(1000071, '1000058'), { goalId: 1000058, warn: null },
+  assert.deepEqual(triage.applyGoalAnswer(1000071, '1000058'), { ok: true, goalId: 1000058, warn: null },
     'an explicit id overrides the default');
 });
 
-await test('BEHAVIOUR: junk clears the goal and SAYS SO rather than landing on a wrong one', () => {
+// BV1.R22 (task 1003609). These three used to resolve to `goalId: null`, which was
+// fine while a goal-less create fell into the version's "<version> — general"
+// catch-all. R11 (task 1003598) deleted that bucket and made goal_id required, so
+// null is now a server 400 arriving AFTER the operator has typed a title, a
+// description and a priority — and losing all of it. Each is a local refusal now.
+
+await test('BEHAVIOUR: "-"/"none" no longer opt out — the bucket they opted into is gone', () => {
+  for (const decline of ['-', 'none', 'NONE']) {
+    const r = triage.applyGoalAnswer(1000071, decline);
+    assert.equal(r.ok, false, `"${decline}" must not resolve`);
+    assert.equal(r.goalId, null);
+    assert.match(r.warn, /no longer exists|must name a real goal/,
+      `"${decline}" must say the bucket is gone, not merely refuse`);
+    assert.doesNotMatch(r.warn, /falling back/, 'nothing falls back any more');
+  }
+});
+
+await test('BEHAVIOUR: blank with NO default refuses rather than sending null', () => {
+  const r = triage.applyGoalAnswer(null, '');
+  assert.equal(r.ok, false, 'no default and no answer is not a decision');
+  assert.match(r.warn, /a goal is required/);
+});
+
+await test('BEHAVIOUR: junk REFUSES rather than downgrading a typo into a decision', () => {
   for (const junk of ['abc', '12.5', '-4', '0', 'goal 7']) {
     const r = triage.applyGoalAnswer(1000071, junk);
-    assert.equal(r.goalId, null, `"${junk}" must not resolve to a goal`);
-    assert.match(r.warn, /general bucket/, `"${junk}" must say where it will land instead`);
+    assert.equal(r.ok, false, `"${junk}" must not resolve to a goal`);
+    assert.equal(r.goalId, null);
+    assert.match(r.warn, /not a goal id/, `"${junk}" must name the problem`);
+    assert.doesNotMatch(r.warn, /general bucket/, 'and must not offer a bucket that no longer exists');
   }
   // Number('') is 0 and Number(' ') is 0 — both would silently become goal 0
   // without the blank check above running first. Guarding the pair together.
   assert.equal(triage.applyGoalAnswer(9, '').goalId, 9);
 });
 
-await test('BEHAVIOUR: createTask puts goal_id on the body, and omits it entirely when null', async () => {
+await test('BEHAVIOUR: createTask refuses to post without a goal, at its own call site', async () => {
+  // The prompt loop re-asks until it has a real id, so the only route here with
+  // null is a NEW call site that forgot — which should fail at its author rather
+  // than as a 400 in production.
+  await assert.rejects(
+    () => triage.createTask({ versionId: 'BV1', title: 't', description: '', priority: 3, sourceRef: null }),
+    /goal_id is required/,
+  );
+});
+
+await test('BEHAVIOUR: createTask puts goal_id on the body, and REFUSES when it is null', async () => {
   const seen = [];
   const fakeClient = {
     tasks: { postTasks: async (req) => { seen.push(req.body); return { ok: true, data: { task: { id: 7 } } }; } },
@@ -157,12 +189,18 @@ await test('BEHAVIOUR: createTask puts goal_id on the body, and omits it entirel
     // object cannot reach it — re-require in a fresh registry instead.
     const fresh = freshTriage();
     await fresh.createTask({ versionId: 'BV1', title: 't', description: 'd', priority: 3, sourceRef: 'idea:1', goalId: 1000071 });
-    await fresh.createTask({ versionId: 'BV1', title: 't', description: 'd', priority: 3, sourceRef: 'idea:2' });
     assert.equal(seen[0].goal_id, 1000071, 'the goal must reach the server');
-    assert.ok(!('goal_id' in seen[1]),
-    'and opting out must send NO goal_id key — the server\'s catch-all only applies on absent');
     assert.equal(seen[0].source, 'idea_inbox', 'provenance still travels');
     assert.equal(seen[0].status, 'backlog');
+    // BV1.R22 (task 1003609): omitting the goal used to send no goal_id key and let
+    // the server file it in the version catch-all. R11 deleted that catch-all, so a
+    // goal-less call is now a caller bug — and it must fail HERE, not as a 400 after
+    // the operator has typed everything.
+    await assert.rejects(
+      () => fresh.createTask({ versionId: 'BV1', title: 't', description: 'd', priority: 3, sourceRef: 'idea:2' }),
+      /goal_id is required/,
+    );
+    assert.equal(seen.length, 1, 'and nothing was posted for the goal-less call');
   } finally {
     cliLib.cliClient = realCliClient;
   }
@@ -192,8 +230,10 @@ await test('BEHAVIOUR: a failed create throws with the status, it does not retur
 // ---- 4. both paths send goal_id -------------------------------------------
 
 await test('BOTH PATHS: the CLI createTask and the hall payload each send goal_id', () => {
-  assert.match(TRIAGE, /if \(goalId != null\) body\.goal_id = Number\(goalId\);/,
+  assert.match(TRIAGE, /body\.goal_id = Number\(goalId\);/,
     'CLI: goal_id must reach the create body');
+  assert.doesNotMatch(TRIAGE, /if \(goalId != null\) body\.goal_id/,
+    'CLI: and unconditionally — a conditional send is what made a goal-less create look survivable');
   assert.match(TRIAGE, /async function createTask\(\{[^}]*goalId/,
     'CLI: createTask must accept it rather than ignore the caller');
   assert.match(HALL, /payload\.goal_id = Number\(form\.goal\.value\)/,
@@ -234,31 +274,46 @@ await test('the suggester default shows score + matched terms so it can be judge
 
 // ---- 2. opting out is explicit ------------------------------------------
 
-await test('OPT-OUT: the prompt itself offers the way out, and the branch delegates the meaning', () => {
+// BV1.R22 (task 1003609) removed the opt-out from BOTH surfaces, because the
+// bucket it opted into no longer exists. These three tests pinned the affordance;
+// they now pin its ABSENCE, which is the assertion that actually protects the
+// invariant — a re-added opt-out would silently start producing 400s again.
+
+await test('OPT-OUT: the CLI prompt RE-ASKS instead of offering a bucket that is gone', () => {
   const branch = TRIAGE.slice(TRIAGE.indexOf('const gd = await resolveGoalDefault'), TRIAGE.indexOf('const task = await createTask'));
-  assert.match(branch, /general bucket/, 'the prompt has to say where opting out lands');
+  assert.doesNotMatch(branch, /general bucket/, 'there is no general bucket to offer');
   assert.match(branch, /applyGoalAnswer\(gd\.goalId, goalAns\)/,
     'the branch must delegate to the tested helper, not re-implement the parsing inline');
-  assert.match(branch, /picked\.warn/, 'and surface its warning');
+  assert.match(branch, /picked\.ok/, 'and act on its verdict');
+  assert.match(branch, /picked\.warn/, 'and surface its reason');
+  assert.match(branch, /for \(;;\)/, 'a refusal re-asks rather than falling through');
+  assert.match(branch, /'s'/, "and skipping stays available, so one unplaceable idea cannot wedge the run");
   assert.match(branch, /resolveGoalDefault\(\{ \.\.\.idea, title \}, versionId\)/,
     'the suggester must see the title the operator just confirmed, not the filed one');
-  // The semantics themselves are covered by the BEHAVIOUR block above — this
-  // only pins that main() is actually wired to them.
 });
 
-await test('OPT-OUT: the hall names where opting out actually lands, and only defaults to it last', () => {
+await test('OPT-OUT: the hall offers no empty goal, and refuses one before it posts', () => {
   const fn = HALL.slice(HALL.indexOf('async function goalOptionsFor'), HALL.indexOf('async function renderPromote'));
-  // "— no goal —" would be a lie: the server files a goal_id-less create under
-  // the version's catch-all. The label has to say so.
-  assert.match(fn, /general bucket/);
-  assert.ok(!/— no goal —/.test(fn), 'the honest label replaced the misleading one');
-  assert.match(fn, /opts\.length === 0 \? ' selected' : ''/, 'the opt-out is the fallback, not the default');
-  assert.match(fn, /a choice rather than the silent default/, 'and the intent is stated');
+  // Scoped to the emitted <option> markup: the code comment above it explains WHY
+  // the bucket is gone and must be allowed to name it.
+  const optionMarkup = fn.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.doesNotMatch(optionMarkup, /general bucket/, 'the bucket is gone from the label too');
+  assert.ok(!/— no goal —/.test(fn), 'and no misleading "no goal" option came back');
+  // What remains when nothing is suggested must be a PLACEHOLDER, not a value:
+  // `disabled` is what stops a blank-looking select from being submittable.
+  assert.match(fn, /selected disabled/, 'the empty row is an unsubmittable placeholder');
+  const submit = HALL.slice(HALL.indexOf('async function submitPromote'), HALL.indexOf('function renderMerge'));
+  assert.match(submit, /form\.goal\.value === ''/, 'and the submit refuses an empty goal');
+  assert.match(submit, /payload\.goal_id = Number\(form\.goal\.value\)/,
+    'goal_id is sent unconditionally now, not behind an if');
+  assert.doesNotMatch(submit, /if \(form\.goal && form\.goal\.value !== ''\) payload\.goal_id/,
+    'the conditional send is what made an empty select look survivable');
 });
 
-await test('the CLI result line names the goal, or says the task fell into the general bucket', () => {
-  assert.match(TRIAGE, /goal \$\{goalId\}` : ', → general bucket'/,
-    'where it landed must be visible in the output, both ways');
+await test('the CLI result line names the goal it landed in', () => {
+  assert.match(TRIAGE, /P\$\{priority\}, goal \$\{goalId\}/,
+    'where it landed must be visible in the output');
+  assert.doesNotMatch(TRIAGE, /→ general bucket/, 'and there is no second way for it to land');
 });
 
 // ---- 3. degrades, never blocks -----------------------------------------

package/tests/publish_reconciler.mjs

@@ -1651,13 +1651,43 @@ test('vector 2: shipped_at is stamped ONLY by shipTask, and shipTask requires co
   // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
   const dbSrc = lifecycleDbSource();
 
-  // Every statement that writes shipped_at, ignoring SELECT projections and comments.
-  const writes = [...dbSrc.matchAll(/shipped_at\s*=\s*now\(\)/g)];
-  assert.equal(writes.length, 1,
-    `shipped_at is written in ${writes.length} places — a second stamp site is how the grader-bypass vector reopens`);
+  // Every statement that writes a TASK's shipped_at, ignoring SELECT projections
+  // and comments.
+  //
+  // THE TABLE MATTERS, and this guard learned that the hard way (BV1.R12, task
+  // 1003599). `versions` has a `shipped_at` too, and the version-close route
+  // stamps it — a legitimate write on a different table that has nothing to do
+  // with the grader-bypass vector. A bare /shipped_at = now()/ over the whole
+  // lifecycle db family counted it as a second TASK stamp site and reddened main.
+  //
+  // Widening the count to 2 would have been the wrong repair: it buys silence
+  // now and re-opens the hole the moment a third site appears anywhere. What this
+  // guard is actually about is stated in its own comment above — "no other write
+  // path can stamp shipped_at ON A TASK" — so the fix is to say `tasks`, not to
+  // raise the number. Each match is attributed to the nearest preceding UPDATE
+  // target, and only `tasks` counts.
+  const stamps = [...dbSrc.matchAll(/shipped_at\s*=\s*now\(\)/g)];
+  const taskStamps = stamps.filter((m) => {
+    const before = dbSrc.slice(0, m.index);
+    const lastUpdate = before.lastIndexOf('UPDATE ');
+    if (lastUpdate === -1) return false;
+    return /^UPDATE\s+tasks\b/.test(before.slice(lastUpdate));
+  });
+  assert.equal(taskStamps.length, 1,
+    `a task's shipped_at is written in ${taskStamps.length} places — a second stamp site is how the grader-bypass vector reopens`);
+  // And the attribution itself must be working: if the regex above ever stopped
+  // matching the real site, `taskStamps` would be 0 and the assert would still be
+  // meaningful — but a silent 0 total would mean the family moved and this guard
+  // is now watching nothing at all.
+  assert.ok(stamps.length >= 1, 'no shipped_at stamp found anywhere — the lifecycle db family moved and this guard is blind');
 
   // …and that one site is guarded on the confirmed state.
-  const stampIdx = dbSrc.indexOf('shipped_at = now()');
+  // Anchored on the ATTRIBUTED task stamp, not `indexOf` — with two shipped_at
+  // sites in the family, "the first one in file order" is whichever file the
+  // carve happens to concatenate first, and that is not a property anyone is
+  // maintaining. The versions stamp has no `status = 'confirmed'` guard and
+  // should not: it is a different table with a different rule.
+  const stampIdx = taskStamps[0].index;
   const window = dbSrc.slice(stampIdx, stampIdx + 500);
   assert.match(window, /WHERE id = \$1 AND status = 'confirmed'/,
     'the stamp must refuse any task not already confirmed — that is what stops a confirm-time ship');

package/tests/task_detail_ui.mjs

@@ -259,7 +259,7 @@ await test('opening Promote loads open versions only, and preselects the idea\'s
   assert.equal(vsel.value, 'BV2', 'the idea\'s suggested_version is honoured');
 });
 
-await test('the goal picker leads with the STORED hint, then the suggester, then the opt-out', async () => {
+await test('the goal picker leads with the STORED hint, then the suggester — and offers NO opt-out', async () => {
   const h = await boot();
   await h.clickGo('promote');
   const opts = h.goalSelect().querySelectorAll('option');
@@ -268,7 +268,14 @@ await test('the goal picker leads with the STORED hint, then the suggester, then
   assert.match(opts[0].textContent, /carried from the filing/);
   assert.equal(opts[1].attrs.value, '1000062', 'the suggester fills in below it');
   assert.match(opts[1].textContent, /matched: promote, merge/, 'with the evidence for judging it');
-  assert.equal(opts[opts.length - 1].attrs.value, '', 'the opt-out is always available');
+  // BV1.R22 (task 1003609) DELETED the trailing opt-out, and this assertion
+  // flipped with it. R11 (task 1003598) removed db.createTask's catch-all
+  // fallback and made goal_id required, so an empty selection stopped meaning
+  // "file it in the version's general bucket" and started meaning a server 400
+  // landing on a builder who had already filled the form. A choice that always
+  // fails is worse than no choice.
+  assert.equal(opts.filter((o) => o.attrs.value === '').length, 0,
+    'no empty-valued option may be offered once a goal is required — it could only ever 400');
 });
 
 await test('with no stored hint the top suggestion is preselected instead', async () => {
@@ -277,12 +284,19 @@ await test('with no stored hint the top suggestion is preselected instead', asyn
   assert.equal(h.goalSelect().value, '1000062', 'the suggester supplies the default when nothing was named');
 });
 
-await test('a suggester outage degrades to the opt-out rather than blocking the verdict', async () => {
+await test('a suggester outage degrades to a DISABLED placeholder that says what to do', async () => {
   const h = await boot({ suggestThrows: true, idea: { ...DEFAULT_IDEA, suggested_goal_id: null } });
   await h.clickGo('promote');
   const opts = h.goalSelect().querySelectorAll('option');
-  assert.equal(opts.length, 1, 'only the opt-out remains');
-  assert.equal(h.goalSelect().value, '', 'and it is selected, so the form is still submittable');
+  assert.equal(opts.length, 1, 'only the placeholder remains');
+  // Before BV1.R22 this row was a submittable opt-out and this test said so. It
+  // is now a PLACEHOLDER, not a value: `disabled`, so the select can never be
+  // blank-but-valid-looking, and the text tells the builder where to go instead.
+  // The old assertion passed either way, because it never checked `disabled` —
+  // which is exactly how a contract change hides inside a green test.
+  assert.ok('disabled' in opts[0].attrs, 'the placeholder must not be submittable');
+  assert.match(opts[0].textContent, /open the goal board and pick one/,
+    'a builder with no suggestion is told what to do, not handed a choice that fails');
 });
 
 await test('promote with a goal chosen POSTs goal_id, then marks the idea promoted', async () => {
@@ -320,14 +334,27 @@ await test('the title survives escaping — what the form renders is what gets c
     'quotes and angle brackets must round-trip through the value attribute unmangled');
 });
 
-await test('promote opting OUT of a goal sends no goal_id key at all', async () => {
+await test('there is no way to promote WITHOUT a goal any more', async () => {
+  // THIS TEST'S PREMISE INVERTED at BV1.R22 (task 1003609). It used to assert
+  // that clearing the picker sent no `goal_id` key, because an absent key meant
+  // "the version's general bucket". R11 (task 1003598) deleted that bucket and
+  // made `goal_id` required, so the behaviour it pinned is now a 400 — and the
+  // test itself crashed with a TypeError once the option it selected stopped
+  // existing, which is what surfaced this.
+  //
+  // What replaces it is the invariant that actually matters now: the form cannot
+  // be made to submit without a goal. Deleting the test outright would leave that
+  // unguarded.
   const h = await boot();
   await h.clickGo('promote');
-  h.goalSelect().value = '';
+  const opts = h.goalSelect().querySelectorAll('option');
+  const submittableBlank = opts.filter((o) => o.attrs.value === '' && !('disabled' in o.attrs));
+  assert.equal(submittableBlank.length, 0, 'no blank option may be both offered and submittable');
+  // And the picker's default is a real goal, so an untouched form is already valid.
+  assert.ok(h.goalSelect().value, 'the picker opens on a real goal, never on nothing');
   await h.submitForm('promote');
   const body = h.requestsTo('POST', /\/tasks$/)[0].body;
-  assert.ok(!('goal_id' in body),
-    'the version\'s general bucket applies only on an ABSENT key — sending null or "" would be a different create');
+  assert.ok('goal_id' in body && body.goal_id, 'every promote now names a goal');
 });
 
 await test('an empty title is refused in the browser, before a doomed request', async () => {