@bongos/core 1.19.592 → 1.19.594

package/docs/module-api-changelog.md

@@ -1633,5 +1633,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.590 with no explicit bump. run 34181177013. (task 1002620)
   1.19.592 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.591 with no explicit bump. run 34181434332. (task 1002620)
+  1.19.593 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.592 with no explicit bump. run 34184095455. (task 1002620)
+  1.19.594 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.593 with no explicit bump. run 34184562228. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -890,8 +890,10 @@ function createClient(opts = {}) {
     "versions": {
       // GET /versions — rank: public — GET /versions
       getVersions: (args) => request("GET", "/versions", { hasBody: false }, args),
-      // POST /versions — rank: metic+archon — POST /versions
+      // POST /versions — rank: archon — POST /versions
       postVersions: (args) => request("POST", "/versions", { hasBody: true }, args),
+      // POST /versions/{id}/close — rank: archon — POST /versions/:id/close
+      postVersionsIdClose: (args) => request("POST", "/versions/{id}/close", { hasBody: true }, args),
       // GET /versions/{id}/done-when — rank: public — GET /versions/:id/done-when
       getVersionsIdDoneWhen: (args) => request("GET", "/versions/{id}/done-when", { hasBody: false }, args),
       // POST /versions/{id}/done-when — rank: metic+archon — POST /versions/:id/done-when

package/modules/government/catalog.js

@@ -101,6 +101,26 @@ const PERMISSIONS = [
   // enforced out of band and can never be delegated by a row in this database.
   { key: 'builder.rank.set', system: true, floor: 'archon', guards: 'PATCH /builders/:id/rank — the single rank writer' },
   { key: 'version.close', system: true, floor: 'archon', guards: 'version close disposition (never delegated below Archon)' },
+  // BV1.R21 (task 1003608, goal 1000086). ADR 0250 §6 amends ADR 0157 for exactly
+  // this key: `version.create` returns to the Archon floor.
+  //
+  // 0157 lowered it to metic on "authoring delegates, disposition does not" — creating
+  // a version confers no authority, so its siblings are `goal.create`/`task.create`.
+  // That was correct about what a version WAS. ADR 0250 D1 changed what a version IS:
+  // the boundary now carries the scope gate, so cutting a new version is no longer
+  // authoring — it is THE WAY AROUND the gate. A builder refused a goal on a building
+  // version needs only cut a fresh version to put it somewhere, and D1 evaporates with
+  // nobody overriding anything. Create therefore joins close as a disposition over
+  // scope, and sits beside it.
+  //
+  // STILL system:false, AND THAT LEAVES A REAL GAP — recorded rather than quietly
+  // widened. `system:true` marks trust-boundary power and permanently bars granting a
+  // key to any CUSTOM rank; false means the government may grant `version.create` to a
+  // custom sub-Archon rank, and for that rank D1 is decorative again. Raising the flag
+  // is a second-order change to what custom ranks may hold — the same reasoning that
+  // keeps `dependency.cross_tier.manage` where it is — and neither ADR 0250 nor this
+  // task decided it. Filed for the owner rather than taken here.
+  { key: 'version.create', system: false, floor: 'archon', guards: 'POST /versions — create a version + its done-when criteria (ADR 0250 §6 returns it to archon; ADR 0157 had lowered it to metic)' },
   { key: 'task.confirm.grade_bypass', system: true, floor: 'archon', guards: 'POST /tasks/:id/confirm — ratify past a failed grade (env-relaxable, ADR 0041)' },
   { key: 'dependency.cross_tier.manage', system: true, floor: 'archon', guards: 'POST|DELETE /dependencies — cross-tier structural edges (ADR 0086)' },
   { key: 'goal.scope.manage', system: true, floor: 'archon', guards: 'cross-tier goal-scope edges + protected-scope admission (ADR 0086)' },
@@ -179,17 +199,6 @@ const PERMISSIONS = [
   //     be granted — a second-order change beyond the delegation that was asked for.
   { key: 'builder.budget.set', system: false, floor: 'metic', guards: 'PATCH /builders/:id/budget (ADR 0157, was archon)' },
   { key: 'criterion.unsatisfy', system: false, floor: 'metic', guards: 'POST /done-when/:id/unsatisfy (ADR 0157, was archon)' },
-  // BV1.R105. system:false DELIBERATELY, despite `version.close` being system:true.
-  // The `system` flag marks TRUST-BOUNDARY power — things that escalate or bypass the
-  // boundary (deploy, protected-path, rank-set, grade-bypass, cross-tier, principals).
-  // Creating a version is AUTHORING: it confers no authority on anyone. Its real
-  // siblings are `goal.create` and `task.create`, both operational. Close is the
-  // DISPOSITION that finalises a version's scope-truth; create opens it — the symmetry
-  // argument was considered and rejected, because system:true would permanently bar
-  // delegating version authoring to a custom rank for no trust-boundary reason.
-  // ADR 0157 then lowered create's floor to metic while close stayed archon, which is
-  // the same asymmetry read from the other side: authoring delegates, disposition does not.
-  { key: 'version.create', system: false, floor: 'metic', guards: 'POST /versions — create a version + its done-when criteria (ADR 0157, was archon)' },
   { key: 'security.report.adjudicate', system: false, floor: 'metic', guards: 'GET /security/reports, POST /security/reports/:id/{confirm,dispute,fix,link-fix}, /security/docs CRUD (ADR 0157, was archon)' },
   { key: 'provisioning.fleet.manage', system: false, floor: 'metic', guards: 'GET /provisioning/fleet[/cost-ledger], POST .../force-teardown (ADR 0157, was archon)' },
   { key: 'box.fleet.manage', system: false, floor: 'metic', scope: 'any', resource: 'box', guards: 'GET /boxes[/cost-ledger], POST /boxes/:b/close, PATCH .../block (ADR 0157, was archon)' },

package/modules/government/migrations/government_012_version_create_archon.sql

@@ -0,0 +1,45 @@
+-- government_012_version_create_archon.sql — REVOKE `version.create` from the
+-- Metic rank-role, completing BV1.R21 (task 1003608, goal 1000086, ADR 0250 §6).
+--
+-- THE DEFECT THIS CLOSES. R21 raised `version.create` back to the Archon floor in
+-- `modules/government/catalog.js`, reversing the ADR 0157 delegation. But the
+-- catalog is the DECLARATION; the grant rows are what `requirePermission` actually
+-- reads. `governance_007_delegate_archon_ops_to_metic.sql` granted the key to
+-- metic and nothing took it back, so on every already-migrated database — the live
+-- instance included — a Metic still held `version.create` and the raised floor was
+-- decorative. That is precisely the failure mode ADR 0016 exists to prevent: a
+-- permission that markdown describes one way and the DB enforces another.
+--
+-- `tests/government_seed.mjs` caught it as "metic: grant migrations drift from
+-- catalog RANK_SEED" — the union of the migrations yielded 66 keys for metic where
+-- RANK_SEED yields 65 — and that red main blocked every merge in the repo until
+-- this landed.
+--
+-- THE FIRST REVOKING MIGRATION IN THIS SYSTEM, and the guard said so in advance:
+-- "A future migration that REVOKES (raising a floor) would make the union
+-- overstate what the DB holds, so fail loudly here rather than let the guard
+-- quietly go wrong." That was the right call and it worked. The guard now
+-- SUBTRACTS revocations in file order, so the union keeps describing the effective
+-- grant set rather than only the additive half of it.
+--
+-- NOT idempotent by ON CONFLICT — a DELETE needs none. It is naturally re-runnable:
+-- deleting a row that is not there affects zero rows and raises nothing.
+--
+-- FORWARD-SAFETY, stated plainly because this one is not additive: an instance that
+-- rolls the CODE back to a release whose catalog still floors `version.create` at
+-- metic would find the grant gone, and its Metics would lose the ability to create
+-- a version until they were re-granted. That is the correct direction to fail — a
+-- rollback that silently re-widened a deliberately narrowed permission is the
+-- worse outcome — and it is why raising a floor is a decision with an ADR behind
+-- it rather than a config edit.
+--
+-- `government_rank_permissions` / `rank_key`, NOT the `governance_*` spelling:
+-- government_001_rename_from_governance renamed both with no compatibility shim.
+
+BEGIN;
+
+DELETE FROM government_rank_permissions
+ WHERE rank_key = 'metic'
+   AND permission_key = 'version.create';
+
+COMMIT;

package/modules/hall-ui/public/goals-render.js

@@ -175,10 +175,19 @@
     // task 1003276 — the category chip is a fact like the others, so it sits in
     // the facts line (a label a person scans, never a door — ADR 0192).
     const catHtml = categoryChip(g.category);
+    // BV1.R15 (task 1003602) — one chip, so a scan of the board shows WHICH goals
+    // were admitted mid-version without opening any of them. The who and the why
+    // are on the goal's own page (renderDetail), where there is room to read
+    // them; a list row only needs the yes/no, which is why `listGoals` carries a
+    // boolean and not the admission row.
+    const admittedChip = g.admitted
+      ? `<span class="fact-chip fact-chip--admitted" title="Added to this version after it started building — an Archon override of the scope gate. Open the goal to see who and why.">⚖ admitted</span>`
+      : '';
     const factsHtml = `<div class="gr-facts">`
       + `<span class="fact-pill fact-pill--${escapeHtml(g.status || 'open')}">${escapeHtml(g.status || 'open')}</span>`
       + chips.join('')
       + catHtml
+      + admittedChip
       + `</div>`;
     return { r, achieved, ringHtml, goalHref, right, catHtml, idHtml, stampHtml, whenHtml, factsHtml };
   }
@@ -614,14 +623,50 @@
   // only when the goal HAS criteria (an empty-criteria goal has nothing to be
   // unlinked from) and the count is >0 — silent otherwise, the goal_advisory
   // fail-open posture.
-  function completionSummaryHtml(g, crit, sat, ringSize, criterionlessTaskCount) {
+  // heldOpenHtml — BV1.R24 (task 1003611): the OTHER half of "why is this goal
+  // still open", which this page did not used to have to answer.
+  //
+  // Before R08/R09 a goal closed on its criteria alone, so the ring was the whole
+  // story. ADR 0250 D2 added "AND no task in it is non-terminal", and a task
+  // linked to no criterion holds the goal open while appearing nowhere in the
+  // rollup — so a builder could read 5-of-5 satisfied, watch the goal stay open,
+  // and have nothing on the page to explain it. Terminal is `shipped` or
+  // deliberately `abandoned`; `completed` and `confirmed` are mid-ship states that
+  // can still fail a grade, so they hold it open too, which is exactly the part
+  // people find surprising and the reason each task's status is shown.
+  //
+  // Silent when nothing is held — an empty "0 tasks" row on the overwhelmingly
+  // common goal is noise, and this band is read on every goal.
+  function heldOpenHtml(g, openTasks) {
+    if (!openTasks || !openTasks.total || g.status !== 'open') return '';
+    const shown = (openTasks.tasks || []).slice(0, 8);
+    const more = openTasks.total - shown.length;
+    const items = shown.map((t) =>
+      `<li><a href="#/task/${escapeHtml(String(t.id))}">#${escapeHtml(String(t.id))}</a>`
+      + ` <span class="held__title">${escapeHtml(t.title || '')}</span>`
+      + ` <span class="held__status">${escapeHtml(t.status || '')}</span></li>`).join('');
+    return `<div class="held-open">
+        <div class="held-open__head">${fmtNum(openTasks.total)} unfinished `
+      + `task${openTasks.total === 1 ? '' : 's'} ${openTasks.total === 1 ? 'is' : 'are'} holding this goal open</div>
+        <ul class="held-open__list">${items}</ul>
+        ${more > 0 ? `<div class="held-open__more">and ${fmtNum(more)} more</div>` : ''}
+      </div>`;
+  }
+  function completionSummaryHtml(g, crit, sat, ringSize, criterionlessTaskCount, openTasks) {
     const pending = crit.filter(isPending).length;
     // task 1002164 — an open goal used to punt confirmation to the /goal-review
     // CLI skill here; confirming now happens on this page, so the line reports
     // what is actually actionable instead of naming a command.
+    //
+    // BV1.R24: when work is what is holding the goal open, SAY SO here rather than
+    // repeating the criterion sentence. Satisfied criteria plus an open goal is
+    // precisely the state that reads as a bug when the page will not explain it.
+    const held = openTasks && openTasks.total ? openTasks.total : 0;
     const openLine = pending
       ? `${fmtNum(pending)} criteri${pending === 1 ? 'on is' : 'a are'} met and ready to confirm.`
-      : 'Open — a criterion becomes confirmable once every task linked to it has shipped.';
+      : (held
+        ? `Open — every criterion can be satisfied and the goal still will not close while work is unfinished.`
+        : 'Open — a criterion becomes confirmable once every task linked to it has shipped.');
     const line = g.status === 'achieved' ? 'Goal achieved — every criterion confirmed.'
       : (g.status === 'archived' ? 'Archived.' : openLine);
     const unlinked = crit.length > 0 && criterionlessTaskCount > 0
@@ -635,7 +680,7 @@
           <div style="font-size:12.5px;color:var(--ink-faint)">${line}</div>
           ${unlinked}
         </div>
-      </div>`;
+      </div>${heldOpenHtml(g, openTasks)}`;
   }
   function critListHtml(list, withDetail, canConfirm) {
     if (!list.length) return emptyStateHtml('No done-when criteria yet.');
@@ -666,11 +711,11 @@
     // task 1002164 — an archived/achieved goal has nothing left to confirm.
     const canConfirm = g.status === 'open' && canConfirmCriteria();
     const band = $('#goal-completion-body');
-    if (band) band.innerHTML = completionSummaryHtml(g, crit, sat, 56, d.criterionless_task_count) + critListHtml(crit.slice(0, CRITERIA_CAP), false, canConfirm);
+    if (band) band.innerHTML = completionSummaryHtml(g, crit, sat, 56, d.criterionless_task_count, d.open_tasks) + critListHtml(crit.slice(0, CRITERIA_CAP), false, canConfirm);
     renderViewAllFoot('#goal-completion-foot', crit.length, CRITERIA_CAP, 'completion', 'criteria');
     setCount('#goal-completion-count', crit.length);
     const full = $('#goal-completion-full');
-    if (full) full.innerHTML = completionSummaryHtml(g, crit, sat, 64, d.criterionless_task_count) + critListHtml(crit, true, canConfirm);
+    if (full) full.innerHTML = completionSummaryHtml(g, crit, sat, 64, d.criterionless_task_count, d.open_tasks) + critListHtml(crit, true, canConfirm);
     const back = $('#goal-completion-back');
     if (back && state.current != null) back.setAttribute('href', `#/goal/${state.current}`);
   }
@@ -804,7 +849,32 @@
       // task 1003276 — the human category, beside the machine-readable module
       // scope so the difference is visible: `scope` is the wall that refuses work
       // (ADR 0086); the chip is a word for a person and gates nothing (ADR 0192).
-      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${categoryChip(g.category)} ${lockSpan} ${gateSpan} ${scope} ${depsSpan}`;
+      // BV1.R15 (task 1003602, goal 1000086, ADR 0250 §3) — "the overrides are
+      // counted and shown on the version." This is the SHOWN half, at the one
+      // place the whole story fits: who waved this goal past the scope gate, and
+      // why. R03 refuses a goal on a version that is already building; an Archon
+      // may override, and that override is only honest if it is legible after
+      // the fact. `d.admitted` is null for every goal created normally, which is
+      // not missing data — it is the positive fact that this goal did not skip
+      // the gate, so nothing renders.
+      // The REASON is rendered, not tucked into a title= attribute: "by whom and
+      // why" is the whole ask, a tooltip is invisible on touch and to anyone not
+      // hunting for it, and an override whose justification you have to discover
+      // is the same unaccountable override with extra steps.
+      const adm = d.admitted;
+      const admBy = adm ? (adm.admitted_by_name || adm.admitted_by_login || ('builder ' + adm.admitted_by)) : '';
+      const admittedSpan = adm
+        ? `<span class="goal-badge goal-badge--admitted" title="This goal was added to ${escapeHtml(String(adm.version_id))} after it had already started building — an Archon override of the scope gate">⚖ Admitted by ${escapeHtml(admBy)}</span>`
+        : '';
+      meta.innerHTML = `<span>${escapeHtml(g.version_id || '')}</span> ${statusBadge(g.status)} ${categoryChip(g.category)} ${lockSpan} ${gateSpan} ${admittedSpan} ${scope} ${depsSpan}`;
+      if (adm) {
+        const why = document.createElement('div');
+        why.className = 'goal-admission';
+        why.innerHTML = `<strong>Admitted into ${escapeHtml(String(adm.version_id))} mid-build</strong> by ${escapeHtml(admBy)}`
+          + (adm.created_at ? ` on ${escapeHtml(fmtDate(adm.created_at))}` : '')
+          + (adm.reason ? ` — ${escapeHtml(String(adm.reason))}` : ' — no reason recorded.');
+        meta.appendChild(why);
+      }
     }
 
     // task 1762: the goal's own owner/manager (or an Archon) can invite/manage
@@ -846,6 +916,16 @@
         parts.push(`<button class="btn-ghost" id="goal-accepting-btn" type="button" data-next-accepting="${closing ? 'false' : 'true'}" title="${closing ? 'Stop taking join-requests; you can still invite people' : 'Take join-requests again'}">${closing ? 'Close to requests' : 'Open to requests'}</button>`);
       }
     }
+    // BV1.R24 (task 1003611): the archive two-step, without curl.
+    //
+    // Archiving used to be a single call that discarded whatever the goal held.
+    // R10 (task 1003597) made it refuse and return the work; R14 (task 1003601)
+    // made it apply a disposition. Both were API-only, so the only way to retire a
+    // goal holding work was to hand-write JSON — which is how the ADR 0264 goal cut
+    // ended up needing a terminal.
+    if (canManage && g.status === 'open') {
+      parts.push('<button class="btn-ghost" id="goal-archive-btn" type="button" title="Retire this goal — you will be asked what happens to any unfinished work">Archive goal</button>');
+    }
     if (g.status === 'open') {
       if (joined) {
         parts.push('<button class="btn-ghost" id="goal-leave-btn" type="button">Leave goal</button>');
@@ -871,6 +951,102 @@
     $('#goal-accepting-btn')?.addEventListener('click', (e) => toggleAcceptingRequests(g.id, e.currentTarget.dataset.nextAccepting === 'true'));
     $('#goal-request-btn')?.addEventListener('click', () => requestToJoin(g.id));
     $('#goal-withdraw-btn')?.addEventListener('click', () => withdrawRequest(g.id, state.myPendingRequest && state.myPendingRequest.id));
+    $('#goal-archive-btn')?.addEventListener('click', () => openArchivePanel(g));
+  }
+
+  // ---- BV1.R24: the archive two-step ---------------------------------------
+  //
+  // The panel mirrors the API exactly, because the API's shape IS the interaction:
+  // a goal holding nothing archives in one click; a goal holding work asks what
+  // happens to each task, and will not submit until every one has an answer.
+  //
+  // The client-side completeness check is a COURTESY, never the gate. The server
+  // refuses a partial map (`disposition_incomplete`) and the panel surfaces that
+  // refusal verbatim if it ever disagrees — a UI that believes it is the
+  // enforcement is how a second, drifting copy of a rule gets written.
+  function archiveRowHtml(t, openGoals) {
+    const opts = openGoals.map((g) =>
+      `<option value="${escapeHtml(String(g.id))}">move → #${escapeHtml(String(g.id))} ${escapeHtml(g.title || '')}</option>`).join('');
+    return `<li class="arch-row" data-task="${escapeHtml(String(t.id))}">
+        <span class="arch-row__task"><a href="#/task/${escapeHtml(String(t.id))}">#${escapeHtml(String(t.id))}</a>
+          ${escapeHtml(t.title || '')} <span class="held__status">${escapeHtml(t.status || '')}</span></span>
+        <select class="arch-row__verb" aria-label="What happens to task ${escapeHtml(String(t.id))}">
+          <option value="" selected>— decide —</option>
+          <option value="abandon">abandon</option>
+          ${opts}
+        </select>
+      </li>`;
+  }
+  async function openArchivePanel(g) {
+    const box = $('#goal-detail-actions');
+    if (!box) return;
+    const d = currentDetail();
+    const held = (d && d.open_tasks) || { total: 0, tasks: [] };
+    // Move targets: this version's other OPEN goals. A closed goal takes no new
+    // work (the server's goalNotOpenRefusal), and offering the goal being archived
+    // would be the silent discard renamed — both are filtered here so the options
+    // a person sees are the ones the server will accept.
+    let openGoals = [];
+    try {
+      const resp = await getJSON(`${API}/goals?version=${encodeURIComponent(g.version_id)}&limit=300`);
+      openGoals = (resp.goals || []).filter((o) => o.status === 'open' && !sameId(o.id, g.id));
+    } catch (_err) { openGoals = []; }
+
+    const panel = document.createElement('div');
+    panel.className = 'arch-panel';
+    panel.id = 'goal-archive-panel';
+    panel.innerHTML = held.total === 0
+      ? `<div class="arch-panel__head">Archive this goal?</div>
+         <div class="arch-panel__note">It holds no unfinished work, so this is a single step. Archiving is reversible — an archived goal can be reopened.</div>
+         <div class="arch-panel__foot">
+           <input type="text" id="arch-reason" placeholder="Why (optional)" />
+           <button class="btn-ghost" id="arch-cancel" type="button">Cancel</button>
+           <button class="landing__btn" id="arch-go" type="button">Archive</button>
+         </div>`
+      : `<div class="arch-panel__head">${fmtNum(held.total)} unfinished task${held.total === 1 ? '' : 's'} — say what happens to each</div>
+         <div class="arch-panel__note">Nothing is discarded by omission: every task needs a decision before this can be submitted. Abandoning stamps the reason below onto the task.</div>
+         <ul class="arch-panel__list">${(held.tasks || []).map((t) => archiveRowHtml(t, openGoals)).join('')}</ul>
+         ${held.total > (held.tasks || []).length ? `<div class="arch-panel__note">Showing ${fmtNum((held.tasks || []).length)} of ${fmtNum(held.total)}.</div>` : ''}
+         <div class="arch-panel__foot">
+           <input type="text" id="arch-reason" placeholder="Why this goal is being retired (required)" />
+           <button class="btn-ghost" id="arch-cancel" type="button">Cancel</button>
+           <button class="landing__btn" id="arch-go" type="button">Archive goal</button>
+         </div>
+         <div class="arch-panel__err" id="arch-err" hidden></div>`;
+    box.appendChild(panel);
+    $('#arch-cancel')?.addEventListener('click', () => panel.remove());
+    $('#arch-go')?.addEventListener('click', () => submitArchive(g, held, panel));
+  }
+  async function submitArchive(g, held, panel) {
+    const err = $('#arch-err');
+    const say = (m) => { if (err) { err.hidden = false; err.textContent = m; } else { toast(m); } };
+    const reason = String(($('#arch-reason') || {}).value || '').trim();
+    const body = { };
+    if (held.total > 0) {
+      if (!reason) return say('Give a reason — it is recorded on every task this abandons.');
+      const dispositions = {};
+      const undecided = [];
+      panel.querySelectorAll('.arch-row').forEach((row) => {
+        const id = row.getAttribute('data-task');
+        const v = row.querySelector('.arch-row__verb').value;
+        if (!v) { undecided.push(id); return; }
+        dispositions[id] = v === 'abandon' ? { verb: 'abandon' } : { verb: 'move', goal_id: Number(v) };
+      });
+      if (undecided.length) return say(`${undecided.length} task${undecided.length === 1 ? ' still needs' : 's still need'} a decision: ${undecided.map((i) => '#' + i).join(', ')}`);
+      body.dispositions = dispositions;
+    }
+    if (reason) body.reason = reason;
+    try {
+      await postJSON(`${API}/goals/${encodeURIComponent(g.id)}/archive`, body);
+      panel.remove();
+      toast('Goal archived.');
+      loadDetail(g.id, { force: true });
+    } catch (e) {
+      // The server's refusal is shown VERBATIM. It knows things this panel does
+      // not — a task claimed since the page loaded, a move target that just
+      // closed — and paraphrasing it would replace a precise answer with a guess.
+      say((e && e.message) || 'Could not archive that goal.');
+    }
   }
   async function loadActiveClaims() {
     try {

package/modules/hall-ui/public/goals.css

@@ -205,6 +205,20 @@
 /* task 1953 — private goals: the lock badge (meta line) + the goal's own
    pending invite/join-request queue (manager view, next to the invite box). */
 .goal-badge--locked { background: var(--warn-weak); color: var(--warn); }
+
+/* BV1.R15 (task 1003602, goal 1000086, ADR 0250 §3) — a goal admitted into a
+   version that was already building. Warn-weighted like the lock badge on
+   purpose: this is the scope gate having been OVERRIDDEN, and it should read as
+   an exception rather than as decoration. The reason line under it is quiet
+   (it is prose, not a status), but it is rendered rather than hidden in a
+   tooltip — an override you have to hover to justify is not accountable. */
+.goal-badge--admitted { background: var(--warn-weak); color: var(--warn); }
+.fact-chip--admitted { background: var(--warn-weak); color: var(--warn); border-color: transparent; }
+.goal-admission {
+  flex-basis: 100%; margin: 4px 0 0; font-size: 12px; line-height: 1.5;
+  color: var(--ink-faint);
+}
+.goal-admission strong { color: var(--warn); font-weight: 500; }
 .goal-pending { margin: 4px 0 10px; display: flex; flex-direction: column; gap: 10px; }
 .pending-group__h {
   font-family: var(--label-face); font-size: var(--label-size); font-weight: 400;
@@ -417,3 +431,40 @@
 @media (prefers-reduced-motion: reduce) {
   .claude-text__toggle::before { transition: none; }
 }
+
+/* ---- BV1.R24 (task 1003611): what holds a goal open, and the archive two-step.
+   Two surfaces the goal page never needed until ADR 0250 D2 made a goal's closure
+   depend on its WORK as well as its criteria. Both use the page's own hairline +
+   ink tokens rather than colours of their own — a panel that announces itself is
+   a panel people click by accident. */
+
+.held-open {
+  margin-top: 10px; padding-top: 10px;
+  border-top: var(--line) solid var(--rule-soft);
+}
+.held-open__head { font-size: 12.5px; font-weight: 600; color: var(--ink); margin-bottom: 6px; }
+.held-open__list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 3px; }
+.held-open__list li { font-size: 12.5px; color: var(--ink-faint); }
+.held__title { color: var(--ink); }
+/* The status is the surprising part — `completed` and `confirmed` still hold a
+   goal open — so it is set apart rather than run into the title. */
+.held__status {
+  font-size: 11px; font-variant-numeric: tabular-nums;
+  padding: 0 5px; border-radius: 3px;
+  border: var(--line) solid var(--rule-soft); color: var(--ink-faint);
+}
+.held-open__more { font-size: 11.5px; color: var(--ink-faint); margin-top: 4px; }
+
+.arch-panel {
+  flex-basis: 100%; margin-top: 10px; padding: 12px;
+  border: var(--line) solid var(--rule); border-radius: 8px;
+}
+.arch-panel__head { font-weight: 650; font-size: 13.5px; margin-bottom: 4px; }
+.arch-panel__note { font-size: 12px; color: var(--ink-faint); margin-bottom: 8px; }
+.arch-panel__list { list-style: none; margin: 0 0 10px; padding: 0; display: flex; flex-direction: column; gap: 6px; }
+.arch-row { display: flex; align-items: center; gap: 10px; font-size: 12.5px; }
+.arch-row__task { flex: 1; min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+.arch-row__verb { flex: none; font-size: 12px; }
+.arch-panel__foot { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
+.arch-panel__foot input { flex: 1; min-width: 200px; }
+.arch-panel__err { margin-top: 8px; font-size: 12.5px; color: var(--danger); }

package/modules/hall-ui/public/roadmap.css

@@ -200,6 +200,11 @@ a.rm-goal__t:hover { color:var(--accent-ink); text-decoration:underline; }
 .rm-gmore:hover { text-decoration:underline; }
 .rm-gmore svg { width:13px; height:13px; }
 .rm-gnone { font-size:12.5px; color:var(--ink-faint); margin:2px 0 0; }
+/* BV1.R15 (task 1003602) — the scope-gate override count. Warn-coloured because
+   it reports an exception being used, and only ever rendered when the count is
+   above zero (see admissionNote). */
+.rm-gadm { font-size:12.5px; color:var(--warn); margin:10px 0 0; }
+.rm-gadm b { font-weight:600; }
 
 /* parked note + staged state */
 .rm-parknote { display:flex; gap:9px; font-size:12.5px; color:var(--ink-soft); background:var(--bg-card);

package/modules/hall-ui/public/roadmap.js

@@ -85,6 +85,25 @@
 
   const arrowSvg = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M5 12h14M13 6l6 6-6 6"/></svg>';
 
+  // BV1.R15 (task 1003602, goal 1000086, ADR 0250 §3): "the overrides are
+  // counted and shown on the version."
+  //
+  // RENDERS NOTHING AT ZERO, and that is the design rather than a shortcut. A
+  // permanent "0 overrides" line is chrome a reader learns to skip, and the
+  // moment it becomes "2 overrides" it would go on being skipped. Appearing only
+  // when the gate was actually overridden makes the line itself the signal.
+  //
+  // It names no goals: which ones they are is one click away on the goals board
+  // (they carry an "admitted" chip), and a roadmap card that grew a second list
+  // stops being a roadmap.
+  function admissionNote(v) {
+    const n = Number(v && v.admissions) || 0;
+    if (n === 0) return '';
+    return `<p class="rm-gadm" title="A goal may only be added to a version that is still in planning. These were added after this version started building — each needed an Archon to override the scope gate and record a reason.">`
+      + `⚖ <b>${fmtNum(n)}</b> goal${n === 1 ? '' : 's'} admitted after this version started building`
+      + `</p>`;
+  }
+
   // The goals block that sits inside an in-flight / featured card. `active` are
   // the in-progress goals (sat>0), already sorted; we show up to 4 and let
   // "See all" carry the rest.
@@ -115,6 +134,7 @@
       </div>
       ${active.length ? `<div class="rm-ginp"><div class="rm-ginp__cap">Active right now</div>${rows}</div>`
         : '<p class="rm-gnone" style="margin-top:12px">No goal has criteria met yet — work is in the task queue.</p>'}
+      ${admissionNote(v)}
       <a class="rm-gmore" href="${GOALS_URL}">See all ${g.total} goals ${arrowSvg}</a>
     </div>`;
   }
@@ -350,6 +370,11 @@
         total: Number(p.total_count) || 0,
         pct: Number(p.percent_complete) || 0,
         criteria: Number(p.criteria_count) || 0,
+        // BV1.R15 (task 1003602, goal 1000086, ADR 0250 §3) — how many goals were
+        // admitted into this version AFTER it started building, i.e. how many
+        // times the scope gate was overridden. 0 for every version nobody
+        // widened, which is the answer this line should almost always give.
+        admissions: Number(p.admission_count) || 0,
         life: {
           sh: Number(p.lifecycle_shipped_count) || 0,
           co: Number(p.lifecycle_confirmed_count) || 0,

package/modules/hall-ui/public/task-detail.js

@@ -311,13 +311,18 @@
         opts.push('<option value="' + esc(String(g.id)) + '"' + (hint == null && i === 0 ? ' selected' : '') + '>'
           + esc(String(g.id)) + ' — ' + esc(g.title || '') + (why ? ' (matched: ' + esc(why) + ')' : '') + '</option>');
       });
-      // Always offer the opt-out, and make it the fallback when nothing was found.
-      // Sending no goal_id does not create a goal-less task — db.createTask files
-      // it under the version's catch-all "general" goal — so the label names where
-      // it actually lands. That bucket carries no done-when criteria, which is why
-      // it should be a choice rather than the silent default it used to be.
-      opts.push('<option value=""' + (opts.length === 0 ? ' selected' : '')
-        + '>— none (the version\'s general bucket) —</option>');
+      // BV1.R22 (task 1003609): THE OPT-OUT IS GONE, because the bucket it named is.
+      // R11 (task 1003598) deleted db.createTask's catch-all fallback and made
+      // goal_id required, so an empty selection is no longer "the general bucket" —
+      // it is a server 400 landing on a builder who has already filled the form.
+      //
+      // What replaces it is a PLACEHOLDER, not a value: disabled so it cannot be
+      // submitted, and selected only when nothing else was found, so the select is
+      // never blank-but-valid-looking. A builder with no suggestions is told what to
+      // do rather than handed a choice that fails.
+      if (opts.length === 0) {
+        opts.push('<option value="" selected disabled>— no goal suggested — open the goal board and pick one —</option>');
+      }
       return opts.join('');
     }
 
@@ -414,10 +419,16 @@
         source: 'idea_inbox',
         source_ref: 'idea:' + idea.id,
       };
-      // task 1003071 (R13): the whole point — a triaged promotion NAMES its goal.
-      // Empty means the operator chose the version's general bucket, which the
-      // server applies itself when goal_id is absent.
-      if (form.goal && form.goal.value !== '') payload.goal_id = Number(form.goal.value);
+      // task 1003071 (R13) made a triaged promotion name its goal; BV1.R22 (task
+      // 1003609) makes it required. There is no longer a version catch-all to fall
+      // into, so an empty select is refused HERE — before two writes and a round
+      // trip — rather than coming back as a server 400 the form cannot explain.
+      if (!form.goal || form.goal.value === '') {
+        busy(false, 'Create task');
+        note('Pick a goal before promoting — every task belongs to one. If none of the suggestions fit, open the goal board and choose the right goal first.');
+        return;
+      }
+      payload.goal_id = Number(form.goal.value);
       if (form.est.value !== '') payload.est_minutes = Number(form.est.value);
       if (form.credits.value !== '') payload.credits_reward = Number(form.credits.value);
       // 'criterion-proposal' is an idea-only kind; everything else is shared with

package/modules/lifecycle/db-goals.js

@@ -178,12 +178,22 @@ async function ensureMaintenanceGoal(versionId, deps = {}) {
 // version" — a visible counter is what keeps the exception honest, because an
 // override nobody can see is just a slower version of having no rule. Returns []
 // for the overwhelmingly common case of a version whose scope nobody widened.
+// BV1.R15 (task 1003602) carries the ADMITTER'S NAME, not just their id. R07
+// returned a bare `admitted_by`, which is enough to count an override and not
+// enough to answer the question ADR 0250 §3 actually asks — "by whom" — without
+// the caller issuing a second lookup per row. The whole point of the counter is
+// that abuse is legible at a glance; a column of numeric ids is not legible.
+// LEFT JOIN, not JOIN: an admission whose admitter was later offboarded must
+// still appear in the count. Losing the row would be the one failure mode that
+// matters, since it hides exactly the history someone would want to erase.
 async function listVersionAdmissions(versionId, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
-    `SELECT a.goal_id, a.version_id, a.admitted_by, a.reason, a.created_at, g.title AS goal_title
+    `SELECT a.goal_id, a.version_id, a.admitted_by, a.reason, a.created_at, g.title AS goal_title,
+            b.github_login AS admitted_by_login, b.display_name AS admitted_by_name
        FROM lifecycle_goal_version_admissions a
        JOIN goals g ON g.id = a.goal_id
+       LEFT JOIN builders b ON b.id = a.admitted_by
       WHERE a.version_id = $1
       ORDER BY a.created_at DESC`,
     [versionId]
@@ -191,6 +201,7 @@ async function listVersionAdmissions(versionId, deps = {}) {
   return rows;
 }
 
+
 // getGoalAdmission (BV1.R07, task 1003594) — the override record for ONE goal, or
 // null when the goal was created normally. Null is the overwhelmingly common
 // answer and is not an absence of data: it is the positive fact "this goal did
@@ -244,10 +255,31 @@ async function getGoalDependencies(goalId, deps = {}) {
 // A caller that only needs the first N (the orphan advisory wants 5 candidates)
 // passes it so Postgres does the truncating instead of shipping the whole version's
 // goals to be discarded in JS (task 1002539).
+// BV1.R15 (task 1003602, goal 1000086, ADR 0250 §3) adds `admitted` — did this
+// goal enter its version through the Archon override rather than the scope gate?
+//
+// A BOOLEAN, not the admission row. The board renders one chip; the who and the
+// why belong on the goal's own page, where there is room to read them, and
+// shipping the reason on every row of a list would put an Archon's free text
+// through a surface that only needs a yes/no. `getGoalAdmission` is still the
+// read for the detail.
+//
+// EXISTS rather than a LEFT JOIN: one row per goal is guaranteed either way, and
+// a join that later gained a second admission row per goal would silently
+// duplicate goals in the board's list.
+//
+// The correlation names `goals.id` in full rather than aliasing the table, so
+// every other line of this query is UNCHANGED — the column list, the two filters
+// and the ORDER BY all still read unqualified. That is deliberate: aliasing the
+// table to `g` would have been tidier and would have rewritten four lines whose
+// literal text tests/goal_tier.mjs pins ("priority-first, then stable
+// ordering"). An additive change should read as additive in the diff.
 async function listGoals({ versionId = null, status = null, limit = null } = {}, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const { rows } = await activePool.query(
-    `SELECT ${GOAL_COLS}
+    `SELECT ${GOAL_COLS},
+            EXISTS (SELECT 1 FROM lifecycle_goal_version_admissions a
+                     WHERE a.goal_id = goals.id) AS admitted
        FROM goals
       WHERE ($1::text IS NULL OR version_id = $1)
         AND ($2::text IS NULL OR status = $2)