@bongos/core 1.19.592 → 1.19.594

package/tests/promote_goal_id.mjs

@@ -122,29 +122,61 @@ await test('BEHAVIOUR: a non-ok or empty response is "none", distinct from "unav
   assert.equal(notOk.source, 'none', 'the two are reported differently because the operator advice differs');
 });
 
-await test('BEHAVIOUR: blank ACCEPTS the default; only "-"/"none" declines', () => {
-  assert.deepEqual(triage.applyGoalAnswer(1000071, ''), { goalId: 1000071, warn: null });
-  assert.deepEqual(triage.applyGoalAnswer(1000071, '   '), { goalId: 1000071, warn: null },
+await test('BEHAVIOUR: blank ACCEPTS the default when there is one', () => {
+  assert.deepEqual(triage.applyGoalAnswer(1000071, ''), { ok: true, goalId: 1000071, warn: null });
+  assert.deepEqual(triage.applyGoalAnswer(1000071, '   '), { ok: true, goalId: 1000071, warn: null },
     'whitespace is a bare Enter, not a decision');
-  assert.deepEqual(triage.applyGoalAnswer(1000071, '-'), { goalId: null, warn: null });
-  assert.deepEqual(triage.applyGoalAnswer(1000071, 'none'), { goalId: null, warn: null });
-  assert.deepEqual(triage.applyGoalAnswer(1000071, 'NONE'), { goalId: null, warn: null });
-  assert.deepEqual(triage.applyGoalAnswer(1000071, '1000058'), { goalId: 1000058, warn: null },
+  assert.deepEqual(triage.applyGoalAnswer(1000071, '1000058'), { ok: true, goalId: 1000058, warn: null },
     'an explicit id overrides the default');
 });
 
-await test('BEHAVIOUR: junk clears the goal and SAYS SO rather than landing on a wrong one', () => {
+// BV1.R22 (task 1003609). These three used to resolve to `goalId: null`, which was
+// fine while a goal-less create fell into the version's "<version> — general"
+// catch-all. R11 (task 1003598) deleted that bucket and made goal_id required, so
+// null is now a server 400 arriving AFTER the operator has typed a title, a
+// description and a priority — and losing all of it. Each is a local refusal now.
+
+await test('BEHAVIOUR: "-"/"none" no longer opt out — the bucket they opted into is gone', () => {
+  for (const decline of ['-', 'none', 'NONE']) {
+    const r = triage.applyGoalAnswer(1000071, decline);
+    assert.equal(r.ok, false, `"${decline}" must not resolve`);
+    assert.equal(r.goalId, null);
+    assert.match(r.warn, /no longer exists|must name a real goal/,
+      `"${decline}" must say the bucket is gone, not merely refuse`);
+    assert.doesNotMatch(r.warn, /falling back/, 'nothing falls back any more');
+  }
+});
+
+await test('BEHAVIOUR: blank with NO default refuses rather than sending null', () => {
+  const r = triage.applyGoalAnswer(null, '');
+  assert.equal(r.ok, false, 'no default and no answer is not a decision');
+  assert.match(r.warn, /a goal is required/);
+});
+
+await test('BEHAVIOUR: junk REFUSES rather than downgrading a typo into a decision', () => {
   for (const junk of ['abc', '12.5', '-4', '0', 'goal 7']) {
     const r = triage.applyGoalAnswer(1000071, junk);
-    assert.equal(r.goalId, null, `"${junk}" must not resolve to a goal`);
-    assert.match(r.warn, /general bucket/, `"${junk}" must say where it will land instead`);
+    assert.equal(r.ok, false, `"${junk}" must not resolve to a goal`);
+    assert.equal(r.goalId, null);
+    assert.match(r.warn, /not a goal id/, `"${junk}" must name the problem`);
+    assert.doesNotMatch(r.warn, /general bucket/, 'and must not offer a bucket that no longer exists');
   }
   // Number('') is 0 and Number(' ') is 0 — both would silently become goal 0
   // without the blank check above running first. Guarding the pair together.
   assert.equal(triage.applyGoalAnswer(9, '').goalId, 9);
 });
 
-await test('BEHAVIOUR: createTask puts goal_id on the body, and omits it entirely when null', async () => {
+await test('BEHAVIOUR: createTask refuses to post without a goal, at its own call site', async () => {
+  // The prompt loop re-asks until it has a real id, so the only route here with
+  // null is a NEW call site that forgot — which should fail at its author rather
+  // than as a 400 in production.
+  await assert.rejects(
+    () => triage.createTask({ versionId: 'BV1', title: 't', description: '', priority: 3, sourceRef: null }),
+    /goal_id is required/,
+  );
+});
+
+await test('BEHAVIOUR: createTask puts goal_id on the body, and REFUSES when it is null', async () => {
   const seen = [];
   const fakeClient = {
     tasks: { postTasks: async (req) => { seen.push(req.body); return { ok: true, data: { task: { id: 7 } } }; } },
@@ -157,12 +189,18 @@ await test('BEHAVIOUR: createTask puts goal_id on the body, and omits it entirel
     // object cannot reach it — re-require in a fresh registry instead.
     const fresh = freshTriage();
     await fresh.createTask({ versionId: 'BV1', title: 't', description: 'd', priority: 3, sourceRef: 'idea:1', goalId: 1000071 });
-    await fresh.createTask({ versionId: 'BV1', title: 't', description: 'd', priority: 3, sourceRef: 'idea:2' });
     assert.equal(seen[0].goal_id, 1000071, 'the goal must reach the server');
-    assert.ok(!('goal_id' in seen[1]),
-    'and opting out must send NO goal_id key — the server\'s catch-all only applies on absent');
     assert.equal(seen[0].source, 'idea_inbox', 'provenance still travels');
     assert.equal(seen[0].status, 'backlog');
+    // BV1.R22 (task 1003609): omitting the goal used to send no goal_id key and let
+    // the server file it in the version catch-all. R11 deleted that catch-all, so a
+    // goal-less call is now a caller bug — and it must fail HERE, not as a 400 after
+    // the operator has typed everything.
+    await assert.rejects(
+      () => fresh.createTask({ versionId: 'BV1', title: 't', description: 'd', priority: 3, sourceRef: 'idea:2' }),
+      /goal_id is required/,
+    );
+    assert.equal(seen.length, 1, 'and nothing was posted for the goal-less call');
   } finally {
     cliLib.cliClient = realCliClient;
   }
@@ -192,8 +230,10 @@ await test('BEHAVIOUR: a failed create throws with the status, it does not retur
 // ---- 4. both paths send goal_id -------------------------------------------
 
 await test('BOTH PATHS: the CLI createTask and the hall payload each send goal_id', () => {
-  assert.match(TRIAGE, /if \(goalId != null\) body\.goal_id = Number\(goalId\);/,
+  assert.match(TRIAGE, /body\.goal_id = Number\(goalId\);/,
     'CLI: goal_id must reach the create body');
+  assert.doesNotMatch(TRIAGE, /if \(goalId != null\) body\.goal_id/,
+    'CLI: and unconditionally — a conditional send is what made a goal-less create look survivable');
   assert.match(TRIAGE, /async function createTask\(\{[^}]*goalId/,
     'CLI: createTask must accept it rather than ignore the caller');
   assert.match(HALL, /payload\.goal_id = Number\(form\.goal\.value\)/,
@@ -234,31 +274,46 @@ await test('the suggester default shows score + matched terms so it can be judge
 
 // ---- 2. opting out is explicit ------------------------------------------
 
-await test('OPT-OUT: the prompt itself offers the way out, and the branch delegates the meaning', () => {
+// BV1.R22 (task 1003609) removed the opt-out from BOTH surfaces, because the
+// bucket it opted into no longer exists. These three tests pinned the affordance;
+// they now pin its ABSENCE, which is the assertion that actually protects the
+// invariant — a re-added opt-out would silently start producing 400s again.
+
+await test('OPT-OUT: the CLI prompt RE-ASKS instead of offering a bucket that is gone', () => {
   const branch = TRIAGE.slice(TRIAGE.indexOf('const gd = await resolveGoalDefault'), TRIAGE.indexOf('const task = await createTask'));
-  assert.match(branch, /general bucket/, 'the prompt has to say where opting out lands');
+  assert.doesNotMatch(branch, /general bucket/, 'there is no general bucket to offer');
   assert.match(branch, /applyGoalAnswer\(gd\.goalId, goalAns\)/,
     'the branch must delegate to the tested helper, not re-implement the parsing inline');
-  assert.match(branch, /picked\.warn/, 'and surface its warning');
+  assert.match(branch, /picked\.ok/, 'and act on its verdict');
+  assert.match(branch, /picked\.warn/, 'and surface its reason');
+  assert.match(branch, /for \(;;\)/, 'a refusal re-asks rather than falling through');
+  assert.match(branch, /'s'/, "and skipping stays available, so one unplaceable idea cannot wedge the run");
   assert.match(branch, /resolveGoalDefault\(\{ \.\.\.idea, title \}, versionId\)/,
     'the suggester must see the title the operator just confirmed, not the filed one');
-  // The semantics themselves are covered by the BEHAVIOUR block above — this
-  // only pins that main() is actually wired to them.
 });
 
-await test('OPT-OUT: the hall names where opting out actually lands, and only defaults to it last', () => {
+await test('OPT-OUT: the hall offers no empty goal, and refuses one before it posts', () => {
   const fn = HALL.slice(HALL.indexOf('async function goalOptionsFor'), HALL.indexOf('async function renderPromote'));
-  // "— no goal —" would be a lie: the server files a goal_id-less create under
-  // the version's catch-all. The label has to say so.
-  assert.match(fn, /general bucket/);
-  assert.ok(!/— no goal —/.test(fn), 'the honest label replaced the misleading one');
-  assert.match(fn, /opts\.length === 0 \? ' selected' : ''/, 'the opt-out is the fallback, not the default');
-  assert.match(fn, /a choice rather than the silent default/, 'and the intent is stated');
+  // Scoped to the emitted <option> markup: the code comment above it explains WHY
+  // the bucket is gone and must be allowed to name it.
+  const optionMarkup = fn.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.doesNotMatch(optionMarkup, /general bucket/, 'the bucket is gone from the label too');
+  assert.ok(!/— no goal —/.test(fn), 'and no misleading "no goal" option came back');
+  // What remains when nothing is suggested must be a PLACEHOLDER, not a value:
+  // `disabled` is what stops a blank-looking select from being submittable.
+  assert.match(fn, /selected disabled/, 'the empty row is an unsubmittable placeholder');
+  const submit = HALL.slice(HALL.indexOf('async function submitPromote'), HALL.indexOf('function renderMerge'));
+  assert.match(submit, /form\.goal\.value === ''/, 'and the submit refuses an empty goal');
+  assert.match(submit, /payload\.goal_id = Number\(form\.goal\.value\)/,
+    'goal_id is sent unconditionally now, not behind an if');
+  assert.doesNotMatch(submit, /if \(form\.goal && form\.goal\.value !== ''\) payload\.goal_id/,
+    'the conditional send is what made an empty select look survivable');
 });
 
-await test('the CLI result line names the goal, or says the task fell into the general bucket', () => {
-  assert.match(TRIAGE, /goal \$\{goalId\}` : ', → general bucket'/,
-    'where it landed must be visible in the output, both ways');
+await test('the CLI result line names the goal it landed in', () => {
+  assert.match(TRIAGE, /P\$\{priority\}, goal \$\{goalId\}/,
+    'where it landed must be visible in the output');
+  assert.doesNotMatch(TRIAGE, /→ general bucket/, 'and there is no second way for it to land');
 });
 
 // ---- 3. degrades, never blocks -----------------------------------------

package/tests/publish_reconciler.mjs

@@ -1651,13 +1651,43 @@ test('vector 2: shipped_at is stamped ONLY by shipTask, and shipTask requires co
   // task 1003204: the lifecycle data layer is db.js + db-*.js now — read the family.
   const dbSrc = lifecycleDbSource();
 
-  // Every statement that writes shipped_at, ignoring SELECT projections and comments.
-  const writes = [...dbSrc.matchAll(/shipped_at\s*=\s*now\(\)/g)];
-  assert.equal(writes.length, 1,
-    `shipped_at is written in ${writes.length} places — a second stamp site is how the grader-bypass vector reopens`);
+  // Every statement that writes a TASK's shipped_at, ignoring SELECT projections
+  // and comments.
+  //
+  // THE TABLE MATTERS, and this guard learned that the hard way (BV1.R12, task
+  // 1003599). `versions` has a `shipped_at` too, and the version-close route
+  // stamps it — a legitimate write on a different table that has nothing to do
+  // with the grader-bypass vector. A bare /shipped_at = now()/ over the whole
+  // lifecycle db family counted it as a second TASK stamp site and reddened main.
+  //
+  // Widening the count to 2 would have been the wrong repair: it buys silence
+  // now and re-opens the hole the moment a third site appears anywhere. What this
+  // guard is actually about is stated in its own comment above — "no other write
+  // path can stamp shipped_at ON A TASK" — so the fix is to say `tasks`, not to
+  // raise the number. Each match is attributed to the nearest preceding UPDATE
+  // target, and only `tasks` counts.
+  const stamps = [...dbSrc.matchAll(/shipped_at\s*=\s*now\(\)/g)];
+  const taskStamps = stamps.filter((m) => {
+    const before = dbSrc.slice(0, m.index);
+    const lastUpdate = before.lastIndexOf('UPDATE ');
+    if (lastUpdate === -1) return false;
+    return /^UPDATE\s+tasks\b/.test(before.slice(lastUpdate));
+  });
+  assert.equal(taskStamps.length, 1,
+    `a task's shipped_at is written in ${taskStamps.length} places — a second stamp site is how the grader-bypass vector reopens`);
+  // And the attribution itself must be working: if the regex above ever stopped
+  // matching the real site, `taskStamps` would be 0 and the assert would still be
+  // meaningful — but a silent 0 total would mean the family moved and this guard
+  // is now watching nothing at all.
+  assert.ok(stamps.length >= 1, 'no shipped_at stamp found anywhere — the lifecycle db family moved and this guard is blind');
 
   // …and that one site is guarded on the confirmed state.
-  const stampIdx = dbSrc.indexOf('shipped_at = now()');
+  // Anchored on the ATTRIBUTED task stamp, not `indexOf` — with two shipped_at
+  // sites in the family, "the first one in file order" is whichever file the
+  // carve happens to concatenate first, and that is not a property anyone is
+  // maintaining. The versions stamp has no `status = 'confirmed'` guard and
+  // should not: it is a different table with a different rule.
+  const stampIdx = taskStamps[0].index;
   const window = dbSrc.slice(stampIdx, stampIdx + 500);
   assert.match(window, /WHERE id = \$1 AND status = 'confirmed'/,
     'the stamp must refuse any task not already confirmed — that is what stops a confirm-time ship');

package/tests/task_detail_ui.mjs

@@ -259,7 +259,7 @@ await test('opening Promote loads open versions only, and preselects the idea\'s
   assert.equal(vsel.value, 'BV2', 'the idea\'s suggested_version is honoured');
 });
 
-await test('the goal picker leads with the STORED hint, then the suggester, then the opt-out', async () => {
+await test('the goal picker leads with the STORED hint, then the suggester — and offers NO opt-out', async () => {
   const h = await boot();
   await h.clickGo('promote');
   const opts = h.goalSelect().querySelectorAll('option');
@@ -268,7 +268,14 @@ await test('the goal picker leads with the STORED hint, then the suggester, then
   assert.match(opts[0].textContent, /carried from the filing/);
   assert.equal(opts[1].attrs.value, '1000062', 'the suggester fills in below it');
   assert.match(opts[1].textContent, /matched: promote, merge/, 'with the evidence for judging it');
-  assert.equal(opts[opts.length - 1].attrs.value, '', 'the opt-out is always available');
+  // BV1.R22 (task 1003609) DELETED the trailing opt-out, and this assertion
+  // flipped with it. R11 (task 1003598) removed db.createTask's catch-all
+  // fallback and made goal_id required, so an empty selection stopped meaning
+  // "file it in the version's general bucket" and started meaning a server 400
+  // landing on a builder who had already filled the form. A choice that always
+  // fails is worse than no choice.
+  assert.equal(opts.filter((o) => o.attrs.value === '').length, 0,
+    'no empty-valued option may be offered once a goal is required — it could only ever 400');
 });
 
 await test('with no stored hint the top suggestion is preselected instead', async () => {
@@ -277,12 +284,19 @@ await test('with no stored hint the top suggestion is preselected instead', asyn
   assert.equal(h.goalSelect().value, '1000062', 'the suggester supplies the default when nothing was named');
 });
 
-await test('a suggester outage degrades to the opt-out rather than blocking the verdict', async () => {
+await test('a suggester outage degrades to a DISABLED placeholder that says what to do', async () => {
   const h = await boot({ suggestThrows: true, idea: { ...DEFAULT_IDEA, suggested_goal_id: null } });
   await h.clickGo('promote');
   const opts = h.goalSelect().querySelectorAll('option');
-  assert.equal(opts.length, 1, 'only the opt-out remains');
-  assert.equal(h.goalSelect().value, '', 'and it is selected, so the form is still submittable');
+  assert.equal(opts.length, 1, 'only the placeholder remains');
+  // Before BV1.R22 this row was a submittable opt-out and this test said so. It
+  // is now a PLACEHOLDER, not a value: `disabled`, so the select can never be
+  // blank-but-valid-looking, and the text tells the builder where to go instead.
+  // The old assertion passed either way, because it never checked `disabled` —
+  // which is exactly how a contract change hides inside a green test.
+  assert.ok('disabled' in opts[0].attrs, 'the placeholder must not be submittable');
+  assert.match(opts[0].textContent, /open the goal board and pick one/,
+    'a builder with no suggestion is told what to do, not handed a choice that fails');
 });
 
 await test('promote with a goal chosen POSTs goal_id, then marks the idea promoted', async () => {
@@ -320,14 +334,27 @@ await test('the title survives escaping — what the form renders is what gets c
     'quotes and angle brackets must round-trip through the value attribute unmangled');
 });
 
-await test('promote opting OUT of a goal sends no goal_id key at all', async () => {
+await test('there is no way to promote WITHOUT a goal any more', async () => {
+  // THIS TEST'S PREMISE INVERTED at BV1.R22 (task 1003609). It used to assert
+  // that clearing the picker sent no `goal_id` key, because an absent key meant
+  // "the version's general bucket". R11 (task 1003598) deleted that bucket and
+  // made `goal_id` required, so the behaviour it pinned is now a 400 — and the
+  // test itself crashed with a TypeError once the option it selected stopped
+  // existing, which is what surfaced this.
+  //
+  // What replaces it is the invariant that actually matters now: the form cannot
+  // be made to submit without a goal. Deleting the test outright would leave that
+  // unguarded.
   const h = await boot();
   await h.clickGo('promote');
-  h.goalSelect().value = '';
+  const opts = h.goalSelect().querySelectorAll('option');
+  const submittableBlank = opts.filter((o) => o.attrs.value === '' && !('disabled' in o.attrs));
+  assert.equal(submittableBlank.length, 0, 'no blank option may be both offered and submittable');
+  // And the picker's default is a real goal, so an untouched form is already valid.
+  assert.ok(h.goalSelect().value, 'the picker opens on a real goal, never on nothing');
   await h.submitForm('promote');
   const body = h.requestsTo('POST', /\/tasks$/)[0].body;
-  assert.ok(!('goal_id' in body),
-    'the version\'s general bucket applies only on an ABSENT key — sending null or "" would be a different create');
+  assert.ok('goal_id' in body && body.goal_id, 'every promote now names a goal');
 });
 
 await test('an empty title is refused in the browser, before a doomed request', async () => {

package/tests/version_close_route.mjs

@@ -0,0 +1,261 @@
+// tests/version_close_route.mjs — a version can finally close
+// (BV1.R12, task 1003599, goal 1000086, ADR 0250 D5, ADR 0263 §5).
+//
+// THE HOLE. Tasks close, criteria close, goals close — and a version only ever
+// moved by hand-run SQL on the droplet. `scripts/gds/version-close.js` still
+// prints that the API exposes no version status transitions, and the
+// `version.close` permission has sat at the archon floor since BV1.R105 with
+// NOTHING referencing it. A thing with no closing move does not close, which is
+// how two versions ended up building on one project at the same time.
+//
+// Two things this file is careful about, because both are places a correct
+// planner and a correct writer still add up to a broken endpoint:
+//
+//   THE MAINTENANCE GOAL IS FILTERED BY THE READ, not by the planner. It is
+//   exempt from the close count and always carries forward (ADR 0263 §7), so it
+//   must never appear in a refusal asking the caller to decide about it — asking
+//   someone to disposition a goal they are not allowed to disposition is worse
+//   than not asking.
+//
+//   ROLL_FORWARD WITHOUT A PLANNING VERSION IS A REFUSAL, never an auto-create.
+//   Cutting the successor implicitly inside a close is exactly the "fake hotfix
+//   version" ADR 0250 §3 built the override counter to prevent.
+//
+// Run:  node tests/version_close_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { planVersionClose, rollForwardNeedsPlanningVersion } = require('../modules/lifecycle/routes/version-route-authz.js');
+const { closeVersion, maintenanceGoalExemptSql, openNonMaintenanceGoals } = require('../modules/lifecycle/db.js');
+const { test, summary } = makeRunner();
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const BUILDING = { id: 'BONGOS-V1', status: 'building' };
+const GOALS = (...n) => n.map((i) => ({ id: String(i), title: `goal ${i}`, open_tasks: 0 }));
+const plan = (over = {}) => planVersionClose({ version: BUILDING, openGoals: GOALS(1, 2), reason: 'V1 is done', ...over });
+
+function txPool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { connect: c.connect, query: (sql, p) => c._client.query(sql, p), queries: c._client.queries };
+}
+const flat = (q) => String(q.sql).replace(/\s+/g, ' ').trim();
+
+// ---- only a building version closes ----------------------------------------
+
+await test('a missing version is a 404, not a refusal about its state', () => {
+  const r = planVersionClose({ version: null });
+  assert.equal(r.ok, false); assert.equal(r.status, 404); assert.equal(r.body.error, 'version_not_found');
+});
+
+await test('only a BUILDING version closes — every other status is refused BY NAME', () => {
+  for (const status of ['planning', 'shipped', 'frozen', 'nonsense', null]) {
+    const r = planVersionClose({ version: { id: 'V', status } });
+    assert.equal(r.ok, false, `'${status}' must not close`);
+    assert.equal(r.body.error, 'version_not_building');
+    assert.equal(r.body.status, status, 'the refusal says WHICH status refused, rather than asserting one');
+  }
+});
+
+await test('a building version holding nothing open closes in ONE call', () => {
+  const r = planVersionClose({ version: BUILDING, openGoals: [] });
+  assert.equal(r.ok, true);
+  assert.deepEqual(r.plan, [], 'and needs no reason — nothing is being cut');
+});
+
+// ---- the two-step ----------------------------------------------------------
+
+await test('open goals refuse with a NAMED 409 that RETURNS the goals', () => {
+  const r = plan({ dispositions: null });
+  assert.equal(r.status, 409);
+  assert.equal(r.body.error, 'version_holds_open_goals');
+  assert.deepEqual(r.body.details.goals.map((g) => g.id), ['1', '2'],
+    'the caller decides per goal, so the goals travel with the refusal');
+});
+
+await test('a partial map is refused — nothing is carried or cut by omission', () => {
+  const r = plan({ dispositions: { 1: { verb: 'abandon' } } });
+  assert.equal(r.ok, false);
+  assert.equal(r.body.error, 'disposition_incomplete');
+  assert.deepEqual(r.body.details.goals.map((g) => g.id), ['2'], 'and it names which');
+});
+
+await test('cutting a goal without a reason is refused — the silent discard, one tier up', () => {
+  for (const reason of ['', '  ', null, undefined]) {
+    const r = plan({ dispositions: { 1: { verb: 'abandon' }, 2: { verb: 'abandon' } }, reason });
+    assert.equal(r.ok, false, `reason ${JSON.stringify(reason)} must not pass`);
+    assert.equal(r.body.error, 'close_reason_required');
+  }
+});
+
+await test('only roll_forward and abandon are verbs', () => {
+  for (const verb of ['carry', 'ROLL_FORWARD', 'delete', '', null, 7]) {
+    const r = plan({ dispositions: { 1: { verb }, 2: { verb: 'abandon' } } });
+    assert.equal(r.ok, false, `verb ${JSON.stringify(verb)} must not pass`);
+    assert.equal(r.body.error, 'bad_disposition');
+  }
+});
+
+await test('a complete map plans one step per goal, in the order the goals came in', () => {
+  const r = plan({ dispositions: { 1: { verb: 'roll_forward' }, 2: { verb: 'abandon' } } });
+  assert.equal(r.ok, true);
+  assert.deepEqual(r.plan, [{ goalId: 1, verb: 'roll_forward' }, { goalId: 2, verb: 'abandon' }]);
+});
+
+// ---- roll_forward needs somewhere to go ------------------------------------
+
+await test('roll_forward with NO planning version is refused, never auto-created', () => {
+  const r = rollForwardNeedsPlanningVersion({ plan: [{ goalId: 1, verb: 'roll_forward' }], planning: [] });
+  assert.ok(r, 'it must refuse');
+  assert.equal(r.status, 409);
+  assert.equal(r.body.error, 'no_planning_version');
+  assert.match(r.body.message, /Scope the next version first/,
+    'and say what to do — auto-cutting one here is the escape hatch ADR 0250 closed');
+});
+
+await test('an all-abandon close needs no planning version at all', () => {
+  assert.equal(rollForwardNeedsPlanningVersion({ plan: [{ goalId: 1, verb: 'abandon' }], planning: [] }), null);
+});
+
+await test('roll_forward WITH a planning version proceeds', () => {
+  assert.equal(rollForwardNeedsPlanningVersion({
+    plan: [{ goalId: 1, verb: 'roll_forward' }], planning: [{ id: 'BONGOS-V2' }],
+  }), null);
+});
+
+// ---- the maintenance exemption ---------------------------------------------
+
+await test('the exemption has ONE definition, and the open-goals read is its only caller', () => {
+  // R18 (task 1003605) swaps this body for `NOT g.is_maintenance` once the column
+  // exists. One call site is what makes that a one-line change instead of a hunt.
+  assert.equal(maintenanceGoalExemptSql('$1'), "g.title <> ($1 || ' — maintenance')");
+  const dbv = src('modules/lifecycle/db-versions.js');
+  const uses = (dbv.match(/maintenanceGoalExemptSql\(/g) || []).length;
+  assert.equal(uses, 3, 'declaration + the open-goals read + the post-apply re-count, and nothing else');
+});
+
+await test('the open-goals read excludes the maintenance goal and counts unfinished work', async () => {
+  const pool = txPool(() => ({ rows: [] }));
+  await openNonMaintenanceGoals('BONGOS-V1', { pool });
+  const q = flat(pool.queries[0]);
+  assert.match(q, /maintenance/, 'the maintenance goal must not be offered for disposition');
+  assert.match(q, /status = 'open'/);
+  assert.match(q, /open_tasks/, 'each goal carries how much work it still holds — most of the decision');
+  assert.match(q, /NOT IN \('shipped', 'abandoned'\)/, 'and counts it with the shared terminal set');
+});
+
+// ---- the write is one transaction ------------------------------------------
+
+function closePool({ status = 'building', goalStatus = 'open', remaining = 0 } = {}) {
+  return txPool((sql) => {
+    const q = String(sql).replace(/\s+/g, ' ');
+    if (/FROM versions WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: 'V1', status }] };
+    if (/FROM goals WHERE id = \$1 AND version_id = \$2 FOR UPDATE/.test(q)) return { rows: [{ id: 1, title: 'g', status: goalStatus }] };
+    if (/UPDATE tasks SET status = 'abandoned'/.test(q)) return { rows: [{ id: 11 }, { id: 12 }] };
+    if (/count\(\*\)::int AS n FROM goals/.test(q)) return { rows: [{ n: remaining }] };
+    if (/UPDATE versions SET status = 'shipped'/.test(q)) return { rows: [{ id: 'V1', status: 'shipped' }] };
+    return { rows: [] };
+  });
+}
+
+await test('the whole close runs inside ONE transaction, version locked first', async () => {
+  const pool = closePool();
+  const out = await closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'abandon' }], reason: 'done' }, { pool });
+  assert.equal(out.version.status, 'shipped');
+  assert.deepEqual(out.applied, [{ goal_id: '1', verb: 'abandon', result: 'archived', tasks_abandoned: 2 }]);
+  const sqls = pool.queries.map(flat);
+  assert.equal(sqls.filter((q) => q === 'BEGIN').length, 1);
+  assert.equal(sqls.filter((q) => q === 'COMMIT').length, 1);
+  const lock = sqls.findIndex((q) => /FROM versions WHERE id = \$1 FOR UPDATE/.test(q));
+  const firstWrite = sqls.findIndex((q) => /^UPDATE tasks/.test(q));
+  assert.ok(lock !== -1 && lock < firstWrite, 'lock the version, then apply — a goal must not be created mid-close');
+  assert.ok(sqls.findIndex((q) => /UPDATE versions SET status = 'shipped'/.test(q)) < sqls.indexOf('COMMIT'));
+});
+
+await test('an abandoned goal takes its open tasks with it, stamped with the close reason', async () => {
+  const pool = closePool();
+  await closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'abandon' }], reason: 'cut in the ten-areas review' }, { pool });
+  const kill = pool.queries.find((q) => /UPDATE tasks SET status = 'abandoned'/.test(flat(q)));
+  assert.ok(kill, 'the tasks must not survive their goal');
+  assert.equal(kill.params[1], 'Abandoned: cut in the ten-areas review',
+    'the same stamp R14 writes — the ledger reads identically whichever door retired the work');
+  assert.match(flat(kill), /NOT IN \('shipped', 'abandoned'\)/, 'and only the unfinished ones');
+});
+
+await test('a roll_forward abandons NOTHING and says the successor is still pending', async () => {
+  const pool = closePool();
+  const out = await closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'roll_forward' }], reason: 'r' }, { pool });
+  assert.deepEqual(out.applied, [{ goal_id: '1', verb: 'roll_forward', result: 'carried_pending_successor' }]);
+  assert.equal(pool.queries.some((q) => /UPDATE tasks SET status = 'abandoned'/.test(flat(q))), false,
+    'carrying a goal forward must never cut its work');
+  assert.equal(pool.queries.some((q) => /UPDATE goals SET status = 'archived'/.test(flat(q))), false);
+});
+
+await test('a carried goal is EXCLUDED from the post-apply re-count, or a close could never carry anything', async () => {
+  const pool = closePool();
+  await closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'roll_forward' }], reason: 'r' }, { pool });
+  const recount = pool.queries.find((q) => /count\(\*\)::int AS n FROM goals/.test(flat(q)));
+  assert.match(flat(recount), /NOT \(g\.id = ANY\(\$2::bigint\[\]\)\)/);
+  assert.deepEqual(recount.params[1], [1], 'the carried goal is expected to still be open');
+});
+
+await test('the re-check runs against committed state and rolls back rather than half-closing', async () => {
+  const pool = closePool({ remaining: 2 });
+  await assert.rejects(
+    closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'abandon' }], reason: 'r' }, { pool }),
+    (e) => e.code === 'CLOSE_INCOMPLETE_AFTER_APPLY' && e.remaining === 2
+  );
+  const sqls = pool.queries.map(flat);
+  assert.ok(sqls.includes('ROLLBACK'));
+  assert.equal(sqls.some((q) => /UPDATE versions SET status = 'shipped'/.test(q)), false, 'the version is not closed');
+});
+
+await test('a version that stopped building mid-call rolls back', async () => {
+  const pool = closePool({ status: 'shipped' });
+  await assert.rejects(
+    closeVersion({ versionId: 'V1', plan: [], reason: 'r' }, { pool }),
+    (e) => e.code === 'VERSION_NOT_BUILDING' && e.versionStatus === 'shipped'
+  );
+  assert.ok(pool.queries.map(flat).includes('ROLLBACK'));
+});
+
+await test('the promotion seam runs INSIDE the transaction, after the flip', async () => {
+  // R20 (task 1003607) hooks here. ensureMaintenanceGoal returns null for a
+  // non-building version, so a carry-over run before the flip silently carries
+  // nothing — the ordering is load-bearing, not stylistic (ADR 0263 §8).
+  const pool = closePool();
+  let sawStatus = null; let ranAt = -1;
+  await closeVersion({ versionId: 'V1', plan: [], reason: 'r' }, {
+    pool,
+    onClosed: async (client) => { ranAt = pool.queries.length; sawStatus = 'called'; await client.query('SELECT 1 AS seam'); return { promoted: null }; },
+  });
+  const sqls = pool.queries.map(flat);
+  assert.equal(sawStatus, 'called', 'the seam must be offered');
+  assert.ok(sqls.findIndex((q) => /UPDATE versions SET status = 'shipped'/.test(q)) < ranAt, 'after the flip');
+  assert.ok(sqls.indexOf('SELECT 1 AS seam') < sqls.indexOf('COMMIT'), 'and before the commit');
+});
+
+// ---- the route is wired to all of it ---------------------------------------
+
+await test('the route declares its body, so a typo cannot read as "no map given"', () => {
+  const V = src('modules/lifecycle/routes/versions.js');
+  const route = V.slice(V.indexOf("router.post('/versions/:id/close'"));
+  assert.match(route, /validateOrRespond\(req, res, \{[\s\S]*?dispositions: \{ type: 'object' \}/);
+  assert.match(route, /requirePermission\('version\.close'\)/, 'behind the permission nothing referenced until now');
+  assert.match(route, /db\.openNonMaintenanceGoals\(versionId\)/, 'the maintenance goal is filtered by the READ');
+  assert.match(route, /rollForwardNeedsPlanningVersion/);
+  const planIdx = route.indexOf('planVersionClose(');
+  const writeIdx = route.indexOf('db.closeVersion(');
+  assert.ok(planIdx !== -1 && writeIdx !== -1 && planIdx < writeIdx, 'decide, then write');
+});
+
+await test('version-close.js no longer being the only door is R23; this route exists for it to call', () => {
+  const V = src('modules/lifecycle/routes/versions.js');
+  assert.match(V, /router\.post\('\/versions\/:id\/close'/, 'the route the CLI will drive');
+});
+
+summary();