@bongos/core 1.19.595 → 1.19.597

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.595",
-  "core_contract": "1.19.595",
-  "source_commit": "a1220b0dc87149660de2f175e060db4787c57d95",
+  "core_version": "1.19.597",
+  "core_contract": "1.19.597",
+  "source_commit": "1015d778d266d3357eaffb989262715110662ad1",
   "source_ref": "HEAD",
-  "built_at": "2026-09-08T03:53:33.643Z",
+  "built_at": "2026-09-08T04:16:25.146Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 457,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2069,
+    "functional_verbatim": 2073,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2550,
-  "tree_sha256": "1730277de39b60195174936924ed1d436cd316ee03525ed50ffb9a1f7b471b88",
+  "file_count": 2554,
+  "tree_sha256": "47e446b7dc9ebe46479e9138f5c45722dd3aa0c70e847abc587415af364f4d0b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2727,7 +2727,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f099ee2077bfb6280355522ce1784f9ebbd78af3ea86334c47cba35745de576b"
+      "sha256": "adfc4f65fbe9fc3265ec5599eb55dbe4c25063ae382006530df8c96ed930fc67"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3734,6 +3734,16 @@
       "mode": "0000644",
       "sha256": "ca03e583bc418f600c1b1ba464bcaf4e380916033ec06cd68990cf153184d883"
     },
+    {
+      "path": "migrations/core_234_goals_is_maintenance.sql",
+      "mode": "0000644",
+      "sha256": "92964dc3578fb2f4b1b7547867d0f53b2998c30bdb39271336e9b9aa348a1b37"
+    },
+    {
+      "path": "migrations/core_235_one_maintenance_goal_per_version.sql",
+      "mode": "0000644",
+      "sha256": "c10c4bbbead4a3bafde336f3433a1432818880751f7a21436a6162f0dbde1abf"
+    },
     {
       "path": "modules/agents/lib/validate.js",
       "mode": "0000644",
@@ -5522,7 +5532,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "6e8235a4025951f82644f4a058a56ee4052d33e3b8b68a7c27d8ce42a0b81b19"
+      "sha256": "c3e06daaf78911c9dc44f72aa7a104f269624c92f343cd808b2962076a641a23"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5557,12 +5567,12 @@
     {
       "path": "modules/lifecycle/db-versions.js",
       "mode": "0000644",
-      "sha256": "09513924d1a97c4e5c2c84c3e55bcadb91159bf309ece479555b6b7a833188c7"
+      "sha256": "9d909149be4152335f6d259a32621c2e3917e98c2595ac1c8ff0d2202891dbcb"
     },
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "75a42d39fe676e0447cead0717a4f832b5296308e786037f5d44ee35593234c6"
+      "sha256": "14c05469abcf349c9173a80059e7fa0dd880b1b5a0b25680ba0d9e524e46d5d9"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -7612,12 +7622,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4245af0512df1399ba99da46a0e4da17e409cef4d34e1e79e80ed8925ba23ce4"
+      "sha256": "0318db53e76bb62b788fce5bf7dfd540e606e3fdcd1ab1e205732deba3a4bf03"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "39e40d2363abc4576a965c2ba46946f62687ce1351ce962341924fd334cc7941"
+      "sha256": "8d5d6869dab12ea697b5e0fae60883aabd464ae4568a47bc997a21cb8933cb59"
     },
     {
       "path": "public-docs/index.html",
@@ -9332,7 +9342,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "50aed74cd31d7a8390994722d3a7ccbbbb056aff57b6324d7204e179170293da"
+      "sha256": "2cb11336e7f6bde05dafd46c2ea3b94d9e5c7ae1f9be772a49b793e17baf7f0d"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10722,7 +10732,7 @@
     {
       "path": "tests/government_seed.mjs",
       "mode": "0000644",
-      "sha256": "f798fe7edf69245324938587dca3682874495b7bf950f0c0e5165b2bb0eadd4e"
+      "sha256": "6fa11446c88018ab6e62a72756f96f176bfaf6cd6099dc231746645ba0f538d2"
     },
     {
       "path": "tests/government_session_scope.mjs",
@@ -11279,10 +11289,20 @@
       "mode": "0000644",
       "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
     },
+    {
+      "path": "tests/maintenance_carry_forward.mjs",
+      "mode": "0000644",
+      "sha256": "4ac9164b84ad7bf8e9c1b45e7cb5e157762c992ddde16041410a528a534e60f5"
+    },
     {
       "path": "tests/maintenance_goal.mjs",
       "mode": "0000644",
-      "sha256": "645fe3e9093abcb1425a59602d6a92a6d90669775aa3503ae435a54c79eca5c1"
+      "sha256": "aa0d19a1d9c2f5ae9e89a77ef8e5c485f0f759e6a36dab988c8c49f0f2b59d27"
+    },
+    {
+      "path": "tests/maintenance_goal_flag.mjs",
+      "mode": "0000644",
+      "sha256": "37356bcd78ff92537a5512b60f2274d573b6c90bb30f5deca006a14d4841fc95"
     },
     {
       "path": "tests/manage_manifest_shared_read.mjs",
@@ -12682,7 +12702,7 @@
     {
       "path": "tests/version_close_route.mjs",
       "mode": "0000644",
-      "sha256": "11c77cc535ecd86bc50ea962835b74672ff3a0d8093d8ce3007586a5873b4201"
+      "sha256": "9a5b8f753c4b898b447b257d64c0034a83fe257c23208ce714e2e469fcaf735d"
     },
     {
       "path": "tests/version_literals.mjs",

package/docs/module-api-changelog.md

@@ -1639,5 +1639,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.593 with no explicit bump. run 34184562228. (task 1002620)
   1.19.595 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.594 with no explicit bump. run 34185042811. (task 1002620)
+  1.19.596 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.595 with no explicit bump. run 34185477798. (task 1002620)
+  1.19.597 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.596 with no explicit bump. run 34186368179. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_234_goals_is_maintenance.sql

@@ -0,0 +1,57 @@
+-- core_234_goals_is_maintenance.sql — say which goal is the version's maintenance
+-- goal in a COLUMN, not in its title (BV1.R18, task 1003605, goal 1000086,
+-- ADR 0263 §7).
+--
+-- WHY THIS IS LOAD-BEARING AND NOT COSMETIC. Until now the maintenance goal was
+-- matched by title — `ensureMaintenanceGoal` (task 1003691) looks up
+-- `"<version> — maintenance"` and its own comment flagged this task as the debt.
+-- For ROUTING a bug that is a provenance wrinkle: the worst case is a
+-- hand-titled goal receiving a defect. For the CLOSE COUNT it is far worse.
+-- `maintenanceGoalExemptSql` decides which goals hold a VERSION open, so with a
+-- title match any Metic+ able to create a goal could name it
+-- `"BONGOS-V1 — maintenance"` and silently exempt it from the gate that decides
+-- when a version may close — widening scope by choosing a string. A boolean
+-- column cannot be spelled into existence.
+--
+-- THE BACKFILL IS BY TITLE, ONCE, and that is the only place the title match is
+-- allowed to survive: the rows that already exist were created by the title
+-- convention, so the convention is how they are identified — exactly once, here,
+-- with the schema then carrying the fact forward. `ensureMaintenanceGoal` stops
+-- reading titles in the same task.
+--
+-- NOT UNIQUE PER VERSION, deliberately. A partial unique index on
+-- (version_id) WHERE is_maintenance would be the tidy thing and would FAIL on any
+-- database that already has two title-matching goals for one version — which is
+-- possible, because `goals` has no unique constraint on (version_id, title) and
+-- the pre-lock window in migration 160's era could produce one. The find-or-create
+-- is already serialised by pg_advisory_xact_lock, and R18 makes it read the flag
+-- with LIMIT 1, so a duplicate is survivable rather than fatal. Adding the
+-- constraint is a follow-up that must first prove the data allows it — the same
+-- lesson core_233 recorded about the building-version index.
+--
+-- CORE, not modules/lifecycle/migrations/: `goals` is a CORE table (migration
+-- 160), and a module migration may only touch its own <key>_-prefixed objects —
+-- fitness.js checkModuleMigrationsAdditive hard-fails an `ALTER TABLE goals` from
+-- a module (ADR 0083 Decision #5).
+--
+-- Forward-safe: one additive column with a NOT NULL default, so old code on the
+-- new schema neither sees nor needs it (every reader SELECTs an explicit column
+-- list). A rollback leaves the column populated and unread.
+
+ALTER TABLE goals
+  ADD COLUMN IF NOT EXISTS is_maintenance boolean NOT NULL DEFAULT false;
+
+-- Backfill: every goal whose title is the maintenance convention for its own
+-- version. Anchored on the version id rather than a bare LIKE '%maintenance%',
+-- so a goal legitimately titled "Maintenance of the art pipeline" is untouched.
+UPDATE goals
+   SET is_maintenance = true
+ WHERE is_maintenance = false
+   AND title = version_id || ' — maintenance';
+
+-- Finding the version's maintenance goal is now a flag read on a hot-ish path
+-- (every homeless bug, every close count), so give it an index. Partial: the
+-- overwhelming majority of goals are not maintenance goals.
+CREATE INDEX IF NOT EXISTS goals_maintenance_by_version_idx
+    ON goals (version_id)
+ WHERE is_maintenance;

package/migrations/core_235_one_maintenance_goal_per_version.sql

@@ -0,0 +1,41 @@
+-- core_235_one_maintenance_goal_per_version.sql — make "one maintenance goal per
+-- version" a CONSTRAINT rather than a convention (task 1003708, BV1.R18b,
+-- goal 1000086, ADR 0263 §7).
+--
+-- WHAT core_234 LEFT OPEN. That migration added `goals.is_maintenance` and gave it
+-- a partial index for lookup speed, which is correct and is why this one is small.
+-- But the index is non-unique, so two goals on one version can both carry the flag
+-- — and `ensureMaintenanceGoal` (db-goals.js) is a find-or-create whose read is
+-- `WHERE version_id = $1 AND is_maintenance LIMIT 1`. With two flagged rows that
+-- `LIMIT 1` returns whichever the planner picks, and every homeless bug files into
+-- an arbitrary one of them, permanently.
+--
+-- That is EXACTLY the failure `pg_advisory_xact_lock` was taken for in task
+-- 1003691 — two bugs reported in the same second both reading "absent" and both
+-- inserting — arriving through a different door. The lock serialises the RACE; it
+-- cannot stop a second maintenance goal created any other way (a hand-set flag, a
+-- backfill on a version whose title convention drifted, a future feature). Moving
+-- from title to flag was the opportunity to make it a real constraint, because
+-- `goals` never had a unique constraint on (version_id, title) and the lock had
+-- been covering for that absence all along.
+--
+-- THE UPGRADE MAY FAIL, AND THAT IS THE POINT. If any version already has two
+-- flagged goals, this index cannot be created and the migration stops — loudly,
+-- before an ambiguous find-or-create becomes load-bearing. core_234's backfill
+-- keys on an exact title, so a duplicate is unlikely; if one exists it is a real
+-- data defect and the right response is to fix the rows, not to weaken the index.
+-- (Verified against live before writing this: no version has more than one.)
+--
+-- Replaces core_234's index rather than adding a second on the same expression:
+-- a UNIQUE index serves every read the plain one did, so keeping both would be
+-- two indexes doing one job.
+
+BEGIN;
+
+CREATE UNIQUE INDEX IF NOT EXISTS goals_one_maintenance_per_version_idx
+    ON goals (version_id)
+ WHERE is_maintenance;
+
+DROP INDEX IF EXISTS goals_maintenance_by_version_idx;
+
+COMMIT;

package/modules/lifecycle/db-goals.js

@@ -34,8 +34,13 @@ const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 // Shared column list so every goal read/return shapes a row identically.
 
+// `is_maintenance` (BV1.R18, task 1003605, migration core_234) rides the shared
+// list because it is a fact ABOUT the goal that several surfaces need to read —
+// the close count's exemption, and the hall, which should not render the one goal
+// nobody chose as though a person had scoped it. Additive: every consumer selects
+// this list, so nothing had to be found and changed.
 const GOAL_COLS =
-  'id, version_id, title, subtitle, description, scope_modules, status, visibility, accepting_requests, created_by, succeeded_by_goal_id, sort_order, category_id, created_at, updated_at';
+  'id, version_id, title, subtitle, description, scope_modules, status, visibility, accepting_requests, created_by, succeeded_by_goal_id, sort_order, category_id, is_maintenance, created_at, updated_at';
 
 // Shared column list for a goal_membership_requests row (task 1951 / ADR 0112) —
 // the invite / join-request queue behind private goals. Every helper below shapes
@@ -128,19 +133,26 @@ async function ensureMaintenanceGoal(versionId, deps = {}) {
 
   await exec.query(`SELECT pg_advisory_xact_lock(hashtext($1))`, [title]);
 
-  // MATCHED BY TITLE, because there is no column that says "this is the
-  // maintenance goal" — the same shape generalGoalIdForVersion uses for the
-  // catch-all, and it carries the same caveat: were a Metic+/Archon to hand-create
-  // a goal titled exactly this, routing would reuse THEIR goal and its scope
-  // rather than the zero-scope bucket below. That needs an already-trusted actor,
-  // so it is a provenance wrinkle rather than a way in, and task 1003605 (BV1.R18)
-  // is where a real flag belongs when the feature gets its own column.
+  // MATCHED BY FLAG since BV1.R18 (task 1003605, migration core_234). This used
+  // to match by TITLE, and its own comment called that "a provenance wrinkle
+  // rather than a way in" — true for routing, where the worst case was a
+  // hand-titled goal receiving a bug. It stopped being true once the same
+  // identification decided which goals hold a VERSION open
+  // (`maintenanceGoalExemptSql`): a Metic+ could then exempt a goal from the
+  // close gate by naming it. `goals.is_maintenance` cannot be spelled.
   //
-  // No index backs (version_id, title): goals are per-version and few, and this
-  // runs once per homeless bug. Revisit with R18 if either stops being true.
+  // LIMIT 1 with no unique constraint behind it is deliberate — see core_234 on
+  // why the partial unique index is a follow-up rather than part of this
+  // migration. The advisory lock above is what keeps this find-or-create from
+  // racing itself; the LIMIT is what keeps a pre-existing duplicate survivable
+  // instead of fatal. Ordered by id so the answer is at least stable.
+  //
+  // `goals_maintenance_by_version_idx` (core_234) backs this read.
   const { rows: found } = await exec.query(
-    `SELECT ${GOAL_COLS} FROM goals WHERE version_id = $1 AND title = $2 LIMIT 1`,
-    [versionId, title]
+    `SELECT ${GOAL_COLS} FROM goals
+      WHERE version_id = $1 AND is_maintenance
+      ORDER BY id LIMIT 1`,
+    [versionId]
   );
   if (found[0]) return found[0];
 
@@ -158,21 +170,142 @@ async function ensureMaintenanceGoal(versionId, deps = {}) {
   // split (sub-Metic lands 'backlog', never 'ready') and createTask's own derived
   // floor. Do not "fix" this by inventing a scope list — narrow the GRANT instead,
   // and write down why.
+  // is_maintenance = true is what makes this goal exempt from the version-close
+  // count (ADR 0263 §7) — set HERE, in the same statement that creates it, so a
+  // maintenance goal cannot exist unflagged for even one transaction. The title
+  // is still written to the convention, because it is what a person reads on the
+  // board; nothing decides anything from it any more.
   const { rows: made } = await exec.query(
-    `INSERT INTO goals (version_id, title, description, scope_modules, status, created_by, sort_order)
-     SELECT $1, $2, $3, $4, 'open', NULL, COALESCE(MAX(sort_order) + 1, 0)
+    `INSERT INTO goals (version_id, title, description, scope_modules, status, created_by, sort_order, is_maintenance)
+     SELECT $1, $2, $3, $4, 'open', NULL, COALESCE(MAX(sort_order) + 1, 0), true
        FROM goals WHERE version_id = $1
      RETURNING ${GOAL_COLS}`,
     [versionId, title,
       `Where a reported defect lands when its reporter named no goal (ADR 0262). ` +
-      `Auto-created by the bug-routing path; task 1003605 (BV1.R18) owns the rest of ` +
-      `the maintenance-goal feature — the close-exempt flag and carrying open bugs ` +
-      `forward to the successor version.`,
+      `Auto-created by the bug-routing path, flagged \`is_maintenance\` so it is exempt ` +
+      `from the version-close count and never holds a version open (ADR 0263 §7). Its ` +
+      `unfinished bugs carry forward to the successor version's maintenance goal.`,
       MAINTENANCE_SCOPE_MODULES]
   );
   return made[0] || null;
 }
 
+// carryBugsForward — move a closing version's unfinished defects into the
+// successor's maintenance goal (BV1.R18, task 1003605, goal 1000086, ADR 0263 §7).
+//
+// THE ONE GOAL THAT LEGITIMATELY SPANS VERSIONS. Every other goal is scoped to a
+// version and dies with it; the maintenance goal is where a defect against
+// already-shipped work lands, and defects do not respect a version boundary. ADR
+// 0250 §3 makes that a pressure valve — a bug must never need an Archon override
+// to be filed — and ADR 0263 §7 points out the valve only works if the queue
+// SURVIVES the boundary. A version close that left the open bugs in a shipped
+// version's goal would entomb them exactly where nobody looks, which is the 1000771
+// bug this whole path was built to end.
+//
+// RUNS ON THE CALLER'S CLIENT, inside the close transaction, and AFTER the
+// successor has been promoted to `building` — `ensureMaintenanceGoal` returns null
+// for a version that is not building, so a carry-over run before the promotion
+// silently carries nothing. That ordering is R20's (task 1003607) to keep; this
+// function fails loudly rather than quietly if it is broken.
+//
+// IT DOES NOT REFUSE AN ACTIVELY-CLAIMED TASK, and that is a deliberate divergence
+// from `archiveGoalWithDispositions` (R14), which does. The two are different acts:
+// archiving ABANDONS a task out from under whoever is working it, so refusing
+// protects them. Carrying forward only re-points which goal the task belongs to —
+// the claim references the task and is untouched, the builder loses nothing — and
+// refusing here would let one in-flight bug fix block a version from ever closing.
+// A close must not be hostage to a claim on a defect.
+//
+// Returns { fromGoalId, toGoalId, moved } — `moved` is 0 whenever there is nothing
+// to carry, which is the common case and is not an error.
+async function carryBugsForward({ fromVersionId, toVersionId }, deps = {}) {
+  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
+  if (fromVersionId == null || toVersionId == null) return { fromGoalId: null, toGoalId: null, moved: 0 };
+
+  // The source goal is read by FLAG, not created: a version that never received a
+  // homeless bug has no maintenance goal, and inventing one on the way out would
+  // leave an empty goal on a shipped version forever.
+  const { rows: from } = await exec.query(
+    `SELECT id FROM goals WHERE version_id = $1 AND is_maintenance ORDER BY id LIMIT 1`,
+    [fromVersionId]
+  );
+  if (!from[0]) return { fromGoalId: null, toGoalId: null, moved: 0 };
+
+  const to = await ensureMaintenanceGoal(toVersionId, deps);
+  if (!to) {
+    throw Object.assign(new Error('successor version cannot hold a maintenance goal'), {
+      code: 'CARRY_FORWARD_NO_DESTINATION', toVersionId,
+      hint: 'ensureMaintenanceGoal returns null unless the destination version is `building` — promote it before carrying forward (ADR 0263 §8).',
+    });
+  }
+
+  // Only the UNFINISHED ones move. A shipped or abandoned defect is history and
+  // belongs to the version it was fixed in — dragging it forward would make every
+  // successor's maintenance goal a growing archive of everything ever reported.
+  const { rows: moved } = await exec.query(
+    `UPDATE tasks SET goal_id = $2, updated_at = now()
+      WHERE goal_id = $1 AND ${nonTerminalSql('status')}
+      RETURNING id::text`,
+    [from[0].id, to.id]
+  );
+  return { fromGoalId: String(from[0].id), toGoalId: String(to.id), moved: moved.length };
+}
+
+// carryMaintenanceForward — move a closing version's unfinished maintenance work
+// into the successor's maintenance goal (BV1.R18, task 1003605, ADR 0263 §7).
+//
+// THE ONE GOAL THAT LEGITIMATELY SPANS VERSIONS. Every other goal either finishes
+// or is dispositioned at close (roll forward, or abandon — R12). A maintenance
+// goal is neither: it holds defects against already-shipped work, and those arrive
+// on their own schedule rather than on the version's. Cutting them because a
+// version ended would delete a bug queue for a reason that has nothing to do with
+// the bugs; making them need an override to survive would put a counted escape
+// hatch on the ordinary path, which is what ADR 0250 §3 built the counter to
+// prevent. So they move.
+//
+// RUNS ON THE CLOSE'S OWN CLIENT, inside its transaction, via the `deps.onClosed`
+// seam R12 left in closeVersion. Two things follow, both load-bearing:
+//
+//   The successor must ALREADY be `building` when this runs. `ensureMaintenanceGoal`
+//   returns null for a version in any other state, so a carry-over run before R20's
+//   promotion silently carries nothing and reports success. That is why the seam
+//   fires after the flip and why this asserts rather than assumes.
+//
+//   Nothing here may fail the close for want of a destination. A version with no
+//   successor (no planning version was scoped) closes with its maintenance work
+//   left where it is — visible on a shipped version, recoverable, and honest —
+//   rather than the close failing or the bugs being cut. Returns a summary saying
+//   which happened.
+//
+// The source goal is left ARCHIVED with nothing open, so it passes R10's own
+// check on the way out rather than being special-cased around it.
+async function carryMaintenanceForward({ fromVersionId, toVersionId }, deps = {}) {
+  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
+  const { rows: src } = await exec.query(
+    `SELECT id FROM goals WHERE version_id = $1 AND is_maintenance LIMIT 1`, [fromVersionId]
+  );
+  if (!src[0]) return { carried: 0, from: null, to: null, reason: 'no_maintenance_goal' };
+  if (!toVersionId) return { carried: 0, from: String(src[0].id), to: null, reason: 'no_successor' };
+
+  const dest = await ensureMaintenanceGoal(toVersionId, { client: exec });
+  // Null means the successor is not `building` — see the ordering note above. Do
+  // not "fix" this by relaxing ensureMaintenanceGoal's version gate: that gate is
+  // what stops a defect being filed into a shipped version's goal (the 1000771 bug).
+  if (!dest) return { carried: 0, from: String(src[0].id), to: null, reason: 'successor_not_building' };
+
+  const { rows: moved } = await exec.query(
+    `UPDATE tasks SET goal_id = $2, version_id = $3, updated_at = now()
+      WHERE goal_id = $1 AND ${nonTerminalSql()}
+        AND ${SMOKE_NOT_LIKE.replace(/title/, 'tasks.title')}
+      RETURNING id`,
+    [src[0].id, dest.id, toVersionId]
+  );
+  // The emptied goal closes behind them. Archived rather than achieved: it was
+  // never "done", it stopped being the live queue.
+  await exec.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [src[0].id]);
+  return { carried: moved.length, from: String(src[0].id), to: String(dest.id), reason: null };
+}
+
 // listVersionAdmissions (BV1.R07, task 1003594) — every goal admitted into ONE
 // version, newest first. ADR 0250 §3: "the overrides are counted and shown on the
 // version" — a visible counter is what keeps the exception honest, because an
@@ -1092,8 +1225,10 @@ async function listPendingRequestsForGoal(goalId, deps = {}) {
 module.exports = {
   acceptMembershipRequestAndAddMember,
   ensureMaintenanceGoal,
+  carryBugsForward,
   achieveGoalIfComplete,
   archiveGoalWithDispositions,
+  carryMaintenanceForward,
   addGoalMember,
   addGoalScopeModules,
   createGoal,

package/modules/lifecycle/db-versions.js

@@ -190,19 +190,19 @@ async function currentBuildingVersionId(deps = {}) {
 // maintenanceGoalExemptSql — "this goal is NOT the version's maintenance goal",
 // as one SQL predicate with ONE definition (BV1.R12, task 1003599; ADR 0263 §7).
 //
-// READ THIS BEFORE CHANGING IT. Today the maintenance goal is identified BY TITLE,
-// because no column says which goal it is — `ensureMaintenanceGoal` (db-goals.js)
-// matches `"<version> — maintenance"` and its own comment flags that as task
-// 1003605's (R18) debt. That is a provenance wrinkle for ROUTING, where the worst
-// case is a hand-titled goal receiving a bug. It is a much worse wrinkle HERE: this
-// predicate decides which goals hold a VERSION open, so a hand-titled goal would
-// silently exempt itself from the gate that decides when a version may close.
+// R18 (task 1003605) REPLACED THE BODY, exactly as R12 said it would, and the
+// seam is why that was a one-line change with no call sites to hunt. It used to
+// read `g.title <> ($1 || ' — maintenance')`, which decided by STRING which goals
+// hold a version open — so any Metic+ able to create a goal could name it
+// `"BONGOS-V1 — maintenance"` and silently exempt it from the gate that decides
+// when a version may close. Widening scope by choosing a title is not a wrinkle,
+// it is a way in. `goals.is_maintenance` (migration core_234) cannot be spelled
+// into existence.
 //
-// So it is named, used in exactly one place, and R18 replaces its BODY with
-// `NOT g.is_maintenance` once the column exists — one edit, no call sites to find.
-// The parameter is the version id placeholder the caller has already bound.
-function maintenanceGoalExemptSql(titleParam) {
-  return `g.title <> (${titleParam} || ' — maintenance')`;
+// The parameter is now unused and kept ONLY so the call sites do not change
+// shape; drop it the next time this file is touched for another reason.
+function maintenanceGoalExemptSql(_titleParam) {
+  return 'NOT g.is_maintenance';
 }
 
 // openNonMaintenanceGoals — the goals that hold a version open, id + title +

package/modules/lifecycle/db.js

@@ -71,6 +71,7 @@ const {
   addGoalScopeModules,
   createGoal,
   ensureMaintenanceGoal,
+  carryBugsForward,
   createMembershipRequest,
   getGoal,
   getGoalAdmission,
@@ -82,6 +83,7 @@ const {
   listActiveClaimsForTasks,
   listCriteriaForGoal,
   archiveGoalWithDispositions,
+  carryMaintenanceForward,
   openTasksInGoal,
   listGoalMembers,
   listGoals,
@@ -225,6 +227,7 @@ module.exports = {
   currentBuildingVersionId,
   createGoal,
   ensureMaintenanceGoal,
+  carryBugsForward,
   getGoal,
   getGoalAdmission,
   listVersionAdmissions,
@@ -257,6 +260,7 @@ module.exports = {
   listPendingRequestsForGoal,
   listCriteriaForGoal,
   archiveGoalWithDispositions,
+  carryMaintenanceForward,
   openTasksInGoal,
   createTask,
   generalGoalIdForVersion,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.595",
+  "version": "1.19.597",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.595",
+      "version": "1.19.597",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.595",
+  "version": "1.19.597",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.595'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.597'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_seed.mjs

@@ -90,16 +90,6 @@ function grantBlocksForRole(role) {
 const REVOKE_RE =
   /DELETE\s+FROM\s+govern(?:ance_role|ment_rank)_permissions\s+WHERE\s+(?:rank_key|role_key)\s*=\s*'([^']+)'\s+AND\s+permission_key\s*=\s*'([^']+)'/gi;
 
-function revokeBlocksForRole(role) {
-  const blocks = [];
-  for (const [file, sql] of grantSqlByFile) {
-    const code = sql.replace(/--[^\n]*/g, '');
-    for (const m of code.matchAll(new RegExp(REVOKE_RE.source, 'gi'))) {
-      if (m[1] === role) blocks.push({ file, key: m[2] });
-    }
-  }
-  return blocks;
-}
 
 // The EFFECTIVE grant set: walk the migrations in filename order, adding each
 // file's grants and removing its revocations, so a key granted early and revoked

package/tests/maintenance_carry_forward.mjs

@@ -0,0 +1,122 @@
+// tests/maintenance_carry_forward.mjs — the one goal that spans versions
+// (BV1.R18b, task 1003708, goal 1000086, ADR 0263 §7).
+//
+// WHY THIS GOT A COLUMN. Since task 1003691 the maintenance goal was found by
+// matching `'<version> — maintenance'`. For the ROUTING path that was a
+// provenance wrinkle — a hand-titled goal receives a bug. For the CLOSING path
+// it was a way through the gate: `maintenanceGoalExemptSql` decides which goals
+// hold a VERSION open, so anyone who named a goal `'BONGOS-V1 — maintenance'`
+// exempted it from the rule that decides when a version may close.
+//
+// A naming convention is not an access control. That sentence is the whole task,
+// and most of this file is that sentence made mechanical.
+//
+// Run:  node tests/maintenance_flag.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { maintenanceGoalExemptSql, ensureMaintenanceGoal, carryMaintenanceForward, openNonMaintenanceGoals } = require('../modules/lifecycle/db.js');
+const { test, summary } = makeRunner();
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const MIG = src('migrations/core_235_one_maintenance_goal_per_version.sql');
+const MIG234 = src('migrations/core_234_goals_is_maintenance.sql');
+const flat = (q) => String(q.sql).replace(/\s+/g, ' ').trim();
+function pool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { connect: c.connect, query: (sql, p) => c._client.query(sql, p), queries: c._client.queries };
+}
+
+// ---- one per version is a CONSTRAINT ---------------------------------------
+
+await test('the per-version uniqueness is enforced by the DATABASE, not a convention', () => {
+  // core_234 gave the flag a partial index for lookup speed, which is right. But a
+  // NON-unique one leaves two flagged goals on one version possible, and
+  // ensureMaintenanceGoal's read is `WHERE version_id = $1 AND is_maintenance
+  // LIMIT 1` — with two rows that returns whichever the planner picks, and every
+  // homeless bug files into an arbitrary one of them, permanently.
+  assert.match(MIG, /CREATE UNIQUE INDEX IF NOT EXISTS goals_one_maintenance_per_version_idx[\s\S]*?ON goals \(version_id\)[\s\S]*?WHERE is_maintenance/);
+  assert.match(MIG, /DROP INDEX IF EXISTS goals_maintenance_by_version_idx/,
+    'and it replaces the plain one — a UNIQUE index serves every read the plain one did');
+  assert.match(MIG, /BEGIN;[\s\S]*COMMIT;/);
+});
+
+await test('it closes the door the advisory lock could not', () => {
+  // The lock (task 1003691) serialises the RACE. It cannot stop a second
+  // maintenance goal created any other way, and `goals` never had a unique
+  // constraint on (version_id, title) for the lock to fall back on.
+  const dbg = src('modules/lifecycle/db-goals.js');
+  assert.match(dbg, /pg_advisory_xact_lock/, 'the lock stays — it solves a different problem');
+  assert.match(MIG234, /is_maintenance boolean NOT NULL DEFAULT false/, 'core_234 still owns the column');
+});
+
+// ---- carry forward ---------------------------------------------------------
+
+function carryPool({ src = { id: 5 }, destStatus = 'building', destFound = { id: 9 } } = {}) {
+  return pool((sql) => {
+    const q = String(sql).replace(/\s+/g, ' ');
+    if (/SELECT id FROM goals WHERE version_id = \$1 AND is_maintenance LIMIT 1/.test(q)) return { rows: src ? [src] : [] };
+    if (/SELECT status FROM versions/.test(q)) return { rows: [{ status: destStatus }] };
+    if (/pg_advisory_xact_lock/.test(q)) return { rows: [] };
+    if (/FROM goals WHERE version_id = \$1 AND is_maintenance/.test(q)) return { rows: destFound ? [destFound] : [] };
+    if (/UPDATE tasks SET goal_id/.test(q)) return { rows: [{ id: 1 }, { id: 2 }, { id: 3 }] };
+    return { rows: [] };
+  });
+}
+
+await test('open bugs move to the successor, and the emptied goal archives behind them', async () => {
+  const p = carryPool();
+  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { pool: p });
+  assert.deepEqual(out, { carried: 3, from: '5', to: '9', reason: null });
+  const mv = p.queries.find((x) => /UPDATE tasks SET goal_id/.test(flat(x)));
+  assert.match(flat(mv), /NOT IN \('shipped', 'abandoned'\)/, 'only the unfinished ones travel');
+  assert.equal(mv.params[2], 'V2', 'and their version_id moves with them, or they are orphaned across the boundary');
+  assert.ok(p.queries.some((x) => /UPDATE goals SET status = 'archived'/.test(flat(x))));
+});
+
+await test('NO successor: the bugs stay put and the close still succeeds', async () => {
+  // A version with nothing scoped after it must not fail its close, and its bug
+  // queue must not be cut for a reason that has nothing to do with the bugs.
+  const p = carryPool();
+  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: null }, { pool: p });
+  assert.equal(out.carried, 0);
+  assert.equal(out.reason, 'no_successor');
+  assert.equal(p.queries.some((x) => /UPDATE tasks/.test(flat(x))), false, 'nothing moved');
+  assert.equal(p.queries.some((x) => /UPDATE goals SET status = 'archived'/.test(flat(x))), false,
+    'and the source goal is NOT closed — the queue is still live');
+});
+
+await test('a successor that is not yet BUILDING carries nothing, and says so', async () => {
+  // The ordering trap ADR 0263 §8 names: ensureMaintenanceGoal returns null for a
+  // non-building version, so a carry-over run before R20's promotion would report
+  // success while moving nothing.
+  const p = carryPool({ destStatus: 'planning', destFound: null });
+  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { pool: p });
+  assert.equal(out.carried, 0);
+  assert.equal(out.reason, 'successor_not_building', 'a silent zero would be indistinguishable from success');
+  assert.equal(p.queries.some((x) => /UPDATE tasks/.test(flat(x))), false);
+});
+
+await test('a version with no maintenance goal at all is a clean no-op', async () => {
+  const p = carryPool({ src: null });
+  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { pool: p });
+  assert.equal(out.reason, 'no_maintenance_goal');
+  assert.equal(out.carried, 0);
+});
+
+await test('it runs on the CALLER exec, so it joins the close transaction', () => {
+  // R12 left `deps.onClosed(client, …)` for exactly this. Opening its own
+  // connection would commit the carry-over independently of the close it belongs to.
+  const dbg = src('modules/lifecycle/db-goals.js');
+  const fn = dbg.slice(dbg.indexOf('async function carryMaintenanceForward'), dbg.indexOf('// listVersionAdmissions'));
+  assert.match(fn, /const exec = deps\.client \|\|/, 'it must accept the caller\'s client');
+  assert.doesNotMatch(fn, /\.connect\(\)/, 'and must never open its own');
+  assert.doesNotMatch(fn, /BEGIN|COMMIT/, 'nor manage a transaction it does not own');
+});
+
+summary();

package/tests/maintenance_goal.mjs

@@ -96,9 +96,15 @@ await test('ensureMaintenanceGoal: an EXISTING goal is returned, and nothing is
   const goal = await ensureMaintenanceGoal('BONGOS-V1', { pool });
   assert.equal(goal.id, 77);
   assert.ok(!find(pool.queries, /INSERT INTO goals/), 'find-or-create must not create when it finds');
-  // The lookup is keyed on the exact title, bound as a parameter.
+  // BV1.R18 (task 1003605, migration core_234): the lookup is keyed on the
+  // VERSION and the `is_maintenance` flag — the title is no longer a parameter,
+  // because the title no longer decides anything. It used to bind
+  // ['BONGOS-V1', 'BONGOS-V1 — maintenance'].
   const lookup = find(pool.queries, /^SELECT .* FROM goals WHERE version_id/);
-  assert.deepEqual(lookup.params, ['BONGOS-V1', 'BONGOS-V1 — maintenance']);
+  assert.deepEqual(lookup.params, ['BONGOS-V1']);
+  assert.match(lookup.sql, /is_maintenance/);
+  assert.equal(/title/.test(lookup.sql.replace(/SELECT[\s\S]*?FROM/, 'SELECT FROM')), false,
+    'the title must not appear in the WHERE clause — a goal named into the convention would otherwise be adopted');
 });
 
 await test('ensureMaintenanceGoal: the LOCK is taken BEFORE the read, or find-or-create races', async () => {

package/tests/maintenance_goal_flag.mjs

@@ -0,0 +1,223 @@
+// tests/maintenance_goal_flag.mjs — which goal is the maintenance goal is a
+// COLUMN, not a title (BV1.R18, task 1003605, goal 1000086, ADR 0263 §7).
+//
+// WHY THIS MATTERS MORE THAN IT LOOKS. The maintenance goal was identified by
+// matching the title `"<version> — maintenance"`. For ROUTING a homeless bug that
+// was a provenance wrinkle: the worst case is a hand-titled goal receiving a
+// defect. Then R12 made the SAME identification decide the version-close count —
+// `maintenanceGoalExemptSql` answers "which goals hold this version open" — and a
+// wrinkle became a way in: any Metic+ able to create a goal could exempt it from
+// the gate that decides when a version may close, by choosing a string.
+// `goals.is_maintenance` (migration core_234) cannot be spelled into existence.
+//
+// The BACKFILL is the one place the title match legitimately survives: the rows
+// that already exist were made by the convention, so the convention identifies
+// them — once, in the migration, with the schema carrying the fact afterwards.
+//
+// Run:  node --test tests/maintenance_goal_flag.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { ensureMaintenanceGoal, carryBugsForward } = require('../modules/lifecycle/db.js');
+const { maintenanceGoalExemptSql } = require('../modules/lifecycle/db-versions.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const MIGRATION = src('migrations/core_234_goals_is_maintenance.sql');
+const DB_GOALS = src('modules/lifecycle/db-goals.js');
+
+function recorder(handler) {
+  const seen = [];
+  const c = makeSqlAwareClient((sql, params) => { seen.push({ sql, params }); return handler(sql, params); });
+  return { client: { query: (sql, params) => c._client.query(sql, params) }, seen };
+}
+
+// ---------------------------------------------------------------------------
+// The predicate that decides which goals hold a version open
+// ---------------------------------------------------------------------------
+
+test('the close-count exemption reads the FLAG, never a title', () => {
+  const sql = maintenanceGoalExemptSql('$1');
+  assert.equal(sql, 'NOT g.is_maintenance');
+  // The specific regression: any form of title comparison here lets a goal
+  // exempt itself from the version-close gate by being named a certain way.
+  assert.equal(/title/i.test(sql), false,
+    'a title comparison here is a scope widening anyone who can name a goal could perform');
+  assert.equal(/maintenance'/.test(sql), false, 'no string literal decides this');
+});
+
+// ---------------------------------------------------------------------------
+// find-or-create
+// ---------------------------------------------------------------------------
+
+test('ensureMaintenanceGoal FINDS by flag, not by title', async () => {
+  const r = recorder((sql) => {
+    if (/FROM versions/.test(sql)) return { rows: [{ status: 'building' }] };
+    if (/pg_advisory_xact_lock/.test(sql)) return { rows: [] };
+    if (/^SELECT .* FROM goals/m.test(sql)) return { rows: [{ id: 7, is_maintenance: true }] };
+    return { rows: [] };
+  });
+  const got = await ensureMaintenanceGoal('BONGOS-V1', { client: r.client });
+  assert.equal(got.id, 7);
+  const lookup = r.seen.find((q) => /FROM goals/.test(q.sql) && /SELECT/.test(q.sql));
+  assert.match(lookup.sql, /WHERE version_id = \$1 AND is_maintenance/);
+  assert.equal(/title = \$2/.test(lookup.sql), false, 'the title must no longer select the goal');
+});
+
+test('the advisory lock is still taken BEFORE the read', async () => {
+  // The lock is what makes find-or-create safe without a unique constraint, and
+  // it is keyed on the title purely as a stable per-version string. Moving the
+  // identification to a flag must not accidentally drop the serialisation.
+  const r = recorder((sql) => {
+    if (/FROM versions/.test(sql)) return { rows: [{ status: 'building' }] };
+    return { rows: [{ id: 7 }] };
+  });
+  await ensureMaintenanceGoal('BONGOS-V1', { client: r.client });
+  const lockAt = r.seen.findIndex((q) => /pg_advisory_xact_lock/.test(q.sql));
+  const readAt = r.seen.findIndex((q) => /FROM goals/.test(q.sql) && /is_maintenance/.test(q.sql));
+  assert.ok(lockAt !== -1, 'the advisory lock must still be taken');
+  assert.ok(lockAt < readAt, 'the lock must precede the read, or two writers both see "none"');
+});
+
+test('a created maintenance goal is flagged in the SAME statement that creates it', () => {
+  // Not a follow-up UPDATE: a maintenance goal must never exist unflagged, even
+  // for one transaction, or a concurrent close count would not exempt it.
+  const insert = DB_GOALS.slice(DB_GOALS.indexOf('INSERT INTO goals (version_id, title, description'));
+  assert.match(insert.slice(0, 400), /is_maintenance/);
+  assert.match(insert.slice(0, 400), /true/);
+});
+
+test('a version that cannot hold work gets no maintenance goal', async () => {
+  for (const status of ['shipped', 'planning', 'frozen']) {
+    const r = recorder(() => ({ rows: [{ status }] }));
+    assert.equal(await ensureMaintenanceGoal('V', { client: r.client }), null, `status=${status}`);
+  }
+});
+
+// ---------------------------------------------------------------------------
+// The carry-over — the one goal that legitimately spans versions
+// ---------------------------------------------------------------------------
+
+test('carryBugsForward moves only NON-TERMINAL tasks', async () => {
+  const r = recorder((sql) => {
+    // `SELECT id FROM goals` is carryBugsForward's own source read;
+    // `SELECT id, version_id, …` is ensureMaintenanceGoal's GOAL_COLS read.
+    // The sql-aware client collapses whitespace, so the two must be told apart
+    // by their projection rather than by line breaks.
+    if (/SELECT id FROM goals/.test(sql)) return { rows: [{ id: 1 }] };
+    if (/FROM versions/.test(sql)) return { rows: [{ status: 'building' }] };
+    if (/pg_advisory_xact_lock/.test(sql)) return { rows: [] };
+    if (/SELECT id, version_id/.test(sql)) return { rows: [{ id: 5 }] };
+    if (/UPDATE tasks/.test(sql)) return { rows: [{ id: '11' }, { id: '12' }] };
+    return { rows: [] };
+  });
+  const out = await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
+  assert.deepEqual(out, { fromGoalId: '1', toGoalId: '5', moved: 2 });
+  const move = r.seen.find((q) => /UPDATE tasks/.test(q.sql));
+  assert.match(move.sql, /status NOT IN \('shipped', 'abandoned'\)/,
+    'a fixed or cut defect belongs to the version it was resolved in — carrying it forward would make every successor an archive');
+});
+
+test('a version with no maintenance goal carries nothing, and that is not an error', async () => {
+  const r = recorder(() => ({ rows: [] }));
+  const out = await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
+  assert.deepEqual(out, { fromGoalId: null, toGoalId: null, moved: 0 });
+  assert.equal(r.seen.some((q) => /UPDATE tasks/.test(q.sql)), false, 'nothing is written');
+});
+
+test('carrying into a version that is not building FAILS LOUDLY', async () => {
+  // ADR 0263 §8: promotion must happen BEFORE the carry-over, because
+  // ensureMaintenanceGoal returns null for a version that is not `building`. A
+  // silent no-op here would strand the bug queue on a shipped version — the
+  // exact entombment this whole path exists to end — and look like success.
+  const r = recorder((sql) => {
+    if (/SELECT id FROM goals/.test(sql)) return { rows: [{ id: 1 }] };
+    if (/FROM versions/.test(sql)) return { rows: [{ status: 'planning' }] };
+    return { rows: [] };
+  });
+  await assert.rejects(
+    () => carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client }),
+    (e) => e.code === 'CARRY_FORWARD_NO_DESTINATION'
+  );
+});
+
+test('carryBugsForward does NOT refuse an actively-claimed task', () => {
+  // A deliberate divergence from archiveGoalWithDispositions (R14), which does.
+  // Archiving abandons a task out from under whoever holds it; carrying forward
+  // only re-points its goal, and the claim references the task, so nothing is
+  // taken from anyone. Refusing here would let one in-flight bug fix block a
+  // version from ever closing.
+  const fn = DB_GOALS.slice(DB_GOALS.indexOf('async function carryBugsForward'));
+  const body = fn.slice(0, fn.indexOf('\n}\n'));
+  assert.equal(/FROM claims/.test(body), false, 'a close must not be hostage to a claim on a defect');
+});
+
+// ---------------------------------------------------------------------------
+// The property the whole task exists for: the flag has no user write path
+// ---------------------------------------------------------------------------
+
+test('NOTHING but the system create can set is_maintenance', () => {
+  // THE POINT OF THE COLUMN. Moving the identification from a title to a flag
+  // only closes the vector if the flag itself cannot be set by whoever could
+  // previously choose the title. Every `UPDATE goals` in the lifecycle names its
+  // columns explicitly — there is no generic passthrough — so this asserts that
+  // none of them names this one, and that the sole writer is the system
+  // find-or-create (`created_by NULL`) plus the one-time migration backfill.
+  //
+  // If a future edit adds a goal-field update that accepts arbitrary columns,
+  // this is what should stop it.
+  const files = [
+    'modules/lifecycle/db-goals.js',
+    'modules/lifecycle/db-versions.js',
+    'modules/lifecycle/goal-edits.js',
+    'modules/lifecycle/goal-category.js',
+    'modules/lifecycle/done-when.js',
+  ];
+  for (const rel of files) {
+    const code = src(rel).replace(/\/\/[^\n]*/g, '');
+    for (const m of code.matchAll(/UPDATE goals[\s\S]{0,400}?(?=RETURNING|WHERE id|;|`)/g)) {
+      assert.equal(/\bis_maintenance\s*=/.test(m[0]), false,
+        `${rel}: an UPDATE sets is_maintenance — the flag must have no write path a caller can reach, or naming a goal is replaced by flagging one`);
+    }
+  }
+});
+
+// ---------------------------------------------------------------------------
+// The migration
+// ---------------------------------------------------------------------------
+
+test('the column is NOT NULL with a false default, so no goal is ambiguously flagged', () => {
+  assert.match(MIGRATION, /ADD COLUMN IF NOT EXISTS is_maintenance boolean NOT NULL DEFAULT false/);
+});
+
+test('the backfill is anchored on the version id, not a bare LIKE', () => {
+  // `title LIKE '%maintenance%'` would have flagged a goal legitimately called
+  // "Maintenance of the art pipeline" and silently exempted it from the close
+  // gate — the very failure the column exists to remove.
+  assert.match(MIGRATION, /title = version_id \|\| ' — maintenance'/);
+  // Comments stripped first: this file's own header explains why a bare
+  // `LIKE '%maintenance%'` would be wrong, and a check that read the prose
+  // would fail on the explanation rather than on the SQL.
+  const sqlOnly = MIGRATION.replace(/--[^\n]*/g, '');
+  assert.equal(/LIKE\s*'%maintenance/i.test(sqlOnly), false);
+});
+
+test('the migration records WHY there is no unique constraint yet', () => {
+  // A partial unique index would be tidy and would FAIL on any database that
+  // already holds two title-matching goals for one version — which is possible,
+  // because `goals` has no unique constraint on (version_id, title). Same lesson
+  // core_233 recorded about the building-version index.
+  assert.match(MIGRATION, /NOT UNIQUE PER VERSION/);
+  assert.match(MIGRATION, /core_233/, 'the precedent is named so the reasoning is findable');
+});
+
+test('the find-or-create survives a pre-existing duplicate rather than throwing', () => {
+  const fn = DB_GOALS.slice(DB_GOALS.indexOf('async function ensureMaintenanceGoal'));
+  assert.match(fn.slice(0, 2500), /ORDER BY id LIMIT 1/,
+    'with no unique constraint, a duplicate must be survivable and the answer stable');
+});

package/tests/version_close_route.mjs

@@ -130,9 +130,16 @@ await test('roll_forward WITH a planning version proceeds', () => {
 // ---- the maintenance exemption ---------------------------------------------
 
 await test('the exemption has ONE definition, and the open-goals read is its only caller', () => {
-  // R18 (task 1003605) swaps this body for `NOT g.is_maintenance` once the column
-  // exists. One call site is what makes that a one-line change instead of a hunt.
-  assert.equal(maintenanceGoalExemptSql('$1'), "g.title <> ($1 || ' — maintenance')");
+  // R18 (task 1003605, migration core_234) SWAPPED this body, exactly as R12
+  // predicted here — the single definition is what made it a one-line change
+  // instead of a hunt, and this assertion moved with it.
+  //
+  // The old body was `g.title <> ($1 || ' — maintenance')`, which decided by
+  // STRING which goals hold a version open: anyone able to name a goal could
+  // exempt it from the close gate. A boolean column cannot be spelled.
+  assert.equal(maintenanceGoalExemptSql('$1'), 'NOT g.is_maintenance');
+  assert.equal(/title/i.test(maintenanceGoalExemptSql('$1')), false,
+    'no title comparison may decide which goals hold a version open');
   const dbv = src('modules/lifecycle/db-versions.js');
   const uses = (dbv.match(/maintenanceGoalExemptSql\(/g) || []).length;
   assert.equal(uses, 3, 'declaration + the open-goals read + the post-apply re-count, and nothing else');