@bongos/core 1.19.597 → 1.19.599

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.597",
-  "core_contract": "1.19.597",
-  "source_commit": "1015d778d266d3357eaffb989262715110662ad1",
+  "core_version": "1.19.599",
+  "core_contract": "1.19.599",
+  "source_commit": "f59ebfca96e7c415cbc1fad82765ad3a5b9928f0",
   "source_ref": "HEAD",
-  "built_at": "2026-09-08T04:16:25.146Z",
+  "built_at": "2026-09-08T04:29:29.015Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 457,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2554,
-  "tree_sha256": "47e446b7dc9ebe46479e9138f5c45722dd3aa0c70e847abc587415af364f4d0b",
+  "tree_sha256": "aedc5cdbc47fef15f2a6faed62adffd158b835cfe6b534ff142dc4bef06645ea",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2727,7 +2727,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "adfc4f65fbe9fc3265ec5599eb55dbe4c25063ae382006530df8c96ed930fc67"
+      "sha256": "2fc4af2f63b7d20ac659d4e25f0c17a4489e45ab57f8c03e2591063266d5017c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5532,7 +5532,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "c3e06daaf78911c9dc44f72aa7a104f269624c92f343cd808b2962076a641a23"
+      "sha256": "e8df5e0da281082f8627d3c985dc1993c3c36e9a9848594fadc8393ea7c128d2"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5567,12 +5567,12 @@
     {
       "path": "modules/lifecycle/db-versions.js",
       "mode": "0000644",
-      "sha256": "9d909149be4152335f6d259a32621c2e3917e98c2595ac1c8ff0d2202891dbcb"
+      "sha256": "53f87c20f89c33a3d14ee4410bafa0f3122fb7534708ce5bdacb8cc1098a487c"
     },
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "14c05469abcf349c9173a80059e7fa0dd880b1b5a0b25680ba0d9e524e46d5d9"
+      "sha256": "33fc8959d522bcf18c445b1a5710940379f84d1e938eecdc52cdf52bec9c4b3d"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5817,7 +5817,7 @@
     {
       "path": "modules/lifecycle/routes/versions.js",
       "mode": "0000644",
-      "sha256": "e13f46e32e43c84bfb2a4d3bc46a90da191c04f516fb7493cfe0cc19d05726d7"
+      "sha256": "35919f2cdd1e9a5da11a89adc9731818aa6b1b292c0754d9123a4cd8324bd970"
     },
     {
       "path": "modules/lifecycle/routes/visuals.js",
@@ -7622,12 +7622,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0318db53e76bb62b788fce5bf7dfd540e606e3fdcd1ab1e205732deba3a4bf03"
+      "sha256": "89f20f42f441b010cc5a6ea07f38828987932c85779d01278988f85428d3465e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "8d5d6869dab12ea697b5e0fae60883aabd464ae4568a47bc997a21cb8933cb59"
+      "sha256": "8bba17aa2a21a1b48b9bfb7fb50aad31f75df0d63e459b7fc4ef504375c4c80a"
     },
     {
       "path": "public-docs/index.html",
@@ -9342,7 +9342,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2cb11336e7f6bde05dafd46c2ea3b94d9e5c7ae1f9be772a49b793e17baf7f0d"
+      "sha256": "55821676bf2fdb2f703e9c6137c877f3b5ede7291985bbce9c611f262a2fc48b"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11289,11 +11289,6 @@
       "mode": "0000644",
       "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
     },
-    {
-      "path": "tests/maintenance_carry_forward.mjs",
-      "mode": "0000644",
-      "sha256": "4ac9164b84ad7bf8e9c1b45e7cb5e157762c992ddde16041410a528a534e60f5"
-    },
     {
       "path": "tests/maintenance_goal.mjs",
       "mode": "0000644",
@@ -11302,7 +11297,7 @@
     {
       "path": "tests/maintenance_goal_flag.mjs",
       "mode": "0000644",
-      "sha256": "37356bcd78ff92537a5512b60f2274d573b6c90bb30f5deca006a14d4841fc95"
+      "sha256": "d1f662d8533544ca1e7575f8b7c75fc93d89a4a60880bd47b873b068a3241e4b"
     },
     {
       "path": "tests/manage_manifest_shared_read.mjs",
@@ -12702,7 +12697,7 @@
     {
       "path": "tests/version_close_route.mjs",
       "mode": "0000644",
-      "sha256": "9a5b8f753c4b898b447b257d64c0034a83fe257c23208ce714e2e469fcaf735d"
+      "sha256": "56c480792cf88946eb3e3663a23e0431e6d8df3cf8219fdf9b71283b772355bb"
     },
     {
       "path": "tests/version_literals.mjs",
@@ -12714,6 +12709,11 @@
       "mode": "0000644",
       "sha256": "692261c26e3da46519757733a7fcf9a9998e0942bc5890688b66b79590d82c27"
     },
+    {
+      "path": "tests/version_roll_forward.mjs",
+      "mode": "0000644",
+      "sha256": "fa0f079b8dff816806788bc34b6beb31e3366d5c7166e531108fe4ea40890373"
+    },
     {
       "path": "tests/versions_route.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1643,5 +1643,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.595 with no explicit bump. run 34185477798. (task 1002620)
   1.19.597 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.596 with no explicit bump. run 34186368179. (task 1002620)
+  1.19.598 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.597 with no explicit bump. run 34186758247. (task 1002620)
+  1.19.599 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.598 with no explicit bump. run 34187136306. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-goals.js

@@ -231,79 +231,45 @@ async function carryBugsForward({ fromVersionId, toVersionId }, deps = {}) {
   );
   if (!from[0]) return { fromGoalId: null, toGoalId: null, moved: 0 };
 
+  // RETURNS, NEVER THROWS (BV1.R18c, task 1003709). This used to throw
+  // CARRY_FORWARD_NO_DESTINATION here, and the call site is closeVersion's
+  // `deps.onClosed` — INSIDE the close transaction. A throw there rolls the whole
+  // close back, so a version whose successor had not been promoted yet would
+  // simply refuse to close. ADR 0263 §4 is explicit that this path may never fail
+  // the close, for the same reason closeCompletedWorkForShip may never fail a ship.
+  //
+  // The reason still travels, because a bare 0 is indistinguishable from "there
+  // was nothing to carry" — and the two want opposite responses: one is fine, the
+  // other means R20 ran the carry-over before the promotion (ADR 0263 §8's
+  // ordering trap) and the queue is still sitting on a shipped version.
   const to = await ensureMaintenanceGoal(toVersionId, deps);
-  if (!to) {
-    throw Object.assign(new Error('successor version cannot hold a maintenance goal'), {
-      code: 'CARRY_FORWARD_NO_DESTINATION', toVersionId,
-      hint: 'ensureMaintenanceGoal returns null unless the destination version is `building` — promote it before carrying forward (ADR 0263 §8).',
-    });
-  }
+  if (!to) return { fromGoalId: String(from[0].id), toGoalId: null, moved: 0, reason: 'successor_not_building' };
 
   // Only the UNFINISHED ones move. A shipped or abandoned defect is history and
   // belongs to the version it was fixed in — dragging it forward would make every
   // successor's maintenance goal a growing archive of everything ever reported.
+  // THE VERSION MOVES WITH THE GOAL (BV1.R18c, task 1003709). Setting only
+  // `goal_id` strands the task's `version_id` on the version being closed, and
+  // that column is not decoration: `version_progress` joins
+  // `tasks t ON t.version_id = v.id`, and `version-close.getCarryOverCount`
+  // filters on it directly. A half-moved task therefore counts against a SHIPPED
+  // version forever, never counts toward the successor, and leaves the closed
+  // version still reporting carry-over it no longer holds.
+  //
+  // Smoke rows are excluded the way version_progress excludes them — a test
+  // fixture must not ride across a version boundary into a real queue.
   const { rows: moved } = await exec.query(
-    `UPDATE tasks SET goal_id = $2, updated_at = now()
+    `UPDATE tasks SET goal_id = $2, version_id = $3, updated_at = now()
       WHERE goal_id = $1 AND ${nonTerminalSql('status')}
+        AND ${SMOKE_NOT_LIKE}
       RETURNING id::text`,
-    [from[0].id, to.id]
-  );
-  return { fromGoalId: String(from[0].id), toGoalId: String(to.id), moved: moved.length };
-}
-
-// carryMaintenanceForward — move a closing version's unfinished maintenance work
-// into the successor's maintenance goal (BV1.R18, task 1003605, ADR 0263 §7).
-//
-// THE ONE GOAL THAT LEGITIMATELY SPANS VERSIONS. Every other goal either finishes
-// or is dispositioned at close (roll forward, or abandon — R12). A maintenance
-// goal is neither: it holds defects against already-shipped work, and those arrive
-// on their own schedule rather than on the version's. Cutting them because a
-// version ended would delete a bug queue for a reason that has nothing to do with
-// the bugs; making them need an override to survive would put a counted escape
-// hatch on the ordinary path, which is what ADR 0250 §3 built the counter to
-// prevent. So they move.
-//
-// RUNS ON THE CLOSE'S OWN CLIENT, inside its transaction, via the `deps.onClosed`
-// seam R12 left in closeVersion. Two things follow, both load-bearing:
-//
-//   The successor must ALREADY be `building` when this runs. `ensureMaintenanceGoal`
-//   returns null for a version in any other state, so a carry-over run before R20's
-//   promotion silently carries nothing and reports success. That is why the seam
-//   fires after the flip and why this asserts rather than assumes.
-//
-//   Nothing here may fail the close for want of a destination. A version with no
-//   successor (no planning version was scoped) closes with its maintenance work
-//   left where it is — visible on a shipped version, recoverable, and honest —
-//   rather than the close failing or the bugs being cut. Returns a summary saying
-//   which happened.
-//
-// The source goal is left ARCHIVED with nothing open, so it passes R10's own
-// check on the way out rather than being special-cased around it.
-async function carryMaintenanceForward({ fromVersionId, toVersionId }, deps = {}) {
-  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
-  const { rows: src } = await exec.query(
-    `SELECT id FROM goals WHERE version_id = $1 AND is_maintenance LIMIT 1`, [fromVersionId]
-  );
-  if (!src[0]) return { carried: 0, from: null, to: null, reason: 'no_maintenance_goal' };
-  if (!toVersionId) return { carried: 0, from: String(src[0].id), to: null, reason: 'no_successor' };
-
-  const dest = await ensureMaintenanceGoal(toVersionId, { client: exec });
-  // Null means the successor is not `building` — see the ordering note above. Do
-  // not "fix" this by relaxing ensureMaintenanceGoal's version gate: that gate is
-  // what stops a defect being filed into a shipped version's goal (the 1000771 bug).
-  if (!dest) return { carried: 0, from: String(src[0].id), to: null, reason: 'successor_not_building' };
-
-  const { rows: moved } = await exec.query(
-    `UPDATE tasks SET goal_id = $2, version_id = $3, updated_at = now()
-      WHERE goal_id = $1 AND ${nonTerminalSql()}
-        AND ${SMOKE_NOT_LIKE.replace(/title/, 'tasks.title')}
-      RETURNING id`,
-    [src[0].id, dest.id, toVersionId]
+    [from[0].id, to.id, toVersionId]
   );
-  // The emptied goal closes behind them. Archived rather than achieved: it was
-  // never "done", it stopped being the live queue.
-  await exec.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [src[0].id]);
-  return { carried: moved.length, from: String(src[0].id), to: String(dest.id), reason: null };
+  // The emptied source goal closes behind them: archived, not achieved — it was
+  // never "done", it stopped being the live queue. Leaving it open on a shipped
+  // version is the mirror of the defect this whole goal exists to remove.
+  await exec.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [from[0].id]);
+  return { fromGoalId: String(from[0].id), toGoalId: String(to.id), moved: moved.length, reason: null };
 }
 
 // listVersionAdmissions (BV1.R07, task 1003594) — every goal admitted into ONE
@@ -1228,7 +1194,6 @@ module.exports = {
   carryBugsForward,
   achieveGoalIfComplete,
   archiveGoalWithDispositions,
-  carryMaintenanceForward,
   addGoalMember,
   addGoalScopeModules,
   createGoal,

package/modules/lifecycle/db-versions.js

@@ -253,7 +253,7 @@ async function openNonMaintenanceGoals(versionId, deps = {}) {
 //     route cannot write one, and file I/O has no business in this transaction.
 //
 // `plan` is planVersionClose's validated output: [{ goalId, verb }].
-async function closeVersion({ versionId, plan = [], reason }, deps = {}) {
+async function closeVersion({ versionId, plan = [], reason, planningVersionId = null }, deps = {}) {
   const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
   const client = await activePool.connect();
   try {
@@ -291,10 +291,19 @@ async function closeVersion({ versionId, plan = [], reason }, deps = {}) {
         // close's reason — the same stamp R14 writes, so the ledger reads
         // identically whichever door retired the work.
         const { rows: killed } = await client.query(
+          // `nonTerminalSql('status')`, NOT the default. The default is `t.status`,
+          // which is right for the SELECTs in this file (they alias `tasks t`) and
+          // is a HARD SQL ERROR here — an `UPDATE tasks` declares no alias, so
+          // Postgres answers `missing FROM-clause entry for table "t"` and the
+          // whole close transaction throws. Every `abandon` disposition was
+          // failing on this (shipped in R12, task 1003599); nothing caught it
+          // because the suite drives this path with a SQL-AWARE FAKE that records
+          // statements instead of parsing them. Found by running the rendered
+          // statement against a real Postgres while building R17.
           `UPDATE tasks SET status = 'abandoned',
                             value_summary = COALESCE(NULLIF($2, ''), value_summary),
                             updated_at = now()
-            WHERE goal_id = $1 AND ${nonTerminalSql()}
+            WHERE goal_id = $1 AND ${nonTerminalSql('status')}
               AND title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
             RETURNING id`,
           [step.goalId, `Abandoned: ${reason}`]
@@ -302,23 +311,100 @@ async function closeVersion({ versionId, plan = [], reason }, deps = {}) {
         await client.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [step.goalId]);
         applied.push({ goal_id: String(step.goalId), verb: 'abandon', result: 'archived', tasks_abandoned: killed.length });
       } else {
-        // roll_forward: left OPEN on purpose until R17 (task 1003604) writes the
-        // successor + `succeeded_by_goal_id` lineage. Reported so a reader is not
-        // left wondering why the goal is still there.
-        applied.push({ goal_id: String(step.goalId), verb: 'roll_forward', result: 'carried_pending_successor' });
+        // roll_forward (BV1.R17, task 1003604, ADR 0263 §6): the goal survives the
+        // version boundary as a NEW goal on the planning version, and the old one
+        // archives behind it with its lineage recorded.
+        //
+        // THE COLUMN IS `succeeded_by_goal_id`, and it points the other way from
+        // what ADR 0250 and this task's own brief said. Migration 160 put it on
+        // the OLD goal pointing at the NEW one; `succeeds_goal_id` has never
+        // existed. The design pass caught that, which is why there is no
+        // migration here.
+        if (!planningVersionId) {
+          // The route refuses this before calling (rollForwardNeedsPlanningVersion),
+          // so reaching it means a caller bypassed the route. Fail rather than
+          // silently leaving the goal on a shipped version.
+          throw Object.assign(new Error('roll_forward with no planning version'), {
+            code: 'NO_PLANNING_VERSION', goalId: String(step.goalId),
+          });
+        }
+        // The successor carries what makes the goal itself — its prose, its scope
+        // wall, its category and its visibility. It does NOT carry `is_maintenance`
+        // (the successor version gets its own via ensureMaintenanceGoal) and it
+        // does not carry admissions: an override that widened THIS version's scope
+        // is spent, and re-creating the row would launder a one-time exception into
+        // a permanent one.
+        const { rows: made } = await client.query(
+          `WITH next_order AS (
+             SELECT COALESCE(MAX(sort_order) + 1, 0) AS n FROM goals WHERE version_id = $2
+           )
+           INSERT INTO goals (version_id, title, subtitle, description, scope_modules,
+                              status, visibility, accepting_requests, created_by, sort_order, category_id)
+           SELECT $2, g.title, g.subtitle, g.description, g.scope_modules,
+                  'open', g.visibility, g.accepting_requests, g.created_by, next_order.n, g.category_id
+             FROM goals g, next_order
+            WHERE g.id = $1
+           RETURNING id`,
+          [step.goalId, planningVersionId]
+        );
+        const successorId = made[0].id;
+
+        // MEMBERSHIP TRAVELS, because a goal without its people is a new goal
+        // wearing the old one's title: the builders who were carrying the work are
+        // exactly the ones who should still find it on their board after the
+        // boundary. `membership_kind` is copied verbatim so the manager stays the
+        // manager (ADR 0177 — never the word `role` here).
+        await client.query(
+          `INSERT INTO goal_members (goal_id, builder_id, membership_kind)
+           SELECT $2, builder_id, membership_kind FROM goal_members WHERE goal_id = $1
+           ON CONFLICT DO NOTHING`,
+          [step.goalId, successorId]
+        );
+
+        // The unfinished work moves; the finished work stays. A shipped task is
+        // the record of what THIS version delivered and must not be re-pointed at
+        // the next one, or every version's history migrates forward with it.
+        // Smoke fixtures are excluded on the same terms as the abandon branch, so
+        // both doors agree about what "unfinished" means.
+        const { rows: moved } = await client.query(
+          `UPDATE tasks SET goal_id = $2, updated_at = now()
+            WHERE goal_id = $1 AND ${nonTerminalSql('status')}
+              AND title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
+            RETURNING id`,
+          [step.goalId, successorId]
+        );
+
+        await client.query(
+          `UPDATE goals SET succeeded_by_goal_id = $2, updated_at = now() WHERE id = $1`,
+          [step.goalId, successorId]
+        );
+        // Archived LAST, and only now legitimately: the predecessor holds zero
+        // unfinished tasks at this point, so it satisfies R10's own closure check
+        // on the way out rather than being special-cased around it (the brief's
+        // explicit ask).
+        await client.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [step.goalId]);
+
+        applied.push({
+          goal_id: String(step.goalId), verb: 'roll_forward', result: 'succeeded',
+          successor_goal_id: String(successorId), tasks_moved: moved.length,
+        });
       }
     }
 
     // The invariant, asserted against committed-in-txn state rather than against
-    // the plan — the one check a bug in the planner cannot fool. `roll_forward`
-    // goals are expected to still be open, so they are excluded by id.
-    const carried = plan.filter((p) => p.verb === 'roll_forward').map((p) => Number(p.goalId));
+    // the plan — the one check a bug in the planner cannot fool.
+    //
+    // R17 (task 1003604) REMOVED THE CARVE-OUT. This used to exclude the
+    // `roll_forward` goals by id, because they were left open pending a successor;
+    // now they archive behind their successor like any other closed goal, so the
+    // check is the whole truth again: after a close, NO non-maintenance goal on
+    // this version is still open. An exclusion list is a hole in an invariant, and
+    // this one no longer has a reason to exist.
     const { rows: left } = await client.query(
       `SELECT count(*)::int AS n FROM goals g
         WHERE g.version_id = $1 AND g.status = 'open'
-          AND ${maintenanceGoalExemptSql('$1')}
-          AND NOT (g.id = ANY($2::bigint[]))`,
-      [versionId, carried]
+          AND ${maintenanceGoalExemptSql('$1')}`,
+      [versionId]
     );
     if ((left[0]?.n ?? 0) > 0) {
       throw Object.assign(new Error('version still holds open goals after dispositions'), {

package/modules/lifecycle/db.js

@@ -83,7 +83,6 @@ const {
   listActiveClaimsForTasks,
   listCriteriaForGoal,
   archiveGoalWithDispositions,
-  carryMaintenanceForward,
   openTasksInGoal,
   listGoalMembers,
   listGoals,
@@ -260,7 +259,6 @@ module.exports = {
   listPendingRequestsForGoal,
   listCriteriaForGoal,
   archiveGoalWithDispositions,
-  carryMaintenanceForward,
   openTasksInGoal,
   createTask,
   generalGoalIdForVersion,

package/modules/lifecycle/routes/versions.js

@@ -274,14 +274,24 @@ module.exports = function buildVersionsRouter() {
     // REFUSAL rather than an auto-create: cutting the successor is a scope
     // decision with its own criteria, and doing it implicitly inside a close is
     // the "fake hotfix version" ADR 0250 §3 built the override counter to prevent.
-    const needsPlanning = rollForwardNeedsPlanningVersion({
-      plan: plan.plan,
-      planning: plan.plan.some((p) => p.verb === 'roll_forward') ? await db.versionsWithStatus('planning') : [],
-    });
+    // Read ONCE and keep it: the same rows decide the refusal AND name the
+    // destination the successors are created on (BV1.R17, task 1003604). Reading
+    // it twice would leave a window in which the refusal passed against one
+    // planning version and the write landed on another.
+    const planning = plan.plan.some((p) => p.verb === 'roll_forward')
+      ? await db.versionsWithStatus('planning')
+      : [];
+    const needsPlanning = rollForwardNeedsPlanningVersion({ plan: plan.plan, planning });
     if (needsPlanning) return res.status(needsPlanning.status).json(needsPlanning.body);
 
     try {
-      const out = await db.closeVersion({ versionId, plan: plan.plan, reason });
+      const out = await db.closeVersion({
+        versionId, plan: plan.plan, reason,
+        // R04 guarantees at most one planning version, so [0] is THE successor
+        // rather than a pick. Null when nothing rolls forward, which is the
+        // common close.
+        planningVersionId: planning[0]?.id ?? null,
+      });
       return res.json({ ok: true, version: out.version, applied: out.applied });
     } catch (err) {
       if (err && err.code === 'VERSION_NOT_FOUND') return res.fail('version_not_found', 404);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.597",
+  "version": "1.19.599",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.597",
+      "version": "1.19.599",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.597",
+  "version": "1.19.599",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.597'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.599'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/maintenance_goal_flag.mjs

@@ -117,7 +117,7 @@ test('carryBugsForward moves only NON-TERMINAL tasks', async () => {
     return { rows: [] };
   });
   const out = await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
-  assert.deepEqual(out, { fromGoalId: '1', toGoalId: '5', moved: 2 });
+  assert.deepEqual(out, { fromGoalId: '1', toGoalId: '5', moved: 2, reason: null });
   const move = r.seen.find((q) => /UPDATE tasks/.test(q.sql));
   assert.match(move.sql, /status NOT IN \('shipped', 'abandoned'\)/,
     'a fixed or cut defect belongs to the version it was resolved in — carrying it forward would make every successor an archive');
@@ -130,20 +130,33 @@ test('a version with no maintenance goal carries nothing, and that is not an err
   assert.equal(r.seen.some((q) => /UPDATE tasks/.test(q.sql)), false, 'nothing is written');
 });
 
-test('carrying into a version that is not building FAILS LOUDLY', async () => {
+test('carrying into a version that is not building REPORTS loudly — without failing the close', async () => {
   // ADR 0263 §8: promotion must happen BEFORE the carry-over, because
   // ensureMaintenanceGoal returns null for a version that is not `building`. A
   // silent no-op here would strand the bug queue on a shipped version — the
   // exact entombment this whole path exists to end — and look like success.
+  //
+  // BV1.R18c (task 1003709) changed HOW it is loud, not whether. This threw
+  // CARRY_FORWARD_NO_DESTINATION, and the call site is closeVersion's
+  // `deps.onClosed` — inside the close transaction. A throw there rolls the whole
+  // close back, so a version whose successor had not been promoted yet would
+  // refuse to close at all, and ADR 0263 §4 says this path may never fail the
+  // close (the same posture closeCompletedWorkForShip has toward a ship).
+  //
+  // The distinction the throw was protecting is kept in the RETURN: `reason` tells
+  // a caller that the destination was missing, which a bare `moved: 0` could not —
+  // and that is the whole point, because "nothing to carry" and "you ran this
+  // before the promotion" want opposite responses.
   const r = recorder((sql) => {
     if (/SELECT id FROM goals/.test(sql)) return { rows: [{ id: 1 }] };
     if (/FROM versions/.test(sql)) return { rows: [{ status: 'planning' }] };
     return { rows: [] };
   });
-  await assert.rejects(
-    () => carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client }),
-    (e) => e.code === 'CARRY_FORWARD_NO_DESTINATION'
-  );
+  const out = await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
+  assert.equal(out.moved, 0);
+  assert.equal(out.reason, 'successor_not_building');
+  assert.equal(out.toGoalId, null, 'and it names no destination, because there was none');
+  assert.equal(r.seen.some((q) => /UPDATE tasks/.test(q.sql)), false, 'nothing moved');
 });
 
 test('carryBugsForward does NOT refuse an actively-claimed task', () => {
@@ -221,3 +234,55 @@ test('the find-or-create survives a pre-existing duplicate rather than throwing'
   assert.match(fn.slice(0, 2500), /ORDER BY id LIMIT 1/,
     'with no unique constraint, a duplicate must be survivable and the answer stable');
 });
+
+// ---- BV1.R18c (task 1003709): the two defects the merge closed -------------
+//
+// `main` briefly carried TWO carry-forward functions, one per session that built
+// R18. Collapsing them was not a coin toss: each had something the other needed,
+// and the two below are the halves that were missing here.
+
+test('R18c: the VERSION moves with the goal, or the task counts against a shipped version forever', async () => {
+  // `version_progress` joins `tasks t ON t.version_id = v.id` (verified against the
+  // live view), and `version-close.getCarryOverCount` filters on it directly. A task
+  // moved to the successor's goal but left stamped with the closing version counts
+  // against a SHIPPED version, never counts toward the successor, and leaves the
+  // closed version still reporting carry-over it no longer holds.
+  const r = recorder((sql) => {
+    if (/SELECT id FROM goals/.test(sql)) return { rows: [{ id: 1 }] };
+    if (/FROM versions/.test(sql)) return { rows: [{ status: 'building' }] };
+    if (/pg_advisory_xact_lock/.test(sql)) return { rows: [] };
+    if (/SELECT id, version_id/.test(sql)) return { rows: [{ id: 5 }] };
+    if (/UPDATE tasks/.test(sql)) return { rows: [{ id: '11' }] };
+    return { rows: [] };
+  });
+  await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
+  const mv = r.seen.find((q) => /UPDATE tasks/.test(q.sql));
+  assert.ok(mv, 'the move must happen');
+  assert.match(mv.sql, /version_id = \$3/, 'goal_id alone leaves the task half-moved');
+  assert.equal(mv.params[2], 'V2');
+  assert.match(mv.sql, /NOT LIKE/, 'and a smoke fixture must not ride across a version boundary');
+});
+
+test('R18c: a successor that is not yet building RETURNS, it does not throw', async () => {
+  // The call site is closeVersion's `deps.onClosed` — inside the close
+  // transaction. A throw there rolls the whole close back, so a version whose
+  // successor had not been promoted would refuse to close. ADR 0263 §4 says this
+  // path may never fail the close.
+  const r = recorder((sql) => {
+    if (/SELECT id FROM goals/.test(sql)) return { rows: [{ id: 1 }] };
+    if (/FROM versions/.test(sql)) return { rows: [{ status: 'planning' }] };
+    return { rows: [] };
+  });
+  const out = await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
+  assert.equal(out.moved, 0);
+  assert.equal(out.reason, 'successor_not_building',
+    'a bare 0 is indistinguishable from "nothing to carry", and the two want opposite responses');
+  assert.equal(out.toGoalId, null);
+});
+
+test('R18c: exactly ONE carry-forward is exported', () => {
+  const db = require('../modules/lifecycle/db.js');
+  assert.equal(typeof db.carryBugsForward, 'function');
+  assert.equal(db.carryMaintenanceForward, undefined,
+    'two functions for one job is how a call site picks the wrong one');
+});

package/tests/version_close_route.mjs

@@ -163,6 +163,11 @@ function closePool({ status = 'building', goalStatus = 'open', remaining = 0 } =
     if (/FROM versions WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: 'V1', status }] };
     if (/FROM goals WHERE id = \$1 AND version_id = \$2 FOR UPDATE/.test(q)) return { rows: [{ id: 1, title: 'g', status: goalStatus }] };
     if (/UPDATE tasks SET status = 'abandoned'/.test(q)) return { rows: [{ id: 11 }, { id: 12 }] };
+    // R17 (task 1003604) — the roll_forward writes: the successor INSERT, the
+    // membership copy, and the task re-point.
+    if (/INSERT INTO goals/.test(q)) return { rows: [{ id: 99 }] };
+    if (/INSERT INTO goal_members/.test(q)) return { rows: [] };
+    if (/UPDATE tasks SET goal_id/.test(q)) return { rows: [{ id: 21 }, { id: 22 }] };
     if (/count\(\*\)::int AS n FROM goals/.test(q)) return { rows: [{ n: remaining }] };
     if (/UPDATE versions SET status = 'shipped'/.test(q)) return { rows: [{ id: 'V1', status: 'shipped' }] };
     return { rows: [] };
@@ -193,21 +198,48 @@ await test('an abandoned goal takes its open tasks with it, stamped with the clo
   assert.match(flat(kill), /NOT IN \('shipped', 'abandoned'\)/, 'and only the unfinished ones');
 });
 
-await test('a roll_forward abandons NOTHING and says the successor is still pending', async () => {
+await test('a roll_forward abandons NOTHING — it creates the successor and moves the work', async () => {
+  // BOTH HALVES OF THIS FILE'S roll_forward EXPECTATION FLIPPED AT R17
+  // (task 1003604). R12 left the verb as a placeholder that reported
+  // `carried_pending_successor` and wrote nothing; the successor, the lineage
+  // and the task move land now. What has NOT changed, and is the assertion
+  // worth keeping, is that carrying a goal forward never CUTS its work.
   const pool = closePool();
-  const out = await closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'roll_forward' }], reason: 'r' }, { pool });
-  assert.deepEqual(out.applied, [{ goal_id: '1', verb: 'roll_forward', result: 'carried_pending_successor' }]);
+  const out = await closeVersion(
+    { versionId: 'V1', plan: [{ goalId: 1, verb: 'roll_forward' }], reason: 'r', planningVersionId: 'V2' },
+    { pool }
+  );
+  assert.equal(out.applied[0].verb, 'roll_forward');
+  assert.equal(out.applied[0].result, 'succeeded');
+  assert.ok('successor_goal_id' in out.applied[0], 'the response must name the goal that carries on');
   assert.equal(pool.queries.some((q) => /UPDATE tasks SET status = 'abandoned'/.test(flat(q))), false,
     'carrying a goal forward must never cut its work');
-  assert.equal(pool.queries.some((q) => /UPDATE goals SET status = 'archived'/.test(flat(q))), false);
 });
 
-await test('a carried goal is EXCLUDED from the post-apply re-count, or a close could never carry anything', async () => {
+await test('a roll_forward with no planning version throws rather than stranding the goal', async () => {
+  // The route refuses this first (rollForwardNeedsPlanningVersion), so reaching
+  // the writer means a caller bypassed the route. Failing beats silently leaving
+  // the goal open on a version that is about to ship.
   const pool = closePool();
-  await closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'roll_forward' }], reason: 'r' }, { pool });
+  await assert.rejects(
+    closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'roll_forward' }], reason: 'r' }, { pool }),
+    (e) => e.code === 'NO_PLANNING_VERSION'
+  );
+});
+
+await test('the post-apply re-count has NO carve-out — every non-maintenance goal must be closed', async () => {
+  // This used to assert the opposite: carried goals were excluded by id, because
+  // they were left open pending a successor. They archive now, so the check is
+  // the whole truth again. An exclusion list is a hole in an invariant, and this
+  // one no longer has a reason to exist.
+  const pool = closePool();
+  await closeVersion(
+    { versionId: 'V1', plan: [{ goalId: 1, verb: 'roll_forward' }], reason: 'r', planningVersionId: 'V2' },
+    { pool }
+  );
   const recount = pool.queries.find((q) => /count\(\*\)::int AS n FROM goals/.test(flat(q)));
-  assert.match(flat(recount), /NOT \(g\.id = ANY\(\$2::bigint\[\]\)\)/);
-  assert.deepEqual(recount.params[1], [1], 'the carried goal is expected to still be open');
+  assert.equal(/ANY\(\$2::bigint\[\]\)/.test(flat(recount)), false, 'the carve-out must be gone');
+  assert.equal(recount.params.length, 1, 'only the version id is bound now');
 });
 
 await test('the re-check runs against committed state and rolls back rather than half-closing', async () => {

package/tests/version_roll_forward.mjs

@@ -0,0 +1,166 @@
+// tests/version_roll_forward.mjs — a goal that is not finished survives the
+// version boundary as a NEW goal, with its lineage recorded
+// (BV1.R17, task 1003604, goal 1000086, ADR 0263 §6).
+//
+// THE COLUMN POINTS THE OTHER WAY from what ADR 0250 and R17's own brief said.
+// Both name `succeeds_goal_id`, which has never existed; migration 160 gave
+// `goals` a **`succeeded_by_goal_id`** — on the OLD goal, pointing at the NEW
+// one. The design pass caught it, which is why R17 reserved no migration. This
+// file pins the direction so the wrong one cannot come back through a reader who
+// trusts the prose over the schema.
+//
+// AND A NOTE ON WHY THIS FILE EXISTS AT ALL, beyond the feature. The close path
+// is driven in tests/version_close_route.mjs by a SQL-AWARE FAKE that records
+// statements rather than parsing them. That fake happily accepted
+// `UPDATE tasks … WHERE t.status NOT IN (…)` — a hard `missing FROM-clause entry
+// for table "t"` on a real Postgres, which meant every `abandon` disposition
+// threw in production from the day R12 shipped. Nothing caught it because
+// nothing ever ran it. The structural assertions at the bottom are the DB-free
+// guard for that whole CLASS of bug: a rendered predicate whose alias does not
+// match the statement it was spliced into.
+//
+// Run:  node --test tests/version_roll_forward.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { nonTerminalSql } = require('../modules/lifecycle/task-status.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const DBV = src('modules/lifecycle/db-versions.js');
+const ROUTES = src('modules/lifecycle/routes/versions.js');
+
+// The roll_forward branch, sliced so assertions land on the right code.
+const CLOSE = DBV.slice(DBV.indexOf('async function closeVersion'));
+const ROLL = CLOSE.slice(CLOSE.indexOf("verb: 'roll_forward'") - 4000, CLOSE.indexOf('// The invariant'));
+
+// ---------------------------------------------------------------------------
+// The lineage
+// ---------------------------------------------------------------------------
+
+test('the lineage column is succeeded_by_goal_id, written on the PREDECESSOR', () => {
+  assert.match(ROLL, /UPDATE goals SET succeeded_by_goal_id = \$2[\s\S]{0,80}WHERE id = \$1/);
+  // The spelling that does not exist must never reach the SQL. Comments are
+  // stripped first: the code deliberately NAMES `succeeds_goal_id` in prose to
+  // explain that it was never created, and a check that read the explanation
+  // would fail on the warning rather than on a real use.
+  const code = DBV.replace(/\/\/[^\n]*/g, '');
+  assert.equal(/succeeds_goal_id/.test(code), false,
+    'ADR 0250 and the task brief both name a column migration 160 never created');
+});
+
+test('no migration was reserved — the column already exists', () => {
+  // R17's brief says this in capitals, because reserving a number for a column
+  // that is already there is the mistake the design pass was written to prevent.
+  assert.match(DBV, /succeeded_by_goal_id/);
+});
+
+// ---------------------------------------------------------------------------
+// What the successor carries, and what it deliberately does not
+// ---------------------------------------------------------------------------
+
+test('the successor carries the goal\'s identity, scope and category', () => {
+  for (const col of ['title', 'subtitle', 'description', 'scope_modules', 'category_id', 'visibility']) {
+    assert.match(ROLL, new RegExp(`g\\.${col}`), `the successor must carry ${col}`);
+  }
+});
+
+test('membership travels with it', () => {
+  // A goal without its people is a new goal wearing the old one's title: the
+  // builders carrying the work are exactly who should still find it after the
+  // boundary. membership_kind is copied verbatim so a manager stays a manager.
+  assert.match(ROLL, /INSERT INTO goal_members \(goal_id, builder_id, membership_kind\)/);
+  assert.match(ROLL, /SELECT \$2, builder_id, membership_kind FROM goal_members WHERE goal_id = \$1/);
+});
+
+test('the successor does NOT inherit is_maintenance or an admission', () => {
+  const insert = ROLL.slice(ROLL.indexOf('INSERT INTO goals'), ROLL.indexOf('RETURNING id'));
+  assert.equal(/is_maintenance/.test(insert), false,
+    'the successor version gets its own maintenance goal via ensureMaintenanceGoal');
+  assert.equal(/admission/i.test(insert), false,
+    'an override that widened THIS version\'s scope is spent — re-creating the row would launder a one-time exception into a permanent one');
+});
+
+// ---------------------------------------------------------------------------
+// What moves, and what stays
+// ---------------------------------------------------------------------------
+
+test('only UNFINISHED tasks are re-pointed; shipped work stays with the version that delivered it', () => {
+  const move = ROLL.slice(ROLL.indexOf('UPDATE tasks SET goal_id'));
+  assert.match(move, /nonTerminalSql\('status'\)/);
+  assert.match(move, /smoke/, 'smoke fixtures are excluded on the same terms as the abandon branch');
+});
+
+test('the predecessor is archived LAST, after its work has left', () => {
+  // The brief's explicit ask: it archives holding zero unfinished tasks, so it
+  // passes R10's own closure check on the way out rather than being
+  // special-cased around it.
+  const moveAt = ROLL.indexOf('UPDATE tasks SET goal_id');
+  const lineageAt = ROLL.indexOf('succeeded_by_goal_id = $2');
+  const archiveAt = ROLL.indexOf("status = 'archived'");
+  assert.ok(moveAt !== -1 && lineageAt !== -1 && archiveAt !== -1);
+  assert.ok(moveAt < archiveAt, 'the tasks must leave before the goal closes');
+  assert.ok(lineageAt < archiveAt, 'the lineage must be written before the goal closes');
+});
+
+// ---------------------------------------------------------------------------
+// The destination
+// ---------------------------------------------------------------------------
+
+test('the route reads the planning version ONCE and passes it to the close', () => {
+  // Reading it twice leaves a window where the refusal passed against one
+  // planning version and the write landed on another.
+  assert.match(ROUTES, /const planning = plan\.plan\.some/);
+  assert.match(ROUTES, /rollForwardNeedsPlanningVersion\(\{ plan: plan\.plan, planning \}\)/);
+  assert.match(ROUTES, /planningVersionId: planning\[0\]\?\.id \?\? null/);
+});
+
+test('closeVersion refuses a roll_forward with no destination rather than stranding the goal', () => {
+  assert.match(ROLL, /NO_PLANNING_VERSION/);
+});
+
+// ---------------------------------------------------------------------------
+// The invariant lost its carve-out
+// ---------------------------------------------------------------------------
+
+test('the post-apply re-count no longer excludes rolled-forward goals', () => {
+  // They used to be left open pending a successor, so the check excluded them by
+  // id. They archive now, so the check is the whole truth again: after a close no
+  // non-maintenance goal on this version is still open. An exclusion list is a
+  // hole in an invariant.
+  const recount = CLOSE.slice(CLOSE.indexOf('// The invariant'), CLOSE.indexOf('CLOSE_INCOMPLETE_AFTER_APPLY'));
+  assert.equal(/ANY\(\$2::bigint\[\]\)/.test(recount), false, 'the carve-out must be gone');
+  assert.equal(/carried/.test(recount), false, 'and its variable with it');
+});
+
+// ---------------------------------------------------------------------------
+// The alias class-of-bug guard (the reason the abandon branch was broken)
+// ---------------------------------------------------------------------------
+
+test('every UPDATE in this file splices an UNALIASED predicate', () => {
+  // `nonTerminalSql()` defaults to `t.status`, which is correct for the SELECTs
+  // here (they alias `tasks t`) and a hard SQL error inside an `UPDATE tasks`,
+  // which declares no alias. R12 shipped exactly that and every abandon
+  // disposition threw `missing FROM-clause entry for table "t"` in production.
+  // The fake-client suite could not see it, so this reads the source instead.
+  const updates = [...DBV.matchAll(/UPDATE (tasks|goals)\b[\s\S]{0,600}?(?=RETURNING|`,)/g)];
+  assert.ok(updates.length >= 3, 'expected the close path\'s UPDATE statements');
+  for (const m of updates) {
+    assert.equal(/\$\{nonTerminalSql\(\)\}/.test(m[0]), false,
+      'an UPDATE must call nonTerminalSql(\'status\') — the default t.status has no FROM-clause entry here');
+    assert.equal(/\bt\.status\b/.test(m[0]), false, `an UPDATE references t.status: ${m[0].slice(0, 90)}`);
+  }
+});
+
+test('the SELECTs that DO alias tasks may keep the default', () => {
+  // The other half of the rule — this is not "never use the default", it is
+  // "match the statement". openNonMaintenanceGoals aliases `tasks t` and is right
+  // to use it, and a fix that changed every call site would have been wrong.
+  assert.match(DBV, /FROM tasks t\s*\n?\s*WHERE t\.goal_id = g\.id AND \$\{nonTerminalSql\(\)\}/);
+  assert.equal(nonTerminalSql(), "t.status NOT IN ('shipped', 'abandoned')");
+  assert.equal(nonTerminalSql('status'), "status NOT IN ('shipped', 'abandoned')");
+});

package/tests/maintenance_carry_forward.mjs

@@ -1,122 +0,0 @@
-// tests/maintenance_carry_forward.mjs — the one goal that spans versions
-// (BV1.R18b, task 1003708, goal 1000086, ADR 0263 §7).
-//
-// WHY THIS GOT A COLUMN. Since task 1003691 the maintenance goal was found by
-// matching `'<version> — maintenance'`. For the ROUTING path that was a
-// provenance wrinkle — a hand-titled goal receives a bug. For the CLOSING path
-// it was a way through the gate: `maintenanceGoalExemptSql` decides which goals
-// hold a VERSION open, so anyone who named a goal `'BONGOS-V1 — maintenance'`
-// exempted it from the rule that decides when a version may close.
-//
-// A naming convention is not an access control. That sentence is the whole task,
-// and most of this file is that sentence made mechanical.
-//
-// Run:  node tests/maintenance_flag.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
-import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
-
-process.env.NODE_ENV = 'test';
-const require = createRequire(import.meta.url);
-const { maintenanceGoalExemptSql, ensureMaintenanceGoal, carryMaintenanceForward, openNonMaintenanceGoals } = require('../modules/lifecycle/db.js');
-const { test, summary } = makeRunner();
-
-const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
-const MIG = src('migrations/core_235_one_maintenance_goal_per_version.sql');
-const MIG234 = src('migrations/core_234_goals_is_maintenance.sql');
-const flat = (q) => String(q.sql).replace(/\s+/g, ' ').trim();
-function pool(handler) {
-  const c = makeSqlAwareClient(handler);
-  return { connect: c.connect, query: (sql, p) => c._client.query(sql, p), queries: c._client.queries };
-}
-
-// ---- one per version is a CONSTRAINT ---------------------------------------
-
-await test('the per-version uniqueness is enforced by the DATABASE, not a convention', () => {
-  // core_234 gave the flag a partial index for lookup speed, which is right. But a
-  // NON-unique one leaves two flagged goals on one version possible, and
-  // ensureMaintenanceGoal's read is `WHERE version_id = $1 AND is_maintenance
-  // LIMIT 1` — with two rows that returns whichever the planner picks, and every
-  // homeless bug files into an arbitrary one of them, permanently.
-  assert.match(MIG, /CREATE UNIQUE INDEX IF NOT EXISTS goals_one_maintenance_per_version_idx[\s\S]*?ON goals \(version_id\)[\s\S]*?WHERE is_maintenance/);
-  assert.match(MIG, /DROP INDEX IF EXISTS goals_maintenance_by_version_idx/,
-    'and it replaces the plain one — a UNIQUE index serves every read the plain one did');
-  assert.match(MIG, /BEGIN;[\s\S]*COMMIT;/);
-});
-
-await test('it closes the door the advisory lock could not', () => {
-  // The lock (task 1003691) serialises the RACE. It cannot stop a second
-  // maintenance goal created any other way, and `goals` never had a unique
-  // constraint on (version_id, title) for the lock to fall back on.
-  const dbg = src('modules/lifecycle/db-goals.js');
-  assert.match(dbg, /pg_advisory_xact_lock/, 'the lock stays — it solves a different problem');
-  assert.match(MIG234, /is_maintenance boolean NOT NULL DEFAULT false/, 'core_234 still owns the column');
-});
-
-// ---- carry forward ---------------------------------------------------------
-
-function carryPool({ src = { id: 5 }, destStatus = 'building', destFound = { id: 9 } } = {}) {
-  return pool((sql) => {
-    const q = String(sql).replace(/\s+/g, ' ');
-    if (/SELECT id FROM goals WHERE version_id = \$1 AND is_maintenance LIMIT 1/.test(q)) return { rows: src ? [src] : [] };
-    if (/SELECT status FROM versions/.test(q)) return { rows: [{ status: destStatus }] };
-    if (/pg_advisory_xact_lock/.test(q)) return { rows: [] };
-    if (/FROM goals WHERE version_id = \$1 AND is_maintenance/.test(q)) return { rows: destFound ? [destFound] : [] };
-    if (/UPDATE tasks SET goal_id/.test(q)) return { rows: [{ id: 1 }, { id: 2 }, { id: 3 }] };
-    return { rows: [] };
-  });
-}
-
-await test('open bugs move to the successor, and the emptied goal archives behind them', async () => {
-  const p = carryPool();
-  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { pool: p });
-  assert.deepEqual(out, { carried: 3, from: '5', to: '9', reason: null });
-  const mv = p.queries.find((x) => /UPDATE tasks SET goal_id/.test(flat(x)));
-  assert.match(flat(mv), /NOT IN \('shipped', 'abandoned'\)/, 'only the unfinished ones travel');
-  assert.equal(mv.params[2], 'V2', 'and their version_id moves with them, or they are orphaned across the boundary');
-  assert.ok(p.queries.some((x) => /UPDATE goals SET status = 'archived'/.test(flat(x))));
-});
-
-await test('NO successor: the bugs stay put and the close still succeeds', async () => {
-  // A version with nothing scoped after it must not fail its close, and its bug
-  // queue must not be cut for a reason that has nothing to do with the bugs.
-  const p = carryPool();
-  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: null }, { pool: p });
-  assert.equal(out.carried, 0);
-  assert.equal(out.reason, 'no_successor');
-  assert.equal(p.queries.some((x) => /UPDATE tasks/.test(flat(x))), false, 'nothing moved');
-  assert.equal(p.queries.some((x) => /UPDATE goals SET status = 'archived'/.test(flat(x))), false,
-    'and the source goal is NOT closed — the queue is still live');
-});
-
-await test('a successor that is not yet BUILDING carries nothing, and says so', async () => {
-  // The ordering trap ADR 0263 §8 names: ensureMaintenanceGoal returns null for a
-  // non-building version, so a carry-over run before R20's promotion would report
-  // success while moving nothing.
-  const p = carryPool({ destStatus: 'planning', destFound: null });
-  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { pool: p });
-  assert.equal(out.carried, 0);
-  assert.equal(out.reason, 'successor_not_building', 'a silent zero would be indistinguishable from success');
-  assert.equal(p.queries.some((x) => /UPDATE tasks/.test(flat(x))), false);
-});
-
-await test('a version with no maintenance goal at all is a clean no-op', async () => {
-  const p = carryPool({ src: null });
-  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { pool: p });
-  assert.equal(out.reason, 'no_maintenance_goal');
-  assert.equal(out.carried, 0);
-});
-
-await test('it runs on the CALLER exec, so it joins the close transaction', () => {
-  // R12 left `deps.onClosed(client, …)` for exactly this. Opening its own
-  // connection would commit the carry-over independently of the close it belongs to.
-  const dbg = src('modules/lifecycle/db-goals.js');
-  const fn = dbg.slice(dbg.indexOf('async function carryMaintenanceForward'), dbg.indexOf('// listVersionAdmissions'));
-  assert.match(fn, /const exec = deps\.client \|\|/, 'it must accept the caller\'s client');
-  assert.doesNotMatch(fn, /\.connect\(\)/, 'and must never open its own');
-  assert.doesNotMatch(fn, /BEGIN|COMMIT/, 'nor manage a transaction it does not own');
-});
-
-summary();