@bongos/core 1.19.598 → 1.19.600

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.598",
-  "core_contract": "1.19.598",
-  "source_commit": "765987c9bfd5277ee8bd4a6dc5c73f6aab9224bc",
+  "core_version": "1.19.600",
+  "core_contract": "1.19.600",
+  "source_commit": "8e02f02563986161d1b77b266027bab29d5534aa",
   "source_ref": "HEAD",
-  "built_at": "2026-09-08T04:22:59.900Z",
+  "built_at": "2026-09-08T04:42:02.346Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 457,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2074,
+    "functional_verbatim": 2075,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2555,
-  "tree_sha256": "2193f9634af7589ddd47ef00b03be7824679582ec0ca3688709c68ffe2e78d7b",
+  "file_count": 2556,
+  "tree_sha256": "a008ff8e9029ba8be4b741e6ce36012a90a005bad10e76f4fed030cee2404487",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2727,7 +2727,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "162a1e6f165acd0b744497fd19ecc34fa10a9229dca13c7b1d35c795511a85b4"
+      "sha256": "251ae2f82d65d325f220649d865bc5413a3febbf493db6994b6f3e9713968ac8"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5532,7 +5532,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "c3e06daaf78911c9dc44f72aa7a104f269624c92f343cd808b2962076a641a23"
+      "sha256": "dde23a909ea56f7102d42af9bd5a832449940b00b4bfac7ed779e7938d95885c"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5572,7 +5572,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "14c05469abcf349c9173a80059e7fa0dd880b1b5a0b25680ba0d9e524e46d5d9"
+      "sha256": "33fc8959d522bcf18c445b1a5710940379f84d1e938eecdc52cdf52bec9c4b3d"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5582,7 +5582,7 @@
     {
       "path": "modules/lifecycle/done-when.js",
       "mode": "0000644",
-      "sha256": "4e798aff55de6481ea9da3f8a08e68d99902f3eac4749e30d727517ff61176b5"
+      "sha256": "7def4b53d251ecac2e9ce4c7aa2df8cb8814e2105d47417e5d43191884cd8ea1"
     },
     {
       "path": "modules/lifecycle/est-advisory.js",
@@ -5869,6 +5869,11 @@
       "mode": "0000644",
       "sha256": "af00ee4629002c8df2448e2146a24108407a36b062859ee1afee293aa60cb209"
     },
+    {
+      "path": "modules/lifecycle/version-autoclose.js",
+      "mode": "0000644",
+      "sha256": "06e035b8d1545d68a0e629e707ea7f86d48fac5dc8fe0c5e70ec8704508ecf7c"
+    },
     {
       "path": "modules/lifecycle/version-close.js",
       "mode": "0000644",
@@ -7622,12 +7627,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a20139fc06badf4713e2ad023c865eb4339b49d1caabfa79d5ea8282c1e13cea"
+      "sha256": "d3456f52cc8555eb1a20f884dc2d32240032138193c5d525ea455d07423e9656"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "cfc6a9c8fd26745544ca7256e40c41929174e617e199cf972e1df59f68e98e51"
+      "sha256": "107d899ff6ec92f0f2dd863f62ab2a68eaa82c7f60d9e172c243b9b5ff421f52"
     },
     {
       "path": "public-docs/index.html",
@@ -9342,7 +9347,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "922414a017882732619bc7ae7c14ec5c056c0bd2f950447ca9abac23d0b3a687"
+      "sha256": "fa5a67fefe06f235502a19ee017a75467ab1f5cadf77c2b004edd4109b397ece"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9622,7 +9627,7 @@
     {
       "path": "tests/auto_satisfy_criteria.mjs",
       "mode": "0000644",
-      "sha256": "d63beea7b680a194d163aa5ad11806c9aa860de93d614195a05a33082e9f8adb"
+      "sha256": "d7ac18d14e8e9e5e7b9e913a76953fe69bfefea4912e77ca30b285647bfcfca8"
     },
     {
       "path": "tests/autonomous_fit_protected_paths.mjs",
@@ -10492,7 +10497,7 @@
     {
       "path": "tests/goal_closure_invariants.mjs",
       "mode": "0000644",
-      "sha256": "eace8ebcf39f40683bf9cbcfbc0e554b115e73d1f72894ca57a89e82d119d357"
+      "sha256": "e5f937b9ce3264b6b4bb3a9ca57fa000b2190fe49c3ba6d70acdd9d26f55423c"
     },
     {
       "path": "tests/goal_conflicts.mjs",
@@ -11289,11 +11294,6 @@
       "mode": "0000644",
       "sha256": "9a1813d6036886ea07d1563e71a466e66c28554b75b22605464c795fd9fa2ebb"
     },
-    {
-      "path": "tests/maintenance_carry_forward.mjs",
-      "mode": "0000644",
-      "sha256": "4ac9164b84ad7bf8e9c1b45e7cb5e157762c992ddde16041410a528a534e60f5"
-    },
     {
       "path": "tests/maintenance_goal.mjs",
       "mode": "0000644",
@@ -11302,7 +11302,7 @@
     {
       "path": "tests/maintenance_goal_flag.mjs",
       "mode": "0000644",
-      "sha256": "37356bcd78ff92537a5512b60f2274d573b6c90bb30f5deca006a14d4841fc95"
+      "sha256": "d1f662d8533544ca1e7575f8b7c75fc93d89a4a60880bd47b873b068a3241e4b"
     },
     {
       "path": "tests/manage_manifest_shared_read.mjs",
@@ -12689,6 +12689,11 @@
       "mode": "0000644",
       "sha256": "808a5fb2e14fb03ded6ed5ea0b3c0a0a7f53bfb885e853acb225f7b439a06ac3"
     },
+    {
+      "path": "tests/version_autoclose.mjs",
+      "mode": "0000644",
+      "sha256": "3a9e1f7ae24aa4d25baaaff53890e4d963f662ae95e5cd69b00da1cd3f6cb012"
+    },
     {
       "path": "tests/version_build_slot.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -1645,5 +1645,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.596 with no explicit bump. run 34186368179. (task 1002620)
   1.19.598 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.597 with no explicit bump. run 34186758247. (task 1002620)
+  1.19.599 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.598 with no explicit bump. run 34187136306. (task 1002620)
+  1.19.600 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.599 with no explicit bump. run 34187881031. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-goals.js

@@ -17,6 +17,9 @@ const { deriveRequiredRank, highestRank } = require('./db-rank-authz.js');
 const { nonTerminalSql, isTerminalStatus } = require('./task-status');
 const { maintenanceGoalTitle } = require('./goal-advisory.js');
 const { SMOKE_NOT_LIKE } = require('./db-shared.js');
+// BV1.R16 (task 1003603) — auto-close, shared with the done-when cascade so the
+// two achievement writers cannot drift apart (ADR 0263 §4).
+const { autoCloseVersionsForGoals } = require('./version-autoclose.js');
 
 // -------------------------------------------------------------------------
 // Goals (ADR 0086 §2 / BV1.R56 — task 1510)
@@ -231,79 +234,45 @@ async function carryBugsForward({ fromVersionId, toVersionId }, deps = {}) {
   );
   if (!from[0]) return { fromGoalId: null, toGoalId: null, moved: 0 };
 
+  // RETURNS, NEVER THROWS (BV1.R18c, task 1003709). This used to throw
+  // CARRY_FORWARD_NO_DESTINATION here, and the call site is closeVersion's
+  // `deps.onClosed` — INSIDE the close transaction. A throw there rolls the whole
+  // close back, so a version whose successor had not been promoted yet would
+  // simply refuse to close. ADR 0263 §4 is explicit that this path may never fail
+  // the close, for the same reason closeCompletedWorkForShip may never fail a ship.
+  //
+  // The reason still travels, because a bare 0 is indistinguishable from "there
+  // was nothing to carry" — and the two want opposite responses: one is fine, the
+  // other means R20 ran the carry-over before the promotion (ADR 0263 §8's
+  // ordering trap) and the queue is still sitting on a shipped version.
   const to = await ensureMaintenanceGoal(toVersionId, deps);
-  if (!to) {
-    throw Object.assign(new Error('successor version cannot hold a maintenance goal'), {
-      code: 'CARRY_FORWARD_NO_DESTINATION', toVersionId,
-      hint: 'ensureMaintenanceGoal returns null unless the destination version is `building` — promote it before carrying forward (ADR 0263 §8).',
-    });
-  }
+  if (!to) return { fromGoalId: String(from[0].id), toGoalId: null, moved: 0, reason: 'successor_not_building' };
 
   // Only the UNFINISHED ones move. A shipped or abandoned defect is history and
   // belongs to the version it was fixed in — dragging it forward would make every
   // successor's maintenance goal a growing archive of everything ever reported.
+  // THE VERSION MOVES WITH THE GOAL (BV1.R18c, task 1003709). Setting only
+  // `goal_id` strands the task's `version_id` on the version being closed, and
+  // that column is not decoration: `version_progress` joins
+  // `tasks t ON t.version_id = v.id`, and `version-close.getCarryOverCount`
+  // filters on it directly. A half-moved task therefore counts against a SHIPPED
+  // version forever, never counts toward the successor, and leaves the closed
+  // version still reporting carry-over it no longer holds.
+  //
+  // Smoke rows are excluded the way version_progress excludes them — a test
+  // fixture must not ride across a version boundary into a real queue.
   const { rows: moved } = await exec.query(
-    `UPDATE tasks SET goal_id = $2, updated_at = now()
+    `UPDATE tasks SET goal_id = $2, version_id = $3, updated_at = now()
       WHERE goal_id = $1 AND ${nonTerminalSql('status')}
+        AND ${SMOKE_NOT_LIKE}
       RETURNING id::text`,
-    [from[0].id, to.id]
+    [from[0].id, to.id, toVersionId]
   );
-  return { fromGoalId: String(from[0].id), toGoalId: String(to.id), moved: moved.length };
-}
-
-// carryMaintenanceForward — move a closing version's unfinished maintenance work
-// into the successor's maintenance goal (BV1.R18, task 1003605, ADR 0263 §7).
-//
-// THE ONE GOAL THAT LEGITIMATELY SPANS VERSIONS. Every other goal either finishes
-// or is dispositioned at close (roll forward, or abandon — R12). A maintenance
-// goal is neither: it holds defects against already-shipped work, and those arrive
-// on their own schedule rather than on the version's. Cutting them because a
-// version ended would delete a bug queue for a reason that has nothing to do with
-// the bugs; making them need an override to survive would put a counted escape
-// hatch on the ordinary path, which is what ADR 0250 §3 built the counter to
-// prevent. So they move.
-//
-// RUNS ON THE CLOSE'S OWN CLIENT, inside its transaction, via the `deps.onClosed`
-// seam R12 left in closeVersion. Two things follow, both load-bearing:
-//
-//   The successor must ALREADY be `building` when this runs. `ensureMaintenanceGoal`
-//   returns null for a version in any other state, so a carry-over run before R20's
-//   promotion silently carries nothing and reports success. That is why the seam
-//   fires after the flip and why this asserts rather than assumes.
-//
-//   Nothing here may fail the close for want of a destination. A version with no
-//   successor (no planning version was scoped) closes with its maintenance work
-//   left where it is — visible on a shipped version, recoverable, and honest —
-//   rather than the close failing or the bugs being cut. Returns a summary saying
-//   which happened.
-//
-// The source goal is left ARCHIVED with nothing open, so it passes R10's own
-// check on the way out rather than being special-cased around it.
-async function carryMaintenanceForward({ fromVersionId, toVersionId }, deps = {}) {
-  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
-  const { rows: src } = await exec.query(
-    `SELECT id FROM goals WHERE version_id = $1 AND is_maintenance LIMIT 1`, [fromVersionId]
-  );
-  if (!src[0]) return { carried: 0, from: null, to: null, reason: 'no_maintenance_goal' };
-  if (!toVersionId) return { carried: 0, from: String(src[0].id), to: null, reason: 'no_successor' };
-
-  const dest = await ensureMaintenanceGoal(toVersionId, { client: exec });
-  // Null means the successor is not `building` — see the ordering note above. Do
-  // not "fix" this by relaxing ensureMaintenanceGoal's version gate: that gate is
-  // what stops a defect being filed into a shipped version's goal (the 1000771 bug).
-  if (!dest) return { carried: 0, from: String(src[0].id), to: null, reason: 'successor_not_building' };
-
-  const { rows: moved } = await exec.query(
-    `UPDATE tasks SET goal_id = $2, version_id = $3, updated_at = now()
-      WHERE goal_id = $1 AND ${nonTerminalSql()}
-        AND ${SMOKE_NOT_LIKE.replace(/title/, 'tasks.title')}
-      RETURNING id`,
-    [src[0].id, dest.id, toVersionId]
-  );
-  // The emptied goal closes behind them. Archived rather than achieved: it was
-  // never "done", it stopped being the live queue.
-  await exec.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [src[0].id]);
-  return { carried: moved.length, from: String(src[0].id), to: String(dest.id), reason: null };
+  // The emptied source goal closes behind them: archived, not achieved — it was
+  // never "done", it stopped being the live queue. Leaving it open on a shipped
+  // version is the mirror of the defect this whole goal exists to remove.
+  await exec.query(`UPDATE goals SET status = 'archived', updated_at = now() WHERE id = $1`, [from[0].id]);
+  return { fromGoalId: String(from[0].id), toGoalId: String(to.id), moved: moved.length, reason: null };
 }
 
 // listVersionAdmissions (BV1.R07, task 1003594) — every goal admitted into ONE
@@ -526,7 +495,20 @@ async function achieveGoalIfComplete({ goalId }, deps = {}) {
   // the goal simply stays open until its last task lands or is abandoned.
   if (unfinishedTasks > 0) return { achieved: false, goal, unfinishedTasks };
   const updated = await setGoalStatus({ goalId, status: 'achieved' }, deps);
-  return { achieved: true, goal: updated };
+
+  // BV1.R16 (task 1003603, ADR 0263 §§3–4): the SECOND achievement writer. A goal
+  // reaching `achieved` may have been the version's last non-maintenance goal, and
+  // that is true whichever door it came through — this manual satisfy path or the
+  // ship-time cascade in done-when.js. ADR 0250 D2 already established that these
+  // two writers move together or a version closes correctly through one and wrongly
+  // through the other; the rule itself lives in ONE place (version-autoclose.js) so
+  // "together" is enforced by the require rather than by remembering.
+  //
+  // Runs on the caller's exec so it sees the flip above, which in the ship path is
+  // still uncommitted. Never throws: autoCloseVersionsForGoals catches per version.
+  const exec = deps.client || ((deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool);
+  const versionsClosed = await autoCloseVersionsForGoals(exec, [updated]);
+  return { achieved: true, goal: updated, versionsClosed };
 }
 
 // addGoalMember — join. Upserts on the (goal_id, builder_id) PK so a re-join is
@@ -1228,7 +1210,6 @@ module.exports = {
   carryBugsForward,
   achieveGoalIfComplete,
   archiveGoalWithDispositions,
-  carryMaintenanceForward,
   addGoalMember,
   addGoalScopeModules,
   createGoal,

package/modules/lifecycle/db.js

@@ -83,7 +83,6 @@ const {
   listActiveClaimsForTasks,
   listCriteriaForGoal,
   archiveGoalWithDispositions,
-  carryMaintenanceForward,
   openTasksInGoal,
   listGoalMembers,
   listGoals,
@@ -260,7 +259,6 @@ module.exports = {
   listPendingRequestsForGoal,
   listCriteriaForGoal,
   archiveGoalWithDispositions,
-  carryMaintenanceForward,
   openTasksInGoal,
   createTask,
   generalGoalIdForVersion,

package/modules/lifecycle/done-when.js

@@ -26,6 +26,10 @@
 const { pool } = require('../../src/module-api');
 const { nonTerminalSql } = require('./task-status');
 const { SMOKE_NOT_LIKE } = require('./db-shared.js');
+// BV1.R16 (task 1003603) — auto-close. Dependency-free module, so requiring it
+// here creates no cycle (db-versions.js requires THIS file, which is why the
+// rule could not live beside closeVersion).
+const { autoCloseVersionsForGoals } = require('./version-autoclose.js');
 
 // isPendingReview — the ONE derivation of the "met — pending review" auto-flag
 // (ADR 0086 §6 / BV1.R63): a criterion with >=1 linked task, every one shipped,
@@ -474,7 +478,8 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null } = {}) {
   // review off docs/architecture.md, whose tasks index list predated 228 and has
   // been corrected.)
   const goalIds = [...new Set(criteria.map((c) => c.goal_id).filter((g) => g != null))].map(Number);
-  if (goalIds.length === 0) return { criteria, goals: [] };
+  // No goal achieved, so no version can have just become closable.
+  if (goalIds.length === 0) return { criteria, goals: [], versionsClosed: [] };
   const { rows: goals } = await exec.query(
     `UPDATE goals g
         SET status = 'achieved', updated_at = now()
@@ -488,7 +493,16 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null } = {}) {
      RETURNING g.id, g.title, g.version_id, g.status`,
     [goalIds]
   );
-  return { criteria, goals };
+  // BV1.R16 (task 1003603, ADR 0263 §§3–4): a version closes ITSELF once its last
+  // non-maintenance goal achieves. On the caller's `exec`, so it sees the flips
+  // above that have not committed yet — a check on the pool would never close the
+  // version on the ship that actually finished it.
+  //
+  // `autoCloseVersionsForGoals` catches per version and never rethrows: a version
+  // close must not be able to fail a builder's ship. The accepted failure is a
+  // version left un-closed, which the reconciler's next unscoped sweep heals.
+  const versionsClosed = await autoCloseVersionsForGoals(exec, goals);
+  return { criteria, goals, versionsClosed };
 }
 
 // describeAutoClose — the one-line summary of what a close actually closed, or

package/modules/lifecycle/version-autoclose.js

@@ -0,0 +1,107 @@
+'use strict';
+
+// modules/lifecycle/version-autoclose.js — a version closes ITSELF when its last
+// non-maintenance goal achieves (BV1.R16, task 1003603, goal 1000086,
+// ADR 0250 D5, ADR 0263 §§3–4).
+//
+// WHY THIS FILE EXISTS AT ALL, rather than living beside `closeVersion`.
+// Goal achievement has TWO writers — `db-goals.achieveGoalIfComplete` (the manual
+// `POST /done-when/:id/satisfy` path) and the `done-when.autoSatisfyShippedCriteria`
+// cascade (every ship, every reconciler tick). Both must auto-close, and neither
+// can reach `db-versions.js`: that file already requires `done-when`, so a call
+// the other way is a require cycle. ADR 0263 §4 accepted writing the rule twice
+// for exactly this reason.
+//
+// It is written ONCE instead, here, because this module requires NOTHING but
+// `task-status` — the `task-status.js` precedent, which is dependency-free so a
+// CLI can read it without paying for the pool. Both writers can require it, no
+// cycle exists, and the rule that decides when a VERSION ends has one definition
+// rather than two that must be kept in lockstep by hand. The duplicate the ADR
+// permitted is a cost it did not have to pay.
+//
+// AUTO-CLOSE HAS NOTHING TO DISPOSITION, and that is the whole shape of this
+// feature (ADR 0263 §3). It fires when the last non-maintenance goal achieves —
+// so by construction every non-maintenance goal on the version is already
+// `achieved` or `archived`, and the set needing a decision is EMPTY BY
+// DEFINITION. The disposition map, the refusal that returns the goals, the
+// successor lineage: all of that belongs to EARLY close (R12) and none of it can
+// ever have input here. This file is therefore much smaller than ADR 0250's
+// sentence makes it sound.
+
+const { nonTerminalSql } = require('./task-status');
+
+// The maintenance goal never holds a version open (ADR 0263 §7). Reads the
+// `is_maintenance` FLAG that R18 (task 1003605, migration core_234) added — never
+// a title, because deciding this by string would let anyone able to name a goal
+// exempt it from the gate that ends a version.
+const NOT_MAINTENANCE = 'NOT g.is_maintenance';
+
+// autoCloseVersionIfComplete — flip `versionId` to `shipped` if, and only if, it
+// holds no open non-maintenance goal.
+//
+// RUNS ON THE CALLER'S `exec`, which is the ship transaction's own client. That
+// is load-bearing rather than tidy: the goal that just achieved was flipped in
+// this same uncommitted transaction, so a check on the module pool would not see
+// it and the version would never close on the ship that finished it — the same
+// reason R09's closure check takes an exec.
+//
+// IDEMPOTENT BY `WHERE status = 'building'`. The reconciler's unscoped sweep runs
+// this every tick, so the second and every later run must be a no-op; without the
+// guard each sweep would rewrite `shipped_at` and the version's own record of
+// when it finished would drift forward forever.
+//
+// Returns the closed version row, or null when the version is not ready (the
+// overwhelmingly common answer) — null is not an error.
+async function autoCloseVersionIfComplete(exec, versionId) {
+  if (!exec || versionId == null) return null;
+  const { rows } = await exec.query(
+    `UPDATE versions v
+        SET status = 'shipped', shipped_at = now()
+      WHERE v.id = $1
+        AND v.status = 'building'
+        AND NOT EXISTS (
+          SELECT 1 FROM goals g
+           WHERE g.version_id = v.id
+             AND g.status = 'open'
+             AND ${NOT_MAINTENANCE}
+        )
+      RETURNING v.id, v.name, v.track, v.status, v.shipped_at`,
+    [versionId]
+  );
+  return rows[0] ?? null;
+}
+
+// autoCloseVersionsForGoals — the call both achievement writers actually make.
+//
+// Takes the goals a cascade just achieved (each carrying `version_id`) and tries
+// their versions, de-duplicated. A cascade can achieve several goals at once and
+// they may sit on different versions, so this is a set rather than a single id.
+//
+// IT MAY NEVER FAIL A SHIP. This is not a preference — it is the established
+// posture of `closeCompletedWorkForShip`, which swallows its own failure on the
+// argument that a criterion close must never fail a ship and the reconciler's
+// sweep retries every tick. A version close is a strictly WIDER write than a
+// criterion close, so it inherits that posture a fortiori: the failure mode we
+// accept is a version left UN-closed, which the next sweep heals, and the one we
+// refuse is a builder's ship rolled back by a bug in version-close. Every throw
+// is caught here, per version, so one bad version cannot stop another closing.
+//
+// Returns the rows that actually closed — usually empty.
+async function autoCloseVersionsForGoals(exec, goals = [], onError = null) {
+  const ids = [...new Set((goals || []).map((g) => g && g.version_id).filter((v) => v != null))];
+  const closed = [];
+  for (const versionId of ids) {
+    try {
+      const row = await autoCloseVersionIfComplete(exec, versionId);
+      if (row) closed.push(row);
+    } catch (err) {
+      // Reported, never propagated. A silent swallow would make a persistently
+      // broken close indistinguishable from "nothing was ready", which is the
+      // failure that hides for months.
+      if (typeof onError === 'function') onError(versionId, err);
+    }
+  }
+  return closed;
+}
+
+module.exports = { autoCloseVersionIfComplete, autoCloseVersionsForGoals, NOT_MAINTENANCE };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.598",
+  "version": "1.19.600",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.598",
+      "version": "1.19.600",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.598",
+  "version": "1.19.600",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.598'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.600'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -107,7 +107,12 @@ await test('ASYMMETRY (rollup): the /status rollup is untouched by this task', (
 await test('EXEC: every write goes through the caller-supplied exec (so a ship txn is atomic)', async () => {
   const exec = fakeExec({ rows: [CRIT] }, { rows: [{ id: 77, title: 'g', version_id: 'BONGOS-V1', status: 'achieved' }] });
   const out = await autoSatisfyShippedCriteria(exec, { taskId: 5 });
-  assert.equal(exec.calls.length, 2, 'one criterion update + one goal cascade');
+  // Three since BV1.R16 (task 1003603): the criterion update, the goal cascade,
+  // and the version auto-close — which is the point, because the third must ride
+  // the SAME exec as the first two or a version would never close on the ship
+  // that finished it.
+  assert.equal(exec.calls.length, 3, 'criterion update + goal cascade + version auto-close');
+  assert.match(exec.calls[2].sql, /UPDATE versions v/, 'and the third is the auto-close, on exec');
   assert.deepEqual(out.criteria, [CRIT]);
   assert.deepEqual(out.goals.map((g) => g.id), [77]);
   const src = readFileSync(new URL('../modules/lifecycle/done-when.js', import.meta.url), 'utf8');

package/tests/goal_closure_invariants.mjs

@@ -251,9 +251,15 @@ test('the cascade reads through the exec it was handed, so it sees the ship\'s o
 test('every statement goes through the caller exec — none reaches the module pool', async () => {
   const exec = makeExec(world({ criteria: [{ satisfied: false, task_ids: [200] }], tasks: [SHIPPED()] }));
   await autoSatisfyShippedCriteria(exec, { taskId: 200 });
-  assert.equal(exec.calls.length, 2, 'the criterion close and the cascade, both on exec');
+  // BV1.R16 (task 1003603) added a third: the version auto-close. It belongs in
+  // THIS test rather than only in its own, because the property under assertion —
+  // nothing reaches the module pool — is exactly what makes auto-close correct on
+  // a ship: the goal it keys on was flipped in this uncommitted transaction, and
+  // a pool read would not see it.
+  assert.equal(exec.calls.length, 3, 'the criterion close, the cascade and the version auto-close, all on exec');
   assert.match(exec.calls[0].sql, /UPDATE done_when_criteria/);
   assert.match(exec.calls[1].sql, /UPDATE goals g/);
+  assert.match(exec.calls[2].sql, /UPDATE versions v/);
 });
 
 // ---------------------------------------------------------------------------

package/tests/maintenance_goal_flag.mjs

@@ -117,7 +117,7 @@ test('carryBugsForward moves only NON-TERMINAL tasks', async () => {
     return { rows: [] };
   });
   const out = await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
-  assert.deepEqual(out, { fromGoalId: '1', toGoalId: '5', moved: 2 });
+  assert.deepEqual(out, { fromGoalId: '1', toGoalId: '5', moved: 2, reason: null });
   const move = r.seen.find((q) => /UPDATE tasks/.test(q.sql));
   assert.match(move.sql, /status NOT IN \('shipped', 'abandoned'\)/,
     'a fixed or cut defect belongs to the version it was resolved in — carrying it forward would make every successor an archive');
@@ -130,20 +130,33 @@ test('a version with no maintenance goal carries nothing, and that is not an err
   assert.equal(r.seen.some((q) => /UPDATE tasks/.test(q.sql)), false, 'nothing is written');
 });
 
-test('carrying into a version that is not building FAILS LOUDLY', async () => {
+test('carrying into a version that is not building REPORTS loudly — without failing the close', async () => {
   // ADR 0263 §8: promotion must happen BEFORE the carry-over, because
   // ensureMaintenanceGoal returns null for a version that is not `building`. A
   // silent no-op here would strand the bug queue on a shipped version — the
   // exact entombment this whole path exists to end — and look like success.
+  //
+  // BV1.R18c (task 1003709) changed HOW it is loud, not whether. This threw
+  // CARRY_FORWARD_NO_DESTINATION, and the call site is closeVersion's
+  // `deps.onClosed` — inside the close transaction. A throw there rolls the whole
+  // close back, so a version whose successor had not been promoted yet would
+  // refuse to close at all, and ADR 0263 §4 says this path may never fail the
+  // close (the same posture closeCompletedWorkForShip has toward a ship).
+  //
+  // The distinction the throw was protecting is kept in the RETURN: `reason` tells
+  // a caller that the destination was missing, which a bare `moved: 0` could not —
+  // and that is the whole point, because "nothing to carry" and "you ran this
+  // before the promotion" want opposite responses.
   const r = recorder((sql) => {
     if (/SELECT id FROM goals/.test(sql)) return { rows: [{ id: 1 }] };
     if (/FROM versions/.test(sql)) return { rows: [{ status: 'planning' }] };
     return { rows: [] };
   });
-  await assert.rejects(
-    () => carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client }),
-    (e) => e.code === 'CARRY_FORWARD_NO_DESTINATION'
-  );
+  const out = await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
+  assert.equal(out.moved, 0);
+  assert.equal(out.reason, 'successor_not_building');
+  assert.equal(out.toGoalId, null, 'and it names no destination, because there was none');
+  assert.equal(r.seen.some((q) => /UPDATE tasks/.test(q.sql)), false, 'nothing moved');
 });
 
 test('carryBugsForward does NOT refuse an actively-claimed task', () => {
@@ -221,3 +234,55 @@ test('the find-or-create survives a pre-existing duplicate rather than throwing'
   assert.match(fn.slice(0, 2500), /ORDER BY id LIMIT 1/,
     'with no unique constraint, a duplicate must be survivable and the answer stable');
 });
+
+// ---- BV1.R18c (task 1003709): the two defects the merge closed -------------
+//
+// `main` briefly carried TWO carry-forward functions, one per session that built
+// R18. Collapsing them was not a coin toss: each had something the other needed,
+// and the two below are the halves that were missing here.
+
+test('R18c: the VERSION moves with the goal, or the task counts against a shipped version forever', async () => {
+  // `version_progress` joins `tasks t ON t.version_id = v.id` (verified against the
+  // live view), and `version-close.getCarryOverCount` filters on it directly. A task
+  // moved to the successor's goal but left stamped with the closing version counts
+  // against a SHIPPED version, never counts toward the successor, and leaves the
+  // closed version still reporting carry-over it no longer holds.
+  const r = recorder((sql) => {
+    if (/SELECT id FROM goals/.test(sql)) return { rows: [{ id: 1 }] };
+    if (/FROM versions/.test(sql)) return { rows: [{ status: 'building' }] };
+    if (/pg_advisory_xact_lock/.test(sql)) return { rows: [] };
+    if (/SELECT id, version_id/.test(sql)) return { rows: [{ id: 5 }] };
+    if (/UPDATE tasks/.test(sql)) return { rows: [{ id: '11' }] };
+    return { rows: [] };
+  });
+  await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
+  const mv = r.seen.find((q) => /UPDATE tasks/.test(q.sql));
+  assert.ok(mv, 'the move must happen');
+  assert.match(mv.sql, /version_id = \$3/, 'goal_id alone leaves the task half-moved');
+  assert.equal(mv.params[2], 'V2');
+  assert.match(mv.sql, /NOT LIKE/, 'and a smoke fixture must not ride across a version boundary');
+});
+
+test('R18c: a successor that is not yet building RETURNS, it does not throw', async () => {
+  // The call site is closeVersion's `deps.onClosed` — inside the close
+  // transaction. A throw there rolls the whole close back, so a version whose
+  // successor had not been promoted would refuse to close. ADR 0263 §4 says this
+  // path may never fail the close.
+  const r = recorder((sql) => {
+    if (/SELECT id FROM goals/.test(sql)) return { rows: [{ id: 1 }] };
+    if (/FROM versions/.test(sql)) return { rows: [{ status: 'planning' }] };
+    return { rows: [] };
+  });
+  const out = await carryBugsForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { client: r.client });
+  assert.equal(out.moved, 0);
+  assert.equal(out.reason, 'successor_not_building',
+    'a bare 0 is indistinguishable from "nothing to carry", and the two want opposite responses');
+  assert.equal(out.toGoalId, null);
+});
+
+test('R18c: exactly ONE carry-forward is exported', () => {
+  const db = require('../modules/lifecycle/db.js');
+  assert.equal(typeof db.carryBugsForward, 'function');
+  assert.equal(db.carryMaintenanceForward, undefined,
+    'two functions for one job is how a call site picks the wrong one');
+});

package/tests/version_autoclose.mjs

@@ -0,0 +1,170 @@
+// tests/version_autoclose.mjs — a version closes ITSELF when its last
+// non-maintenance goal achieves (BV1.R16, task 1003603, goal 1000086,
+// ADR 0250 D5, ADR 0263 §§3–4).
+//
+// THE SHAPE, which is smaller than ADR 0250's sentence suggests. Auto-close fires
+// when the last non-maintenance goal achieves — so by construction every
+// non-maintenance goal on the version is already closed, and the set needing a
+// disposition is EMPTY BY DEFINITION. The disposition map, the refusal that
+// returns the goals, the successor lineage: all of that is EARLY close (R12) and
+// none of it can ever have input here.
+//
+// THE TWO PROPERTIES THAT ARE LOAD-BEARING, and the reason this file is not just
+// a happy-path check:
+//
+//   1. It hangs off BOTH achievement writers. `db-goals.achieveGoalIfComplete` is
+//      the manual satisfy path; `done-when.autoSatisfyShippedCriteria` is the
+//      cascade on every ship and every reconciler tick. ADR 0250 D2 established
+//      that these two move together or a version closes correctly through one door
+//      and wrongly through the other. ADR 0263 §4 expected the rule to be written
+//      TWICE for that reason — a require cycle stops db-versions.js being the
+//      shared home. It is written ONCE instead, in a dependency-free module both
+//      can require, so "together" is enforced by the import rather than by anyone
+//      remembering.
+//
+//   2. It may NEVER fail a ship. A version close is a strictly wider write than a
+//      criterion close, and `closeCompletedWorkForShip` already swallows its own
+//      failure on the argument that a criterion close must not fail a ship. The
+//      accepted failure here is a version left UN-closed, which the next sweep
+//      heals; the refused one is a builder's ship rolled back by a bug in
+//      version-close.
+//
+// Run:  node --test tests/version_autoclose.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { autoCloseVersionIfComplete, autoCloseVersionsForGoals, NOT_MAINTENANCE } =
+  require('../modules/lifecycle/version-autoclose.js');
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+const AUTOCLOSE = src('modules/lifecycle/version-autoclose.js');
+const DONE_WHEN = src('modules/lifecycle/done-when.js');
+const DB_GOALS = src('modules/lifecycle/db-goals.js');
+
+const recorder = (handler) => {
+  const seen = [];
+  return { seen, exec: { query: async (sql, params) => { seen.push({ sql, params }); return handler(sql, params); } } };
+};
+
+// ---------------------------------------------------------------------------
+// The predicate
+// ---------------------------------------------------------------------------
+
+test('the maintenance goal never holds a version open, and it is read by FLAG', () => {
+  assert.equal(NOT_MAINTENANCE, 'NOT g.is_maintenance');
+  assert.equal(/title/i.test(NOT_MAINTENANCE), false,
+    'deciding this by string would let anyone able to name a goal exempt it from the gate that ends a version');
+});
+
+test('the close asks "is any non-maintenance goal still open", and nothing else', async () => {
+  const r = recorder(() => ({ rows: [] }));
+  await autoCloseVersionIfComplete(r.exec, 'V1');
+  const sql = r.seen[0].sql.replace(/\s+/g, ' ');
+  assert.match(sql, /UPDATE versions v/);
+  assert.match(sql, /NOT EXISTS \( SELECT 1 FROM goals g/);
+  assert.match(sql, /g\.status = 'open'/);
+  assert.match(sql, /NOT g\.is_maintenance/);
+  // No disposition machinery may appear here — see the header.
+  assert.equal(/disposition|abandon|roll_forward/i.test(sql), false,
+    'auto-close has nothing to disposition; that is all early close');
+});
+
+test('the flip is guarded on building, so a reconciler retry is a no-op', async () => {
+  // Without the guard every sweep rewrites shipped_at and the version's own
+  // record of when it finished drifts forward forever.
+  const r = recorder(() => ({ rows: [] }));
+  await autoCloseVersionIfComplete(r.exec, 'V1');
+  assert.match(r.seen[0].sql.replace(/\s+/g, ' '), /v\.status = 'building'/);
+});
+
+test('a version that is not ready returns null, which is not an error', async () => {
+  const r = recorder(() => ({ rows: [] }));
+  assert.equal(await autoCloseVersionIfComplete(r.exec, 'V1'), null);
+});
+
+test('a missing exec or version id is a no-op, not a throw', async () => {
+  assert.equal(await autoCloseVersionIfComplete(null, 'V1'), null);
+  const r = recorder(() => ({ rows: [] }));
+  assert.equal(await autoCloseVersionIfComplete(r.exec, null), null);
+  assert.equal(r.seen.length, 0, 'and it must not issue a query it cannot key');
+});
+
+// ---------------------------------------------------------------------------
+// It may never fail a ship
+// ---------------------------------------------------------------------------
+
+test('a throwing close is CAUGHT — a ship must never be rolled back by version-close', async () => {
+  const boom = { query: async () => { throw new Error('deadlock detected'); } };
+  const seen = [];
+  const out = await autoCloseVersionsForGoals(boom, [{ version_id: 'V1' }], (v, e) => seen.push(`${v}:${e.message}`));
+  assert.deepEqual(out, []);
+  assert.deepEqual(seen, ['V1:deadlock detected'],
+    'reported, never propagated — a silent swallow makes a persistently broken close look like "nothing was ready"');
+});
+
+test('one bad version does not stop another closing', async () => {
+  let n = 0;
+  const exec = { query: async () => { n += 1; if (n === 1) throw new Error('nope'); return { rows: [{ id: 'V2', status: 'shipped' }] }; } };
+  const out = await autoCloseVersionsForGoals(exec, [{ version_id: 'V1' }, { version_id: 'V2' }], () => {});
+  assert.deepEqual(out.map((v) => v.id), ['V2']);
+});
+
+test('versions are de-duplicated — a cascade can achieve several goals on one version', async () => {
+  const r = recorder(() => ({ rows: [] }));
+  await autoCloseVersionsForGoals(r.exec, [{ version_id: 'V1' }, { version_id: 'V1' }, { version_id: 'V2' }]);
+  assert.deepEqual(r.seen.map((q) => q.params[0]), ['V1', 'V2']);
+});
+
+test('a goal with no version_id is skipped rather than queried as null', async () => {
+  const r = recorder(() => ({ rows: [] }));
+  assert.deepEqual(await autoCloseVersionsForGoals(r.exec, [{}, null, undefined]), []);
+  assert.equal(r.seen.length, 0);
+});
+
+// ---------------------------------------------------------------------------
+// BOTH achievement writers, and the reason it is written once
+// ---------------------------------------------------------------------------
+
+test('the ship-time cascade auto-closes, on the caller exec', () => {
+  assert.match(DONE_WHEN, /const versionsClosed = await autoCloseVersionsForGoals\(exec, goals\)/,
+    'on `exec`, not the pool — the goal it just achieved is uncommitted, and a pool read would never close the version on the ship that finished it');
+  assert.match(DONE_WHEN, /return \{ criteria, goals, versionsClosed \}/);
+});
+
+test('the MANUAL satisfy path auto-closes too', () => {
+  // The failure this prevents: a version that closes correctly through a ship and
+  // wrongly through POST /done-when/:id/satisfy.
+  assert.match(DB_GOALS, /const versionsClosed = await autoCloseVersionsForGoals\(exec, \[updated\]\)/);
+  assert.match(DB_GOALS, /return \{ achieved: true, goal: updated, versionsClosed \}/);
+});
+
+test('both writers import the SAME rule — it is not written twice', () => {
+  // ADR 0263 §4 expected a deliberate duplicate, because db-versions.js requires
+  // done-when.js and so cannot be the shared home. A dependency-free module can
+  // be, which makes "the two copies move together" an import rather than a habit.
+  for (const [name, code] of [['done-when.js', DONE_WHEN], ['db-goals.js', DB_GOALS]]) {
+    assert.match(code, /require\('\.\/version-autoclose\.js'\)/, `${name} must import the shared rule`);
+  }
+  // And the rule's SQL exists in exactly one file.
+  assert.equal(/UPDATE versions v[\s\S]*?NOT EXISTS/.test(DONE_WHEN), false, 'done-when.js must not carry its own copy');
+  assert.equal(/UPDATE versions v[\s\S]*?NOT EXISTS/.test(DB_GOALS), false, 'db-goals.js must not carry its own copy');
+  assert.match(AUTOCLOSE, /UPDATE versions v/);
+});
+
+test('the shared module stays dependency-free, or the cycle comes back', () => {
+  // db-versions.js requires done-when.js. If this module ever requires either,
+  // the import that makes the single definition possible becomes a cycle.
+  const requires = [...AUTOCLOSE.matchAll(/require\('([^']+)'\)/g)].map((m) => m[1]);
+  assert.deepEqual(requires, ['./task-status'],
+    'only task-status — the dependency-free precedent that lets both writers share this');
+});
+
+test('an empty cascade short-circuits without asking about versions', () => {
+  assert.match(DONE_WHEN, /if \(goalIds\.length === 0\) return \{ criteria, goals: \[\], versionsClosed: \[\] \}/,
+    'no goal achieved means no version can have just become closable');
+});

package/tests/maintenance_carry_forward.mjs

@@ -1,122 +0,0 @@
-// tests/maintenance_carry_forward.mjs — the one goal that spans versions
-// (BV1.R18b, task 1003708, goal 1000086, ADR 0263 §7).
-//
-// WHY THIS GOT A COLUMN. Since task 1003691 the maintenance goal was found by
-// matching `'<version> — maintenance'`. For the ROUTING path that was a
-// provenance wrinkle — a hand-titled goal receives a bug. For the CLOSING path
-// it was a way through the gate: `maintenanceGoalExemptSql` decides which goals
-// hold a VERSION open, so anyone who named a goal `'BONGOS-V1 — maintenance'`
-// exempted it from the rule that decides when a version may close.
-//
-// A naming convention is not an access control. That sentence is the whole task,
-// and most of this file is that sentence made mechanical.
-//
-// Run:  node tests/maintenance_flag.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
-import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
-
-process.env.NODE_ENV = 'test';
-const require = createRequire(import.meta.url);
-const { maintenanceGoalExemptSql, ensureMaintenanceGoal, carryMaintenanceForward, openNonMaintenanceGoals } = require('../modules/lifecycle/db.js');
-const { test, summary } = makeRunner();
-
-const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
-const MIG = src('migrations/core_235_one_maintenance_goal_per_version.sql');
-const MIG234 = src('migrations/core_234_goals_is_maintenance.sql');
-const flat = (q) => String(q.sql).replace(/\s+/g, ' ').trim();
-function pool(handler) {
-  const c = makeSqlAwareClient(handler);
-  return { connect: c.connect, query: (sql, p) => c._client.query(sql, p), queries: c._client.queries };
-}
-
-// ---- one per version is a CONSTRAINT ---------------------------------------
-
-await test('the per-version uniqueness is enforced by the DATABASE, not a convention', () => {
-  // core_234 gave the flag a partial index for lookup speed, which is right. But a
-  // NON-unique one leaves two flagged goals on one version possible, and
-  // ensureMaintenanceGoal's read is `WHERE version_id = $1 AND is_maintenance
-  // LIMIT 1` — with two rows that returns whichever the planner picks, and every
-  // homeless bug files into an arbitrary one of them, permanently.
-  assert.match(MIG, /CREATE UNIQUE INDEX IF NOT EXISTS goals_one_maintenance_per_version_idx[\s\S]*?ON goals \(version_id\)[\s\S]*?WHERE is_maintenance/);
-  assert.match(MIG, /DROP INDEX IF EXISTS goals_maintenance_by_version_idx/,
-    'and it replaces the plain one — a UNIQUE index serves every read the plain one did');
-  assert.match(MIG, /BEGIN;[\s\S]*COMMIT;/);
-});
-
-await test('it closes the door the advisory lock could not', () => {
-  // The lock (task 1003691) serialises the RACE. It cannot stop a second
-  // maintenance goal created any other way, and `goals` never had a unique
-  // constraint on (version_id, title) for the lock to fall back on.
-  const dbg = src('modules/lifecycle/db-goals.js');
-  assert.match(dbg, /pg_advisory_xact_lock/, 'the lock stays — it solves a different problem');
-  assert.match(MIG234, /is_maintenance boolean NOT NULL DEFAULT false/, 'core_234 still owns the column');
-});
-
-// ---- carry forward ---------------------------------------------------------
-
-function carryPool({ src = { id: 5 }, destStatus = 'building', destFound = { id: 9 } } = {}) {
-  return pool((sql) => {
-    const q = String(sql).replace(/\s+/g, ' ');
-    if (/SELECT id FROM goals WHERE version_id = \$1 AND is_maintenance LIMIT 1/.test(q)) return { rows: src ? [src] : [] };
-    if (/SELECT status FROM versions/.test(q)) return { rows: [{ status: destStatus }] };
-    if (/pg_advisory_xact_lock/.test(q)) return { rows: [] };
-    if (/FROM goals WHERE version_id = \$1 AND is_maintenance/.test(q)) return { rows: destFound ? [destFound] : [] };
-    if (/UPDATE tasks SET goal_id/.test(q)) return { rows: [{ id: 1 }, { id: 2 }, { id: 3 }] };
-    return { rows: [] };
-  });
-}
-
-await test('open bugs move to the successor, and the emptied goal archives behind them', async () => {
-  const p = carryPool();
-  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { pool: p });
-  assert.deepEqual(out, { carried: 3, from: '5', to: '9', reason: null });
-  const mv = p.queries.find((x) => /UPDATE tasks SET goal_id/.test(flat(x)));
-  assert.match(flat(mv), /NOT IN \('shipped', 'abandoned'\)/, 'only the unfinished ones travel');
-  assert.equal(mv.params[2], 'V2', 'and their version_id moves with them, or they are orphaned across the boundary');
-  assert.ok(p.queries.some((x) => /UPDATE goals SET status = 'archived'/.test(flat(x))));
-});
-
-await test('NO successor: the bugs stay put and the close still succeeds', async () => {
-  // A version with nothing scoped after it must not fail its close, and its bug
-  // queue must not be cut for a reason that has nothing to do with the bugs.
-  const p = carryPool();
-  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: null }, { pool: p });
-  assert.equal(out.carried, 0);
-  assert.equal(out.reason, 'no_successor');
-  assert.equal(p.queries.some((x) => /UPDATE tasks/.test(flat(x))), false, 'nothing moved');
-  assert.equal(p.queries.some((x) => /UPDATE goals SET status = 'archived'/.test(flat(x))), false,
-    'and the source goal is NOT closed — the queue is still live');
-});
-
-await test('a successor that is not yet BUILDING carries nothing, and says so', async () => {
-  // The ordering trap ADR 0263 §8 names: ensureMaintenanceGoal returns null for a
-  // non-building version, so a carry-over run before R20's promotion would report
-  // success while moving nothing.
-  const p = carryPool({ destStatus: 'planning', destFound: null });
-  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { pool: p });
-  assert.equal(out.carried, 0);
-  assert.equal(out.reason, 'successor_not_building', 'a silent zero would be indistinguishable from success');
-  assert.equal(p.queries.some((x) => /UPDATE tasks/.test(flat(x))), false);
-});
-
-await test('a version with no maintenance goal at all is a clean no-op', async () => {
-  const p = carryPool({ src: null });
-  const out = await carryMaintenanceForward({ fromVersionId: 'V1', toVersionId: 'V2' }, { pool: p });
-  assert.equal(out.reason, 'no_maintenance_goal');
-  assert.equal(out.carried, 0);
-});
-
-await test('it runs on the CALLER exec, so it joins the close transaction', () => {
-  // R12 left `deps.onClosed(client, …)` for exactly this. Opening its own
-  // connection would commit the carry-over independently of the close it belongs to.
-  const dbg = src('modules/lifecycle/db-goals.js');
-  const fn = dbg.slice(dbg.indexOf('async function carryMaintenanceForward'), dbg.indexOf('// listVersionAdmissions'));
-  assert.match(fn, /const exec = deps\.client \|\|/, 'it must accept the caller\'s client');
-  assert.doesNotMatch(fn, /\.connect\(\)/, 'and must never open its own');
-  assert.doesNotMatch(fn, /BEGIN|COMMIT/, 'nor manage a transaction it does not own');
-});
-
-summary();