@bongos/core 1.19.604 → 1.19.606

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.604",
-  "core_contract": "1.19.604",
-  "source_commit": "a0b8d2452aa627d45214f54b63305c41150dfffd",
+  "core_version": "1.19.606",
+  "core_contract": "1.19.606",
+  "source_commit": "01995576a9a5691914eaf92601a2babcb7f80436",
   "source_ref": "HEAD",
-  "built_at": "2026-09-08T23:04:26.027Z",
+  "built_at": "2026-09-08T23:43:27.112Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 457,
+    "docs_redacted": 458,
     "agent_docs_stubbed": 24,
     "functional_verbatim": 2077,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2558,
-  "tree_sha256": "e207bd28e7b6dfedc243c12724dc4419850b2fd1b573af52c057014c148408ee",
+  "file_count": 2559,
+  "tree_sha256": "b6468d5e9ecfea1fc1343a754b406f526858051bbb096a22aaa58915cf7673ab",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1839,10 +1839,15 @@
       "mode": "0000644",
       "sha256": "03f1cf19a181d6726066ba6fb72156add0cb8ede004ebc7ddf8ac3859a335596"
     },
+    {
+      "path": "docs/adr/0265-work-with-no-goal-and-the-order-the-cut-needs.md",
+      "mode": "0000644",
+      "sha256": "c9cd485b1ffce55fea15fd5b544a01e5753309e291c88bd223d33e6c11c4ebec"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "b38a32c8557012f9e5e761c5e219901ad628af9b63d2cb190d32e783dbf9aaa9"
+      "sha256": "c4bbd4c0ff9163a435564b56c4aac1d2c08e2b129d32b7f24779a60674096b47"
     },
     {
       "path": "docs/api-reference.md",
@@ -2727,7 +2732,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e2b518f8b64d95ee83ea4821e25942fc0b37e6ac3c3ebf0c2351ffad064f7020"
+      "sha256": "70528d71799dfa6f699267c439e32e65b2b922b768a6b7ff3b5b2f4d7aae8bd4"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5567,7 +5572,7 @@
     {
       "path": "modules/lifecycle/db-versions.js",
       "mode": "0000644",
-      "sha256": "51b170cdd34a90c49070ec79723b5250dffbc8c61d5ed114d6a560bcc93cadb7"
+      "sha256": "8d8f8a16443e9f193829d8ac127b522e92984bcafc9a48a27c7deea5da2900b7"
     },
     {
       "path": "modules/lifecycle/db.js",
@@ -5817,7 +5822,7 @@
     {
       "path": "modules/lifecycle/routes/versions.js",
       "mode": "0000644",
-      "sha256": "014de34389dbf26b4b089b677466c9c7cfd81f79b9e1714241be12f589086c0f"
+      "sha256": "a8cdb97b220c2de738396986e8cd326218f688a0277b4c75784420cfbdd0d369"
     },
     {
       "path": "modules/lifecycle/routes/visuals.js",
@@ -7627,12 +7632,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5641c682f6618871cdcb765ee962b6b7ce884bad1786e6ee4a24c8bf0a43f8c0"
+      "sha256": "e1c65152d1b74b121478122824125a5b194f81391d291bded7b7f19a546cd072"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a725aa33a88eadd39a01540bd819b5856c541d3d10f6386bcd8ee05b70497377"
+      "sha256": "32c321ede296ec490893a1ca5e120cd82d19424fdb1073242921b6d1b7b1217c"
     },
     {
       "path": "public-docs/index.html",
@@ -9347,7 +9352,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ec2543ebf2e3bd98d8497238975cec5bccc13cbff7f8835b42bec4757ae078f9"
+      "sha256": "887427fe5187c116f958ad5c23a0974c1a44fa00a02e43ad6ea5ef6b02f31888"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12712,7 +12717,7 @@
     {
       "path": "tests/version_close_route.mjs",
       "mode": "0000644",
-      "sha256": "56c480792cf88946eb3e3663a23e0431e6d8df3cf8219fdf9b71283b772355bb"
+      "sha256": "f972971a1f668a085c5f5b4c5ccba616e4b77a3f3308f9a48af33e43ecd62a8c"
     },
     {
       "path": "tests/version_literals.mjs",

package/docs/adr/0265-work-with-no-goal-and-the-order-the-cut-needs.md

@@ -0,0 +1,125 @@
+# 0265 — Work with no goal survives a version close, and the order the ten-area cut actually needs
+
+- **Status:** Accepted
+- **Date:** 2026-09-08
+- **Tasks:** [#1003713](https://cloudbongos.com/builders#/task/1003713) (this record + the fix). Found while re-basing the cutover plan in [#1003711](https://cloudbongos.com/builders#/task/1003711).
+- **Goal:** [#1000086](https://cloudbongos.com/builders#/goal/1000086) — Strict versioning, criteria `sv-every-task-has-a-goal` and `sv-cutover-proven-live`.
+- **Builds on:** [ADR 0250](<redacted>.md) (D3, D4, D5), [ADR 0263](<redacted>.md) (§5–§8), [ADR 0264](<redacted>.md) (the cut this order executes).
+
+## 1. The defect
+
+**A version can close while still holding unfinished work, because the closing
+invariant counts goals and not tasks.**
+
+`closeVersion` applies each goal's disposition and then asserts, against
+committed in-transaction state, that no non-maintenance goal on the version is
+still `open`. That is the whole check. Every task write inside the close is
+scoped `WHERE goal_id = $1` — the abandon branch and the roll-forward move both.
+
+So a task belonging to **no** goal is reached by nothing: no disposition touches
+it, the goal re-count cannot see it, and the version flips to `shipped` with the
+task still stamped with it. It is then permanently non-terminal on a version that
+is over, and invisible to every surface that reasons per goal.
+
+[ADR 0250](<redacted>.md) D3 shut this door one tier down — R10 and R14 made a *goal* refuse to
+close while holding unfinished tasks. The version tier never got the same
+treatment, and D4 ("every task has a goal") was written as a property of the data
+rather than as a gate anything enforced at the boundary.
+
+### It has already happened
+
+Measured on the live instance 2026-09-08: **six non-terminal tasks sit on shipped
+versions** — five on GDS-V3 under goal 1000002 and one on GDS-V4 under goal
+1000004. Those versions shipped and took the work with them.
+
+The next batch was already queued. **Forty-seven tasks on BONGOS-V1 carry
+`goal_id IS NULL`** (measured in task 1003711): R11 made `goal_id` required going
+forward but never backfilled the rows that predated it, because every catch-all
+lookup matches the exact title `<VERSION> — general` and BONGOS-V1's catch-all is
+titled "Work with no goal yet". Closing BONGOS-V1 would have stranded all 47 by
+exactly this path, and R30's live proof would have found it *after* the close,
+with no way back.
+
+## 2. The decision
+
+**A version refuses to close while any non-terminal task remains on it,** as a
+second invariant beside the goal re-count, in the same transaction, against
+committed state. It fails with `CLOSE_LEAVES_STRANDED_TASKS` carrying the count
+and up to fifty ids, and the route renders that as a 409 naming them — the
+caller's only move is to go and home those tasks, and making them run a query to
+discover which ones is how forty-seven went unnoticed.
+
+Two exemptions, both forced rather than chosen:
+
+- **The maintenance goal's tasks.** `carryBugsForward` runs in the `onClosed`
+  hook, which fires *after* this check and after the flip ([ADR 0263](<redacted>.md) §8), so
+  maintenance work is legitimately still on the version at check time. Exempted
+  through `maintenanceGoalExemptSql` — the **same** predicate the goal count
+  uses, never a second copy. R18 replaced that function's body once already (a
+  title comparison became `is_maintenance`, closing a spoofing hole); a
+  hand-inlined copy here would have survived that edit and quietly re-opened it.
+- **Smoke fixtures**, on the same `__smoke__` terms the abandon and roll-forward
+  branches already use. Three doors now decide what "unfinished" means and they
+  have to agree — a test fixture that wedges a production close is worse than the
+  bug it was pinning.
+
+The probe runs **after** the goal re-count and **before** the flip. Order is part
+of the decision: open goals are the bigger and more actionable problem, and
+reporting stray tasks first would send a caller chasing rows the goal
+dispositions were about to move anyway.
+
+## 3. The consequence: the cut needs roll-forward, *then* fold
+
+Verifying the above surfaced two facts that together determine how
+[ADR 0264](<redacted>.md)'s thirty-eight-goals-to-ten cut can be executed at all:
+
+1. **A task cannot cross a version boundary by hand.** `PATCH /tasks/:id { goal_id }`
+   refuses with 409 `goal_version_mismatch` — "a task can only join a goal in its
+   own version". The version → goal → task rollup is why: a cross-version link
+   drops the task out of its version's totals.
+2. **`roll_forward` creates, it does not merge.** It writes a *new* goal on the
+   planning version with the predecessor's prose, membership and scope, archives
+   the predecessor behind it with `succeeded_by_goal_id`, and moves the unfinished
+   tasks' `goal_id` **and** `version_id` together (task 1003710). There is no
+   disposition that folds a goal into an existing one.
+
+So neither obvious order works. Closing BONGOS-V1 and rolling its goals forward
+would mint roughly thirty-three successor goals on BONGOS-V2 — the same sprawl,
+one version later. And homing the tasks into the ten area goals first is refused,
+because the area goals live on BONGOS-V2 and the tasks live on BONGOS-V1.
+
+**The order that works, with no new code and no Archon overrides:**
+
+1. **Give every homeless task a goal on its own version.** The 47 null-goal rows
+   and the two catch-alls' populations go to any real goal on the version they
+   are already on — bugs to that version's maintenance goal ([ADR 0262](<redacted>.md)), the rest
+   to whichever existing goal fits. This is the step the new invariant makes
+   mandatory rather than optional.
+2. **Close the building version, rolling every goal that still holds work
+   forward.** Tasks arrive on BONGOS-V2 carrying both `goal_id` and `version_id`.
+3. **Fold on BONGOS-V2 while it is still `planning`.** Now each task and its
+   destination area goal share a version, so `PATCH /tasks/:id { goal_id }` is
+   legal; move the work into the ten areas and archive the emptied successors
+   through R14's disposition flow.
+
+Step 3 has to happen before BONGOS-V2 starts building, because D1 closes a
+version's goal set the moment it does. That is not an awkward constraint — it is
+the rule doing its job: the fold *is* scoping, and scoping belongs in `planning`.
+
+## 4. Alternatives rejected
+
+- **Add a `fold_into` disposition to the close.** It would collapse steps 2 and 3
+  into one call, but it puts a scope decision — which area absorbs which goal —
+  inside a transaction that also ships a version, and it invents a second way to
+  move a task between goals beside the one that already exists. The two-step
+  costs one extra pass over the data and keeps folding where a human can see it.
+- **Create the six new area goals on BONGOS-V1 using R07's `admit_reason`
+  override.** Legal, and it would let the whole fold happen before the close. But
+  it spends ten Archon admissions to work around a rule those admissions exist to
+  make expensive, and it grows the building version's goal set to forty-three on
+  the way to shrinking it. ADR 0250 §3 built the override counter precisely so
+  this shape would be visible; using it here would be reading the counter as a
+  budget.
+- **Backfill the 47 with a migration instead of gating the close.** A backfill
+  fixes today's rows and nothing else; the gate is what stops the forty-eighth.
+  Both are wanted, but only one of them is a rule.

package/docs/adr/README.md

@@ -356,3 +356,4 @@ This keeps the decision history honest and traceable.
 | 0262 | [**A bug never lands in the inbox: the system names the home the reporter didn't** ([task 1003691](https://cloudbongos.com/builders#/task/1003691) · goal 1000086 — *Strict versioning*). `routing.js` returned early on a goal-less filing, so its own `kind='bug'` hard-land branch was UNREACHABLE without a goal — `kind` only ever chose a routed task's STATUS, never whether it routed — and a reported defect sat in `idea_inbox` awaiting the triage pass criterion C1 exists to remove. The premise that [ADR 0250](<redacted>.md) D4 and [ADR 0235](<redacted>.md) contradict each other is FALSE: 0235's exemption is an advisory silence in `goal-advisory.adviseGoal`, and its actual decision already requires a real `goal_id`. So nothing is amended; this is the explicit decision 0235 §6 said would be needed. **D1** a homeless bug gets the version's MAINTENANCE goal (R18's design), find-or-created under an advisory lock inside the route's own transaction — not the catch-all R11 is deleting, and adding no `allowCatchAll` caller. **D2** the gate is the VECTOR (`api`, `discord-bugs`), not the kind: `#ideas` passes no kind, so the classifier guesses one from keywords, and gating on kind alone would silently overturn [ADR 0234](<redacted>.md)'s owner-interview decision. Rejected: goal-less bug tasks (breaks D4 a day after it landed); rejecting the filing (Discord cannot retry, so the report is lost); the catch-all (repopulates the bucket being drained); building R18 whole first.](<redacted>.md) | work intake / idea routing / the version-goal invariant |
 | 0263 | [**How a version closes: auto, early, roll-forward, and the maintenance exemption** ([task 1003593](https://cloudbongos.com/builders#/task/1003593) · goal 1000086 — *Strict versioning*). [ADR 0250](<redacted>.md) D5 decided a version *can* close; this is the design pass that makes its five build tasks mechanical, so they do not each invent their own refusal codes and payload shapes and meet only in production. **The asymmetry that shrinks the feature:** auto-close fires when the last non-maintenance goal achieves — so by construction every non-maintenance goal is already closed and the set needing a disposition is EMPTY. All the machinery (the disposition map, the refusal that returns the goals, successor lineage) belongs to EARLY close alone; R16 is small and R12 carries the weight. **Auto-close hangs off BOTH achievement writers** (`db-goals.achieveGoalIfComplete` and the `done-when` cascade — the deliberate duplicate D2 already governs, a require cycle being the reason they are not one helper), on the caller `exec` so it sees the ship's uncommitted flip, and **may never fail a ship**: wrapped and swallowed like `closeCompletedWorkForShip`, idempotent under `WHERE status='building'`, so a failure leaves a version un-closed (self-healing on the next reconciler sweep) and never half-closed. **Early close** is the R10 archive two-step verbatim in spirit — refuse with `version_holds_open_goals` **returning the goals**, then proceed with a per-goal `roll_forward`/`abandon` map and a required `reason`; six named codes, because the callers are agents. **Two briefs are corrected by measurement:** the lineage column is `succeeded_by_goal_id` (migration 160, on the OLD row pointing forward) — not the `succeeds_goal_id` both 0250 and R17's brief name, so R17 needs NO migration; and R18's `is_maintenance` flag is load-bearing rather than cosmetic, because answering the close count with a `title NOT LIKE` would let a hand-titled goal silently exempt itself from the gate that decides when a VERSION closes. Promotion runs inside the close txn and BEFORE roll-forward (`ensureMaintenanceGoal` returns null for a non-`building` version, so a carry-over run first silently carries nothing); zero planning versions is not an error; R19's one migration should carry the `building` AND `planning` partial unique indexes so the promotion race resolves like a 23505 rather than a prayer. Rejected: auto-creating the successor version inside a close (the "fake hotfix version" escape hatch 0250 built the override counter to prevent), writing `limitations/<version>-shipped.md` from the route (file I/O in a ship transaction — it stays R23's CLI work), and a version reopen.](<redacted>.md) | version lifecycle / scope closure |
 | 0264 | [**The ten working areas: one goal per area, held until 5,000 builders** ([task 1003696](https://cloudbongos.com/builders#/task/1003696) · goal 1000086 — *Strict versioning*, criterion `sv-cutover-proven-live`). The owner and the full team ran a manual goal review on 2026-09-07 and cut **38 open goals down to 10**, one per working area, each with a named owner and a described 5,000-builder end state: project creation (Rini), account/community (Rini), human project management (Scott), core distribution (Lars/Will), module distribution & economy (Will), the four-role experience incl. agents (Masterqua/Rini), government (Will/Masterqua), the credit economy (Scott), platform analytics (Lars), security (everyone bar Nils and Scott). **Why the rules were not enough on their own:** [ADR 0250](<redacted>.md) D1 closes the goal set of a BUILDING version — which freezes 38 goals exactly as effectively as it would freeze 10. Enforcement cannot shrink a scope that is already too large, so the rules and the cut are two halves of one move; the horizon is a SCALE (5,000 builders), not a date, because that is the question that decides when this set stops being the right set. **The finding that reorders the goal:** none of the cut can be executed today. R10 ([task 1003597](https://cloudbongos.com/builders#/task/1003597)) made `POST /goals/:id/archive` refuse a goal holding unfinished tasks and demand a disposition — correct, and exactly D3 — but the vector that SUPPLIES a disposition is R14 ([task 1003601](https://cloudbongos.com/builders#/task/1003601)), unshipped. Every one of the 12 deletes and every fold goes through that door, so **R14 is the keystone of the whole cut**, not one feature among thirteen, and is built before the rest of the version-close chain rather than in rank order. It looks like a bug and is not: the refusal is the design, landed one task ahead of its own remedy. "Delete" means `archived`, never a row removal (`goals.status` is open|achieved|archived, migration 160; reversible via `/reopen`) — preserving the rows keeps shipped-task attribution and credit history a delete would strand. Three open goals were NOT covered by the review and are surfaced as open questions rather than guessed: 1000003 (the catch-all — already R25's target), 1000065 (assumed to be area 2's community half), and 1000088 (repo cleanup — maps to no area, needs an owner decision). Deliberately does not decide: the areas' priority order, criteria for the six goals R29 must create (inventing criteria for someone else's area is how a goal acquires scope its owner never agreed to), or any task rehoming (R25/R26).](<redacted>.md) | scope / goal set / owner decision |
+| 0265 | [**Work with no goal survives a version close, and the order the ten-area cut actually needs** ([task 1003713](https://cloudbongos.com/builders#/task/1003713) · goal 1000086 — *Strict versioning*, criteria `sv-every-task-has-a-goal` + `sv-cutover-proven-live`). `closeVersion`'s post-apply invariant counts GOALS, and every task write inside the close is scoped `WHERE goal_id = $1` — so a task belonging to no goal is reached by no disposition, counted by no re-count, and ships stranded on a version that is over. Not hypothetical: six such tasks already sat on shipped GDS-V3/GDS-V4, and 47 rows on BONGOS-V1 carried a null `goal_id` (R11 required the column going forward but never backfilled, because every catch-all lookup matches the exact title `<VERSION> — general` and BONGOS-V1's is titled 'Work with no goal yet'). Decision: a second invariant in the same transaction refuses a close leaving ANY non-terminal task on the version, failing `CLOSE_LEAVES_STRANDED_TASKS` with the ids; exempting only the maintenance goal (its carry-forward runs in the later `onClosed` hook) — through the SAME `maintenanceGoalExemptSql` the goal count uses, never a second copy — and `__smoke__` fixtures. Consequence recorded here too: because `PATCH /tasks/:id {goal_id}` refuses a cross-version move (409 `goal_version_mismatch`) and `roll_forward` CREATES a successor rather than merging into one, [ADR 0264](<redacted>.md)'s cut must run home-then-close-then-**fold on the planning version**, where task and destination finally share a version. Rejected: a `fold_into` disposition (puts scope decisions inside a shipping transaction), creating the six new areas on the building version via R07 admissions (spends ten overrides to route around the rule they price), and a backfill instead of a gate (fixes today's rows, not the forty-eighth).](<redacted>.md) | lifecycle / version boundary |

package/docs/module-api-changelog.md

@@ -1657,5 +1657,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.602 with no explicit bump. run 34191126290. (task 1002620)
   1.19.604 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.603 with no explicit bump. run 34288910914. (task 1002620)
+  1.19.605 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.604 with no explicit bump. run 34290892691. (task 1002620)
+  1.19.606 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.605 with no explicit bump. run 34291868670. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-versions.js

@@ -14,6 +14,7 @@ const api = require('../../src/module-api');
 const { pool, withTx } = api;
 const doneWhen = require('./done-when.js');
 const { nonTerminalSql } = require('./task-status');
+const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 
 async function listVersions() {
   const { rows } = await pool.query(
@@ -465,6 +466,59 @@ async function closeVersion({ versionId, plan = [], reason, planningVersionId =
       });
     }
 
+    // THE SAME INVARIANT, ONE TIER DOWN (BV1.R32, task 1003713, ADR 0265).
+    //
+    // The check above counts GOALS, and every task write in this transaction is
+    // scoped `WHERE goal_id = $1` — the abandon branch and the roll-forward move
+    // both. So a task belonging to NO goal is touched by nothing and counted by
+    // nothing: no disposition reaches it, the goal re-count cannot see it, and
+    // the version ships with the task still stamped with it. It is then
+    // permanently non-terminal on a version that is over, and invisible to every
+    // surface that reasons per goal.
+    //
+    // NOT HYPOTHETICAL. Six such tasks were already on shipped versions when this
+    // was written (five on GDS-V3, one on GDS-V4), and 47 tasks on BONGOS-V1
+    // carried a null `goal_id` waiting for the same fate at its close. R10/R14
+    // shut this door for a GOAL holding unfinished tasks; the version tier never
+    // got the same treatment. This is that treatment.
+    //
+    // TWO EXEMPTIONS, both forced rather than chosen:
+    //   The maintenance goal's work is legitimately still here. `carryBugsForward`
+    //   runs in the `onClosed` hook, which fires AFTER this check and after the
+    //   flip (R20, task 1003607), so maintenance tasks have not moved yet and
+    //   must not trip the gate. Exempted through `maintenanceGoalExemptSql` — the
+    //   SAME predicate the goal count uses, so the two halves cannot drift into
+    //   disagreeing about which goal is exempt.
+    //
+    //   Smoke fixtures, on the same terms the abandon and roll-forward branches
+    //   already use. Three doors now decide what "unfinished" means and they have
+    //   to agree; a fixture that blocks a close is a test artifact wedging prod.
+    //
+    // LEFT JOIN, not INNER: a null `goal_id` is the whole point, and an inner
+    // join would silently drop exactly the rows this exists to catch.
+    const { rows: stranded } = await client.query(
+      `SELECT t.id FROM tasks t
+         LEFT JOIN goals g ON g.id = t.goal_id
+        WHERE t.version_id = $1
+          AND ${nonTerminalSql('t.status')}
+          AND t.${SMOKE_NOT_LIKE}
+          AND (g.id IS NULL OR ${maintenanceGoalExemptSql('$1')})
+        ORDER BY t.id
+        LIMIT 51`,
+      [versionId]
+    );
+    if (stranded.length > 0) {
+      throw Object.assign(new Error('version still holds non-terminal tasks after dispositions'), {
+        code: 'CLOSE_LEAVES_STRANDED_TASKS',
+        remaining: stranded.length,
+        // Capped at 51 so the sample can say "more than 50" without counting the
+        // whole table; the caller's next move is to go and home them, and a
+        // sample plus a floor is enough to start.
+        truncated: stranded.length > 50,
+        task_ids: stranded.slice(0, 50).map((r) => String(r.id)),
+      });
+    }
+
     const { rows: closed } = await client.query(
       `UPDATE versions SET status = 'shipped', shipped_at = now()
         WHERE id = $1

package/modules/lifecycle/routes/versions.js

@@ -350,6 +350,19 @@ module.exports = function buildVersionsRouter() {
           details: { remaining: err.remaining },
         });
       }
+      // BV1.R32 (task 1003713, ADR 0265): work with no goal. Dispositioning every
+      // goal is not the same as accounting for every task, and a task belonging to
+      // no goal is reached by no disposition. The ids ride the refusal because the
+      // caller's only move is to go and home them, and making them run a query to
+      // find out which ones is how 47 orphans went unnoticed on BONGOS-V1.
+      if (err && err.code === 'CLOSE_LEAVES_STRANDED_TASKS') {
+        const count = err.truncated ? `more than ${err.task_ids.length}` : String(err.remaining);
+        return res.fail('version_holds_stranded_tasks', {
+          status: 409,
+          message: `Version '${versionId}' would ship holding ${count} unfinished task(s) that belong to no goal on it — nothing was changed. Give each one a goal on this version (or abandon it), then close.`,
+          details: { remaining: err.remaining, truncated: err.truncated, task_ids: err.task_ids },
+        });
+      }
       throw err;
     }
   }, { errorCode: 'close_version_failed' }));

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.604",
+  "version": "1.19.606",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.604",
+      "version": "1.19.606",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.604",
+  "version": "1.19.606",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.604'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.606'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/version_close_route.mjs

@@ -129,7 +129,7 @@ await test('roll_forward WITH a planning version proceeds', () => {
 
 // ---- the maintenance exemption ---------------------------------------------
 
-await test('the exemption has ONE definition, and the open-goals read is its only caller', () => {
+await test('the exemption has ONE definition, and every gate calls it rather than re-spelling it', () => {
   // R18 (task 1003605, migration core_234) SWAPPED this body, exactly as R12
   // predicted here — the single definition is what made it a one-line change
   // instead of a hunt, and this assertion moved with it.
@@ -142,7 +142,12 @@ await test('the exemption has ONE definition, and the open-goals read is its onl
     'no title comparison may decide which goals hold a version open');
   const dbv = src('modules/lifecycle/db-versions.js');
   const uses = (dbv.match(/maintenanceGoalExemptSql\(/g) || []).length;
-  assert.equal(uses, 3, 'declaration + the open-goals read + the post-apply re-count, and nothing else');
+  // Four since BV1.R32 (task 1003713): the stranded-task probe reuses the same
+  // predicate rather than re-spelling it. That is the POINT of the ratchet — a
+  // new caller is fine, a second hand-written copy of the rule is not. Bump this
+  // number only alongside a call site that calls the function.
+  assert.equal(uses, 4,
+    'declaration + the open-goals read + the post-apply re-count + the stranded-task probe, and nothing else');
 });
 
 await test('the open-goals read excludes the maintenance goal and counts unfinished work', async () => {
@@ -157,7 +162,7 @@ await test('the open-goals read excludes the maintenance goal and counts unfinis
 
 // ---- the write is one transaction ------------------------------------------
 
-function closePool({ status = 'building', goalStatus = 'open', remaining = 0 } = {}) {
+function closePool({ status = 'building', goalStatus = 'open', remaining = 0, stranded = 0 } = {}) {
   return txPool((sql) => {
     const q = String(sql).replace(/\s+/g, ' ');
     if (/FROM versions WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: 'V1', status }] };
@@ -169,6 +174,11 @@ function closePool({ status = 'building', goalStatus = 'open', remaining = 0 } =
     if (/INSERT INTO goal_members/.test(q)) return { rows: [] };
     if (/UPDATE tasks SET goal_id/.test(q)) return { rows: [{ id: 21 }, { id: 22 }] };
     if (/count\(\*\)::int AS n FROM goals/.test(q)) return { rows: [{ n: remaining }] };
+    // BV1.R32 (task 1003713) — the second invariant: work left on the version
+    // that belongs to no goal on it. `stranded` is a count of fake task ids.
+    if (/FROM tasks t LEFT JOIN goals g/.test(q)) {
+      return { rows: Array.from({ length: stranded }, (_, i) => ({ id: 900 + i })) };
+    }
     if (/UPDATE versions SET status = 'shipped'/.test(q)) return { rows: [{ id: 'V1', status: 'shipped' }] };
     return { rows: [] };
   });
@@ -297,4 +307,74 @@ await test('version-close.js no longer being the only door is R23; this route ex
   assert.match(V, /router\.post\('\/versions\/:id\/close'/, 'the route the CLI will drive');
 });
 
+
+// ---- BV1.R32: a task with no goal must not ride a close out ------------------
+// The goal re-count above is not the whole invariant. Every task write in the
+// close is scoped `WHERE goal_id = $1`, so a task belonging to NO goal is
+// touched by nothing and counted by nothing — and six such tasks were already
+// sitting on shipped versions (GDS-V3, GDS-V4) when this was written.
+
+await test('R32: a non-terminal task with no goal blocks the close and rolls back', async () => {
+  const pool = closePool({ stranded: 3 });
+  await assert.rejects(
+    closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'abandon' }], reason: 'r' }, { pool }),
+    (e) => e.code === 'CLOSE_LEAVES_STRANDED_TASKS'
+      && e.remaining === 3
+      && e.truncated === false
+      && Array.isArray(e.task_ids) && e.task_ids.length === 3 && e.task_ids[0] === '900'
+  );
+  const sqls = pool.queries.map(flat);
+  assert.ok(sqls.includes('ROLLBACK'));
+  assert.equal(sqls.some((q) => /UPDATE versions SET status = 'shipped'/.test(q)), false,
+    'the version must not ship while it still holds unhomed work');
+});
+
+await test('R32: the stranded probe runs AFTER the goal re-count and BEFORE the flip', async () => {
+  // Order matters for the message the caller gets: open goals are the bigger,
+  // more actionable problem, and reporting stray tasks first would send them
+  // chasing rows that the goal dispositions were about to move anyway.
+  const pool = closePool();
+  await closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'abandon' }], reason: 'r' }, { pool });
+  const sqls = pool.queries.map(flat);
+  const goalCount = sqls.findIndex((q) => /count\(\*\)::int AS n FROM goals/.test(q));
+  const strandProbe = sqls.findIndex((q) => /FROM tasks t LEFT JOIN goals g/.test(q));
+  const flip = sqls.findIndex((q) => /UPDATE versions SET status = 'shipped'/.test(q));
+  assert.ok(goalCount !== -1 && strandProbe !== -1 && flip !== -1, 'all three steps must run');
+  assert.ok(goalCount < strandProbe, 'open goals are reported before stray tasks');
+  assert.ok(strandProbe < flip, 'the probe must gate the flip, not follow it');
+});
+
+await test('R32: the maintenance exemption is the SAME predicate as the goal count', async () => {
+  // The two halves of the invariant must never disagree about which goal is
+  // exempt. R18 replaced maintenanceGoalExemptSql's body once already (a title
+  // match became `is_maintenance`); a second, hand-inlined copy here would have
+  // survived that edit and silently re-opened the title-spoofing hole.
+  const pool = closePool();
+  await closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'abandon' }], reason: 'r' }, { pool });
+  const probe = flat(pool.queries.find((q) => /FROM tasks t LEFT JOIN goals g/.test(flat(q))));
+  assert.ok(probe.includes(maintenanceGoalExemptSql('$1')),
+    'the task probe must reuse maintenanceGoalExemptSql, not re-spell it');
+  assert.ok(/LEFT JOIN goals g/.test(probe),
+    'an INNER join would drop the null-goal rows this exists to catch');
+  assert.ok(/g\.id IS NULL OR/.test(probe),
+    'a task with no goal row at all is the primary case');
+});
+
+await test('R32: smoke fixtures never wedge a real close', async () => {
+  const pool = closePool();
+  await closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'abandon' }], reason: 'r' }, { pool });
+  const probe = flat(pool.queries.find((q) => /FROM tasks t LEFT JOIN goals g/.test(flat(q))));
+  assert.ok(/smoke/.test(probe), 'the probe must exclude __smoke__ fixtures like the other two doors do');
+});
+
+await test('R32: the sample is capped and says so rather than counting the table', async () => {
+  const pool = closePool({ stranded: 51 });
+  await assert.rejects(
+    closeVersion({ versionId: 'V1', plan: [{ goalId: 1, verb: 'abandon' }], reason: 'r' }, { pool }),
+    (e) => e.code === 'CLOSE_LEAVES_STRANDED_TASKS' && e.truncated === true && e.task_ids.length === 50
+  );
+  const probe = flat(pool.queries.find((q) => /FROM tasks t LEFT JOIN goals g/.test(flat(q))));
+  assert.ok(/LIMIT 51/.test(probe), 'read one past the cap so "more than 50" is knowable without a count');
+});
+
 summary();