@bongos/core 1.19.639 → 1.19.640

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.639",
-  "core_contract": "1.19.639",
-  "source_commit": "01a3b3c69f079cd730ec88a36b12d3bf30562abd",
+  "core_version": "1.19.640",
+  "core_contract": "1.19.640",
+  "source_commit": "2ab73a01133b60e930ce77745cd7bab2be53d517",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T16:31:46.801Z",
+  "built_at": "2026-09-10T17:05:44.826Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 470,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2598,
-  "tree_sha256": "03b9b58d7185ba54ca84475a26d2b95870ba16c25ab83697ea91aadf90959e1d",
+  "tree_sha256": "5d4e0f8138d98ccd04fe0ae74d565738470c6b6210f6ccad1084e067ed8eab63",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "352910d55c713789e1ff42c1adf06d47097296419000ceeb7a794b25dca46d38"
+      "sha256": "27b63233558ace04674687e72734ac62bf14b5ff1bc8f0f218ace0b708121a82"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3867,7 +3867,7 @@
     {
       "path": "modules/builder-settings/builder-needs.js",
       "mode": "0000644",
-      "sha256": "0e660777b249d85ecf5024f0f505aca6372a1305dff7cb62c48f73ed5b6cc902"
+      "sha256": "fb576eb616b62b6616ee4875745f062ff01c8be2c31e88b11cf058bee3a6b71a"
     },
     {
       "path": "modules/builder-settings/db.js",
@@ -4267,7 +4267,7 @@
     {
       "path": "modules/discord/board-broadcast.js",
       "mode": "0000644",
-      "sha256": "36906948331be98d0e14b7d0a02d0c86533b2d6247a3506e88c5c52827615411"
+      "sha256": "1d3cfd6ef66c5dfb40d8e39cad9a2683d0a7cfd692c6da85f0a008008bfd4185"
     },
     {
       "path": "modules/discord/bug-attachments.js",
@@ -7717,12 +7717,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8764369ffd2116e5dba8ddb06c801c496e68275a450528ad0bde450fa251bb89"
+      "sha256": "cd5ac6c00223a78f16aae563bafeadb8d919a15eb46aa70a955b31f1e4a4d14b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c6f51339c4fe0264cc3b5a2feb1fb25f4d1a50460fa51413ae47a184255c1c07"
+      "sha256": "3220018d398311cd5dad8ad43c895021eb38edcfa607bcbd72d16afae8323a6f"
     },
     {
       "path": "public-docs/index.html",
@@ -8802,7 +8802,7 @@
     {
       "path": "scripts/gds/sequence.js",
       "mode": "0000644",
-      "sha256": "08b2165b899aa71983826789613d7eadd1bdded7f4ef12b05d7c1a60bb79337e"
+      "sha256": "966e2caee9fff17d57d523402af8f39b02572270b1f4437377eb4b64a8bb494d"
     },
     {
       "path": "scripts/gds/session-cost.js",
@@ -9477,7 +9477,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4b836d646ba65252f11dea1b5dd4872e44835b94247bba3f7cb9e98b05742b54"
+      "sha256": "ae0011557d1a9e04d4193538369dfc2c1cad08dfcefa0898c904566fd2374fe5"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10362,7 +10362,7 @@
     {
       "path": "tests/discord_board_broadcast.mjs",
       "mode": "0000644",
-      "sha256": "f3ac413d7653d3027516eae052523b98206cb54452cb3410602e1bb85c4d4c19"
+      "sha256": "df417a2907c9436d2645dc63121ddb7b7152bf9d3aeb0adeffcc67febb7e43ef"
     },
     {
       "path": "tests/discord_bot.mjs",
@@ -10757,7 +10757,7 @@
     {
       "path": "tests/government_board_hash_redirect.mjs",
       "mode": "0000644",
-      "sha256": "072ae4535449315072118dbe4c904bfd7bacef849fb439095125f545a88b79f2"
+      "sha256": "8dbd98e30dc2ece5896a2f412f6ad8a677ee37025f66f3e21c92b90da5bb192d"
     },
     {
       "path": "tests/government_board_majority.mjs",
@@ -10782,7 +10782,7 @@
     {
       "path": "tests/government_board_summons.mjs",
       "mode": "0000644",
-      "sha256": "349bf135c0c38fb23d40142e3aaa2a5aada9484a4cead9c5b312450a9f818c07"
+      "sha256": "2fc96deb1fb0521befd18b8f2c569076f0047ffe8da49a8129a24b5eb8fd0fcf"
     },
     {
       "path": "tests/government_board_view.mjs",
@@ -12362,7 +12362,7 @@
     {
       "path": "tests/sequence.mjs",
       "mode": "0000644",
-      "sha256": "68e8478af48abc5d3a114f74d1f0bba6cb527c9b457a9f2d291a2ed45cf971dc"
+      "sha256": "5f5933b629b39b90ce3a3ebb5e44b42d573dcb58985716fdcd1a50190754e7a5"
     },
     {
       "path": "tests/served_paths_shipped.mjs",

package/docs/module-api-changelog.md

@@ -1727,5 +1727,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.637 with no explicit bump. run 34438897721. (task 1002620)
   1.19.639 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.638 with no explicit bump. run 34502609272. (task 1002620)
+  1.19.640 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.639 with no explicit bump. run 34506041899. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/builder-settings/builder-needs.js

@@ -174,10 +174,13 @@ function boardVotesNeed(ctx) {
   if (n <= 0) return null;
   const firstId = pending && pending.first_item_id;
   // Deep-link the named sitting when we know it (?item=<id> — the Board Room
-  // panel scrolls to and highlights it; the hash stays the tab), else the room.
+  // page scrolls to and highlights it), else the room itself. The Board Room is
+  // its own page since ADR 0266; the retired hash form it replaced is a fragment
+  // the server never sees, so it survives only as government.js's client-side
+  // redirect and nothing here emits it any more.
   const href = firstId
-    ? `/government?item=${encodeURIComponent(firstId)}#board-room`
-    : '/government#board-room';
+    ? `/board-room?item=${encodeURIComponent(firstId)}`
+    : '/board-room';
   const subject = n === 1 ? 'An idea is' : `${n} ideas are`;
   return {
     id: 'board_votes',

package/modules/discord/board-broadcast.js

@@ -151,11 +151,18 @@ function subjectLabel(subjectType) {
   return subjectType === 'constitutional_amendment' ? 'A constitutional amendment' : 'A Full Idea';
 }
 
-// Straight to THAT item: ?item=<id> — the Board Room panel reads it and scrolls
-// to / highlights the named sitting (the hash stays the tab).
+// Straight to THAT item: ?item=<id> — the Board Room page reads it and scrolls
+// to / highlights the named sitting.
+//
+// POINTS AT `/board-room`, the room's own page since ADR 0266. This is the link
+// a member is most likely to click (ADR 0175 §8 makes the mention the "vote
+// within X" notice), and it is also the one that outlives the code: an
+// announcement already in channel history keeps whatever URL it was posted with
+// forever. That is why government.js's `#board-room` redirect stays a release
+// regardless — it serves the old messages, not this writer.
 function itemLink(itemId) {
   const origin = ((api.branding && api.branding().domains) || {}).buildersOrigin || '';
-  return `${origin ? origin.replace(/\/$/, '') : ''}/government?item=${encodeURIComponent(itemId)}#board-room`;
+  return `${origin ? origin.replace(/\/$/, '') : ''}/board-room?item=${encodeURIComponent(itemId)}`;
 }
 
 // ── the close (BV1.R22 of goal 1000069) ──────────────────────────────────────

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.639",
+  "version": "1.19.640",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.639",
+      "version": "1.19.640",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.639",
+  "version": "1.19.640",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/sequence.js

@@ -164,13 +164,62 @@ function chainFrom(headId, byId, { limit = DEFAULT_LIMIT } = {}) {
   return picked;
 }
 
+// Does the task's OWN declared file surface rule a schema change out? (task 1003699)
+//
+// tasks.needs_migration is set server-side from a keyword scan of the title and
+// description (migration 081; detectsMigration in
+// modules/lifecycle/routes/task-route-helpers.js), so the flag means "this task
+// SAYS the word migration", not "this task changes the schema". Task 1003697
+// carried it while its description said, in capitals, not to change any
+// migration; the row for THIS task is flagged too, for the same reason. A false
+// halt is not free — it is a task the runner will never offer.
+//
+// So the flag alone no longer halts. It is overridden only by positive evidence
+// pointing the other way: a NON-EMPTY touches[] that names no path under
+// migrations/. That is the author stating the file surface and leaving
+// migrations/ out of it.
+//
+// The asymmetry is deliberate. An absent or empty touches[] tells us nothing, so
+// it keeps halting — and it must, because the rank floor cannot be leaned on
+// here: task 1003697 sat at requires_rank 'xenos' with the flag set, so ADR
+// 0270's needs_migration→floor coupling did not raise it and would not have
+// caught a real schema change either.
+//
+// Note this is NARROWER than what the task proposed. "touches[] hitting
+// migrations/, or a declared migration number" would have re-read the prose, and
+// 1003697's description contains a literal migrations/… path while its touches[]
+// contains none — so the number/path branch would have preserved the very false
+// halt the task was filed to remove, and failed its own acceptance criterion.
+// touches[] is the only signal here that is structural rather than vocabulary.
+// A `migrations` DIRECTORY anywhere in the path, not only at the repo root.
+// This codebase ships MODULE-OWNED schema migrations at
+// modules/<key>/migrations/NNN_*.sql (ADR 0083; docs/modules-contract.md §
+// "Module-owned migrations"), and ten such directories exist today — so an
+// anchored /^migrations\//  test would have called every one of them "not a
+// migration" and suppressed the halt on a real schema change.
+//
+// That mistake would have been worse than the bug this task fixes, because
+// nothing else catches it: permission-path-check's protected-surfaces registry
+// carries a `migrations/` glob that IS a second gate for root migrations, but it
+// is root-anchored too, so a module-owned migration has no other halt at all.
+//
+// Matching a whole path SEGMENT is what keeps docs/migrations-guide.md — a file
+// with the word in its name and no migrations directory — from counting.
+const MIGRATION_DIR_RE = /(?:^|\/)migrations\//i;
+
+function declaredSurfaceExcludesMigrations(task) {
+  const touches = Array.isArray(task.touches) ? task.touches : [];
+  if (!touches.length) return false;
+  return !touches.some((raw) => MIGRATION_DIR_RE.test(String(raw).trim().replace(/\\/g, '/')));
+}
+
 // The halt matrix. Facts only — every entry is something the runner can read
 // off the task row, never a judgement about the work itself.
 function haltReasons(task, { rank, claimableIds = null } = {}) {
   const reasons = [];
   if (!task) return [{ code: 'not_found', detail: 'no such task' }];
 
-  if (task.needs_migration) {
+  if (task.needs_migration && !declaredSurfaceExcludesMigrations(task)) {
     reasons.push({ code: 'needs_migration', detail: HALT_REASONS.needs_migration });
   }
   if (task.security_sensitive) {
@@ -286,9 +335,64 @@ async function fetchChain(api, headId, limit) {
   return byId;
 }
 
+// GOAL_PAGE is deliberately below the route's limit cap (1000): the cap is what
+// made the old single read look complete, and paging in smaller bites means the
+// "did I get everything?" question is answered by a short last page rather than
+// by trusting one number. GOAL_MAX_ROWS is a runaway guard, not a window — it is
+// far above any real goal, and hitting it throws rather than truncating.
+const GOAL_PAGE = 500;
+const GOAL_MAX_ROWS = 20000;
+
+// Every task row in one goal, paged until the server runs out (task 1003699).
+//
+// THE BUG THIS REPLACES. The old body asked for `?limit=1000` with NO goal
+// filter and matched goal_id in JS. Past a thousand rows in that ordering — this
+// instance crossed it long ago — a task in the goal simply fell outside the
+// window, and the planner printed "No open tasks in goal N". That is
+// indistinguishable from a finished chain, which is the dangerous part: the
+// runner concludes the goal is DONE and stops. Raising the limit only moves the
+// cliff, so the fix is to filter server-side (?goal_id=, ADR 0086 §3) and page.
+//
+// ANY unreadable page throws, for the same reason the bug was invisible: "I
+// could not look" and "there is nothing left" must never render as the same
+// sentence — and a dropped middle page would say the second while meaning the
+// first.
+async function fetchGoalTaskRows(api, goalId) {
+  const rows = [];
+  for (let offset = 0; ; offset += GOAL_PAGE) {
+    const query = { goal_id: Number(goalId), limit: GOAL_PAGE };
+    // The route rejects offset=0 as "must be a positive integer", so page one
+    // sends no offset at all.
+    if (offset) query.offset = offset;
+    const r = await api.tasks.getTasks({ query });
+    if (!r.ok) {
+      // ANY failed page throws, not just the first. Returning the rows read so
+      // far would hand back a short list that looks like a complete goal — the
+      // same "silent incompleteness reads as done" mistake this task exists to
+      // remove, just relocated from a fixed window to a transient failure. A
+      // caller that wants partial data can ask again; one that is told nothing
+      // cannot know to.
+      throw new Error(
+        `could not read the tasks in goal ${goalId} at offset ${offset} `
+        + `(HTTP ${r.status || '?'}) — refusing to report a partial goal as a complete one`,
+      );
+    }
+    const page = rowsOf(r.data) || [];
+    rows.push(...page);
+    if (page.length < GOAL_PAGE) break;
+    if (rows.length >= GOAL_MAX_ROWS) {
+      throw new Error(`goal ${goalId} returned ${rows.length}+ rows — refusing to page further`);
+    }
+  }
+  return rows;
+}
+
 async function fetchGoalTasks(api, goalId, limit) {
-  const r = await api.tasks.getTasks({ query: { limit: 1000 } });
-  const rows = (r.ok ? rowsOf(r.data) : null) || [];
+  const rows = await fetchGoalTaskRows(api, goalId);
+  // The goal_id match stays even though the server filtered: a core pinned older
+  // than ADR 0086 §3 ignores an unknown query param instead of rejecting it, so
+  // without this line an un-upgraded instance would silently hand back the whole
+  // table and the planner would plan someone else's goal.
   const mine = rows
     .filter((t) => Number(t.goal_id) === Number(goalId) && !TERMINAL.has(t.status))
     .slice(0, limit);
@@ -472,6 +576,10 @@ module.exports = {
   readArgv,
   edgeIds,
   rowsOf,
+  fetchGoalTasks,
+  fetchGoalTaskRows,
+  declaredSurfaceExcludesMigrations,
+  GOAL_PAGE,
   topoOrder,
   chainFrom,
   haltReasons,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.639'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.640'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/discord_board_broadcast.mjs

@@ -50,7 +50,8 @@ test('linked members are @mentioned on the allowlist; unlinked members are named
   assert.ok(posted.text.includes('<@111222333>'));
   assert.ok(posted.text.includes('unlinked-two'), 'the unlinked member is still named');
   assert.ok(posted.text.includes('within 90 minutes'), 'the mention IS the vote-within-X notice');
-  assert.ok(posted.text.includes('/government?item=11#board-room'), 'deep-links THAT item — the panel scrolls to it');
+  assert.ok(posted.text.includes('/board-room?item=11'), 'deep-links THAT item — the page scrolls to it');
+  assert.ok(!posted.text.includes('#board-room'), 'never emits the retired hash form (ADR 0266)');
 });
 
 test('a clockless sitting says so, and an amendment names its subject honestly', async () => {
@@ -221,7 +222,8 @@ test('the close is EDITED onto the same message, and the edit is stamped', async
   assert.equal(edited.messageId, '555000111');
   assert.ok(edited.text.includes('RATIFIED'), 'the summons now reads as the outcome');
   assert.ok(!edited.text.includes('your vote is wanted'), 'nothing stale survives the edit');
-  assert.ok(edited.text.includes('/government?item=11#board-room'), 'the record is still one click away');
+  assert.ok(edited.text.includes('/board-room?item=11'), 'the record is still one click away');
+  assert.ok(!edited.text.includes('#board-room'), 'never emits the retired hash form (ADR 0266)');
   assert.equal(stamped, '11', 'edited_at answers "is this window still shown as open?" without asking Discord');
 });
 

package/tests/government_board_hash_redirect.mjs

@@ -127,3 +127,63 @@ test('the government page no longer declares a board-room tab to redirect INTO',
   const ids = [...GOV_SRC.matchAll(/\{ id: '([a-z-]+)', label: '[^']*', panel:/g)].map((m) => m[1]);
   assert.ok(!ids.includes('board-room'), `board-room is a page, not a tab (found ${ids})`);
 });
+
+// ── the redirect is the ONLY thing that knows the old shape (task 1003736) ────
+//
+// The carve moved the room; task 1003736 moved the WRITERS. Its done-when clause
+// is a statement about the whole tree — "nothing outside the government.js
+// compatibility redirect emits the hash form" — and a claim of that shape rots
+// the moment someone adds a fourth writer by copying an older one. Grepping once
+// at review time proves it for that afternoon only, so it is pinned here instead.
+//
+// TWO TRAPS THIS ENCODES, both of which make the naive sweep wrong:
+//   1. `#board-room` is ALSO the name of a Discord CHANNEL (channels.json, BV1
+//      R20). modules/government/CLAUDE.md and the BV1 spec name that channel, not
+//      a URL — repointing them would be a straightforward mistake, so the sweep
+//      hunts the URL form specifically and the quoted literal separately.
+//   2. ADRs and session logs RECORD the old form on purpose; they are history and
+//      may not be rewritten to match today's code.
+const SWEEP_DIRS = ['modules', 'src', 'scripts', 'docs/recipes', 'docs/packs', '.claude/skills'];
+const SWEEP_EXTS = new Set(['.js', '.mjs', '.cjs', '.html', '.css', '.json', '.md']);
+
+function sweepFiles() {
+  const out = [];
+  const walk = (rel) => {
+    const abs = path.join(ROOT, rel);
+    if (!fs.existsSync(abs)) return;
+    for (const e of fs.readdirSync(abs, { withFileTypes: true })) {
+      if (e.name === 'node_modules' || e.name.startsWith('.git')) continue;
+      const childRel = `${rel}/${e.name}`;
+      if (e.isDirectory()) walk(childRel);
+      else if (SWEEP_EXTS.has(path.extname(e.name))) out.push(childRel);
+    }
+  };
+  for (const d of SWEEP_DIRS) walk(d);
+  return out;
+}
+
+test('no writer anywhere in the tree still emits the retired hash URL', () => {
+  // The emitted form, not the bare fragment: `/government…#board-room`. This is
+  // what a link WRITER produces, and it is the thing task 1003736 repointed in
+  // builder-needs.js (hall banner + CLI nudge) and board-broadcast.js (Discord).
+  const offenders = sweepFiles().filter((rel) =>
+    /\/government[^\s'"`)\]]*#board-room/.test(fs.readFileSync(path.join(ROOT, rel), 'utf8')));
+  assert.deepEqual(offenders, [],
+    `these still emit the retired deep link — point them at /board-room?item=<id>:\n  ${offenders.join('\n  ')}`);
+});
+
+test('the hash literal survives only in the redirect that consumes it', () => {
+  // The QUOTED literal is the runtime value — the thing a branch compares
+  // against. Comments discussing the retired tab are documentation and are left
+  // alone (they use backticks, not quotes), which is why this looks for quotes.
+  const allowed = 'modules/hall-ui/public/government.js';
+  const offenders = sweepFiles().filter((rel) => rel !== allowed
+    && /['"]#board-room['"]/.test(fs.readFileSync(path.join(ROOT, rel), 'utf8')));
+  assert.deepEqual(offenders, [],
+    `only ${allowed}'s redirect may still know the old shape, found in:\n  ${offenders.join('\n  ')}`);
+
+  // And the allowlisted file must actually still contain it — an allowlist that
+  // guards a string nobody has any more is a rule quietly protecting nothing.
+  assert.match(GOV_SRC, /['"]#board-room['"]/,
+    'the compatibility redirect itself is gone — old Discord links now dead-end');
+});

package/tests/government_board_summons.mjs

@@ -199,14 +199,18 @@ test('pending votes are action_needed and deep-link the oldest sitting', () => {
   const n = needs.boardVotesNeed({ pendingBoardVotes: { count: 9, first_item_id: '1' } });
   assert.equal(n.id, 'board_votes');
   assert.equal(n.state, 'action_needed');
-  assert.equal(n.action.href, '/government?item=1#board-room');
-  // The hash is the TAB (makeTabs owns it); the item is a query param.
-  assert.match(n.action.href, /#board-room$/);
+  assert.equal(n.action.href, '/board-room?item=1');
+  // The item is a query param, because `/board-room` reads `?item=` and a
+  // FRAGMENT would never reach the server (ADR 0266). The old
+  // `/government…#board-room` form survives only as government.js's
+  // compatibility redirect — no writer may emit it.
+  assert.ok(!n.action.href.includes('#board-room'), 'never emits the retired hash form');
 });
 
 test('a count with no item id still links the room', () => {
   const n = needs.boardVotesNeed({ pendingBoardVotes: { count: 2 } });
-  assert.equal(n.action.href, '/government#board-room');
+  assert.equal(n.action.href, '/board-room');
+  assert.ok(!n.action.href.includes('#board-room'), 'never emits the retired hash form');
 });
 
 test('the need reaches computeNeeds as an action_needed item', () => {

package/tests/sequence.mjs

@@ -16,10 +16,15 @@ const {
   pickNext,
   summarize,
   MIN_SPEC_CHARS,
+  fetchGoalTasks,
+  fetchGoalTaskRows,
+  declaredSurfaceExcludesMigrations,
+  GOAL_PAGE,
 } = require('../scripts/gds/sequence.js');
 
 let passed = 0, failed = 0;
 const t = (n, f) => { try { f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };
+const ta = async (n, f) => { try { await f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };
 
 // A description long enough to clear the thin-spec gate, so fixtures testing
 // OTHER halt reasons don't trip it incidentally.
@@ -327,5 +332,157 @@ t('pickNext on an empty plan returns no pick and nothing skipped', () => {
   assert.equal(r.head, null);
 });
 
+// ------------------------------------------------- goal paging (task 1003699)
+
+// A fake board big enough to have the cliff the bug fell off. The UNFILTERED
+// listing is capped at UNFILTERED_CAP rows exactly as the real route caps
+// ?limit at 1000, so a row past it is genuinely unreachable that way — which is
+// what makes the acceptance test meaningful rather than a small-instance smoke.
+const UNFILTERED_CAP = 1000;
+
+function fakeBoard({ goalId = 42, rowsInGoal = 3, targetIndex = 1100, total = 1200, failPages = [] } = {}) {
+  const table = [];
+  for (let i = 0; i < total; i += 1) {
+    table.push({ id: 10000 + i, title: `filler ${i}`, status: 'ready', goal_id: 999, touches: [] });
+  }
+  // The task under test sits PAST the unfiltered cap, and is in the goal.
+  table[targetIndex] = { id: 777, title: 'the task past the window', status: 'ready', goal_id: goalId, touches: [] };
+  for (let k = 1; k < rowsInGoal; k += 1) {
+    table[targetIndex - k] = { id: 800 + k, title: `sibling ${k}`, status: 'ready', goal_id: goalId, touches: [] };
+  }
+
+  const calls = [];
+  const api = {
+    tasks: {
+      async getTasks({ query } = {}) {
+        const q = query || {};
+        calls.push({ ...q });
+        if (q.offset === 0) return { ok: false, status: 400 };   // the real route's rule
+        const page = calls.length - 1;
+        if (failPages.includes(page)) return { ok: false, status: 500 };
+        const rows = q.goal_id === undefined
+          ? table.slice(0, UNFILTERED_CAP)
+          : table.filter((r) => Number(r.goal_id) === Number(q.goal_id));
+        const off = Number(q.offset) || 0;
+        const lim = Number(q.limit) || rows.length;
+        return { ok: true, data: { tasks: rows.slice(off, off + lim) } };
+      },
+      async getTasksId({ id }) {
+        const row = table.find((r) => Number(r.id) === Number(id));
+        return row ? { ok: true, data: { task: { ...row, dependencies: [], dependents: [] } } } : { ok: false };
+      },
+    },
+  };
+  return { api, calls, table };
+}
+
+await ta('the unfiltered listing genuinely cannot see the task — the premise of the bug', async () => {
+  const { api } = fakeBoard();
+  const r = await api.tasks.getTasks({ query: { limit: 1000 } });
+  const ids = (r.data.tasks || []).map((x) => Number(x.id));
+  assert.equal(ids.length, UNFILTERED_CAP);
+  assert.ok(!ids.includes(777), 'task 777 must sit outside the unfiltered window, or this suite proves nothing');
+});
+
+await ta('--goal finds a task that is NOT in the first page of the unfiltered listing', async () => {
+  const { api } = fakeBoard();
+  const byId = await fetchGoalTasks(api, 42, 50);
+  assert.ok(byId.has(777), 'the goal-scoped read must return the task past the 1000-row window');
+  assert.equal(byId.size, 3, 'and its two siblings, and nothing from another goal');
+});
+
+await ta('a goal larger than one page is paged until exhausted, and offset=0 is never sent', async () => {
+  const { api, calls } = fakeBoard({ rowsInGoal: GOAL_PAGE + 7, targetIndex: 1100, total: 2000 });
+  const rows = await fetchGoalTaskRows(api, 42);
+  assert.equal(rows.length, GOAL_PAGE + 7, 'every row in the goal, across pages');
+  assert.ok(calls.length >= 2, 'more than one page was requested');
+  assert.equal(calls[0].offset, undefined, 'page one sends no offset (the route rejects offset=0)');
+  assert.equal(calls[1].offset, GOAL_PAGE, 'page two continues from the page size');
+  assert.ok(calls.every((c) => c.goal_id === 42), 'every page is scoped server-side');
+});
+
+await ta('an unreadable FIRST page throws — it must never read as an empty chain', async () => {
+  const { api } = fakeBoard({ failPages: [0] });
+  await assert.rejects(() => fetchGoalTaskRows(api, 42), (e) => {
+    assert.match(e.message, /refusing to report a partial goal/);
+    assert.match(e.message, /goal 42 at offset 0/, 'the message names which page failed');
+    return true;
+  });
+});
+
+await ta('a LATER page failing also throws — a partial goal must not read as a whole one', async () => {
+  const { api } = fakeBoard({ rowsInGoal: GOAL_PAGE + 7, targetIndex: 1100, total: 2000, failPages: [1] });
+  await assert.rejects(() => fetchGoalTaskRows(api, 42), /refusing to report a partial goal/);
+});
+
+await ta('the goal_id match is kept as a guard against a core that ignores the param', async () => {
+  const { api } = fakeBoard();
+  // Simulate a pinned older core: the goal_id filter is silently ignored.
+  const inner = api.tasks.getTasks;
+  api.tasks.getTasks = ({ query } = {}) => inner({ query: { ...query, goal_id: undefined } });
+  const byId = await fetchGoalTasks(api, 42, 50);
+  assert.equal(byId.size, 0, 'a whole-table answer must not become someone else\'s plan');
+});
+
+// -------------------------------------------- needs_migration (task 1003699)
+
+await ta('needs_migration no longer halts on the word alone (task 1003697\'s shape)', async () => {
+  // The real 1003697: the flag set from prose, four touched files, none of them a
+  // migration — and a description that DOES contain a literal migrations/ path,
+  // which is why keying on the prose would not have fixed anything.
+  const t1003697 = task({
+    id: 1003697,
+    needs_migration: true,
+    touches: ['config/rename-history-baseline.json', 'scripts/gds/gds-literal-scan.js',
+      'scripts/gds/rename-history-check.js', 'tests/rename_history_restraint.mjs'],
+    description: `${SPEC} see migrations/163_goal_dep_trigger.sql — DO NOT change any migration`,
+  });
+  assert.ok(declaredSurfaceExcludesMigrations(t1003697));
+  const reasons = haltReasons(t1003697, { rank: 'metic', claimableIds: new Set([1003697]) });
+  assert.ok(!reasons.some((r) => r.code === 'needs_migration'), reasons.map((r) => r.code).join(','));
+});
+
+await ta('a task that genuinely touches migrations/ still halts', async () => {
+  const real = task({ id: 5, needs_migration: true, touches: ['migrations/214_add_column.sql', 'src/x.js'] });
+  assert.equal(declaredSurfaceExcludesMigrations(real), false);
+  const reasons = haltReasons(real, { rank: 'metic', claimableIds: new Set([5]) });
+  assert.ok(reasons.some((r) => r.code === 'needs_migration'));
+});
+
+await ta('a flagged task with NO declared surface keeps halting — silence is not evidence', async () => {
+  for (const touches of [[], undefined]) {
+    const unknown = task({ id: 6, needs_migration: true, touches });
+    assert.equal(declaredSurfaceExcludesMigrations(unknown), false);
+    const reasons = haltReasons(unknown, { rank: 'metic', claimableIds: new Set([6]) });
+    assert.ok(reasons.some((r) => r.code === 'needs_migration'), `touches=${JSON.stringify(touches)}`);
+  }
+});
+
+await ta('a MODULE-OWNED migration counts — modules/<key>/migrations/ is real schema work here', async () => {
+  // ADR 0083 / docs/modules-contract.md: ten modules ship their own migrations.
+  // An anchored ^migrations/ test called these "not a migration" and suppressed
+  // the halt — and nothing else would have caught it, because the protected-path
+  // registry's own migrations/ glob is root-anchored too.
+  for (const p of [
+    'modules/economy/migrations/012_add_col.sql',
+    'modules/lifecycle/migrations/163_goal_dep_trigger.sql',
+    'src/db/migrations/x.sql',
+  ]) {
+    const real = task({ id: 7, needs_migration: true, touches: [p, 'src/x.js'] });
+    assert.equal(declaredSurfaceExcludesMigrations(real), false, p);
+    const reasons = haltReasons(real, { rank: 'metic', claimableIds: new Set([7]) });
+    assert.ok(reasons.some((r) => r.code === 'needs_migration'), `${p} must still halt`);
+  }
+});
+
+await ta('the migrations match reads a path SEGMENT, so a lookalike filename does not count', async () => {
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['./migrations/9.sql'] })), false);
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['Migrations/9.sql'] })), false);
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['modules\\economy\\migrations\\012.sql'] })), false);
+  // The word in a FILE name, with no migrations directory, is not schema work.
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['docs/migrations-guide.md'] })), true);
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['docs/recipes/migrations.md'] })), true);
+});
+
 console.log(`\nsequence: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);