@bongos/core 1.19.639 → 1.19.641

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.639",
-  "core_contract": "1.19.639",
-  "source_commit": "01a3b3c69f079cd730ec88a36b12d3bf30562abd",
+  "core_version": "1.19.641",
+  "core_contract": "1.19.641",
+  "source_commit": "7af21a0086bc6cbc069a459b0a30b90f1646f82e",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T16:31:46.801Z",
+  "built_at": "2026-09-10T17:12:24.520Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 470,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2104,
+    "functional_verbatim": 2106,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2598,
-  "tree_sha256": "03b9b58d7185ba54ca84475a26d2b95870ba16c25ab83697ea91aadf90959e1d",
+  "file_count": 2600,
+  "tree_sha256": "1fd37a4de38d4265a2f0956b03da63ce66a9e84de7ce8a24e1c66ae4465ea028",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "352910d55c713789e1ff42c1adf06d47097296419000ceeb7a794b25dca46d38"
+      "sha256": "967b335b7e06715fb8c07cea7af1141fa2dd3acb0da7873017048bb63aad15d0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3867,7 +3867,7 @@
     {
       "path": "modules/builder-settings/builder-needs.js",
       "mode": "0000644",
-      "sha256": "0e660777b249d85ecf5024f0f505aca6372a1305dff7cb62c48f73ed5b6cc902"
+      "sha256": "fb576eb616b62b6616ee4875745f062ff01c8be2c31e88b11cf058bee3a6b71a"
     },
     {
       "path": "modules/builder-settings/db.js",
@@ -4267,7 +4267,7 @@
     {
       "path": "modules/discord/board-broadcast.js",
       "mode": "0000644",
-      "sha256": "36906948331be98d0e14b7d0a02d0c86533b2d6247a3506e88c5c52827615411"
+      "sha256": "1d3cfd6ef66c5dfb40d8e39cad9a2683d0a7cfd692c6da85f0a008008bfd4185"
     },
     {
       "path": "modules/discord/bug-attachments.js",
@@ -4297,7 +4297,7 @@
     {
       "path": "modules/discord/discord-bugs.js",
       "mode": "0000644",
-      "sha256": "52b463955cd7e57f8d194c161a76e2ade83481f3ee0a16759019a5b1f873b374"
+      "sha256": "000c766b483804e00ac523850e5cd8bc06a8f25aecf622a8629e1987014447b7"
     },
     {
       "path": "modules/discord/discord-channels.js",
@@ -4307,7 +4307,7 @@
     {
       "path": "modules/discord/discord-inbound.js",
       "mode": "0000644",
-      "sha256": "86099070386ff606ec14330375ac8c3145365307ae2ac354539731aebcc16563"
+      "sha256": "4779118709c5e5365c1acc7b7348bf2d812726530876ac99d9f28777db0477b2"
     },
     {
       "path": "modules/discord/discord-message-buffer.js",
@@ -4317,13 +4317,18 @@
     {
       "path": "modules/discord/discord-reaction.js",
       "mode": "0000644",
-      "sha256": "010766b857bd4c6727acdb2272de0442febaf81da6ba2da497b525a3e9d07df6"
+      "sha256": "6d5cd39f63c1f8d6d84e713606844eead96fc2366e720523067f46d845c10c8d"
     },
     {
       "path": "modules/discord/discord-role-sync.js",
       "mode": "0000644",
       "sha256": "852abc58bdec011b6d3bf222a35e198c6ea98a761d57a76be85477ef85ae54f5"
     },
+    {
+      "path": "modules/discord/lifecycle-port.js",
+      "mode": "0000644",
+      "sha256": "f5c7bb703d5c230f334322128129dfc02c6cc03fa9d8d37e00b67493de80a25d"
+    },
     {
       "path": "modules/discord/migrations/discord_001_board_messages.sql",
       "mode": "0000644",
@@ -7717,12 +7722,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8764369ffd2116e5dba8ddb06c801c496e68275a450528ad0bde450fa251bb89"
+      "sha256": "9a655dfca70f3edf6083c6533004860a8a6da53455d732526dea6c0c37f3fcf1"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c6f51339c4fe0264cc3b5a2feb1fb25f4d1a50460fa51413ae47a184255c1c07"
+      "sha256": "80d6ffe532ebbd4d2165171ec5e2887487599e42c53e5411bb4048074d2eb0fb"
     },
     {
       "path": "public-docs/index.html",
@@ -8802,7 +8807,7 @@
     {
       "path": "scripts/gds/sequence.js",
       "mode": "0000644",
-      "sha256": "08b2165b899aa71983826789613d7eadd1bdded7f4ef12b05d7c1a60bb79337e"
+      "sha256": "966e2caee9fff17d57d523402af8f39b02572270b1f4437377eb4b64a8bb494d"
     },
     {
       "path": "scripts/gds/session-cost.js",
@@ -9477,7 +9482,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "4b836d646ba65252f11dea1b5dd4872e44835b94247bba3f7cb9e98b05742b54"
+      "sha256": "cc274e241228f0ad4bb534674500d4daf228abcf6434241fed7152e49590f43f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10362,7 +10367,7 @@
     {
       "path": "tests/discord_board_broadcast.mjs",
       "mode": "0000644",
-      "sha256": "f3ac413d7653d3027516eae052523b98206cb54452cb3410602e1bb85c4d4c19"
+      "sha256": "df417a2907c9436d2645dc63121ddb7b7152bf9d3aeb0adeffcc67febb7e43ef"
     },
     {
       "path": "tests/discord_bot.mjs",
@@ -10389,6 +10394,11 @@
       "mode": "0000644",
       "sha256": "c4e01ac01a3f01fc1a7aece34457a1660034164ab7cb65039f26d4a72d92a403"
     },
+    {
+      "path": "tests/discord_lifecycle_port.mjs",
+      "mode": "0000644",
+      "sha256": "eaa289f4e1fa413b30f23cc23a0aea166bd1d9c18a1992d07a0694b28c9fa3c2"
+    },
     {
       "path": "tests/discord_message_buffer.mjs",
       "mode": "0000644",
@@ -10757,7 +10767,7 @@
     {
       "path": "tests/government_board_hash_redirect.mjs",
       "mode": "0000644",
-      "sha256": "072ae4535449315072118dbe4c904bfd7bacef849fb439095125f545a88b79f2"
+      "sha256": "8dbd98e30dc2ece5896a2f412f6ad8a677ee37025f66f3e21c92b90da5bb192d"
     },
     {
       "path": "tests/government_board_majority.mjs",
@@ -10782,7 +10792,7 @@
     {
       "path": "tests/government_board_summons.mjs",
       "mode": "0000644",
-      "sha256": "349bf135c0c38fb23d40142e3aaa2a5aada9484a4cead9c5b312450a9f818c07"
+      "sha256": "2fc96deb1fb0521befd18b8f2c569076f0047ffe8da49a8129a24b5eb8fd0fcf"
     },
     {
       "path": "tests/government_board_view.mjs",
@@ -12362,7 +12372,7 @@
     {
       "path": "tests/sequence.mjs",
       "mode": "0000644",
-      "sha256": "68e8478af48abc5d3a114f74d1f0bba6cb527c9b457a9f2d291a2ed45cf971dc"
+      "sha256": "5f5933b629b39b90ce3a3ebb5e44b42d573dcb58985716fdcd1a50190754e7a5"
     },
     {
       "path": "tests/served_paths_shipped.mjs",

package/docs/module-api-changelog.md

@@ -1727,5 +1727,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.637 with no explicit bump. run 34438897721. (task 1002620)
   1.19.639 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.638 with no explicit bump. run 34502609272. (task 1002620)
+  1.19.640 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.639 with no explicit bump. run 34506041899. (task 1002620)
+  1.19.641 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.640 with no explicit bump. run 34506718627. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/builder-settings/builder-needs.js

@@ -174,10 +174,13 @@ function boardVotesNeed(ctx) {
   if (n <= 0) return null;
   const firstId = pending && pending.first_item_id;
   // Deep-link the named sitting when we know it (?item=<id> — the Board Room
-  // panel scrolls to and highlights it; the hash stays the tab), else the room.
+  // page scrolls to and highlights it), else the room itself. The Board Room is
+  // its own page since ADR 0266; the retired hash form it replaced is a fragment
+  // the server never sees, so it survives only as government.js's client-side
+  // redirect and nothing here emits it any more.
   const href = firstId
-    ? `/government?item=${encodeURIComponent(firstId)}#board-room`
-    : '/government#board-room';
+    ? `/board-room?item=${encodeURIComponent(firstId)}`
+    : '/board-room';
   const subject = n === 1 ? 'An idea is' : `${n} ideas are`;
   return {
     id: 'board_votes',

package/modules/discord/board-broadcast.js

@@ -151,11 +151,18 @@ function subjectLabel(subjectType) {
   return subjectType === 'constitutional_amendment' ? 'A constitutional amendment' : 'A Full Idea';
 }
 
-// Straight to THAT item: ?item=<id> — the Board Room panel reads it and scrolls
-// to / highlights the named sitting (the hash stays the tab).
+// Straight to THAT item: ?item=<id> — the Board Room page reads it and scrolls
+// to / highlights the named sitting.
+//
+// POINTS AT `/board-room`, the room's own page since ADR 0266. This is the link
+// a member is most likely to click (ADR 0175 §8 makes the mention the "vote
+// within X" notice), and it is also the one that outlives the code: an
+// announcement already in channel history keeps whatever URL it was posted with
+// forever. That is why government.js's `#board-room` redirect stays a release
+// regardless — it serves the old messages, not this writer.
 function itemLink(itemId) {
   const origin = ((api.branding && api.branding().domains) || {}).buildersOrigin || '';
-  return `${origin ? origin.replace(/\/$/, '') : ''}/government?item=${encodeURIComponent(itemId)}#board-room`;
+  return `${origin ? origin.replace(/\/$/, '') : ''}/board-room?item=${encodeURIComponent(itemId)}`;
 }
 
 // ── the close (BV1.R22 of goal 1000069) ──────────────────────────────────────

package/modules/discord/discord-bugs.js

@@ -57,6 +57,7 @@ const { auditDiscordBot } = require('./discord-audit');
 const auth = require('./auth');
 const attachments = require('./bug-attachments');
 const { combineParts, createMessageAggregator } = require('./discord-message-buffer');
+const { lifecycleMethod } = require('./lifecycle-port');
 const api = require('../../src/module-api');
 const { LIMITS } = api;
 const log = api.logger('discord');
@@ -134,14 +135,10 @@ const realDeps = {
   // module rule, ADR 0083/0093). `ideas.capture` is the same door #ideas uses;
   // `lifecycle` answers which goal, on which still-open version.
   captureIdea: (...a) => api.resolve('ideas.capture')(...a),
-  // resolveOptional, not resolve: an instance running without the lifecycle module
-  // has no goals to suggest, and that is a reason to file the report WITHOUT a
-  // home — never a reason to lose it. Returns null, which lands it in the inbox.
-  suggestGoalForCapture: async (...a) => {
-    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
-    if (!lifecycle || !lifecycle.suggestGoalForCapture) return null;
-    return lifecycle.suggestGoalForCapture(...a);
-  },
+  // Optional, not required: an instance running without the lifecycle module has
+  // no goals to suggest, and that is a reason to file the report WITHOUT a home
+  // — never a reason to lose it. Resolves null, which lands it in the inbox.
+  suggestGoalForCapture: lifecycleMethod('suggestGoalForCapture', () => null),
   insertAuditLog: db.insertAuditLog,
   persistImages: attachments.persistImages,
 };

package/modules/discord/discord-inbound.js

@@ -49,6 +49,7 @@ const { auditDiscordBot } = require('./discord-audit');
 const auth = require('./auth');
 const attachments = require('./bug-attachments');
 const { createMessageAggregator } = require('./discord-message-buffer');
+const { lifecycleMethod } = require('./lifecycle-port');
 const { LIMITS } = api;
 const log = api.logger('discord');
 
@@ -88,21 +89,13 @@ const realDeps = {
   // Lazy: resolve the `ideas.capture` port at CALL time, so the ideas module's
   // registration (at its route-factory mount) need not precede this module's load.
   captureIdea: (...a) => api.resolve('ideas.capture')(...a),
-  // resolveOptional, not resolve: a vanilla instance without the lifecycle
-  // module has no goals to suggest, and that is a reason to skip the hint —
-  // never a reason to lose the idea (the discord-bugs.js precedent).
-  suggestGoalForCapture: async (...a) => {
-    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
-    if (!lifecycle || !lifecycle.suggestGoalForCapture) return null;
-    return lifecycle.suggestGoalForCapture(...a);
-  },
-  // Same resolveOptional posture — a vanilla instance without lifecycle has no
-  // versions to default to, which is a reason to skip the default, never the idea.
-  listVersions: async () => {
-    const lifecycle = api.resolveOptional && api.resolveOptional('lifecycle');
-    if (!lifecycle || !lifecycle.listVersions) return [];
-    return lifecycle.listVersions();
-  },
+  // Optional, not required: a vanilla instance without the lifecycle module has
+  // no goals to suggest, and that is a reason to skip the hint — never a reason
+  // to lose the idea (the discord-bugs.js precedent).
+  suggestGoalForCapture: lifecycleMethod('suggestGoalForCapture', () => null),
+  // Same posture — a vanilla instance without lifecycle has no versions to
+  // default to, which is a reason to skip the default, never the idea.
+  listVersions: lifecycleMethod('listVersions', () => []),
   insertAuditLog: db.insertAuditLog,
   persistImages: attachments.persistImages,
 };

package/modules/discord/discord-reaction.js

@@ -32,14 +32,13 @@ const { pool } = require('../../src/module-api');
 const db = require('./db');
 const { auditDiscordBot } = require('./discord-audit');
 const auth = require('./auth');
-const api = require('../../src/module-api');
-// VOTABLE_TASK_STATUSES is the lifecycle module's votable-status set, resolved via
+const { lifecycleMember } = require('./lifecycle-port');
+// VOTABLE_TASK_STATUSES is the lifecycle module's votable-status set, read via
 // the `lifecycle` kernel PORT (the doorway leak retired at BV1.R86) — a vote only
-// lands on confirmed/shipped work. Resolved at call time (this file runs under the
-// discord bot poller, well after the lifecycle port registers at boot). A
-// #ship-feed message is always about a shipped task, but we re-check rather than
-// trust the channel.
-const votableStatuses = () => api.resolveOptional('lifecycle')?.VOTABLE_TASK_STATUSES || new Set();
+// lands on confirmed/shipped work. lifecycle-port.js keeps the resolve late and
+// the absent-module fallback empty. A #ship-feed message is always about a
+// shipped task, but we re-check rather than trust the channel.
+const votableStatuses = () => lifecycleMember('VOTABLE_TASK_STATUSES', () => new Set());
 const VOTING_RANKS = new Set(['metic', 'archon']);
 
 // PURE — extract the GDS task id from a #ship-feed message. The producer

package/modules/discord/lifecycle-port.js

@@ -0,0 +1,69 @@
+// modules/discord/lifecycle-port.js — the one place this module reaches the
+// OPTIONAL `lifecycle` kernel port.
+//
+// Why this file exists: four call sites across discord-bugs.js,
+// discord-inbound.js and discord-reaction.js each hand-rolled the same
+// resolveOptional('lifecycle') dance — resolve the port at call time, check the
+// member is actually there, fall back to an empty value when it is not. The
+// duplication was a grader nit on task 1003068 and the goal 1000071 R11 ship.
+//
+// THE POSTURE — resolveOptional, never resolve. `lifecycle` is an optional
+// module: a vanilla Cloud Bongos instance runs without it, so it has no goals
+// to suggest and no versions to default to. That is a reason to skip the hint,
+// NEVER a reason to lose the idea or drop the bug report. Every accessor here
+// degrades to an empty value, and nothing in this file throws.
+//
+// LATE BINDING IS LOAD-BEARING. The port is resolved inside each accessor, not
+// once at require time, because this module's files are loaded before the
+// lifecycle module registers its provider at boot. Hoisting the resolve to
+// module scope would pin the fallback forever — which is why every accessor
+// below is a function, and why none of them caches.
+//
+// A module may import only the published doorway (src/module-api.js), so this
+// helper lives beside its callers rather than in core (ADR 0083/0093).
+
+const api = require('../../src/module-api');
+
+// The port itself, or null. The `api.resolveOptional &&` guard is kept because
+// three of the four original copies carried it; discord-reaction.js was the odd
+// one out, so routing every caller through here also settles that inconsistency
+// in favour of the guard.
+function lifecyclePort() {
+  return (api.resolveOptional && api.resolveOptional('lifecycle')) || null;
+}
+
+// Read one member off the `lifecycle` port, or produce an empty stand-in.
+//
+// `makeFallback` is a FACTORY, not a value, and deliberately so: the fallbacks
+// in play are mutable (`[]`, `new Set()`), and handing every caller one shared
+// instance would turn a mutation by any one of them into a cross-call leak.
+// Each call gets a fresh fallback, exactly as the hand-rolled copies did.
+//
+// Reading as `lifecycle[member]` also keeps the port's GETTERS working —
+// VOTABLE_TASK_STATUSES is one (`get VOTABLE_TASK_STATUSES()`), so it must be
+// read off the object rather than destructured ahead of time.
+function lifecycleMember(member, makeFallback) {
+  const lifecycle = lifecyclePort();
+  const value = lifecycle ? lifecycle[member] : undefined;
+  return value === undefined || value === null ? makeFallback() : value;
+}
+
+// Wrap an optional lifecycle METHOD as an always-callable async function: it
+// forwards to the port when the module is present, and resolves to a fresh
+// fallback when either the module or that method is absent. The caller cannot
+// tell the two absences apart, and does not need to.
+//
+// `fn.call(lifecycle, …)`, not `fn(…)`: the call sites this replaced invoked
+// `lifecycle.method(...)`, so the port was the receiver. Every member the port
+// exports today is a delegating arrow that ignores `this`, so nothing currently
+// depends on it — which is exactly why dropping it would go unnoticed until a
+// provider that DOES use `this` broke silently. Preserve it.
+function lifecycleMethod(member, makeFallback) {
+  return async (...args) => {
+    const lifecycle = lifecyclePort();
+    const fn = lifecycle ? lifecycle[member] : undefined;
+    return typeof fn === 'function' ? fn.call(lifecycle, ...args) : makeFallback();
+  };
+}
+
+module.exports = { lifecycleMember, lifecycleMethod };

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.639",
+  "version": "1.19.641",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.639",
+      "version": "1.19.641",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.639",
+  "version": "1.19.641",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/sequence.js

@@ -164,13 +164,62 @@ function chainFrom(headId, byId, { limit = DEFAULT_LIMIT } = {}) {
   return picked;
 }
 
+// Does the task's OWN declared file surface rule a schema change out? (task 1003699)
+//
+// tasks.needs_migration is set server-side from a keyword scan of the title and
+// description (migration 081; detectsMigration in
+// modules/lifecycle/routes/task-route-helpers.js), so the flag means "this task
+// SAYS the word migration", not "this task changes the schema". Task 1003697
+// carried it while its description said, in capitals, not to change any
+// migration; the row for THIS task is flagged too, for the same reason. A false
+// halt is not free — it is a task the runner will never offer.
+//
+// So the flag alone no longer halts. It is overridden only by positive evidence
+// pointing the other way: a NON-EMPTY touches[] that names no path under
+// migrations/. That is the author stating the file surface and leaving
+// migrations/ out of it.
+//
+// The asymmetry is deliberate. An absent or empty touches[] tells us nothing, so
+// it keeps halting — and it must, because the rank floor cannot be leaned on
+// here: task 1003697 sat at requires_rank 'xenos' with the flag set, so ADR
+// 0270's needs_migration→floor coupling did not raise it and would not have
+// caught a real schema change either.
+//
+// Note this is NARROWER than what the task proposed. "touches[] hitting
+// migrations/, or a declared migration number" would have re-read the prose, and
+// 1003697's description contains a literal migrations/… path while its touches[]
+// contains none — so the number/path branch would have preserved the very false
+// halt the task was filed to remove, and failed its own acceptance criterion.
+// touches[] is the only signal here that is structural rather than vocabulary.
+// A `migrations` DIRECTORY anywhere in the path, not only at the repo root.
+// This codebase ships MODULE-OWNED schema migrations at
+// modules/<key>/migrations/NNN_*.sql (ADR 0083; docs/modules-contract.md §
+// "Module-owned migrations"), and ten such directories exist today — so an
+// anchored /^migrations\//  test would have called every one of them "not a
+// migration" and suppressed the halt on a real schema change.
+//
+// That mistake would have been worse than the bug this task fixes, because
+// nothing else catches it: permission-path-check's protected-surfaces registry
+// carries a `migrations/` glob that IS a second gate for root migrations, but it
+// is root-anchored too, so a module-owned migration has no other halt at all.
+//
+// Matching a whole path SEGMENT is what keeps docs/migrations-guide.md — a file
+// with the word in its name and no migrations directory — from counting.
+const MIGRATION_DIR_RE = /(?:^|\/)migrations\//i;
+
+function declaredSurfaceExcludesMigrations(task) {
+  const touches = Array.isArray(task.touches) ? task.touches : [];
+  if (!touches.length) return false;
+  return !touches.some((raw) => MIGRATION_DIR_RE.test(String(raw).trim().replace(/\\/g, '/')));
+}
+
 // The halt matrix. Facts only — every entry is something the runner can read
 // off the task row, never a judgement about the work itself.
 function haltReasons(task, { rank, claimableIds = null } = {}) {
   const reasons = [];
   if (!task) return [{ code: 'not_found', detail: 'no such task' }];
 
-  if (task.needs_migration) {
+  if (task.needs_migration && !declaredSurfaceExcludesMigrations(task)) {
     reasons.push({ code: 'needs_migration', detail: HALT_REASONS.needs_migration });
   }
   if (task.security_sensitive) {
@@ -286,9 +335,64 @@ async function fetchChain(api, headId, limit) {
   return byId;
 }
 
+// GOAL_PAGE is deliberately below the route's limit cap (1000): the cap is what
+// made the old single read look complete, and paging in smaller bites means the
+// "did I get everything?" question is answered by a short last page rather than
+// by trusting one number. GOAL_MAX_ROWS is a runaway guard, not a window — it is
+// far above any real goal, and hitting it throws rather than truncating.
+const GOAL_PAGE = 500;
+const GOAL_MAX_ROWS = 20000;
+
+// Every task row in one goal, paged until the server runs out (task 1003699).
+//
+// THE BUG THIS REPLACES. The old body asked for `?limit=1000` with NO goal
+// filter and matched goal_id in JS. Past a thousand rows in that ordering — this
+// instance crossed it long ago — a task in the goal simply fell outside the
+// window, and the planner printed "No open tasks in goal N". That is
+// indistinguishable from a finished chain, which is the dangerous part: the
+// runner concludes the goal is DONE and stops. Raising the limit only moves the
+// cliff, so the fix is to filter server-side (?goal_id=, ADR 0086 §3) and page.
+//
+// ANY unreadable page throws, for the same reason the bug was invisible: "I
+// could not look" and "there is nothing left" must never render as the same
+// sentence — and a dropped middle page would say the second while meaning the
+// first.
+async function fetchGoalTaskRows(api, goalId) {
+  const rows = [];
+  for (let offset = 0; ; offset += GOAL_PAGE) {
+    const query = { goal_id: Number(goalId), limit: GOAL_PAGE };
+    // The route rejects offset=0 as "must be a positive integer", so page one
+    // sends no offset at all.
+    if (offset) query.offset = offset;
+    const r = await api.tasks.getTasks({ query });
+    if (!r.ok) {
+      // ANY failed page throws, not just the first. Returning the rows read so
+      // far would hand back a short list that looks like a complete goal — the
+      // same "silent incompleteness reads as done" mistake this task exists to
+      // remove, just relocated from a fixed window to a transient failure. A
+      // caller that wants partial data can ask again; one that is told nothing
+      // cannot know to.
+      throw new Error(
+        `could not read the tasks in goal ${goalId} at offset ${offset} `
+        + `(HTTP ${r.status || '?'}) — refusing to report a partial goal as a complete one`,
+      );
+    }
+    const page = rowsOf(r.data) || [];
+    rows.push(...page);
+    if (page.length < GOAL_PAGE) break;
+    if (rows.length >= GOAL_MAX_ROWS) {
+      throw new Error(`goal ${goalId} returned ${rows.length}+ rows — refusing to page further`);
+    }
+  }
+  return rows;
+}
+
 async function fetchGoalTasks(api, goalId, limit) {
-  const r = await api.tasks.getTasks({ query: { limit: 1000 } });
-  const rows = (r.ok ? rowsOf(r.data) : null) || [];
+  const rows = await fetchGoalTaskRows(api, goalId);
+  // The goal_id match stays even though the server filtered: a core pinned older
+  // than ADR 0086 §3 ignores an unknown query param instead of rejecting it, so
+  // without this line an un-upgraded instance would silently hand back the whole
+  // table and the planner would plan someone else's goal.
   const mine = rows
     .filter((t) => Number(t.goal_id) === Number(goalId) && !TERMINAL.has(t.status))
     .slice(0, limit);
@@ -472,6 +576,10 @@ module.exports = {
   readArgv,
   edgeIds,
   rowsOf,
+  fetchGoalTasks,
+  fetchGoalTaskRows,
+  declaredSurfaceExcludesMigrations,
+  GOAL_PAGE,
   topoOrder,
   chainFrom,
   haltReasons,

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.639'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.641'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/discord_board_broadcast.mjs

@@ -50,7 +50,8 @@ test('linked members are @mentioned on the allowlist; unlinked members are named
   assert.ok(posted.text.includes('<@111222333>'));
   assert.ok(posted.text.includes('unlinked-two'), 'the unlinked member is still named');
   assert.ok(posted.text.includes('within 90 minutes'), 'the mention IS the vote-within-X notice');
-  assert.ok(posted.text.includes('/government?item=11#board-room'), 'deep-links THAT item — the panel scrolls to it');
+  assert.ok(posted.text.includes('/board-room?item=11'), 'deep-links THAT item — the page scrolls to it');
+  assert.ok(!posted.text.includes('#board-room'), 'never emits the retired hash form (ADR 0266)');
 });
 
 test('a clockless sitting says so, and an amendment names its subject honestly', async () => {
@@ -221,7 +222,8 @@ test('the close is EDITED onto the same message, and the edit is stamped', async
   assert.equal(edited.messageId, '555000111');
   assert.ok(edited.text.includes('RATIFIED'), 'the summons now reads as the outcome');
   assert.ok(!edited.text.includes('your vote is wanted'), 'nothing stale survives the edit');
-  assert.ok(edited.text.includes('/government?item=11#board-room'), 'the record is still one click away');
+  assert.ok(edited.text.includes('/board-room?item=11'), 'the record is still one click away');
+  assert.ok(!edited.text.includes('#board-room'), 'never emits the retired hash form (ADR 0266)');
   assert.equal(stamped, '11', 'edited_at answers "is this window still shown as open?" without asking Discord');
 });
 

package/tests/discord_lifecycle_port.mjs

@@ -0,0 +1,153 @@
+// tests/discord_lifecycle_port.mjs — the optional `lifecycle` port accessor
+// (task 1003630).
+//
+// The four hand-rolled resolveOptional('lifecycle') wrappers this helper
+// replaced were never covered: every existing discord test injects `deps`, so
+// the real `realDeps` wrappers — and specifically their absent-module branch —
+// ran only in production. That branch is the whole point of the file (a vanilla
+// Cloud Bongos instance has no lifecycle module), so it is what these pin:
+//
+//   1. present module  → the port's own member/method is used
+//   2. absent module   → a fresh empty fallback, and NO throw
+//   3. absent MEMBER on a present module → the same fallback (the caller cannot
+//      tell the two absences apart, and must not need to)
+//   4. the fallback is a FACTORY — each call gets its own instance, so one
+//      caller mutating an empty [] or Set() cannot leak into the next
+//   5. binding is LATE — a provider registered after require() is still seen
+//   6. the RECEIVER survives — `lifecycle.method(...)` was the original call
+//      shape, so `this` inside a method must still be the port, and a getter
+//      member must still fire
+//
+// DB-free and bot-free: it drives the seam registry directly.
+//
+// WHY IT LIVES HERE and not in modules/discord/tests/: module-owned tests are
+// discovered but gated by isModuleEnabled('discord'), and `discord` is OFF in
+// the vanilla pack (config/modules.neutral.json) with no config/modules.json in
+// the repo — so a module-owned copy is skipped in CI and would never actually
+// run. The runner's MODULE_TESTS map is curated and does not list discord, so
+// top-level tests/discord_*.mjs run unconditionally. This sits beside its three
+// siblings (discord_reaction, discord_inbound, discord_bugs) for that reason.
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const seams = require('../src/module-seams.js');
+const { lifecycleMember, lifecycleMethod } = require('../modules/discord/lifecycle-port.js');
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
+}
+
+console.log('\ndiscord: the optional lifecycle port degrades instead of throwing');
+
+// ---- 1. the module is present ---------------------------------------------
+
+await test('lifecycleMember reads the real member off a registered port', () => {
+  seams._reset();
+  const statuses = new Set(['confirmed', 'shipped']);
+  seams.registerProvider('lifecycle', { VOTABLE_TASK_STATUSES: statuses });
+  assert.equal(lifecycleMember('VOTABLE_TASK_STATUSES', () => new Set()), statuses);
+});
+
+await test('lifecycleMethod forwards args to the real method and returns its value', async () => {
+  seams._reset();
+  const seen = [];
+  seams.registerProvider('lifecycle', {
+    suggestGoalForCapture: async (draft, extra) => { seen.push([draft, extra]); return { goal_id: '1000091' }; },
+  });
+  const suggest = lifecycleMethod('suggestGoalForCapture', () => null);
+  assert.deepEqual(await suggest({ title: 'x' }, 7), { goal_id: '1000091' });
+  assert.deepEqual(seen, [[{ title: 'x' }, 7]], 'every argument is forwarded, in order');
+});
+
+// ---- 2. the module is absent (the vanilla instance) ------------------------
+
+await test('lifecycleMember falls back when NO provider is registered', () => {
+  seams._reset();
+  const out = lifecycleMember('VOTABLE_TASK_STATUSES', () => new Set());
+  assert.ok(out instanceof Set);
+  assert.equal(out.size, 0, 'an empty votable set, so no vote can land');
+});
+
+await test('lifecycleMethod resolves the fallback rather than throwing', async () => {
+  seams._reset();
+  assert.equal(await lifecycleMethod('suggestGoalForCapture', () => null)({ title: 'x' }), null);
+  assert.deepEqual(await lifecycleMethod('listVersions', () => [])(), []);
+});
+
+// ---- 3. present module, absent member -------------------------------------
+
+await test('a present port MISSING the member falls back the same way', async () => {
+  seams._reset();
+  seams.registerProvider('lifecycle', { somethingElse: () => 'nope' });
+  assert.deepEqual(lifecycleMember('VOTABLE_TASK_STATUSES', () => new Set()), new Set());
+  assert.equal(await lifecycleMethod('suggestGoalForCapture', () => null)({}), null);
+});
+
+await test('a member present but NOT a function still falls back', async () => {
+  seams._reset();
+  seams.registerProvider('lifecycle', { listVersions: 'not callable' });
+  assert.deepEqual(await lifecycleMethod('listVersions', () => [])(), []);
+});
+
+// ---- 4. the fallback is a factory, not a shared instance -------------------
+
+await test('each fallback is a FRESH instance — a mutation cannot leak forward', async () => {
+  seams._reset();
+  const first = lifecycleMember('VOTABLE_TASK_STATUSES', () => new Set());
+  first.add('poisoned');
+  const second = lifecycleMember('VOTABLE_TASK_STATUSES', () => new Set());
+  assert.equal(second.size, 0, 'the second caller must not see the first caller\'s write');
+  assert.notEqual(first, second);
+
+  const listVersions = lifecycleMethod('listVersions', () => []);
+  const a = await listVersions();
+  a.push('poisoned');
+  assert.deepEqual(await listVersions(), [], 'the same holds across method calls');
+});
+
+// ---- 6. the receiver and getters survive the indirection -------------------
+
+await test('a method still sees the PORT as `this` (not undefined)', async () => {
+  seams._reset();
+  const port = {
+    marker: 'the-port',
+    // A plain method, so `this` is meaningful — unlike the delegating arrows the
+    // real lifecycle module exports today.
+    async suggestGoalForCapture() { return this && this.marker; },
+  };
+  seams.registerProvider('lifecycle', port);
+  assert.equal(
+    await lifecycleMethod('suggestGoalForCapture', () => null)({}),
+    'the-port',
+    'fn.call(lifecycle, …) — dropping the receiver would return undefined here',
+  );
+});
+
+await test('a GETTER member is read off the object, so it actually fires', () => {
+  seams._reset();
+  let reads = 0;
+  seams.registerProvider('lifecycle', {
+    get VOTABLE_TASK_STATUSES() { reads += 1; return new Set(['shipped']); },
+  });
+  assert.deepEqual(lifecycleMember('VOTABLE_TASK_STATUSES', () => new Set()), new Set(['shipped']));
+  assert.equal(reads, 1, 'the real port defines this member as a getter');
+});
+
+// ---- 5. binding is late ----------------------------------------------------
+
+await test('a provider registered AFTER require() is still picked up', async () => {
+  seams._reset();
+  const suggest = lifecycleMethod('suggestGoalForCapture', () => null);
+  assert.equal(await suggest({}), null, 'nothing registered yet — the fallback');
+  seams.registerProvider('lifecycle', { suggestGoalForCapture: async () => ({ goal_id: '42' }) });
+  assert.deepEqual(await suggest({}), { goal_id: '42' }, 'the late registration is seen without a re-require');
+});
+
+seams._reset();
+console.log(`\n  ${passed} passed, ${failed} failed`);
+if (failed > 0) process.exit(1);

package/tests/government_board_hash_redirect.mjs

@@ -127,3 +127,63 @@ test('the government page no longer declares a board-room tab to redirect INTO',
   const ids = [...GOV_SRC.matchAll(/\{ id: '([a-z-]+)', label: '[^']*', panel:/g)].map((m) => m[1]);
   assert.ok(!ids.includes('board-room'), `board-room is a page, not a tab (found ${ids})`);
 });
+
+// ── the redirect is the ONLY thing that knows the old shape (task 1003736) ────
+//
+// The carve moved the room; task 1003736 moved the WRITERS. Its done-when clause
+// is a statement about the whole tree — "nothing outside the government.js
+// compatibility redirect emits the hash form" — and a claim of that shape rots
+// the moment someone adds a fourth writer by copying an older one. Grepping once
+// at review time proves it for that afternoon only, so it is pinned here instead.
+//
+// TWO TRAPS THIS ENCODES, both of which make the naive sweep wrong:
+//   1. `#board-room` is ALSO the name of a Discord CHANNEL (channels.json, BV1
+//      R20). modules/government/CLAUDE.md and the BV1 spec name that channel, not
+//      a URL — repointing them would be a straightforward mistake, so the sweep
+//      hunts the URL form specifically and the quoted literal separately.
+//   2. ADRs and session logs RECORD the old form on purpose; they are history and
+//      may not be rewritten to match today's code.
+const SWEEP_DIRS = ['modules', 'src', 'scripts', 'docs/recipes', 'docs/packs', '.claude/skills'];
+const SWEEP_EXTS = new Set(['.js', '.mjs', '.cjs', '.html', '.css', '.json', '.md']);
+
+function sweepFiles() {
+  const out = [];
+  const walk = (rel) => {
+    const abs = path.join(ROOT, rel);
+    if (!fs.existsSync(abs)) return;
+    for (const e of fs.readdirSync(abs, { withFileTypes: true })) {
+      if (e.name === 'node_modules' || e.name.startsWith('.git')) continue;
+      const childRel = `${rel}/${e.name}`;
+      if (e.isDirectory()) walk(childRel);
+      else if (SWEEP_EXTS.has(path.extname(e.name))) out.push(childRel);
+    }
+  };
+  for (const d of SWEEP_DIRS) walk(d);
+  return out;
+}
+
+test('no writer anywhere in the tree still emits the retired hash URL', () => {
+  // The emitted form, not the bare fragment: `/government…#board-room`. This is
+  // what a link WRITER produces, and it is the thing task 1003736 repointed in
+  // builder-needs.js (hall banner + CLI nudge) and board-broadcast.js (Discord).
+  const offenders = sweepFiles().filter((rel) =>
+    /\/government[^\s'"`)\]]*#board-room/.test(fs.readFileSync(path.join(ROOT, rel), 'utf8')));
+  assert.deepEqual(offenders, [],
+    `these still emit the retired deep link — point them at /board-room?item=<id>:\n  ${offenders.join('\n  ')}`);
+});
+
+test('the hash literal survives only in the redirect that consumes it', () => {
+  // The QUOTED literal is the runtime value — the thing a branch compares
+  // against. Comments discussing the retired tab are documentation and are left
+  // alone (they use backticks, not quotes), which is why this looks for quotes.
+  const allowed = 'modules/hall-ui/public/government.js';
+  const offenders = sweepFiles().filter((rel) => rel !== allowed
+    && /['"]#board-room['"]/.test(fs.readFileSync(path.join(ROOT, rel), 'utf8')));
+  assert.deepEqual(offenders, [],
+    `only ${allowed}'s redirect may still know the old shape, found in:\n  ${offenders.join('\n  ')}`);
+
+  // And the allowlisted file must actually still contain it — an allowlist that
+  // guards a string nobody has any more is a rule quietly protecting nothing.
+  assert.match(GOV_SRC, /['"]#board-room['"]/,
+    'the compatibility redirect itself is gone — old Discord links now dead-end');
+});

package/tests/government_board_summons.mjs

@@ -199,14 +199,18 @@ test('pending votes are action_needed and deep-link the oldest sitting', () => {
   const n = needs.boardVotesNeed({ pendingBoardVotes: { count: 9, first_item_id: '1' } });
   assert.equal(n.id, 'board_votes');
   assert.equal(n.state, 'action_needed');
-  assert.equal(n.action.href, '/government?item=1#board-room');
-  // The hash is the TAB (makeTabs owns it); the item is a query param.
-  assert.match(n.action.href, /#board-room$/);
+  assert.equal(n.action.href, '/board-room?item=1');
+  // The item is a query param, because `/board-room` reads `?item=` and a
+  // FRAGMENT would never reach the server (ADR 0266). The old
+  // `/government…#board-room` form survives only as government.js's
+  // compatibility redirect — no writer may emit it.
+  assert.ok(!n.action.href.includes('#board-room'), 'never emits the retired hash form');
 });
 
 test('a count with no item id still links the room', () => {
   const n = needs.boardVotesNeed({ pendingBoardVotes: { count: 2 } });
-  assert.equal(n.action.href, '/government#board-room');
+  assert.equal(n.action.href, '/board-room');
+  assert.ok(!n.action.href.includes('#board-room'), 'never emits the retired hash form');
 });
 
 test('the need reaches computeNeeds as an action_needed item', () => {

package/tests/sequence.mjs

@@ -16,10 +16,15 @@ const {
   pickNext,
   summarize,
   MIN_SPEC_CHARS,
+  fetchGoalTasks,
+  fetchGoalTaskRows,
+  declaredSurfaceExcludesMigrations,
+  GOAL_PAGE,
 } = require('../scripts/gds/sequence.js');
 
 let passed = 0, failed = 0;
 const t = (n, f) => { try { f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };
+const ta = async (n, f) => { try { await f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };
 
 // A description long enough to clear the thin-spec gate, so fixtures testing
 // OTHER halt reasons don't trip it incidentally.
@@ -327,5 +332,157 @@ t('pickNext on an empty plan returns no pick and nothing skipped', () => {
   assert.equal(r.head, null);
 });
 
+// ------------------------------------------------- goal paging (task 1003699)
+
+// A fake board big enough to have the cliff the bug fell off. The UNFILTERED
+// listing is capped at UNFILTERED_CAP rows exactly as the real route caps
+// ?limit at 1000, so a row past it is genuinely unreachable that way — which is
+// what makes the acceptance test meaningful rather than a small-instance smoke.
+const UNFILTERED_CAP = 1000;
+
+function fakeBoard({ goalId = 42, rowsInGoal = 3, targetIndex = 1100, total = 1200, failPages = [] } = {}) {
+  const table = [];
+  for (let i = 0; i < total; i += 1) {
+    table.push({ id: 10000 + i, title: `filler ${i}`, status: 'ready', goal_id: 999, touches: [] });
+  }
+  // The task under test sits PAST the unfiltered cap, and is in the goal.
+  table[targetIndex] = { id: 777, title: 'the task past the window', status: 'ready', goal_id: goalId, touches: [] };
+  for (let k = 1; k < rowsInGoal; k += 1) {
+    table[targetIndex - k] = { id: 800 + k, title: `sibling ${k}`, status: 'ready', goal_id: goalId, touches: [] };
+  }
+
+  const calls = [];
+  const api = {
+    tasks: {
+      async getTasks({ query } = {}) {
+        const q = query || {};
+        calls.push({ ...q });
+        if (q.offset === 0) return { ok: false, status: 400 };   // the real route's rule
+        const page = calls.length - 1;
+        if (failPages.includes(page)) return { ok: false, status: 500 };
+        const rows = q.goal_id === undefined
+          ? table.slice(0, UNFILTERED_CAP)
+          : table.filter((r) => Number(r.goal_id) === Number(q.goal_id));
+        const off = Number(q.offset) || 0;
+        const lim = Number(q.limit) || rows.length;
+        return { ok: true, data: { tasks: rows.slice(off, off + lim) } };
+      },
+      async getTasksId({ id }) {
+        const row = table.find((r) => Number(r.id) === Number(id));
+        return row ? { ok: true, data: { task: { ...row, dependencies: [], dependents: [] } } } : { ok: false };
+      },
+    },
+  };
+  return { api, calls, table };
+}
+
+await ta('the unfiltered listing genuinely cannot see the task — the premise of the bug', async () => {
+  const { api } = fakeBoard();
+  const r = await api.tasks.getTasks({ query: { limit: 1000 } });
+  const ids = (r.data.tasks || []).map((x) => Number(x.id));
+  assert.equal(ids.length, UNFILTERED_CAP);
+  assert.ok(!ids.includes(777), 'task 777 must sit outside the unfiltered window, or this suite proves nothing');
+});
+
+await ta('--goal finds a task that is NOT in the first page of the unfiltered listing', async () => {
+  const { api } = fakeBoard();
+  const byId = await fetchGoalTasks(api, 42, 50);
+  assert.ok(byId.has(777), 'the goal-scoped read must return the task past the 1000-row window');
+  assert.equal(byId.size, 3, 'and its two siblings, and nothing from another goal');
+});
+
+await ta('a goal larger than one page is paged until exhausted, and offset=0 is never sent', async () => {
+  const { api, calls } = fakeBoard({ rowsInGoal: GOAL_PAGE + 7, targetIndex: 1100, total: 2000 });
+  const rows = await fetchGoalTaskRows(api, 42);
+  assert.equal(rows.length, GOAL_PAGE + 7, 'every row in the goal, across pages');
+  assert.ok(calls.length >= 2, 'more than one page was requested');
+  assert.equal(calls[0].offset, undefined, 'page one sends no offset (the route rejects offset=0)');
+  assert.equal(calls[1].offset, GOAL_PAGE, 'page two continues from the page size');
+  assert.ok(calls.every((c) => c.goal_id === 42), 'every page is scoped server-side');
+});
+
+await ta('an unreadable FIRST page throws — it must never read as an empty chain', async () => {
+  const { api } = fakeBoard({ failPages: [0] });
+  await assert.rejects(() => fetchGoalTaskRows(api, 42), (e) => {
+    assert.match(e.message, /refusing to report a partial goal/);
+    assert.match(e.message, /goal 42 at offset 0/, 'the message names which page failed');
+    return true;
+  });
+});
+
+await ta('a LATER page failing also throws — a partial goal must not read as a whole one', async () => {
+  const { api } = fakeBoard({ rowsInGoal: GOAL_PAGE + 7, targetIndex: 1100, total: 2000, failPages: [1] });
+  await assert.rejects(() => fetchGoalTaskRows(api, 42), /refusing to report a partial goal/);
+});
+
+await ta('the goal_id match is kept as a guard against a core that ignores the param', async () => {
+  const { api } = fakeBoard();
+  // Simulate a pinned older core: the goal_id filter is silently ignored.
+  const inner = api.tasks.getTasks;
+  api.tasks.getTasks = ({ query } = {}) => inner({ query: { ...query, goal_id: undefined } });
+  const byId = await fetchGoalTasks(api, 42, 50);
+  assert.equal(byId.size, 0, 'a whole-table answer must not become someone else\'s plan');
+});
+
+// -------------------------------------------- needs_migration (task 1003699)
+
+await ta('needs_migration no longer halts on the word alone (task 1003697\'s shape)', async () => {
+  // The real 1003697: the flag set from prose, four touched files, none of them a
+  // migration — and a description that DOES contain a literal migrations/ path,
+  // which is why keying on the prose would not have fixed anything.
+  const t1003697 = task({
+    id: 1003697,
+    needs_migration: true,
+    touches: ['config/rename-history-baseline.json', 'scripts/gds/gds-literal-scan.js',
+      'scripts/gds/rename-history-check.js', 'tests/rename_history_restraint.mjs'],
+    description: `${SPEC} see migrations/163_goal_dep_trigger.sql — DO NOT change any migration`,
+  });
+  assert.ok(declaredSurfaceExcludesMigrations(t1003697));
+  const reasons = haltReasons(t1003697, { rank: 'metic', claimableIds: new Set([1003697]) });
+  assert.ok(!reasons.some((r) => r.code === 'needs_migration'), reasons.map((r) => r.code).join(','));
+});
+
+await ta('a task that genuinely touches migrations/ still halts', async () => {
+  const real = task({ id: 5, needs_migration: true, touches: ['migrations/214_add_column.sql', 'src/x.js'] });
+  assert.equal(declaredSurfaceExcludesMigrations(real), false);
+  const reasons = haltReasons(real, { rank: 'metic', claimableIds: new Set([5]) });
+  assert.ok(reasons.some((r) => r.code === 'needs_migration'));
+});
+
+await ta('a flagged task with NO declared surface keeps halting — silence is not evidence', async () => {
+  for (const touches of [[], undefined]) {
+    const unknown = task({ id: 6, needs_migration: true, touches });
+    assert.equal(declaredSurfaceExcludesMigrations(unknown), false);
+    const reasons = haltReasons(unknown, { rank: 'metic', claimableIds: new Set([6]) });
+    assert.ok(reasons.some((r) => r.code === 'needs_migration'), `touches=${JSON.stringify(touches)}`);
+  }
+});
+
+await ta('a MODULE-OWNED migration counts — modules/<key>/migrations/ is real schema work here', async () => {
+  // ADR 0083 / docs/modules-contract.md: ten modules ship their own migrations.
+  // An anchored ^migrations/ test called these "not a migration" and suppressed
+  // the halt — and nothing else would have caught it, because the protected-path
+  // registry's own migrations/ glob is root-anchored too.
+  for (const p of [
+    'modules/economy/migrations/012_add_col.sql',
+    'modules/lifecycle/migrations/163_goal_dep_trigger.sql',
+    'src/db/migrations/x.sql',
+  ]) {
+    const real = task({ id: 7, needs_migration: true, touches: [p, 'src/x.js'] });
+    assert.equal(declaredSurfaceExcludesMigrations(real), false, p);
+    const reasons = haltReasons(real, { rank: 'metic', claimableIds: new Set([7]) });
+    assert.ok(reasons.some((r) => r.code === 'needs_migration'), `${p} must still halt`);
+  }
+});
+
+await ta('the migrations match reads a path SEGMENT, so a lookalike filename does not count', async () => {
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['./migrations/9.sql'] })), false);
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['Migrations/9.sql'] })), false);
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['modules\\economy\\migrations\\012.sql'] })), false);
+  // The word in a FILE name, with no migrations directory, is not schema work.
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['docs/migrations-guide.md'] })), true);
+  assert.equal(declaredSurfaceExcludesMigrations(task({ needs_migration: true, touches: ['docs/recipes/migrations.md'] })), true);
+});
+
 console.log(`\nsequence: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);