@bongos/core 1.19.660 → 1.19.662

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.660'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.662'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/goal_sort_staleness.mjs

@@ -202,7 +202,18 @@ await test('a server-side filter change RE-FETCHES; every other filter stays ins
   // direct question anyway, and means a control absent from that query can never
   // cost a round-trip.
   assert.match(WORK_SRC, /let lastServerFilterQuery = '';/);
-  assert.match(WORK_SRC, /if \(q !== lastServerFilterQuery\) \{[\s\S]{0,200}refreshLive\(\);\s*\n\s*loadBacklog\(\);/);
+  // task 1003828 split this into ONE DECISION PER FEED. It used to be a single
+  // comparison that re-fetched both and returned early — which was fine while the
+  // two asked the server the same question, and wrong once the backlog started
+  // asking a narrower one (version/kind/discipline/goal_id, which GET /tasks
+  // answers and GET /tasks/claimable does not). The early return also meant a
+  // change to a CLIENT-side lens skipped the other tab's re-render until the next
+  // poll repainted it. Each side now re-fetches or re-renders on its own; the
+  // property under test is unchanged — a server-facing change costs a round-trip
+  // and nothing else does.
+  assert.match(WORK_SRC, /let lastBacklogQuery = '';/);
+  assert.match(WORK_SRC, /if \(q !== lastServerFilterQuery\) \{ lastServerFilterQuery = q; refreshLive\(\); \} else \{ renderClaimable\(\); \}/);
+  assert.match(WORK_SRC, /if \(bq !== lastBacklogQuery\) \{ lastBacklogQuery = bq; loadBacklog\(\); \} else \{ renderBacklog\(\); \}/);
   const kit = read('modules/hall-ui/public/hall-kit.js');
   assert.match(kit, /if \(onChange\) onChange\(values\(\)\);/,
     'the contract this decision depends on — if it ever hands the changed id instead, revisit');

package/tests/government_ownership_scope.mjs

@@ -40,6 +40,7 @@ const {
   PERMISSIONS, RANK_ORDER, RANK_SEED, RESOURCE_FAMILIES, permissionKeys, byKey,
   scopeOf, resourceOf, isOwnershipScoped, isCrossOwner, ownershipScopedKeys, crossOwnerKeys,
   crossOwnerKeysFor, isPrincipalKey, seedForRank,
+  OWNERSHIP_VERBS, VERB_DOMINANCE, verbDominates, verbOf,
 } = catalog;
 const {
   sameOwner, authorizeOwned, authorizeOwnedOrAny, builderHasPermissions, effectivePermissions,
@@ -106,12 +107,24 @@ test('A3: the modelled families are the ones the ownership sweep names', () => {
   // The cross-owner side is NOT derivable from spelling: box's is `box.fleet.manage`.
   assert.deepEqual([...crossOwnerKeys()].sort(),
     ['box.fleet.manage', 'claim.release.any', 'memory.read.any']);
-  assert.deepEqual(crossOwnerKeysFor('task.act.own'), ['claim.release.any']);
+  // The escalation path is DECLARED per key, never derived from the resource
+  // family (task 1003195). box is the one REAL pair in the catalog today:
+  // `box.fleet.manage` is the same `manage` verb over every owner's box, so it
+  // genuinely subsumes managing your own.
   assert.deepEqual(crossOwnerKeysFor('box.manage.own'), ['box.fleet.manage']);
+  // claim and memory each HAVE an `any` key in their family and still declare no
+  // counterpart — the distinction the family-derived version could not make.
+  // `claim.release.any` carries one third of `act` (release, not cost or notes);
+  // `memory.read.any` is a read, and reading every builder's memory is not the
+  // authority to manage one. A family-derived answer returned both.
+  assert.deepEqual(crossOwnerKeysFor('task.act.own'), []);
+  assert.deepEqual(crossOwnerKeysFor('memory.manage.own'), []);
   // Some resources have NO cross-owner form by design — nobody manages another
   // builder's credential, Archon included.
   assert.deepEqual(crossOwnerKeysFor('credential.manage.own'), []);
   assert.deepEqual(crossOwnerKeysFor('nope.not.a.key'), []);
+  // A cross-owner key is not itself own-scoped, so it has no path of its own.
+  assert.deepEqual(crossOwnerKeysFor('claim.release.any'), []);
 });
 
 test('A4: RESOURCE_FAMILIES is frozen and agrees with each row it lists', () => {
@@ -246,20 +259,112 @@ test('C5: builderHasPermissions REFUSES an ownership-scoped key rather than answ
 
 // ═══ D — `.any` DOES reach another builder's resource ═════════════════════════
 
-test('D1: the cross-owner key reaches a row the caller does not own', async () => {
-  await holding(['task.act.own', 'claim.release.any'], async () => {
-    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: SOMEONE_ELSE }), true,
-      'claim.release.any is exactly the authority to act on someone else\'s claim');
-    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: ME }), true);
+test('D1: a DECLARED cross-owner counterpart reaches a row the caller does not own', async () => {
+  // box is the catalog's one real pair, and it must keep working: `box.fleet.manage`
+  // is the whole point of a cross-owner key. Asserted BOTH with and without the own
+  // key, because the counterpart is a standalone admit — it does not merely widen a
+  // grant the builder already has.
+  await holding(['box.manage.own', 'box.fleet.manage'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: SOMEONE_ELSE }), true,
+      'box.fleet.manage is exactly the authority to manage someone else\'s box');
+    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: ME }), true);
   });
+  await holding(['box.fleet.manage'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: SOMEONE_ELSE }), true);
+  });
+});
+
+// ═══ D1b — a cross-owner key with a WEAKER VERB is not a counterpart ═══════════
+//
+// task 1003195, from the task-1002671 adversarial verification (finding 12). The
+// admit branch used to hand back the resource family's whole `any` list VERB-BLIND,
+// so any cross-owner key over the resource satisfied EVERY own key over it. The
+// escalation is now a per-key declaration checked for verb dominance at load.
+//
+// ORACLE DISCIPLINE, per this file's header: these two cases are driven by holding
+// the weak `any` key ALONE. The old D1 always held the own key TOO, so the admit it
+// recorded could have come from either branch — which is exactly why the defect sat
+// unpinned. Holding only the weak key leaves the counterpart branch as the sole
+// possible source of a `true`.
+test('D1b: a weaker-verb cross-owner key does not satisfy an own key', async () => {
+  // A READ grant over every builder's memory is not the authority to MANAGE one.
+  await holding(['memory.read.any'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: SOMEONE_ELSE }), false,
+      'memory.read.any reads every memory; it does not manage another builder\'s');
+  });
+  // `act` is a BUNDLE (release + cost + notes); `claim.release.any` carries the
+  // release third only, so it must not admit the other two against someone else.
+  await holding(['claim.release.any'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: SOMEONE_ELSE }), false,
+      'claim.release.any releases a claim; it does not post costs or notes on one');
+  });
+  // Holding the own key as well changes nothing about the OTHER owner's row — the
+  // shape the old D1 asserted as an admit.
   await holding(['memory.manage.own', 'memory.read.any'], async () => {
-    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: SOMEONE_ELSE }), true);
+    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: SOMEONE_ELSE }), false);
+    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: ME }), true,
+      'the own branch is untouched — your own row is still yours');
   });
-  await holding(['box.manage.own', 'box.fleet.manage'], async () => {
-    assert.equal(await authorizeOwnedOrAny(ME, 'box.manage.own', { ownerId: SOMEONE_ELSE }), true);
+  await holding(['task.act.own', 'claim.release.any'], async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: SOMEONE_ELSE }), false);
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: ME }), true);
+  });
+  // And the strongest form: EVERY permission in the catalog still does not reach
+  // another owner's memory or claim, because nothing in it dominates those verbs.
+  await holding(EVERYTHING, async () => {
+    assert.equal(await authorizeOwnedOrAny(ME, 'memory.manage.own', { ownerId: SOMEONE_ELSE }), false,
+      'no key in the catalog dominates memory.manage.own');
+    assert.equal(await authorizeOwnedOrAny(ME, 'task.act.own', { ownerId: SOMEONE_ELSE }), false,
+      'no key in the catalog dominates task.act.own');
   });
 });
 
+// The declaration itself, held against the verb rule that admits it. This is the
+// catalog-level twin of D1b: it fails if a future edit declares a counterpart whose
+// verb does not dominate, even before any resolver call exercises it.
+test('D1c: every declared counterpart is cross-owner, same-resource, and verb-dominant', () => {
+  let declared = 0;
+  for (const p of PERMISSIONS) {
+    if (p.scope !== 'own') continue;
+    assert.ok(Array.isArray(p.counterpart),
+      `${p.key} is own-scoped and must declare counterpart explicitly`);
+    assert.ok(OWNERSHIP_VERBS.includes(p.verb), `${p.key} must declare a known verb`);
+    assert.equal(verbOf(p.key), p.verb, 'verbOf must agree with the row it reads');
+    for (const key of p.counterpart) {
+      declared++;
+      const c = byKey(key);
+      assert.ok(c, `${p.key} names counterpart ${key}, which must exist`);
+      assert.equal(c.scope, 'any', `${p.key}'s counterpart ${key} must be cross-owner`);
+      assert.equal(c.resource, p.resource, `${p.key}'s counterpart ${key} must share its resource`);
+      assert.ok(verbDominates(c.verb, p.verb),
+        `${p.key}'s counterpart ${key} (verb ${c.verb}) must dominate verb ${p.verb}`);
+    }
+  }
+  assert.ok(declared >= 1, 'expected at least the box pair to be declared');
+  // A verb never dominates a wider one, and an unknown verb fails closed — the
+  // relation is asserted directly so a future edit to the table is caught here.
+  assert.equal(verbDominates('manage', 'read'), true);
+  assert.equal(verbDominates('manage', 'act'), true);
+  assert.equal(verbDominates('read', 'read'), true);
+  assert.equal(verbDominates('read', 'manage'), false);
+  assert.equal(verbDominates('release', 'act'), false);
+  assert.equal(verbDominates('act', 'manage'), false);
+  assert.equal(verbDominates('manage', 'nonsense'), false);
+  assert.equal(verbDominates(null, 'manage'), false);
+  // The table is the whole relation: only `manage` subsumes anything, and it is the
+  // one verb nothing else dominates. Pinned so a widening needs a deliberate edit.
+  assert.deepEqual(Object.keys(VERB_DOMINANCE), ['manage']);
+  for (const v of OWNERSHIP_VERBS) {
+    assert.equal(verbDominates('manage', v), true, `manage must dominate ${v}`);
+    if (v !== 'manage') {
+      assert.equal(verbDominates(v, 'manage'), false, `${v} must not dominate manage`);
+    }
+  }
+  // An unscoped key has no verb at all — the axis only means something with a scope.
+  assert.equal(verbOf('cost.log'), null);
+  assert.equal(verbOf('nope.not.a.key'), null);
+});
+
 test('D2: holding only the OWN key never reaches someone else, in either entry point', async () => {
   for (const [, fam] of PAIRED) {
     for (const ownKey of fam.own) {
@@ -354,7 +459,7 @@ test('F3: a cross-owner key cheaper than its own-scoped counterpart throws at mo
   assert.throws(
     () => loadMutatedCatalog('inverted floors', (s) => s.replace(
       `  { key: 'goal.manage.own',`,
-      `  { key: 'goal.manage.any', system: false, floor: 'xenos', scope: 'any', resource: 'goal', guards: 'fixture' },\n  { key: 'goal.manage.own',`)),
+      `  { key: 'goal.manage.any', system: false, floor: 'xenos', scope: 'any', resource: 'goal', verb: 'manage', guards: 'fixture' },\n  { key: 'goal.manage.own',`)),
     /must never be cheaper than own-only/,
   );
 });
@@ -363,11 +468,87 @@ test('F4: a cross-owner key with no ownership-scoped counterpart throws at modul
   assert.throws(
     () => loadMutatedCatalog('lone any', (s) => s.replace(
       `  { key: 'goal.manage.own',`,
-      `  { key: 'widget.manage.any', system: false, floor: 'archon', scope: 'any', resource: 'widget', guards: 'fixture' },\n  { key: 'goal.manage.own',`)),
+      `  { key: 'widget.manage.any', system: false, floor: 'archon', scope: 'any', resource: 'widget', verb: 'manage', guards: 'fixture' },\n  { key: 'goal.manage.own',`)),
     /with no ownership-scoped counterpart/,
   );
 });
 
+// F5–F8 are task 1003195's half: the counterpart declaration and its verb rule.
+// Same harness, so what is proven is the SHIPPED assertion block. Each fixture
+// reintroduces the exact defect the task was filed for, or a near neighbour of it.
+
+test('F5: a counterpart whose verb does not dominate throws at module load', () => {
+  // The literal finding-12 defect: memory.read.any declared as the escalation path
+  // for memory.manage.own — a read grant admitting a write on another owner's row.
+  assert.throws(
+    () => loadMutatedCatalog('weak verb counterpart', (s) => s.replace(
+      `resource: 'memory', verb: 'manage', counterpart: []`,
+      `resource: 'memory', verb: 'manage', counterpart: ['memory.read.any']`)),
+    /does not dominate/,
+  );
+  // And its sibling: release is one third of act.
+  assert.throws(
+    () => loadMutatedCatalog('partial verb counterpart', (s) => s.replace(
+      `resource: 'claim', verb: 'act', counterpart: []`,
+      `resource: 'claim', verb: 'act', counterpart: ['claim.release.any']`)),
+    /does not dominate/,
+  );
+});
+
+test('F6: an own-scoped key that declares no counterpart at all throws at module load', () => {
+  // The fail-loud that replaces the silent family derivation: a new own key cannot
+  // inherit an escalation path merely by belonging to a resource.
+  assert.throws(
+    () => loadMutatedCatalog('missing counterpart', (s) => s.replace(
+      `resource: 'credential', verb: 'manage', counterpart: []`,
+      `resource: 'credential', verb: 'manage'`)),
+    /must declare counterpart/,
+  );
+});
+
+test('F7: a counterpart that is dangling, cross-resource, or not cross-owner throws', () => {
+  assert.throws(
+    () => loadMutatedCatalog('dangling counterpart', (s) => s.replace(
+      `resource: 'credential', verb: 'manage', counterpart: []`,
+      `resource: 'credential', verb: 'manage', counterpart: ['credential.manage.any']`)),
+    /not a permission in this catalog/,
+  );
+  assert.throws(
+    () => loadMutatedCatalog('cross-resource counterpart', (s) => s.replace(
+      `resource: 'credential', verb: 'manage', counterpart: []`,
+      `resource: 'credential', verb: 'manage', counterpart: ['box.fleet.manage']`)),
+    /never crosses resource families/,
+  );
+  assert.throws(
+    () => loadMutatedCatalog('own key as counterpart', (s) => s.replace(
+      `resource: 'box', verb: 'manage', counterpart: ['box.fleet.manage']`,
+      `resource: 'box', verb: 'manage', counterpart: ['memory.manage.own']`)),
+    /is not cross-owner/,
+  );
+});
+
+test('F8: the verb field itself is partitioned with scope and checked against the vocabulary', () => {
+  assert.throws(
+    () => loadMutatedCatalog('scope without verb', (s) => s.replace(
+      `resource: 'builder_prefs', verb: 'set', counterpart: []`,
+      `resource: 'builder_prefs', counterpart: []`)),
+    /scope and verb must come together/,
+  );
+  assert.throws(
+    () => loadMutatedCatalog('unknown verb', (s) => s.replace(
+      `resource: 'builder_prefs', verb: 'set', counterpart: []`,
+      `resource: 'builder_prefs', verb: 'obliterate', counterpart: []`)),
+    /unknown verb/,
+  );
+  // A counterpart on a key that has no owner axis is a mis-declaration, not a no-op.
+  assert.throws(
+    () => loadMutatedCatalog('counterpart on an any key', (s) => s.replace(
+      `resource: 'memory', verb: 'read', guards:`,
+      `resource: 'memory', verb: 'read', counterpart: [], guards:`)),
+    /is not own-scoped/,
+  );
+});
+
 // ═══ G — the R94/R95/R98 invariants this slice must not have disturbed ════════
 
 test('G1: the seed is still floor-derived and cumulative — the ownership axis adds no grants', () => {

package/tests/hall_board_world.mjs

@@ -471,3 +471,106 @@ test('the tab strip is left alone — it scrolls in its own row and never moved
   assert.ok(strip, 'the tab strip rule is present');
   assert.match(strip[1], /overflow-x:\s*auto/, 'it scrolls itself, which is why it is not the overflow cause');
 });
+
+// ---- the board's filters drive BOTH queue tabs (task 1003828) ---------------
+//
+// The owner reported an auto-filed artist review as "going into uncategorized
+// BONGOS-V2 backlog tasks" and asked for tasks to be "filterable by role type".
+// The review was never uncategorised — cascade.js inherits its parent's goal —
+// but the Backlog tab it lands on could not say so and could not be narrowed:
+//
+//   * renderBacklog() applied the SEARCH BOX ONLY. Version, Goal, Kind,
+//     Discipline, Newcomer and Run mode were read inside renderClaimable and
+//     nowhere else, so six controls were silently inert over the tab holding the
+//     most rows. Nothing errored; the list simply did not change.
+//   * The filter bar was INSIDE #claim-scroll, which makeTabs hides. So on the
+//     Backlog tab those controls were not merely inert — they were off-screen.
+//   * A backlog row rendered id + title + version + rank + kind. No goal, no
+//     discipline. A correctly-goaled task genuinely read as uncategorised.
+//
+// Each is invisible in a browser the way this file's other entries are: the page
+// renders, it just renders a control that does nothing.
+
+const workJs = read('work.js');
+
+test('the filter bar is above the panels, not inside the Ready one that gets hidden', () => {
+  const filters = workHtml.indexOf('id="work-filters"');
+  const tabs = workHtml.indexOf('id="work-tabs"');
+  const claim = workHtml.indexOf('id="claim-scroll"');
+  assert.ok(filters > 0 && tabs > 0 && claim > 0, 'all three mounts present');
+  assert.ok(filters > tabs, 'the bar follows the tab strip it belongs to');
+  assert.ok(filters < claim,
+    'and precedes the Ready panel — inside it, makeTabs hides the filters with the tab');
+});
+
+test('the bar shows on the two QUEUE tabs and hides on the two that it cannot narrow', () => {
+  assert.match(workJs, /const FILTERED_TABS = new Set\(\['ready', 'backlog'\]\)/,
+    'Ready and Backlog are task feeds; In Progress and Completed render other objects');
+  assert.match(workJs, /function syncFilterBarVisibility/);
+  // Wired BOTH ways: on a tab change, and once at boot — makeTabs restores a
+  // deep-linked tab (/work#completed) before the bar is built, and fires
+  // onChange only on a CHANGE, so opening state has to be set explicitly.
+  assert.match(workJs, /onChange: \(id\) => \{[\s\S]{0,160}syncFilterBarVisibility\(id\)/,
+    'a tab change re-syncs the bar');
+  assert.match(workJs, /syncFilterBarVisibility\(workTabs && workTabs\.active \? workTabs\.active\(\) : 'ready'\)/,
+    'and the opening tab decides the opening state');
+});
+
+test('both queue tabs narrow through ONE predicate, so a filter cannot reach only one', () => {
+  assert.match(workJs, /function matchesBoardFilters\(t, f\)/,
+    'the predicate is shared, not copied per tab');
+  // Both renderers must consult it. This is the whole defect: before, only the
+  // claimable one did.
+  const claimable = workJs.slice(workJs.indexOf('function renderClaimable'), workJs.indexOf('async function populateCreatorFilter'));
+  const backlog = workJs.slice(workJs.indexOf('function renderBacklog'), workJs.indexOf('async function refreshLive'));
+  for (const [name, body] of [['renderClaimable', claimable], ['renderBacklog', backlog]]) {
+    assert.ok(body.length, `${name} body located`);
+    assert.match(body, /matchesBoardFilters\(t, filters\)/, `${name} narrows through the shared predicate`);
+    assert.match(body, /applyRunMode\(list, \$\('#f-fit'\)/, `${name} applies the set-relative run-mode lens too`);
+  }
+});
+
+test('a backlog row names its craft and its goal', () => {
+  const backlog = workJs.slice(workJs.indexOf('function renderBacklog'));
+  // The same vocabulary the Ready card has carried since 1755 — a second spelling
+  // would let the two tabs describe one task differently.
+  assert.match(backlog, /const discipline = t\.discipline \|\| 'unclassified'/);
+  assert.match(backlog, /disciplineTag/, 'the row renders the discipline tag');
+  assert.match(backlog, /taskState\.goalTitles \|\| \{\}/, 'the goal is named by TITLE, not by bare id');
+  assert.match(backlog, /'No goal'/, 'and a goal-less row says so rather than rendering a gap');
+  assert.ok(rule(workCss, '.history__goal'), '.history__goal has a rule — an unstyled sub-line inherits the title size');
+});
+
+test('the backlog asks the SERVER the narrow question, because its read is capped', () => {
+  // A client-side-only narrow of a capped read LIES: filtering the 500 fetched
+  // rows to the artist ones hides the artist tasks that sat at row 501.
+  assert.match(workJs, /function backlogFilterQuery/);
+  const q = workJs.slice(workJs.indexOf('function backlogFilterQuery'), workJs.indexOf('BACKLOG_LIMIT ='));
+  for (const param of ['version=', 'kind=', 'discipline=', 'goal_id=']) {
+    assert.ok(q.includes(param), `the backlog read sends ${param} — GET /tasks answers it`);
+  }
+  // '__none__' (ungoaled) has no server predicate, so it must not be sent.
+  assert.match(q, /f\.goal && f\.goal !== '__none__'/,
+    "the client-only 'No goal' lens is never sent to the route");
+  // It reads through boardFilterValues rather than re-querying the DOM, so the
+  // query and the client predicate can never disagree about a control's value.
+  assert.match(q, /const f = boardFilterValues\(\);/);
+  // And it stays SEPARATE from the claimable query: GET /tasks/claimable answers
+  // only version + discipline, so kind/goal_id there would be a silent no-op.
+  const claimQ = workJs.slice(workJs.indexOf('function serverFilterQuery'), workJs.indexOf('task 1003828 — the BACKLOG'));
+  assert.ok(!claimQ.includes('goal_id='), 'the claimable feed is not sent goal_id');
+  assert.ok(!claimQ.includes('kind='), 'nor kind');
+});
+
+test('each feed decides its own re-fetch, so a server change cannot strand the other tab', () => {
+  // The old shape compared ONE query and returned early, which left the other
+  // tab's client-side lenses unapplied until the next poll happened to repaint.
+  assert.match(workJs, /if \(q !== lastServerFilterQuery\) \{ lastServerFilterQuery = q; refreshLive\(\); \} else \{ renderClaimable\(\); \}/);
+  assert.match(workJs, /if \(bq !== lastBacklogQuery\) \{ lastBacklogQuery = bq; loadBacklog\(\); \} else \{ renderBacklog\(\); \}/);
+});
+
+test('the Goal filter offers goals that only have BACKLOG work', () => {
+  const populate = workJs.slice(workJs.indexOf('function populateGoalFilter'), workJs.indexOf('async function copyPromptForTask'));
+  assert.match(populate, /\[\.\.\.taskState\.all, \.\.\.\(taskState\.backlog \|\| \[\]\)\]/,
+    'built from the claimable feed alone, a backlog-only goal was unofferable');
+});