@bongos/core 1.19.673 → 1.19.674

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.673",
-  "core_contract": "1.19.673",
-  "source_commit": "9798ad8423cf89ef3bad579911f1f5ca8505e800",
+  "core_version": "1.19.674",
+  "core_contract": "1.19.674",
+  "source_commit": "0da6434caa66f679eeb8c34bc2be3826f2a1bfe8",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T18:16:55.232Z",
+  "built_at": "2026-09-11T18:40:06.671Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 474,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2121,
+    "functional_verbatim": 2122,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2619,
-  "tree_sha256": "3be80c1f6787508e21f11f1b391ce342ad0c0e3b570a6360bd00d3e5b5cfa417",
+  "file_count": 2620,
+  "tree_sha256": "984de9fdd6b42c1d4cf8728faad1a458ab08d8491957851e2874992610d4ae01",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -387,7 +387,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "e1d2929cc1373aca2d24879b9fbbbbfcd1ef77c850565aca7dba0130ff1ac43b"
+      "sha256": "d692cd6b80b1c286f6990a0ebcb3c109d51213b6cdc58cc7dc97fa52ff6fbe46"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1912,12 +1912,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "93eeff755bd089165265cf0f2c7f21e36803ff9519266512f834891d1ff6dc60"
+      "sha256": "4b396cff8505cdec44f4cb471c79c5e5af8e5446a04a3ecaad0cba5435677f9a"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "0d47d92e4e20e0f7d2a9ea9a1a4c643ed2e22103cd6ef5081377b22540993670"
+      "sha256": "8292a0f17190f803436bd3ae60f7ca36631d57b552c3553b6f5f2cdcd4eaffd9"
     },
     {
       "path": "docs/architecture.md",
@@ -2792,7 +2792,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "e1eb4883d1a25ac4b5b90ba00150f280c004569abeba0f9c0c4099982e587c6e"
+      "sha256": "0e8b8ccaf7913c7d40a59f5662da9dac4cbd8ec419df1e7ada549a26d1824f67"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5692,7 +5692,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "fb6503bdaf013a13752968844693cbf957484f033b9df27a66f93eacb91c2cfa"
+      "sha256": "5b2df46e54dbeb0694a805d9743df5da6fde90b73a76989e917257b7f78f8ed9"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -5747,7 +5747,7 @@
     {
       "path": "modules/lifecycle/goal-edits.js",
       "mode": "0000644",
-      "sha256": "09ca2631bfa979f5948b6b669cfe478cc67db3d4e1fbacd4c6f2bbd5ce0ec618"
+      "sha256": "f00d1bb6bd57624679295f33d55ad1d81a9479789a78d4325f13948b9559f9f5"
     },
     {
       "path": "modules/lifecycle/goal-rollup.js",
@@ -5872,7 +5872,7 @@
     {
       "path": "modules/lifecycle/routes/done-when.js",
       "mode": "0000644",
-      "sha256": "25b18aa82f5b2951f3a9560fa5285dc2793556303ed68ae0aa9ea781ec2d45c9"
+      "sha256": "9370fd1fc8a4a1ff864c1e85321b05a74bb45150ef8eb92cefdbbd85524bbe27"
     },
     {
       "path": "modules/lifecycle/routes/gate-approvals.js",
@@ -7767,12 +7767,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "dfc25c3b8365e868e5119aff5e8447d41b1983dbb9db9c2669e13f9259726629"
+      "sha256": "747c1f7d390c913bc71f93fa96ecc76f67aea4409a3265fdf6555ca91aac5c11"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "98edbd2fab2c33a96eebabd87c3c0c4dbd2f563fda40ca37bc737b186726fade"
+      "sha256": "59c1c75a1f396810212ad4654ac2dfd0f100e4c63fd3b2b7f5e11be22ce1a6fc"
     },
     {
       "path": "public-docs/index.html",
@@ -9532,7 +9532,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "6aaa55e88d207f52ea930ba86d7d292c06326cdcb7c08823dd225df4bff15e2f"
+      "sha256": "b2adf8fa055095fb344dad2ce76e3e0710ba0c23e3b5ccd68105b5daeded0390"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10284,6 +10284,11 @@
       "mode": "0000644",
       "sha256": "970db80cf43dba855bf9bd331434add458ab16e719f06710487094a3a578ec53"
     },
+    {
+      "path": "tests/criterion_goal_attach.mjs",
+      "mode": "0000644",
+      "sha256": "979589fd08dc41da3c837513452353aa87f7653620fad22c8a9115d4d7d13b90"
+    },
     {
       "path": "tests/criterion_progress.mjs",
       "mode": "0000644",

package/clients/bongos-client/index.d.ts

@@ -150,8 +150,8 @@ export interface PatchBuildersIdBudgetResponse { builder: unknown }
 export interface PatchBuildersIdRankRequest { rank: string }
 export interface PatchBuildersIdRankResponse { builder: unknown; previous_rank: unknown; direction: unknown; credit_delta: unknown; broadcast: unknown }
 export interface PatchBuildersIdStatusRequest { status: "active" | "inactive"; reason?: string }
-export interface PatchDoneWhenCriterionIdRequest { criterion_md: string }
-export interface PatchDoneWhenCriterionIdResponse { ok: boolean; criterion: unknown; deltas: unknown; unchanged: boolean }
+export interface PatchDoneWhenCriterionIdRequest { criterion_md?: string; goal_id?: number }
+export interface PatchDoneWhenCriterionIdResponse { ok: boolean; criterion: unknown; deltas: unknown; unchanged: unknown; achieved_goals: unknown }
 export interface PatchGoalsIdMembersBuilderIdRequest { membership_kind: string }
 export interface PatchGoalsIdMembersBuilderIdResponse { ok: boolean; member: unknown; changed: boolean }
 export interface PatchHelpRequestsIdRequest { status: "answered" | "withdrawn" }
@@ -650,7 +650,7 @@ export interface BongosClient {
   };
   "doneWhen": {
     /** PATCH /done-when/{criterionId} — rank: metic+archon */
-    patchDoneWhenCriterionId(args: RequestArgs & { body: PatchDoneWhenCriterionIdRequest }): Promise<PatchDoneWhenCriterionIdResponse>;
+    patchDoneWhenCriterionId(args?: RequestArgs & { body?: PatchDoneWhenCriterionIdRequest }): Promise<PatchDoneWhenCriterionIdResponse>;
     /** POST /done-when/{criterionId}/satisfy — rank: metic+archon */
     postDoneWhenCriterionIdSatisfy(args?: RequestArgs & { body?: PostDoneWhenCriterionIdSatisfyRequest }): Promise<ApiResponse>;
     /** POST /done-when/{criterionId}/unsatisfy — rank: metic+archon */

package/docs/api/openapi.json

@@ -4386,7 +4386,7 @@
           "done-when"
         ],
         "summary": "PATCH /done-when/:criterionId",
-        "description": "PATCH /done-when/:criterionId — correct a criterion's TEXT (task 1003102). Was write-once: this file exposed create, satisfy and unsatisfy and nothing else, so wrong text had no API repair path. The incident that forced it: a shell-quoting error stripped backtick-wrapped literals out of three criteria on goal 1000073 at CREATION time — the intent was recorded, the text was wrong, and the only channels were prod SQL or archiving the goal (worse: criteria are version-level rows, so an archived goal's criteria linger in the version rollup). A SATISFIED criterion is REFUSED, by name — see prose-edits.criterionProseRefusal for why that is a decision and not a limitation: a satisfied criterion is a claim someone verified, and re-wording it re-points that verification at text nobody checked. Unsatisfy → edit → re-satisfy makes the undo a recorded act. Gated like criterion CREATION — BOTH HALVES. The permission `criterion.create` is only the RANK floor; the sibling POST /versions/:id/done-when also runs authorizeCriterionCreate, the per-goal owner|manager wall (ADR 0154). Copying just the rank half would let any Metic rewrite criteria on a goal they neither own, manage, nor belong to — reusing the SAME pure gate is the only way the claim \"gated like creation\" is true. (Caught by the grader on the first cut of task 1003102: the comment said it, the code did half of it.) rank: metic+archon — matches POST /versions/:id/done-when.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `criterion.create` (all required).",
+        "description": "PATCH /done-when/:criterionId — amend a criterion's TEXT (task 1003102) and/or MOVE it between goals (task 1003509). Was write-once: this file exposed create, satisfy and unsatisfy and nothing else, so wrong text had no API repair path. The incident that forced it: a shell-quoting error stripped backtick-wrapped literals out of three criteria on goal 1000073 at CREATION time — the intent was recorded, the text was wrong, and the only channels were prod SQL or archiving the goal (worse: criteria are version-level rows, so an archived goal's criteria linger in the version rollup). A SATISFIED criterion is REFUSED, by name — see prose-edits.criterionProseRefusal for why that is a decision and not a limitation: a satisfied criterion is a claim someone verified, and re-wording it re-points that verification at text nobody checked. Unsatisfy → edit → re-satisfy makes the undo a recorded act. Gated like criterion CREATION — BOTH HALVES. The permission `criterion.create` is only the RANK floor; the sibling POST /versions/:id/done-when also runs authorizeCriterionCreate, the per-goal owner|manager wall (ADR 0154). Copying just the rank half would let any Metic rewrite criteria on a goal they neither own, manage, nor belong to — reusing the SAME pure gate is the only way the claim \"gated like creation\" is true. (Caught by the grader on the first cut of task 1003102: the comment said it, the code did half of it.) rank: metic+archon — matches POST /versions/:id/done-when. THE GOAL MOVE (task 1003509 — walk finding W5). `goal_id` used to be writable only by createCriterion's INSERT, so a criterion was born linked and stayed that way for life. The runner seeds a fresh instance's V1 criterion with NO goal — at standup there is no goal yet to name (provision-repo.js seedFirstVersionCmd) — so the owner's first goal could never adopt it: /progress showed the criterion \"(ungrouped)\" forever beside the goal it obviously belonged to, reporting `criteria: []`. Amending it took SQL, and a hub-provisioned owner has no SQL access at all. BOTH ENDS OF A MOVE ARE GATED, not just the goal it leaves. A move is a criterion write on the DESTINATION every bit as much as on the source, and gating only the source would let a goal's own owner push their criterion into a goal they have no authority over — a criterion being, per the CREATE route above, a thing that permanently blocks version close and goal auto-achieve with no delete route to undo it. So authorizeCriterionCreate runs against both and both must pass. DETACH (`goal_id: null`) has no destination, so it lands on that gate's goal-less branch and is Archon-only — the same wall that makes version-level criteria Archon-only at creation (ADR 0154), reached without a rule of its own. A SATISFIED criterion may still MOVE. criterionProseRefusal freezes the text of a verified claim, and that reasoning is about re-wording: moving one between goals changes how it is grouped, never what was checked. It is refused here only when the prose is what is changing. WHO CAN ADOPT THE SEEDED CRITERION. Because a goal-LESS criterion is version-level, the source gate's own goal-less branch makes ANY write to one Archon-only — which predates this task (a non-Archon could not edit an ungrouped criterion's prose either). That is not a wall in front of W5: the founder of a wizard-born instance IS its Archon, so the one criterion this was filed for is theirs to place. A Metic is unaffected where it matters — regrouping between two goals they already hold needs no escalation.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `criterion.create` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/done-when.js",
         "x-permissions": [
@@ -4404,7 +4404,7 @@
           }
         ],
         "requestBody": {
-          "required": true,
+          "required": false,
           "content": {
             "application/json": {
               "schema": {
@@ -18447,11 +18447,12 @@
             "type": "string",
             "minLength": 1,
             "maxLength": 10000
+          },
+          "goal_id": {
+            "type": "integer",
+            "minimum": 1
           }
         },
-        "required": [
-          "criterion_md"
-        ],
         "additionalProperties": false
       },
       "PatchDoneWhenCriterionIdResponse": {
@@ -18462,15 +18463,15 @@
           },
           "criterion": {},
           "deltas": {},
-          "unchanged": {
-            "type": "boolean"
-          }
+          "unchanged": {},
+          "achieved_goals": {}
         },
         "required": [
           "ok",
           "criterion",
           "deltas",
-          "unchanged"
+          "unchanged",
+          "achieved_goals"
         ]
       },
       "PatchGoalsIdMembersBuilderIdRequest": {

package/docs/api-reference.md

@@ -202,7 +202,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
-| PATCH | `/api/bongos/done-when/:criterionId` | `metic+archon` | `criterion_md` | PATCH /done-when/:criterionId — correct a criterion's TEXT (task 1003102). |
+| PATCH | `/api/bongos/done-when/:criterionId` | `metic+archon` | `criterion_md`, `goal_id` | PATCH /done-when/:criterionId — amend a criterion's TEXT (task 1003102) and/or MOVE it between goals (task 1003509). |
 | POST | `/api/bongos/done-when/:criterionId/satisfy` | `metic+archon` | `satisfied_by_task_id` | Auth (Metic+): confirm a criterion — flip it to satisfied. |
 | POST | `/api/bongos/done-when/:criterionId/unsatisfy` | `metic+archon` | — | Auth: flip a criterion back to unsatisfied (rare; for corrections). |
 | GET | `/api/bongos/done-when/pending-review` | `metic+archon` | — | Auth (Metic+): the criterion review queue — every criterion auto-flagged "met — pending review" (≥1 linked task, all shipped, not yet con… |

package/docs/module-api-changelog.md

@@ -1805,5 +1805,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.671 with no explicit bump. run 34629971417. (task 1002620)
   1.19.673 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.672 with no explicit bump. run 34632328471. (task 1002620)
+  1.19.674 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.673 with no explicit bump. run 34634515595. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-tasks.js

@@ -352,6 +352,27 @@ async function createCriterion({ versionId, criterionId, criterionMd, goalId = n
   return rows[0];
 }
 
+// updateCriterionGoal — move an EXISTING criterion into a goal, or out of one
+// (task 1003509). Criteria used to be born linked and stay that way: goal_id was
+// writable only in createCriterion's INSERT, so the runner-seeded V1 criterion a
+// fresh instance starts with could never join the goal it obviously belongs to,
+// and /progress showed it "(ungrouped)" forever beside a goal reporting
+// criteria: []. Amending it needed SQL, which a hub-provisioned owner has no
+// access to at all (walk finding W5).
+//
+// goalId null DETACHES (back to a version-level criterion). The caller owns every
+// question this raises — that the goal exists and sits on the criterion's own
+// version, who may write it, and whether the move completes the goal; this is the
+// UPDATE and nothing else, exactly as updateTaskGoal below is for tasks.
+async function updateCriterionGoal(id, goalId) {
+  const { rows } = await pool.query(
+    `UPDATE done_when_criteria SET goal_id = $1 WHERE id = $2
+     RETURNING id, version_id, criterion_id, criterion_md, goal_id, sort_order, satisfied`,
+    [goalId, id]
+  );
+  return rows[0] ?? null;
+}
+
 async function updateTaskGoal(id, goalId) {
   const { rows } = await pool.query(
     `UPDATE tasks SET goal_id = $1, updated_at = now() WHERE id = $2 RETURNING *`,
@@ -1034,6 +1055,7 @@ module.exports = {
   setCreditsReward,
   suggestCreditsReward,
   taskTouchesProtectedPath,
+  updateCriterionGoal,
   updateTaskAutomationTag,
   updateTaskDescription,
   updateTaskTitle,

package/modules/lifecycle/goal-edits.js

@@ -187,6 +187,39 @@ async function recordProseEdit(kind, id, req, deltas, deps = {}) {
   }
 }
 
+// recordCriterionGoalMove — the audit row for moving a criterion between goals
+// (task 1003509). Same reason recordProseEdit exists: the global write-audit
+// middleware records the request body, which carries the DESTINATION and nothing
+// else, so on its own the trail cannot say which goal the criterion left. For a
+// regrouping that is the half that matters — "criterion 12 joined goal 5" is not
+// recoverable without "…and left goal 3".
+//
+// A no-op move (same goal_id in and out) writes nothing, mirroring the empty-delta
+// short-circuit above. And an audit failure is logged, never thrown: the move has
+// already committed, so throwing here would report a failure that did not happen.
+async function recordCriterionGoalMove({ criterionId, fromGoalId, toGoalId }, req, deps = {}) {
+  const log = deps.log || ((m) => proseLog().info(m));
+  const from = fromGoalId ?? null;
+  const to = toGoalId ?? null;
+  if (from === to) return;
+  const builderId = req.builder && req.builder.id;
+  log(`criterion ${criterionId} moved by builder ${builderId}: goal ${from ?? '(none)'} -> ${to ?? '(none)'}`);
+  const insert = deps.insertAuditLog || api.insertAuditLog;
+  try {
+    await insert({
+      builderId,
+      route: `criterion:${criterionId}:goal-move`,
+      method: 'PATCH',
+      requestBodyRedacted: JSON.stringify({ from_goal_id: from, to_goal_id: to }),
+      responseStatus: 200,
+      ip: req.ip || null,
+      userAgent: (req.get && req.get('user-agent')) || null,
+    });
+  } catch (e) {
+    log(`[gds] AUDIT GAP: criterion ${criterionId} goal move landed but its audit row failed: ${e && e.message}`);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // WHY PATCH /goals/:id looks the way it does (kept here, not in the route:
 // routes/goals.js is over the fitness oversize threshold, so prose there is
@@ -332,6 +365,7 @@ module.exports = {
   criterionProseRefusal,
   goalAcceptingRequestsHandler,
   logProseEdit,
+  recordCriterionGoalMove,
   recordProseEdit,
   goalProseHandler,
   goalVisibilityHandler,

package/modules/lifecycle/routes/done-when.js

@@ -224,7 +224,7 @@ module.exports = function buildDoneWhenRouter() {
     });
   }, { errorCode: 'satisfy_failed' }));
 
-  // PATCH /done-when/:criterionId — correct a criterion's TEXT (task 1003102).
+  // PATCH /done-when/:criterionId — amend a criterion's TEXT (task 1003102) and/or MOVE it between goals (task 1003509).
   // Was write-once: this file exposed create, satisfy and unsatisfy and nothing
   // else, so wrong text had no API repair path. The incident that forced it: a
   // shell-quoting error stripped backtick-wrapped literals out of three criteria
@@ -246,31 +246,128 @@ module.exports = function buildDoneWhenRouter() {
   // claim "gated like creation" is true. (Caught by the grader on the first cut of
   // task 1003102: the comment said it, the code did half of it.)
   // rank: metic+archon — matches POST /versions/:id/done-when.
+  //
+  // THE GOAL MOVE (task 1003509 — walk finding W5). `goal_id` used to be writable
+  // only by createCriterion's INSERT, so a criterion was born linked and stayed
+  // that way for life. The runner seeds a fresh instance's V1 criterion with NO
+  // goal — at standup there is no goal yet to name (provision-repo.js
+  // seedFirstVersionCmd) — so the owner's first goal could never adopt it:
+  // /progress showed the criterion "(ungrouped)" forever beside the goal it
+  // obviously belonged to, reporting `criteria: []`. Amending it took SQL, and a
+  // hub-provisioned owner has no SQL access at all.
+  //
+  // BOTH ENDS OF A MOVE ARE GATED, not just the goal it leaves. A move is a
+  // criterion write on the DESTINATION every bit as much as on the source, and
+  // gating only the source would let a goal's own owner push their criterion into
+  // a goal they have no authority over — a criterion being, per the CREATE route
+  // above, a thing that permanently blocks version close and goal auto-achieve
+  // with no delete route to undo it. So authorizeCriterionCreate runs against both
+  // and both must pass. DETACH (`goal_id: null`) has no destination, so it lands
+  // on that gate's goal-less branch and is Archon-only — the same wall that makes
+  // version-level criteria Archon-only at creation (ADR 0154), reached without a
+  // rule of its own.
+  //
+  // A SATISFIED criterion may still MOVE. criterionProseRefusal freezes the text
+  // of a verified claim, and that reasoning is about re-wording: moving one
+  // between goals changes how it is grouped, never what was checked. It is
+  // refused here only when the prose is what is changing.
+  //
+  // WHO CAN ADOPT THE SEEDED CRITERION. Because a goal-LESS criterion is
+  // version-level, the source gate's own goal-less branch makes ANY write to one
+  // Archon-only — which predates this task (a non-Archon could not edit an
+  // ungrouped criterion's prose either). That is not a wall in front of W5: the
+  // founder of a wizard-born instance IS its Archon, so the one criterion this
+  // was filed for is theirs to place. A Metic is unaffected where it matters —
+  // regrouping between two goals they already hold needs no escalation.
   router.patch('/done-when/:criterionId', auth.requireBuilder, auth.requirePermission('criterion.create'), asyncHandler('PATCH /done-when/:criterionId', async (req, res) => {
     if (validateOrRespond(req, res, {
-      criterion_md: { required: true, type: 'string', minLength: 1, maxLength: LIMITS.NOTES },
+      criterion_md: { type: 'string', minLength: 1, maxLength: LIMITS.NOTES },
+      goal_id: { type: 'integer', min: 1 },
     })) return;
+    // `goal_id: null` is a DETACH and has to be told apart from an absent field, so
+    // the presence of the KEY decides, never its value. (The validator treats an
+    // explicit null as absent, which is why it validates at all.)
+    const movingGoal = Object.prototype.hasOwnProperty.call(req.body || {}, 'goal_id');
+    const changingProse = req.body.criterion_md != null;
+    if (!movingGoal && !changingProse) {
+      return res.fail('nothing_to_update', { status: 400, message: 'Send criterion_md, goal_id, or both.' });
+    }
     const id = parseId(req, res, { param: 'criterionId', code: 'bad_criterion_id' });
     if (id === null) return;
     const existing = await doneWhen.getCriterion(id);
     if (!existing) return res.fail('criterion_not_found', 404);
-    // The ownership wall, resolved exactly as the CREATE route resolves it: the
-    // criterion's OWN goal + version, and membership read only for a non-Archon.
-    const goal = existing.goal_id != null ? await db.getGoal(existing.goal_id) : null;
     const version = await db.getVersion(existing.version_id);
-    const actorMembership = (goal && req.builder.rank !== 'archon')
-      ? await db.getGoalMember({ goalId: goal.id, builderId: req.builder.id })
-      : null;
-    const authority = authorizeCriterionCreate({
-      goal, version, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
-    });
+    // The ownership wall, resolved exactly as the CREATE route resolves it: the
+    // goal + version, and membership read only for a non-Archon. One closure, so
+    // both ends of a move are decided by the same code rather than a copy.
+    const authorizeFor = async (goal) => {
+      const actorMembership = (goal && req.builder.rank !== 'archon')
+        ? await db.getGoalMember({ goalId: goal.id, builderId: req.builder.id })
+        : null;
+      return authorizeCriterionCreate({
+        goal, version, actorId: req.builder.id, actorRank: req.builder.rank, actorMembership,
+      });
+    };
+    const currentGoal = existing.goal_id != null ? await db.getGoal(existing.goal_id) : null;
+    const authority = await authorizeFor(currentGoal);
     if (!authority.ok) return res.status(authority.status).json(authority.body);
-    const refusal = goalEdits.criterionProseRefusal(existing);
-    if (refusal) return res.fail(refusal.code, refusal.status, refusal.message ? { message: refusal.message } : undefined);
-    const result = await goalEdits.updateCriterionProse({ criterionId: id, criterionMd: req.body.criterion_md });
-    if (!result) return res.fail('criterion_not_found', 404);
-    await goalEdits.recordProseEdit('criterion', id, req, result.deltas);
-    return res.json({ ok: true, criterion: result.criterion, deltas: result.deltas, unchanged: !!result.unchanged });
+
+    const targetGoalId = movingGoal ? (req.body.goal_id ?? null) : null;
+    if (movingGoal) {
+      let targetGoal = null;
+      if (targetGoalId !== null) {
+        targetGoal = await db.getGoal(targetGoalId);
+        // Same refusal the CREATE route gives, for the same reason: a criterion may
+        // never cross versions, which would put it in one version's rollup and the
+        // other's goal at once.
+        if (!targetGoal || String(targetGoal.version_id) !== String(existing.version_id)) {
+          return res.fail('bad_goal_id', { status: 400, message: `goal_id ${targetGoalId} does not exist on version '${existing.version_id}'.` });
+        }
+      }
+      const destination = await authorizeFor(targetGoal);
+      if (!destination.ok) return res.status(destination.status).json(destination.body);
+    }
+
+    let criterion = existing;
+    let deltas = [];
+    let unchanged = false;
+    if (changingProse) {
+      const refusal = goalEdits.criterionProseRefusal(existing);
+      if (refusal) return res.fail(refusal.code, refusal.status, refusal.message ? { message: refusal.message } : undefined);
+      const result = await goalEdits.updateCriterionProse({ criterionId: id, criterionMd: req.body.criterion_md });
+      if (!result) return res.fail('criterion_not_found', 404);
+      await goalEdits.recordProseEdit('criterion', id, req, result.deltas);
+      criterion = result.criterion;
+      deltas = result.deltas;
+      unchanged = !!result.unchanged;
+    }
+    const achievedGoals = [];
+    const fromGoalId = existing.goal_id ?? null;
+    // A move to where it already is writes nothing at all — not the row, not the
+    // audit, not a re-derive. Nothing about the world changed.
+    if (movingGoal && fromGoalId !== targetGoalId) {
+      const moved = await db.updateCriterionGoal(id, targetGoalId);
+      if (!moved) return res.fail('criterion_not_found', 404);
+      criterion = moved;
+      await goalEdits.recordCriterionGoalMove(
+        { criterionId: id, fromGoalId, toGoalId: targetGoalId }, req
+      );
+      // BOTH ENDS are re-derived, because a move changes what each of them still
+      // needs. The destination is the obvious half — adopting an already-satisfied
+      // criterion can be the thing that completes a goal. The SOURCE is the half
+      // that is easy to miss and just as real: taking an UNSATISFIED criterion out
+      // of a goal can leave every criterion that remains satisfied, which is that
+      // goal completing. Skipping it would leave a goal silently open that nothing
+      // will ever close again — no later ship re-checks it, because no task under
+      // it changed. achieveGoalIfComplete is conservative and idempotent (open
+      // goals only, and it never un-achieves), so asking twice is two reads.
+      for (const goalId of [fromGoalId, targetGoalId]) {
+        if (goalId === null) continue;
+        const outcome = await db.achieveGoalIfComplete({ goalId });
+        if (outcome && outcome.achieved) achievedGoals.push(goalId);
+      }
+    }
+    return res.json({ ok: true, criterion, deltas, unchanged, achieved_goals: achievedGoals });
   }, { errorCode: 'criterion_update_failed' }));
 
   // Auth: flip a criterion back to unsatisfied (rare; for corrections).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.673",
+  "version": "1.19.674",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.673",
+      "version": "1.19.674",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.673",
+  "version": "1.19.674",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.673'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.674'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/criterion_goal_attach.mjs

@@ -0,0 +1,347 @@
+// tests/criterion_goal_attach.mjs
+//
+// Route-level proof that an EXISTING criterion can join a goal, leave one, and
+// that BOTH ends of the move are walled (task 1003509 — walk finding W5).
+//
+// WHY THE ROUTE AND NOT THE PREDICATE. tests/criterion_authoring_gate.mjs already
+// pins authorizeCriterionCreate as a pure decision. The defect this file exists to
+// catch is one layer up and invisible there: a move is a criterion write on the
+// DESTINATION goal as much as on the source, so gating only the goal it leaves
+// would let a goal's own owner push their criterion into a goal they hold no
+// authority over. That failure passes every pure-gate test — the gate is correct,
+// it is simply not asked twice. This route's own history records the same shape
+// once already ("the comment said it, the code did half of it", task 1003102).
+//
+// So this runs the REAL Express router with the data layer and the auth gate
+// stubbed at the module boundary — the tests/task_visual_route_gate.mjs pattern.
+// No DB, no network, no session.
+//
+// Run:  node tests/criterion_goal_attach.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+
+const express = require('express');
+const api = require('../src/module-api.js');
+
+// The REAL updateCriterionGoal SQL runs here, against a recording pool. That
+// matters: db-tasks.js destructures `pool` off the doorway at REQUIRE time and
+// takes no deps seam (its siblings createCriterion/updateTaskGoal take none
+// either, and growing one just for a test would make this function the odd one
+// out), so the pool has to be replaced BEFORE the first require below. Stubbing
+// db.updateCriterionGoal instead would leave its SQL with no coverage at all —
+// a mutation that made the UPDATE write nothing stayed green until this landed.
+const sqlLog = [];
+Object.defineProperty(api, 'pool', {
+  configurable: true,
+  value: {
+    query: async (sql, params) => {
+      sqlLog.push({ sql, params });
+      if (/UPDATE done_when_criteria/.test(sql)) {
+        const [goalId, id] = params;
+        criterion = { ...criterion, id: Number(id), goal_id: goalId };
+        return { rows: [{ ...criterion }] };
+      }
+      throw new Error(`unexpected SQL reached the pool: ${sql}`);
+    },
+  },
+});
+
+const db = require('../modules/lifecycle/db.js');
+const doneWhen = require('../modules/lifecycle/done-when.js');
+const goalEdits = require('../modules/lifecycle/goal-edits.js');
+
+// ---- the world the route sees ---------------------------------------------
+const V1 = 'INST-V1';
+const V2 = 'INST-V2';
+const ARCHON = { id: 900, rank: 'archon' };
+const METIC = { id: 700, rank: 'metic' };
+
+let actor = METIC;
+let criterion = null;
+const goals = new Map();
+let calls = {};
+let completable = new Set();
+
+function resetWorld() {
+  actor = METIC;
+  completable = new Set([3]);
+  sqlLog.length = 0;
+  calls = { achieve: [], auditMove: [], prose: [] };
+  // Derived from the SQL the real updateCriterionGoal actually sent, as
+  // [criterionId, goalId] — so "nothing was written" means no UPDATE reached the
+  // pool, not merely that a stub went uncalled.
+  Object.defineProperty(calls, 'updateGoal', {
+    get: () => sqlLog
+      .filter((q) => /UPDATE done_when_criteria/.test(q.sql))
+      .map((q) => [Number(q.params[1]), q.params[0]]),
+  });
+  // The shape a wizard-born instance actually starts with: seeded under V1 by
+  // provision-repo.js, belonging to no goal because none existed at standup.
+  criterion = { id: 55, version_id: V1, criterion_id: 'first-goal', criterion_md: 'ship something', goal_id: null, satisfied: false, sort_order: 10 };
+  goals.clear();
+  //                        id           version    status   created_by (owner)
+  goals.set(3, { id: 3, version_id: V1, status: 'open', created_by: METIC.id });
+  goals.set(4, { id: 4, version_id: V1, status: 'open', created_by: 999 });   // someone else's
+  goals.set(9, { id: 9, version_id: V2, status: 'open', created_by: METIC.id }); // another version
+}
+
+// ---- stubs at the module boundary -----------------------------------------
+api.requireBuilder = (req, _res, next) => { req.builder = actor; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+
+doneWhen.getCriterion = async (id) => (criterion && criterion.id === Number(id) ? { ...criterion } : null);
+db.getVersion = async (id) => ({ id, status: 'building' });
+db.getGoal = async (id) => (goals.has(Number(id)) ? { ...goals.get(Number(id)) } : null);
+db.getGoalMember = async () => null;  // membership is never the path under test; ownership is
+// NOT stubbed — db.updateCriterionGoal is the real one, running its real SQL
+// against the pool above. `calls.updateGoal` is derived from what that SQL sent.
+db.achieveGoalIfComplete = async ({ goalId }) => {
+  calls.achieve.push(goalId);
+  // Which goals a re-derive would actually complete is per-test — BOTH ends of a
+  // move can be completed by it, and which one matters is the point.
+  return { achieved: completable.has(Number(goalId)), goal: goals.get(Number(goalId)) ?? null };
+};
+goalEdits.recordCriterionGoalMove = async (move) => { calls.auditMove.push(move); };
+goalEdits.updateCriterionProse = async ({ criterionId, criterionMd }) => {
+  calls.prose.push([criterionId, criterionMd]);
+  criterion = { ...criterion, criterion_md: criterionMd };
+  return { criterion: { ...criterion }, deltas: [{ field: 'criterion_md' }], unchanged: false };
+};
+goalEdits.recordProseEdit = async () => {};
+
+const buildRouter = require('../modules/lifecycle/routes/done-when.js');
+
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => {
+  res.fail = (code, status, extra) => {
+    const s = typeof status === 'number' ? status : (status && status.status) || 500;
+    return res.status(s).json({ error: code, ...(extra && typeof extra === 'object' ? extra : {}) });
+  };
+  next();
+});
+app.use(buildRouter());
+
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const base = `http://127.0.0.1:${server.address().port}`;
+
+async function patch(body) {
+  const res = await fetch(`${base}/done-when/55`, {
+    method: 'PATCH',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => ({})) };
+}
+
+let passed = 0, failed = 0;
+async function test(name, fn) {
+  resetWorld();
+  try { await fn(); console.log(`  ok  ${name}`); passed++; }
+  catch (err) { console.error(`  FAIL ${name}\n     ${err.message}`); failed++; }
+}
+
+// ---------------------------------------------------------------------------
+
+await test('the ungrouped V1 criterion joins a goal — the W5 fix', async () => {
+  // The founder of a wizard-born instance IS its Archon, which is what makes the
+  // W5 case reachable: a goal-LESS criterion is version-level, and ADR 0154 keeps
+  // version-level criteria Archon-only. That predates this task — the same gate
+  // already refused a non-Archon PROSE edit on an ungrouped criterion.
+  actor = ARCHON;
+  const r = await patch({ goal_id: 3 });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.equal(r.body.criterion.goal_id, 3);
+  assert.deepEqual(calls.updateGoal, [[55, 3]]);
+});
+
+await test('BOTH ends are gated: owning the source does not license the destination', async () => {
+  // The criterion already sits in goal 3, which METIC owns. Goal 4 is someone
+  // else's. Gating only the source would let this through — that is the defect.
+  criterion.goal_id = 3;
+  const r = await patch({ goal_id: 4 });
+  assert.equal(r.status, 403, `expected the destination wall, got ${r.status} ${JSON.stringify(r.body)}`);
+  assert.equal(r.body.error, 'goal_not_yours');
+  assert.deepEqual(calls.updateGoal, [], 'nothing was written');
+});
+
+await test('a METIC moves a criterion between two goals they own — no Archon needed', async () => {
+  // The other half of the W5 fix: regrouping WITHIN a workspace someone already
+  // holds needs no escalation. Goal 7 is a second goal owned by the same Metic.
+  goals.set(7, { id: 7, version_id: V1, status: 'open', created_by: METIC.id });
+  criterion.goal_id = 3;
+  const r = await patch({ goal_id: 7 });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.equal(r.body.criterion.goal_id, 7);
+  assert.deepEqual(calls.auditMove, [{ criterionId: 55, fromGoalId: 3, toGoalId: 7 }]);
+});
+
+await test('a criterion may never cross versions', async () => {
+  actor = ARCHON;
+  const r = await patch({ goal_id: 9 });   // goal 9 lives on V2, the criterion on V1
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error, 'bad_goal_id');
+  assert.deepEqual(calls.updateGoal, []);
+});
+
+await test('an absent goal is the same refusal as a foreign-version one', async () => {
+  actor = ARCHON;
+  const r = await patch({ goal_id: 4242 });
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error, 'bad_goal_id');
+});
+
+await test('DETACH is Archon-only — it lands on the gate\'s goal-less branch (ADR 0154)', async () => {
+  criterion.goal_id = 3;
+  const denied = await patch({ goal_id: null });
+  assert.equal(denied.status, 403);
+  assert.equal(denied.body.error, 'goal_id_required');
+  assert.deepEqual(calls.updateGoal, []);
+
+  actor = ARCHON;
+  const allowed = await patch({ goal_id: null });
+  assert.equal(allowed.status, 200, JSON.stringify(allowed.body));
+  assert.equal(allowed.body.criterion.goal_id, null);
+  assert.deepEqual(calls.updateGoal, [[55, null]]);
+});
+
+await test('a SATISFIED criterion still moves — only its text is frozen', async () => {
+  actor = ARCHON;
+  criterion.satisfied = true;
+  const moved = await patch({ goal_id: 3 });
+  assert.equal(moved.status, 200, JSON.stringify(moved.body));
+  assert.equal(moved.body.criterion.goal_id, 3);
+
+  const reworded = await patch({ criterion_md: 'something else' });
+  assert.equal(reworded.status, 409);
+  assert.equal(reworded.body.error, 'criterion_satisfied');
+  assert.deepEqual(calls.prose, [], 'the frozen text was never written');
+});
+
+await test('adopting a criterion that completes the goal reports the achievement', async () => {
+  actor = ARCHON;
+  const r = await patch({ goal_id: 3 });
+  assert.equal(r.status, 200);
+  assert.deepEqual(calls.achieve, [3], 'the destination is re-derived, not assumed');
+  assert.equal(r.body.achieved_goals.includes(3), true);
+});
+
+await test('leaving a goal can COMPLETE it — the source is re-derived too', async () => {
+  // The half that is easy to miss: pulling an UNSATISFIED criterion out of goal 3
+  // can leave everything still in goal 3 satisfied. Nothing else would ever close
+  // it — no later ship re-checks that goal, because no task under it changed.
+  actor = ARCHON;
+  criterion.goal_id = 3;
+  completable = new Set([3]);          // the goal it LEAVES is the one that completes
+  const r = await patch({ goal_id: 4 });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.deepEqual(calls.achieve, [3, 4], 'both ends re-derived, source first');
+  assert.deepEqual(r.body.achieved_goals, [3]);
+});
+
+await test('a DETACH still re-derives the goal it left', async () => {
+  actor = ARCHON;
+  criterion.goal_id = 3;
+  completable = new Set([3]);
+  const r = await patch({ goal_id: null });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.deepEqual(calls.achieve, [3], 'no destination, but the source still counts');
+  assert.deepEqual(r.body.achieved_goals, [3]);
+});
+
+await test('a move that completes BOTH ends reports both', async () => {
+  actor = ARCHON;
+  criterion.goal_id = 3;
+  completable = new Set([3, 4]);
+  const r = await patch({ goal_id: 4 });
+  assert.deepEqual(r.body.achieved_goals, [3, 4]);
+});
+
+await test('a no-op move writes nothing at all', async () => {
+  actor = ARCHON;
+  criterion.goal_id = 3;
+  const r = await patch({ goal_id: 3 });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.deepEqual(calls.updateGoal, [], 'no UPDATE reached the pool');
+  assert.deepEqual(calls.auditMove, [], 'nothing to audit');
+  assert.deepEqual(calls.achieve, [], 'nothing changed, so nothing to re-derive');
+});
+
+await test('a DETACH from a goal-less criterion is also a no-op', async () => {
+  actor = ARCHON;
+  const r = await patch({ goal_id: null });
+  assert.equal(r.status, 200);
+  assert.deepEqual(calls.updateGoal, []);
+});
+
+await test('a DETACH re-derives no DESTINATION — there is none to complete', async () => {
+  actor = ARCHON;
+  criterion.goal_id = 3;
+  completable = new Set();             // nothing completes; only the CALL shape is under test
+  const r = await patch({ goal_id: null });
+  assert.equal(r.status, 200);
+  assert.deepEqual(calls.achieve, [3], 'the source, and only the source');
+  assert.equal(r.body.achieved_goals.length, 0);
+});
+
+await test('the move is audited with the goal it LEFT, which the request body cannot show', async () => {
+  criterion.goal_id = 3;
+  actor = ARCHON;
+  await patch({ goal_id: 4 });
+  assert.deepEqual(calls.auditMove, [{ criterionId: 55, fromGoalId: 3, toGoalId: 4 }]);
+});
+
+await test('prose and goal move in one call: both land, and the response carries both', async () => {
+  actor = ARCHON;
+  const r = await patch({ criterion_md: 'reworded', goal_id: 3 });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.deepEqual(calls.prose, [[55, 'reworded']]);
+  assert.deepEqual(calls.updateGoal, [[55, 3]]);
+  // The goal move happens last, so the returned row must carry BOTH changes —
+  // returning the prose result here would report goal_id as it was before.
+  assert.equal(r.body.criterion.goal_id, 3);
+  assert.equal(r.body.criterion.criterion_md, 'reworded');
+});
+
+await test('an empty patch is refused rather than silently doing nothing', async () => {
+  const r = await patch({});
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error, 'nothing_to_update');
+});
+
+await test('prose-only editing is unchanged (the pre-existing contract)', async () => {
+  actor = ARCHON;
+  const r = await patch({ criterion_md: 'clearer wording' });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.deepEqual(calls.prose, [[55, 'clearer wording']]);
+  assert.deepEqual(calls.updateGoal, [], 'an absent goal_id never touches the linkage');
+  assert.ok(Array.isArray(r.body.deltas) && r.body.deltas.length === 1);
+});
+
+await test('the UPDATE sets goal_id from the parameter, keyed by criterion id', async () => {
+  // What a recording pool CAN prove is the statement, not its execution — there is
+  // no Postgres in this lane. So pin the shape: a SET that writes the bound
+  // parameter (not the column back onto itself), keyed by id, RETURNING the row
+  // the route hands back. Without this, `SET goal_id = goal_id` is a silent no-op
+  // that every behavioural test above still passes, because they read the row this
+  // fake returns rather than one a database wrote.
+  actor = ARCHON;
+  await patch({ goal_id: 3 });
+  const update = sqlLog.find((q) => /UPDATE done_when_criteria/.test(q.sql));
+  assert.ok(update, 'the move reached the pool at all');
+  const sql = update.sql.replace(/\s+/g, ' ').trim();
+  assert.match(sql, /SET goal_id = \$1\b/, 'writes the bound parameter, not the column onto itself');
+  assert.match(sql, /WHERE id = \$2\b/, 'keyed by the criterion id');
+  assert.match(sql, /RETURNING\b[^;]*\bgoal_id\b/, 'returns the moved row, so the response cannot go stale');
+  assert.deepEqual(update.params, [3, 55]);
+});
+
+await new Promise((r) => server.close(r));
+console.log(`\ncriterion_goal_attach: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);