@bongos/core 1.19.786 → 1.19.787

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.786",
-  "core_contract": "1.19.786",
-  "source_commit": "785c921afb48af049814782f27929cc27885667c",
+  "core_version": "1.19.787",
+  "core_contract": "1.19.787",
+  "source_commit": "b32b78533de72aa607032c7eeea369d98103ef3b",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T22:20:27.767Z",
+  "built_at": "2026-09-16T22:32:51.862Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 483,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2668,
-  "tree_sha256": "3d454ef4a876f5368603708cbe4f13b53dc57a854dc03e217285b327b6dd0bf9",
+  "tree_sha256": "6633332cd057cd360e74849250fa2f7ab2458f7f683c8c6315c4820d19d06ac7",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -207,7 +207,7 @@
     {
       "path": ".claude/skills/planning-session/SKILL.md",
       "mode": "0000644",
-      "sha256": "8ed3e62213268015e49ad180d9f9c0c3c875867b392e93430a9850962a70455b"
+      "sha256": "ede2aa15718bff19d38ffa7f42d64bae7490a9025f7e85d43c43306da3f611b6"
     },
     {
       "path": ".claude/skills/priority-session/SKILL.md",
@@ -2512,7 +2512,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "580f9ae0d3677bc11fe335f73027c314edd8633f2397cd71400e07725a8f4a03"
+      "sha256": "3c0fb2e250b9dca8299cae204683c9fb815421e52206b44472b94952d7e61ede"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5447,7 +5447,7 @@
     {
       "path": "modules/lifecycle/db-deps-criteria.js",
       "mode": "0000644",
-      "sha256": "04406d383068e42eafed42fa51cf9108df2907f0807b1ed7bcd0abc9eaf7bfb7"
+      "sha256": "2fefa2efa05b2a63ee510345180c04d211d5068c8bc82c050392dac3d02cfac2"
     },
     {
       "path": "modules/lifecycle/db-goals.js",
@@ -5737,12 +5737,12 @@
     {
       "path": "modules/lifecycle/routes/task-write-routes.js",
       "mode": "0000644",
-      "sha256": "b821b384c67c5182f52653a283674da62756885c4fa5cf6790cea5eccd688f49"
+      "sha256": "9cff3bcd27467dc413aa975cd20262b47e8595a50a845d93b557a24828719bbf"
     },
     {
       "path": "modules/lifecycle/routes/tasks.js",
       "mode": "0000644",
-      "sha256": "3c4bbd0b62fbef12e8511bfcbaae22fa677fc956b83423a8f213207fc1062c90"
+      "sha256": "0497ab99a5c13399617b43f70d775e77773f1eed259548433f19c20c708ebab9"
     },
     {
       "path": "modules/lifecycle/routes/version-route-authz.js",
@@ -7622,12 +7622,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "a08e66b825d352b3b0c128f3b5b71d4665183bf734d69d0e837adf8946a28f19"
+      "sha256": "c99209b9bfd8f2191eb0e622e45d4875760a65c7ae4f8653758667e11bd0bb66"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9f9dfe9f5f8cc3d3ebc1cd46909eb73ac9ef03046933478f391cb6c23680cfa6"
+      "sha256": "fae2586d07f9b98f2631be427db59eb76c7149b49a01c404af51a40edde911a3"
     },
     {
       "path": "public-docs/index.html",
@@ -8702,7 +8702,7 @@
     {
       "path": "scripts/gds/seed-bongos-v1-idea-routing-tasks.js",
       "mode": "0000644",
-      "sha256": "d028e80a7c1cd85805954187e43ec32d624244bf9b3374b4f27c5d47ced79f95"
+      "sha256": "fc30acb5a295289c446b5fd7dd79bcd4e2ba8a3b90bbe1c426fecc087bbefadd"
     },
     {
       "path": "scripts/gds/seed-bongos-v1-seo-tasks.js",
@@ -8727,7 +8727,7 @@
     {
       "path": "scripts/gds/seed-bv1-profiles-tasks.js",
       "mode": "0000644",
-      "sha256": "a1101fcbb8988a19bd34f5c80789b8d69e421907be4c6143f6052e594c0b6944"
+      "sha256": "53353029323de1e200b11bceccf822f524a19ff857cf17f6fa4b1ada73408c40"
     },
     {
       "path": "scripts/gds/seed-bv1-r01-delta-tasks.js",
@@ -9492,7 +9492,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0eb65d596ccf4f9af9cb2ec8769e373c18f3148b93e785157895d4dbb94299c7"
+      "sha256": "37250a4442445fd5b73d199d17c2646944e633f7816a366ef7f6477168c6c2bd"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10342,7 +10342,7 @@
     {
       "path": "tests/criterion_ref_parse.mjs",
       "mode": "0000644",
-      "sha256": "8eca863d641ce68a3edad2b902ecc15e9ec64c14fb420418a463461f29e44ff1"
+      "sha256": "80ce711abf62a78dc4f36b513b852a5396173a2ff50e5deab2460531d17911e4"
     },
     {
       "path": "tests/criterion_suggest.mjs",

package/.claude/skills/planning-session/SKILL.md

@@ -172,7 +172,7 @@ Don't tunnel-vision. Surface lateral options the user might not have thought of:
 - **Criteria (done-when)** — the goal's criteria verbatim by slug (C1, C2, …); every task links to one.
 - **Design decisions & assumptions** — what we're committing to and why; note grounding from the codebase (existing modules/tables/routes to reuse). Starts from your best defaults; the Phase-4 interview fills and revises this.
 - **Open questions (for the interview)** — the non-obvious decisions still unresolved, each with why-it-matters + the options you see. This is the raw material for Phase 4; empty it as answers land.
-- **Task outline** — grouped by criterion (and phase, if phased), one row per task: `R## · kind · title · one-line done-when · deps:[R##] · criterion_ids:[Cn]`, tagged `[E]`/`[I]`/`[N]`. Mark **spikes** (needs-exploration) and **proofs** (the live demo per criterion).
+- **Task outline** — grouped by criterion (and phase, if phased), one row per task: `R## · kind · title · one-line done-when · deps:[R##] · criterion_ids:[<criterion-slug>]`, tagged `[E]`/`[I]`/`[N]`. Mark **spikes** (needs-exploration) and **proofs** (the live demo per criterion).
 - **Dependency graph & ranking** — filled in Phase 4 (topo order + priority tiers).
 - **Out of scope** — what this goal explicitly does NOT do, so the interview and tasks stay bounded.
 
@@ -269,10 +269,10 @@ Once the spec is finalized (Phase 4), **read `docs/specs/<ver>-<goal-slug>.md` a
    - **Migration** at `migrations/<NN>_<ver_slug>_planning_seed.sql` (CORE — platform-universal, non-scope-truth changes only): `UPDATE versions SET done_when = ...` and `UPDATE tasks` for existing-task priority + V##.R## title prefix (guarded by `WHERE title NOT LIKE 'V<ver>.R%'`). **Do NOT put versions/goals/`done_when_criteria` INSERTs here** — that's scope-truth and fails the `selfhost-boot` gate (ADR 0105).
 
 3. **Write a seed script** at `scripts/gds/seed-<ver_slug>-tasks.js` modeled on `scripts/gds/seed-v3-tasks.js` containing:
-   - The TASKS array — one entry per net-new task with full description, kind, discipline, priority, est_minutes, manual_degree, credits_reward, **optional** `touches` (see below), optional `promoted_idea_id`, `depends_on_refs: ['R##', ...]` (the dep edges captured during brainstorm), AND **`criterion_ids: ['Cn', ...]`** — the done-when criterion(s) this task gates. The brainstorm in Phase 3 is already grouped by criterion, so this is just transcribing that grouping. Use the positional `"Cn"` token (C1 = the version's first criterion); the server resolves it against the task's version at create (ADR 0025 / task 438). **This replaces the old `**Criterion:** Cn` prose** — don't write that line anymore; pass `criterion_ids` instead so the task is linked in `task_criteria` at creation and `/status` counts it with no backfill.
+   - The TASKS array — one entry per net-new task with full description, kind, discipline, priority, est_minutes, manual_degree, credits_reward, **optional** `touches` (see below), optional `promoted_idea_id`, `depends_on_refs: ['R##', ...]` (the dep edges captured during brainstorm), AND **`criterion_ids: ['Cn', ...]`** — the done-when criterion(s) this task gates. The brainstorm in Phase 3 is already grouped by criterion, so this is just transcribing that grouping. **Use the criterion_id SLUG, not a positional `"Cn"` token.** `Cn` ranks over the whole VERSION's criteria, so on a version holding more than one goal it resolves to some other goal's criterion — which is how all 15 tasks of goal 1000071 were mislinked while the seed printed success (learning 1000188). Since task 1003108 the server **refuses** a positional ref on a multi-goal version (`400 ambiguous_criterion_ref`) rather than guessing, so a slug is the only ref that works there. The server resolves it against the task's version at create (ADR 0025 / task 438). **This replaces the old `**Criterion:** Cn` prose** — don't write that line anymore; pass `criterion_ids` instead so the task is linked in `task_criteria` at creation and `/status` counts it with no backfill.
    - **`touches` is now OPTIONAL (task 882 / [ADR 0049](../../../docs/adr/0049-split-parallel-safety-contract.md)).** Omit it (or leave it blank) unless you already know a tight file set and want the advisory overlap signal during the brainstorm. At first `/builder-ship` the server backfills `touches[]` from the real committed diff — the declared set becomes what git actually reported. Don't burn planning effort predicting file lists; a rough or absent prediction is fine and no longer ship-blocking.
    - **`requires_rank` AUTO-DERIVES — you don't hand-set it per task (task [#1498](https://example.com/builders#/task/1498) / [ADR 0084](../../../docs/adr/0084-auto-derived-per-task-rank-floor.md)).** On create the server floors a task at `metic` when it is `security_sensitive` or its `touches` reach the permission / authz / ship-grade / deploy / migration core (the same protected paths a sub-Metic builder can't push to); everything else stays the open `xenos` default. To deliberately gate a task **higher** than the auto-floor (e.g. owner-only work), pass `requires_rank: 'metic' | 'archon'` on the task — it can only RAISE the floor, never drop below it.
-   - **Pass `goal_id: <gid>` on each task** so it lands under its goal (not the version's default catch-all). `POST /tasks` now honors `goal_id` (validated to belong to the version); to move an already-created task, `PATCH /tasks/:id` with `{goal_id}` (task 1763). `criterion_ids` accepts a **slug** (the `criterion_id` you set above), a `"Cn"` position, or a numeric id — the slug is position-independent and cleanest.
+   - **Pass `goal_id: <gid>` on each task** so it lands under its goal (not the version's default catch-all). `POST /tasks` now honors `goal_id` (validated to belong to the version); to move an already-created task, `PATCH /tasks/:id` with `{goal_id}` (task 1763). `criterion_ids` accepts a **slug** (the `criterion_id` you set above), a numeric id, or a `"Cn"` position — **but `Cn` is rejected outright once the version holds a second goal**, and a version almost always gains one. Treat the slug as the only form you write.
    - A main() that POSTs each task **with its `criterion_ids`** (idempotent on `source_ref`; the criterion links are inserted at create, idempotent on `(task_id, criterion_id)`), PATCHes `idea_inbox` for promotions, and after all tasks exist, POSTs `task_dependencies` via `POST /tasks/:id/dependencies` (resolving each R## to the just-created task ID). Idempotent on `(task_id, depends_on_task_id)`. (Need to re-attribute an already-seeded task? `POST /tasks/:id/criteria` with `{criterion_ids:['Cn',...]}`; `DELETE /tasks/:id/criteria/:criterionId` to detach — both Metic+ ([ADR 0090](../../../docs/adr/0090-metic-task-authoring.md)), mirroring the dependency endpoints.)
 
 > **Seeding contract — validated on goal 1000045 (2026-07-16):** proof-tasks use `kind='verify'` (a deliverable that IS a verification; can't be prematurely confirmed), spikes `kind='spike'`; `POST /tasks` accepts `criterion_ids` + `goal_id` inline and disciplines include `ui`; there is **no `promoted_idea_id`** field on `POST /tasks` — mark a promoted idea via `PATCH /inbox/:id`; **descoping a criterion has no API** (done-when is create/satisfy/unsatisfy only) — remove the row via a direct DB delete (`ssh … "sudo -u postgres psql -d <db> -c \"DELETE FROM done_when_criteria WHERE id=…\""`) under the meta-task claim, capturing the SQL in its notes; and a seed script **must throttle + honor `429` `retry_after`** (per-IP rate limit) — add a base delay between calls and back off on 429, or a large seed dies halfway. A completed reference seed: `scripts/gds/<redacted>.js`.

package/docs/module-api-changelog.md

@@ -2046,5 +2046,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.784 with no explicit bump. run 35156349018. (task 1002620)
   1.19.786 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.785 with no explicit bump. run 35157132070. (task 1002620)
+  1.19.787 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.786 with no explicit bump. run 35158163962. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-deps-criteria.js

@@ -286,13 +286,26 @@ function parseCriterionRef(raw) {
 }
 
 // Resolve an array of refs to done_when_criteria.id values within a version.
-// Returns { ids: [unique numeric ids, first-appearance order], unresolved: [refs] }.
-
-async function resolveCriterionIds(versionId, refs) {
+// Returns { ids: [unique numeric ids, first-appearance order], unresolved: [refs],
+// ambiguous: [positional refs refused because the version holds >1 goal] }.
+//
+// WHY ambiguous exists (task 1003108). A positional "Cn" ranks over the WHOLE
+// version's criteria. That is unambiguous only while the version holds ONE goal:
+// add a second and the "C1" a planner reads off a per-goal spec silently resolves
+// to some other goal's criterion — a wrong link, not an error. It mislinked all 15
+// tasks of goal 1000071 (2026-08-17, learning 1000188) and the seed still printed
+// success. Task 1003076 added the after-the-fact tally that catches the symptom;
+// this refuses the ref at the write, so the mislink cannot be created. Slugs are
+// position-independent and stay legal on every version, which is why the skill now
+// requires them. `executor` is the same testability seam countTasksWithoutCriterionLink
+// uses — a fake SQL-recording client needs no live Postgres.
+
+async function resolveCriterionIds(versionId, refs, executor = pool) {
   const ids = [];
   const unresolved = [];
-  if (!Array.isArray(refs) || refs.length === 0) return { ids, unresolved };
-  const { rows } = await pool.query(
+  const ambiguous = [];
+  if (!Array.isArray(refs) || refs.length === 0) return { ids, unresolved, ambiguous };
+  const { rows } = await executor.query(
     `SELECT id, criterion_id,
             ROW_NUMBER() OVER (ORDER BY sort_order, criterion_id) AS cnum
        FROM done_when_criteria
@@ -302,17 +315,31 @@ async function resolveCriterionIds(versionId, refs) {
   const byId = new Set(rows.map((r) => Number(r.id)));
   const byCnum = new Map(rows.map((r) => [Number(r.cnum), Number(r.id)]));
   const bySlug = new Map(rows.map((r) => [String(r.criterion_id), Number(r.id)]));
+  // Only pay for the goal count when a positional ref is actually present — the
+  // slug path (the one the skill now requires) costs no extra query.
+  let multiGoal = false;
+  if (refs.some((r) => parseCriterionRef(r).kind === 'cnum')) {
+    const { rows: g } = await executor.query(
+      'SELECT COUNT(*)::int AS n FROM goals WHERE version_id = $1',
+      [versionId]
+    );
+    multiGoal = Number(g[0] ? g[0].n : 0) > 1;
+  }
   const seen = new Set();
   for (const raw of refs) {
     const p = parseCriterionRef(raw);
     let id = null;
-    if (p.kind === 'cnum') id = byCnum.get(p.n) ?? null;
-    else if (p.kind === 'id') id = byId.has(p.id) ? p.id : null;
+    if (p.kind === 'cnum') {
+      // Refuse rather than guess: resolving it would produce a plausible-looking
+      // wrong link that no later check attributes to the ref.
+      if (multiGoal) { ambiguous.push(String(raw).trim()); continue; }
+      id = byCnum.get(p.n) ?? null;
+    } else if (p.kind === 'id') id = byId.has(p.id) ? p.id : null;
     else id = bySlug.get(p.slug) ?? null;
     if (id == null) { unresolved.push(String(raw).trim()); continue; }
     if (!seen.has(id)) { seen.add(id); ids.push(id); }
   }
-  return { ids, unresolved };
+  return { ids, unresolved, ambiguous };
 }
 
 // countTasksWithoutCriterionLink — task 1003157's DONE WHEN item 2: the count of

package/modules/lifecycle/routes/task-write-routes.js

@@ -62,8 +62,9 @@ module.exports = function registerTaskWriteRoutes(router) {
       requires_rank: { type: 'string', maxLength: 16 },  // task 1498 / ADR 0084 — per-task rank floor (auto-derived; explicit value can only raise it)
       auto_detect_touches: { type: 'boolean' },
       // task 438: link the new task to done-when criteria at creation time. Each
-      // element is a numeric done_when_criteria.id, a positional "Cn" token, or a
-      // criterion_id slug — resolved against this task's version below (ADR 0025).
+      // element is a criterion_id slug (required on a multi-goal version — task
+      // 1003108), a numeric done_when_criteria.id, or a positional "Cn" token —
+      // resolved against this task's version below (ADR 0025).
       criterion_ids: { type: 'array', maxItems: 100 },
       // BV1.R53 (task 1422): module affinity label. Drives module-disjointness at
       // claim time and diff⊆module drift detection at ship time.
@@ -119,7 +120,10 @@ module.exports = function registerTaskWriteRoutes(router) {
     // is unambiguous and a numeric id from another version doesn't resolve.
     let criterionIdsResolved = [];
     if (Array.isArray(body.criterion_ids) && body.criterion_ids.length > 0) {
-      const { ids, unresolved } = await db.resolveCriterionIds(body.version_id, body.criterion_ids);
+      const { ids, unresolved, ambiguous } = await db.resolveCriterionIds(body.version_id, body.criterion_ids);
+      if (ambiguous.length > 0) {
+        return res.fail('ambiguous_criterion_ref', { status: 400, message: `Version '${body.version_id}' holds more than one goal, so a positional "Cn" ref ranks over the WHOLE version's criteria — not this goal's — and would link to the wrong criterion silently (task 1003108). Re-send these as criterion_id slugs: ${ambiguous.join(', ')}.`, details: { ambiguous } });
+      }
       if (unresolved.length > 0) {
         return res.fail('bad_criterion_ref', { status: 400, message: `These criterion refs don't match any criterion of version '${body.version_id}': ` +
             `${unresolved.join(', ')}. Use a numeric done_when_criteria.id, a "Cn" position, or a criterion_id slug.`, details: { unresolved } });

package/modules/lifecycle/routes/tasks.js

@@ -452,7 +452,10 @@ module.exports = function buildTasksRouter() {
 
     const task = await db.getTask(id);
     if (!task) return res.fail('task_not_found', 404);
-    const { ids, unresolved } = await db.resolveCriterionIds(task.version_id, refs);
+    const { ids, unresolved, ambiguous } = await db.resolveCriterionIds(task.version_id, refs);
+    if (ambiguous.length > 0) {
+      return res.fail('ambiguous_criterion_ref', { status: 400, message: `Version '${task.version_id}' holds more than one goal, so a positional "Cn" ref ranks over the WHOLE version's criteria — not this goal's — and would link to the wrong criterion silently (task 1003108). Re-send these as criterion_id slugs: ${ambiguous.join(', ')}.`, details: { ambiguous } });
+    }
     if (unresolved.length > 0) {
       return res.fail('bad_criterion_ref', { status: 400, message: `These criterion refs don't match any criterion of version '${task.version_id}': ${unresolved.join(', ')}.`, details: { unresolved } });
     }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.786",
+  "version": "1.19.787",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.786",
+      "version": "1.19.787",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.786",
+  "version": "1.19.787",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/seed-bongos-v1-idea-routing-tasks.js

@@ -1,3 +1,10 @@
+// DO NOT COPY THE `crit:` TOKENS FROM THIS FILE (task 1003108) — copy its
+// verifySeedCriteriaLinks tail instead, which is what this script is cited for.
+// Its positional "Cn" refs rank over the whole VERSION's criteria, so on a
+// multi-goal version they resolve to another goal's criterion silently (learning
+// 1000188). POST /tasks now refuses a positional ref there (400
+// ambiguous_criterion_ref). A new seed uses criterion_id SLUGS.
+//
 // Seed the tasks for goal 1000071 "Idea routing — work that has a home lands in it" (BONGOS-V1).
 // Source of truth: docs/specs/bongos-v1-idea-routing.md (status: final).
 // Idempotent on (source, source_ref). Re-running resolves to the existing rows.

package/scripts/gds/seed-bv1-profiles-tasks.js

@@ -1,3 +1,12 @@
+// DO NOT COPY THE `crit:` TOKENS FROM THIS FILE (task 1003108). Its positional
+// "Cn" refs were written when BONGOS-V1 held one goal, where they were unambiguous.
+// Cn ranks over the whole VERSION's criteria, so on a multi-goal version it resolves
+// to another goal's criterion silently — that is how all 15 tasks of goal 1000071 were
+// mislinked (learning 1000188). POST /tasks now refuses a positional ref on a
+// multi-goal version (400 ambiguous_criterion_ref). A new seed uses criterion_id
+// SLUGS. This file is kept as-is because it has already run and is idempotent on
+// source_ref — a re-run returns the existing rows before criterion resolution.
+//
 // Seed the tasks for goal 1000045 "Public builder profiles" (BONGOS-V1, internal).
 // Source of truth: docs/specs/bongos-v1-public-builder-profiles.md (status: final).
 // Idempotent on (source, source_ref). Re-running resolves to the existing rows.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.786'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.787'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/criterion_ref_parse.mjs

@@ -6,8 +6,10 @@
 //   - a numeric done_when id     → { kind: 'id', id }
 //   - a criterion_id slug        → { kind: 'slug', slug }
 // resolveCriterionIds itself is DB-backed (it ranks a version's criteria), so the
-// parsing rule — the part that decides what a token MEANS — is what's unit-tested
-// here without a database. Run: node tests/criterion_ref_parse.mjs
+// parsing rule — the part that decides what a token MEANS — is unit-tested here
+// without a database. Task 1003108 added a second block covering resolveCriterionIds
+// itself through its executor seam: a positional "Cn" must be REFUSED once the
+// version holds more than one goal. Run: node tests/criterion_ref_parse.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
@@ -49,5 +51,82 @@ test('a "Cn" embedded in a longer string does NOT match (anchored)', () => {
   assert.equal(db.parseCriterionRef('see C8 above').kind, 'slug');
 });
 
-console.log(`\ncriterion ref parse (task 438) tests: ${passed} passed, ${failed} failed`);
-process.exit(failed > 0 ? 1 : 0);
+// --- resolveCriterionIds: the multi-goal refusal (task 1003108) -------------
+// resolveCriterionIds is DB-backed, but it takes an `executor` seam (the one
+// countTasksWithoutCriterionLink uses), so a fake SQL-recording client covers the
+// rule without Postgres. The rule: a positional "Cn" ranks over the WHOLE
+// version's criteria, so once a version holds a second goal it silently resolves
+// to another goal's criterion — the shape that mislinked all 15 tasks of goal
+// 1000071. It must come back as `ambiguous`, never as an id.
+
+function fakeExecutor(goalCount) {
+  const seen = [];
+  return {
+    seen,
+    async query(sql, params) {
+      seen.push(sql);
+      if (/FROM goals/.test(sql)) return { rows: [{ n: goalCount }] };
+      return { rows: [
+        { id: 501, criterion_id: 'first-slug', cnum: 1 },
+        { id: 502, criterion_id: 'second-slug', cnum: 2 },
+      ] };
+    },
+  };
+}
+
+async function atest(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+async function main() {
+  await atest('a positional "Cn" resolves on a SINGLE-goal version', async () => {
+    const r = await db.resolveCriterionIds('V9', ['C2'], fakeExecutor(1));
+    assert.deepEqual(r.ids, [502]);
+    assert.deepEqual(r.ambiguous, []);
+    assert.deepEqual(r.unresolved, []);
+  });
+
+  await atest('a positional "Cn" is REFUSED on a multi-goal version', async () => {
+    const r = await db.resolveCriterionIds('V9', ['C2'], fakeExecutor(2));
+    assert.deepEqual(r.ids, [], 'must not resolve to an id — refusing is the whole point');
+    assert.deepEqual(r.ambiguous, ['C2']);
+    assert.deepEqual(r.unresolved, [], 'ambiguous is not the same failure as unknown');
+  });
+
+  await atest('slugs still resolve on a multi-goal version', async () => {
+    const r = await db.resolveCriterionIds('V9', ['second-slug'], fakeExecutor(2));
+    assert.deepEqual(r.ids, [502]);
+    assert.deepEqual(r.ambiguous, []);
+  });
+
+  await atest('a mixed list refuses only the positional ref', async () => {
+    const r = await db.resolveCriterionIds('V9', ['first-slug', 'C2', '502'], fakeExecutor(2));
+    assert.deepEqual(r.ids, [501, 502], 'the slug and the numeric id survive');
+    assert.deepEqual(r.ambiguous, ['C2']);
+  });
+
+  await atest('an unknown slug is unresolved, not ambiguous', async () => {
+    const r = await db.resolveCriterionIds('V9', ['no-such-slug'], fakeExecutor(2));
+    assert.deepEqual(r.unresolved, ['no-such-slug']);
+    assert.deepEqual(r.ambiguous, []);
+  });
+
+  await atest('the goal count is NOT queried when no positional ref is present', async () => {
+    // The slug path is the one the skill now requires — it must not pay for an
+    // extra round trip. A green test here is what keeps the fast path fast.
+    const ex = fakeExecutor(2);
+    await db.resolveCriterionIds('V9', ['first-slug'], ex);
+    assert.equal(ex.seen.filter((s) => /FROM goals/.test(s)).length, 0);
+  });
+
+  await atest('an empty ref list returns all three arrays', async () => {
+    const r = await db.resolveCriterionIds('V9', [], fakeExecutor(2));
+    assert.deepEqual(r, { ids: [], unresolved: [], ambiguous: [] });
+  });
+
+  console.log(`\ncriterion ref parse (task 438) + multi-goal refusal (task 1003108) tests: ${passed} passed, ${failed} failed`);
+  process.exit(failed > 0 ? 1 : 0);
+}
+
+main();