@bongos/core 1.19.815 → 1.19.816

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.815",
-  "core_contract": "1.19.815",
-  "source_commit": "49e12ef5bf0e0f642be16e2d07f3a8e4126088a3",
+  "core_version": "1.19.816",
+  "core_contract": "1.19.816",
+  "source_commit": "aa1a7485bebfc27a8b19c0acbff29287f1212828",
   "source_ref": "HEAD",
-  "built_at": "2026-09-17T07:58:43.512Z",
+  "built_at": "2026-09-17T08:14:24.758Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 489,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2730,
-  "tree_sha256": "8f4f7be2444b6e33f3772cc07af105a80fdd6a416ab122c91973dcb9600c0cf4",
+  "tree_sha256": "78e804a2a5bda8a926f2f33af27c70ca3a6e0b4b5b3aa9a5b3bd8c66dd5cec24",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2542,7 +2542,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "0f668e27938e73ba4769f2c5a1ee40205ffb350b25ad5c09bc7d660e2bb90b1d"
+      "sha256": "c86194915e38b871c476151bdf00719d190411407942cfc8dd9f0a7734630ab0"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5557,7 +5557,7 @@
     {
       "path": "modules/lifecycle/db-goals.js",
       "mode": "0000644",
-      "sha256": "b4d1c8bd2254f93519a88302072c2f524a1acb4152382fb09bdc22b1ef95f0ed"
+      "sha256": "1b229bd4bf18563dd772c0be46f320ae533e71a5c7ba32aaa4b523ac9f97a4dc"
     },
     {
       "path": "modules/lifecycle/db-grade.js",
@@ -5597,7 +5597,7 @@
     {
       "path": "modules/lifecycle/db.js",
       "mode": "0000644",
-      "sha256": "a568b425560d8d8f4523995442454233b69016a31934810c5d4b7d83baab0b09"
+      "sha256": "30c8884948a8dee8213c55279c12f06e104c7d95ab3d7fad9dc67506ed1ac1ab"
     },
     {
       "path": "modules/lifecycle/dead-deps.js",
@@ -5657,7 +5657,7 @@
     {
       "path": "modules/lifecycle/goal-suggest.js",
       "mode": "0000644",
-      "sha256": "85117db645accd023f4f61735f9f22a8c5f6ef08a29c61db99fbade51d081147"
+      "sha256": "cdbfa36b58dc26b7ce9d7a3d1f2812edd0ea050c2b27fe3837be6b6edf7d9ac5"
     },
     {
       "path": "modules/lifecycle/help-requests.js",
@@ -7792,12 +7792,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "48fba5427217aab544717eef126aa155f404dc6ba71ad21e2b2c4db586da9be7"
+      "sha256": "aa6749d880220869386e00488652da7ae32a0116855dba519e6b943c47f7180c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "abc68f18878f7339c9dba180f3b965c6b2cb253f91255b509ccb9fbd47c3b21b"
+      "sha256": "966ab00e5b62d0280043e13e156ce400cd3afa3f7c5bc04f02eea79392fd26f3"
     },
     {
       "path": "public-docs/index.html",
@@ -8057,7 +8057,7 @@
     {
       "path": "scripts/gds/capture.js",
       "mode": "0000644",
-      "sha256": "6779ebc36d51762777cb55352489a05ca9974f29c49d874b40c7486be83496ff"
+      "sha256": "7320809dacf61454d114d5c55c244e7eac3314f36302eab879950355540573f6"
     },
     {
       "path": "scripts/gds/category-advisory-guard.js",
@@ -9687,7 +9687,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "15e7fcbcb8377bea7245c66e4784accaecd09d92bd9baf3ecda20aab73faadac"
+      "sha256": "575b32eed8f62dad0302816f97e77604488891d13188bf5b690a867c37a962ac"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10312,7 +10312,7 @@
     {
       "path": "tests/capture_goal_routing.mjs",
       "mode": "0000644",
-      "sha256": "30c86ef5ae46c698b621dbe90e15210d162cc88d8b33bd0889330ff8686a065e"
+      "sha256": "2ddceb37d46eda5c3ab2a56b54c86f3cf55596479b5fe7f30646f45b1ac11ac2"
     },
     {
       "path": "tests/cascade-dispatch.mjs",
@@ -11102,7 +11102,7 @@
     {
       "path": "tests/goal_suggest.mjs",
       "mode": "0000644",
-      "sha256": "d61e2bd5b5a65239f1410011a5035b124bf8e20c41eac08018635ec8cd3a49c7"
+      "sha256": "41cf7774b86acabe7621563430fc4784152dea05f6cd3136b00081eca876e74d"
     },
     {
       "path": "tests/goal_tier.mjs",

package/docs/module-api-changelog.md

@@ -2104,5 +2104,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.813 with no explicit bump. run 35194334679. (task 1002620)
   1.19.815 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.814 with no explicit bump. run 35197139985. (task 1002620)
+  1.19.816 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.815 with no explicit bump. run 35198566737. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/db-goals.js

@@ -832,6 +832,41 @@ async function listCriteriaForGoal(goalId, deps = {}) {
   }));
 }
 
+// listCriterionTextForGoals — every goal's done-when criterion prose, keyed by
+// goal id, in ONE query (task 1003859). The goal suggester ranks on this.
+//
+// WHY BULK. The suggester scores all open goals for a version at once — eleven
+// of them on BONGOS-V2 — so per-goal reads would be eleven round trips on a
+// path that runs at capture time, for prose that is a few hundred bytes a goal.
+//
+// NO INDEX ON goal_id, DELIBERATELY. done_when_criteria carries a handful of rows
+// per goal and low hundreds in total — a scan of it is cheaper than the index it
+// would need maintaining, and adding one would mint a migration (a reserved number
+// and human review) to speed up a read that is already the smallest thing on this
+// path. idx_done_when_version exists for the version-scoped read; revisit if the
+// table ever grows a digit.
+//
+// WHY NOT listCriteriaForGoal. That read carries linked-task counts and the
+// pending_review derivation, none of which a text ranker wants; this returns the
+// criterion prose and nothing else.
+async function listCriterionTextForGoals(goalIds, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  const ids = (goalIds || []).map((g) => String(g)).filter(Boolean);
+  if (ids.length === 0) return new Map();
+  const { rows } = await activePool.query(
+    `SELECT goal_id, criterion_md
+       FROM done_when_criteria
+      WHERE goal_id = ANY($1::bigint[])`,
+    [ids]
+  );
+  const byGoal = new Map();
+  for (const r of rows) {
+    const k = String(r.goal_id);
+    byGoal.set(k, (byGoal.get(k) ? byGoal.get(k) + ' ' : '') + String(r.criterion_md || ''));
+  }
+  return byGoal;
+}
+
 // isGoalMember — is this builder a member of this goal? The membership predicate
 // behind the bounded-authority gates (BV1.R64 ask-to-widen; the R60 authoring
 // gate reuses the same idea). Returns a plain boolean.
@@ -1251,6 +1286,7 @@ module.exports = {
   isGoalMember,
   listActiveClaimsForTasks,
   listCriteriaForGoal,
+  listCriterionTextForGoals,
   openTasksInGoal,
   listGoalMembers,
   listGoals,

package/modules/lifecycle/db.js

@@ -88,6 +88,7 @@ const {
   isGoalMember,
   listActiveClaimsForTasks,
   listCriteriaForGoal,
+  listCriterionTextForGoals,
   archiveGoalWithDispositions,
   openTasksInGoal,
   listGoalMembers,
@@ -267,6 +268,7 @@ module.exports = {
   listInboxFor,
   listPendingRequestsForGoal,
   listCriteriaForGoal,
+  listCriterionTextForGoals,
   archiveGoalWithDispositions,
   openTasksInGoal,
   xenosClaimAllowed,

package/modules/lifecycle/goal-suggest.js

@@ -18,12 +18,25 @@
 // so there is one notion of "these two texts are about the same thing" in the
 // module, not two.
 //
-// WHAT A GOAL IS MATCHED ON: its title and its scope_modules. Deliberately NOT
-// its description — a goal description is where a whole planning spec lives (goal
-// 1000062 carries an entire decision record in its), so it shares tokens with
-// almost any draft and would flatten every score toward the same number. Modules
-// are included because they are a strong, cheap signal: a draft about the hall
-// really does belong with a goal scoped to `hall-ui`.
+// WHAT A GOAL IS MATCHED ON: its title, its scope_modules, and its DONE-WHEN
+// CRITERIA (task 1003859). Criteria were added because title-only ranking went
+// dead the moment the goal board adopted ADR 0264's naming: all eleven open
+// BONGOS-V2 goals are titled 'Working area N — <subject>', so a real subject word
+// in a draft — 'release', 'grader', 'dependency' — had almost nothing to overlap,
+// every goal scored under threshold, and the suggester returned [] for every idea
+// walked at the 2026-09-12 triage. It also left suggested_goal_id NULL at capture
+// time on every BONGOS-V2 filing, so triage inherited nothing either. The criteria
+// carry the subject vocabulary the titles stopped carrying.
+//
+// Criterion terms are weighted BELOW title terms (see CRITERION_WEIGHT): a goal
+// named for the subject is still the stronger claim, and criteria are longer text
+// that would otherwise swamp it.
+//
+// Still deliberately NOT the goal DESCRIPTION — a goal description is where a whole
+// planning spec lives (goal 1000062 carries an entire decision record in its), so
+// it shares tokens with almost any draft and would flatten every score toward the
+// same number. Modules are included because they are a strong, cheap signal: a
+// draft about the hall really does belong with a goal scoped to `hall-ui`.
 
 const { tokenize } = require('./criterion-suggest.js');
 const { versionAcceptsNewWork } = require('./db-tasks.js');
@@ -38,10 +51,47 @@ const captureErr = (err) => api.logger('lifecycle').error({ err: err && err.mess
 // Matches suggestCriteria's default so the two suggesters feel the same.
 const SUGGEST_LIMIT = 5;
 
+// A criterion term counts for less than the same term in the title. Criteria are
+// several sentences per goal against a title's handful of words, so equal weight
+// would let a goal that merely MENTIONS a subject outrank one NAMED for it.
+const CRITERION_WEIGHT = 0.5;
+
+// rankableCriteria — the criterion prose the ranker may read, for the goals it is
+// about to score. Both callers go through this, so the two rules below have ONE
+// home and cannot drift apart.
+//
+// RULE 1 — PRIVATE GOALS ARE EXCLUDED. This function's own header explains that
+// GET /goals (and therefore this suggester) already lists private goals' TITLES to
+// any signed-in builder, and that reconciling that is a decision about the goal
+// board as a whole rather than something a suggester settles. Criteria are a
+// different order of exposure: score + matched_terms make a ranker into a
+// word-guessing oracle, so ranking on a private goal's done-when prose would let
+// any builder probe the CONTENT of work they cannot see, one candidate word per
+// request. So this addition stops at the visibility line the status quo already
+// draws — a private goal keeps ranking exactly as it did before (title + modules),
+// and nothing new is disclosed. Widening or narrowing the title-level status quo
+// stays the separate decision it was.
+//
+// RULE 2 — BEST EFFORT. A criteria read that fails degrades to title-only ranking,
+// which is what this path did before the criteria existed. A suggester is advisory
+// everywhere it is called; taking down a bug report or 500ing a picker to protect
+// a ranking refinement would be the wrong trade.
+async function rankableCriteria(db, goals, onError) {
+  if (typeof db.listCriterionTextForGoals !== 'function') return null;
+  const rankable = (goals || []).filter((g) => g && g.visibility !== 'private');
+  if (rankable.length === 0) return null;
+  try {
+    return await db.listCriterionTextForGoals(rankable.map((g) => g.id));
+  } catch (err) { onError(err); return null; }
+}
+
 // Rank open goals against a DRAFT capture. Pure — no DB, no writes; the caller
 // supplies the goal rows.
 //
 //   goals   — open goal rows { id, title, scope_modules }
+//   opts.criteriaByGoal — Map<goalId, criterion prose> (db.listCriterionTextForGoals).
+//             Optional: omitted, this ranks exactly as it did before — the pure
+//             function stays callable with no DB anywhere near it.
 //   draft   — { title, body } (body optional: a capture's prose, weighted lower)
 //   opts    — { versionId, limit, includeZero }
 //
@@ -54,7 +104,7 @@ const SUGGEST_LIMIT = 5;
 // offer "browse all" without this function pretending to a confidence it lacks.
 function suggestGoals(goals, draft = {}, opts = {}) {
   const { title = '', body = '' } = draft;
-  const { versionId = null, limit = SUGGEST_LIMIT, includeZero = false } = opts;
+  const { versionId = null, limit = SUGGEST_LIMIT, includeZero = false, criteriaByGoal = null } = opts;
 
   // Weighted term map: body terms at 1, title terms override to 2 (a term in
   // both IS a title term — the stronger signal wins). suggestCriteria's rule.
@@ -73,10 +123,20 @@ function suggestGoals(goals, draft = {}, opts = {}) {
       // by the >=3-char filter, which is fine — 'hall' is the signal.
       ...tokenize((g.scope_modules || []).join(' ')),
     ]);
+    // Criterion terms that the title/modules already cover add nothing — they are
+    // scored at the full title weight above, and double-counting would reward a
+    // goal for repeating itself.
+    const criterionTerms = new Set();
+    if (criteriaByGoal) {
+      for (const t of tokenize(criteriaByGoal.get(String(g.id)) || '')) {
+        if (!goalTerms.has(t)) criterionTerms.add(t);
+      }
+    }
     let score = 0;
     const matched = [];
     for (const [term, w] of weights) {
       if (goalTerms.has(term)) { score += w; matched.push(term); }
+      else if (criterionTerms.has(term)) { score += w * CRITERION_WEIGHT; matched.push(term); }
     }
     return { ...g, score, matched_terms: matched.sort() };
   }).sort((a, b) => (b.score - a.score) || (Number(a.id) - Number(b.id)));
@@ -133,11 +193,16 @@ async function suggestGoalForCapture({ title = '', body = '' } = {}, deps = {})
       && g.title !== generalGoalTitle(g.version_id));
     if (homes.length === 0) return null;
 
+    // Criterion prose for the same goals — this is the capture-time half of task
+    // 1003859, and it is the half that matters most: suggested_goal_id is written
+    // HERE, and it was NULL on every BONGOS-V2 filing.
+    const criteriaByGoal = await rankableCriteria(db, homes, captureErr);
+
     // versionId is passed null: the catch-alls are already gone, and passing one
     // version's id here would only re-filter for that version. includeZero stays
     // false, so a filing that matches nothing gets NO goal rather than the
     // first one dressed up as a suggestion.
-    const [best] = suggestGoals(homes, { title, body }, { versionId: null, limit: 1 });
+    const [best] = suggestGoals(homes, { title, body }, { versionId: null, limit: 1, criteriaByGoal });
     if (!best) return null;
 
     // suggestGoals normalises to { id, title, scope_modules, … } and drops
@@ -184,7 +249,8 @@ function goalSuggestHandler({ db, LIMITS }) {
     // was an oversight, not a decision.
     try {
       const open = await db.listGoals({ versionId, status: 'open' });
-      const suggestions = suggestGoals(open, { title, body }, { versionId, limit });
+      const criteriaByGoal = await rankableCriteria(db, open || [], proseErr);
+      const suggestions = suggestGoals(open, { title, body }, { versionId, limit, criteriaByGoal });
       return res.json({
         version_id: versionId,
         // `kind` is echoed, NOT ranked on. Kind decides how a capture LANDS (the

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.815",
+  "version": "1.19.816",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.815",
+      "version": "1.19.816",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.815",
+  "version": "1.19.816",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/capture.js

@@ -50,8 +50,12 @@
 //                                 the active-claim default below is skipped —
 //                                 an opt-out that still guessed a goal would not
 //                                 be an opt-out.
-//                  (neither)    → default to the ACTIVE CLAIM's goal, if this
-//                                 builder holds one and its task has a goal
+//                  (neither)    → default to the ACTIVE CLAIM's goal — but ONLY
+//                                 when the captured text and the claimed task
+//                                 share a subject word (task 1003859); an
+//                                 unrelated filing says so and stays homeless.
+//                                 Applies if this builder holds a claim and its
+//                                 task has a goal
 //                                 ("capturing mid-work almost always concerns
 //                                 the work" — the interview's own words). With
 //                                 no default to offer, the R07 suggester
@@ -160,6 +164,29 @@ function sanitizeForTerminal(s) {
   return String(s == null ? '' : s).replace(/[\x00-\x1f\x7f]/g, '');
 }
 
+// claimShareSubject — does the captured text have ANYTHING in common with the
+// task I happen to be holding? (task 1003859)
+//
+// WHY THE DEFAULT NEEDED A GUARD. The active-claim default is a convenience for
+// the ordinary case: you are working on X and you file something about X. But it
+// fired unconditionally, so filing an UNRELATED bug mid-session minted it into
+// the claim's goal — this very bug was filed from a session holding a security
+// task and landed in Working area 10 (Security), which has nothing to do with it,
+// and had to be moved by hand. ADR 0234's owner-interview decision is that a
+// guess must not mint work into a goal, and an inherited goal with no subject in
+// common is exactly a guess.
+//
+// Reuses criterion-suggest's tokenize — the same notion of 'these two texts are
+// about the same thing' the goal suggester ranks with, so the guard and the
+// suggester cannot disagree about what a subject word is.
+const { tokenize } = require('../../modules/lifecycle/criterion-suggest.js');
+
+function claimShareSubject(capturedText, claimTitle) {
+  const theirs = new Set(tokenize(claimTitle));
+  if (theirs.size === 0) return true; // nothing to disagree with — keep the old behaviour
+  return tokenize(capturedText).some((t) => theirs.has(t));
+}
+
 // resolveGoalForCapture — the WHOLE of --goal resolution for one capture, in the
 // interview's own precedence: an explicit id wins outright; 'none' is a hard
 // opt-out (no default, no hint); otherwise the active-claim default runs, and
@@ -168,26 +195,34 @@ function sanitizeForTerminal(s) {
 // is testable without capturing stdout. Never throws (both collaborators above
 // already degrade to null on their own).
 async function resolveGoalForCapture({ goalArg, version, title, kind, client = cliClient } = {}) {
+  const claimLines = [];
   const parsed = parseGoalArg(goalArg);
   if (parsed.kind === 'id') return { goalId: parsed.id, lines: [] };
   if (parsed.kind === 'none') return { goalId: null, lines: [] };
 
   const defaulted = await resolveActiveClaimGoal({ client });
   if (defaulted) {
-    return {
-      goalId: defaulted.goalId,
-      lines: [`↪ defaulting --goal to ${defaulted.goalId} from your active claim on task #${defaulted.taskId} ("${sanitizeForTerminal(defaulted.taskTitle)}") — override with --goal <id>, or --goal none to file homeless.`],
-    };
+    // Only inherit when the two are actually about the same thing. When they are
+    // not, say so and fall through to the suggester — which ranks on what was
+    // WRITTEN rather than on what happens to be open — instead of filing silently
+    // into the wrong goal.
+    if (claimShareSubject(title, defaulted.taskTitle)) {
+      return {
+        goalId: defaulted.goalId,
+        lines: [`↪ defaulting --goal to ${defaulted.goalId} from your active claim on task #${defaulted.taskId} ("${sanitizeForTerminal(defaulted.taskTitle)}") — override with --goal <id>, or --goal none to file homeless.`],
+      };
+    }
+    claimLines.push(`↪ NOT defaulting to your active claim's goal: task #${defaulted.taskId} ("${sanitizeForTerminal(defaulted.taskTitle)}") shares no subject with what you filed — pass --goal ${defaulted.goalId} if it really belongs there.`);
   }
 
   const hint = await fetchGoalSuggestion({ client, version, title, kind });
   if (hint) {
     return {
       goalId: null,
-      lines: [`💡 possible home: goal ${hint.id} "${sanitizeForTerminal(hint.title)}" (score ${hint.score}) — re-run with --goal ${hint.id} (or --goal none to stay homeless on purpose).`],
+      lines: [...claimLines, `💡 possible home: goal ${hint.id} "${sanitizeForTerminal(hint.title)}" (score ${hint.score}) — re-run with --goal ${hint.id} (or --goal none to stay homeless on purpose).`],
     };
   }
-  return { goalId: null, lines: [] };
+  return { goalId: null, lines: claimLines };
 }
 
 // DEFAULT IS NO, and only an explicit yes counts. Extracted so the done-when

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.815'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.816'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/capture_goal_routing.mjs

@@ -181,7 +181,11 @@ await test('no --goal: the active-claim default fires and names how to opt out',
     me: { ok: true, data: { active_claims: [{ task_id: 55, title: 'Fix the thing' }] } },
     task: { ok: true, data: { task: { id: 55, goal_id: 1000071, title: 'Fix the thing' } } },
   });
-  const r = await capture.resolveGoalForCapture({ goalArg: null, version: 'BV1', title: 't', client });
+  // The captured text shares 'thing' with the claim — the ordinary case the
+  // default exists for. (It used to be the bare title 't'; since task 1003859 the
+  // default only fires on a shared subject word, so a placeholder no longer
+  // exercises this path.)
+  const r = await capture.resolveGoalForCapture({ goalArg: null, version: 'BV1', title: 'the thing is broken', client });
   assert.equal(r.goalId, 1000071);
   assert.equal(r.lines.length, 1);
   assert.match(r.lines[0], /1000071/);
@@ -239,4 +243,64 @@ await test('WIRING: a routing refusal is surfaced through the existing verbatim
   assert.match(CAPTURE_SRC, /console\.error\(formatCaptureFailure\(r\.status, r\.data\)\);/);
 });
 
+// ---------------------------------------------------------------------------
+// the active-claim default must not mint UNRELATED work into the claim's goal
+// (task 1003859)
+// ---------------------------------------------------------------------------
+//
+// The default fired unconditionally, so filing an unrelated bug mid-session
+// routed it into whatever goal you happened to be holding — task 1003859 itself
+// was filed from a security claim and landed in Working area 10, and had to be
+// moved by hand. ADR 0234: a guess must not mint work into a goal.
+
+await test('no --goal, claim shares NO subject with the filing: does not inherit, and says why', async () => {
+  const { client, calls } = stubClient({
+    me: { ok: true, data: { active_claims: [{ task_id: 55, title: 'Harden the OAuth callback against replay' }] } },
+    task: { ok: true, data: { task: { id: 55, goal_id: 1000094, title: 'Harden the OAuth callback against replay' } } },
+    suggestions: { ok: true, data: { suggestions: [] } },
+  });
+  const r = await capture.resolveGoalForCapture({
+    goalArg: null, version: 'BV1', title: 'The goal suggester returns zero suggestions for every idea', client,
+  });
+  assert.equal(r.goalId, null, 'an unrelated claim must not decide where this work lives');
+  assert.equal(r.lines.length, 1, 'staying homeless silently would be the same bug with no evidence');
+  assert.match(r.lines[0], /NOT defaulting/);
+  assert.match(r.lines[0], /1000094/, 'it must name the goal it declined, so --goal can override it');
+  assert.equal(calls.suggestions.length, 1, 'with no default, the suggester still gets its turn');
+});
+
+await test('a declined default still yields to a real suggestion, keeping both lines', async () => {
+  const { client } = stubClient({
+    me: { ok: true, data: { active_claims: [{ task_id: 55, title: 'Harden the OAuth callback against replay' }] } },
+    task: { ok: true, data: { task: { id: 55, goal_id: 1000094, title: 'Harden the OAuth callback against replay' } } },
+    suggestions: { ok: true, data: { suggestions: [{ id: 1000091, title: 'Working area 7', score: 3 }] } },
+  });
+  const r = await capture.resolveGoalForCapture({
+    goalArg: null, version: 'BV1', title: 'The goal suggester returns zero suggestions', client,
+  });
+  assert.equal(r.goalId, null);
+  assert.equal(r.lines.length, 2, 'the refusal and the hint are different facts — both are printed');
+  assert.match(r.lines[0], /NOT defaulting/);
+  assert.match(r.lines[1], /1000091/);
+});
+
+await test('--goal N still wins outright over the guard (it is not a veto)', async () => {
+  const { client, calls } = stubClient({
+    me: { ok: true, data: { active_claims: [{ task_id: 55, title: 'Something else entirely' }] } },
+    task: { ok: true, data: { task: { id: 55, goal_id: 1000094 } } },
+  });
+  const r = await capture.resolveGoalForCapture({ goalArg: '1000094', version: 'BV1', title: 'unrelated words here', client });
+  assert.deepEqual(r, { goalId: 1000094, lines: [] });
+  assert.equal(calls.me, 0);
+});
+
+await test('a claim title with no subject words at all still inherits — the guard only fires on real disagreement', async () => {
+  const { client } = stubClient({
+    me: { ok: true, data: { active_claims: [{ task_id: 55, title: 'a' }] } },
+    task: { ok: true, data: { task: { id: 55, goal_id: 1000071, title: 'a' } } },
+  });
+  const r = await capture.resolveGoalForCapture({ goalArg: null, version: 'BV1', title: 'anything at all', client });
+  assert.equal(r.goalId, 1000071, 'nothing to compare against is not evidence of a mismatch');
+});
+
 summary();

package/tests/goal_suggest.mjs

@@ -199,13 +199,23 @@ await test('the handler clamps limit into a sane range', async () => {
 // confident answer and declines whenever "confident" is not available.
 // =========================================================================
 
-const fakeDb = ({ versions = [], goals = [], throws = null, calls = null } = {}) => ({
+const fakeDb = ({ versions = [], goals = [], throws = null, calls = null, criteria = null } = {}) => ({
   listVersions: async () => { if (throws === 'versions') throw new Error('boom'); return versions; },
   listGoals: async (args) => {
     if (calls) calls.push(args);
     if (throws === 'goals') throw new Error('boom');
     return goals;
   },
+  // task 1003859: the criterion prose the ranker reads alongside the title.
+  // Omitted (criteria: null) it is absent from the fake ENTIRELY, which is also
+  // the pinned shape for a db that predates this read.
+  ...(criteria ? {
+    listCriterionTextForGoals: async (ids) => {
+      if (throws === 'criteria') throw new Error('boom');
+      if (calls) calls.push({ criteriaFor: ids.map(String) });
+      return new Map(Object.entries(criteria));
+    },
+  } : {}),
 });
 
 const BUILDING = { id: 'BONGOS-V1', status: 'building' };
@@ -298,4 +308,141 @@ await test('suggestGoalForCapture: the catch-all is never offered as a home', as
   assert.equal(got, null, 'a bucket is not a workspace — dropped for EVERY open version, not just one');
 });
 
+// ---------------------------------------------------------------------------
+// ranking on DONE-WHEN CRITERIA (task 1003859)
+// ---------------------------------------------------------------------------
+//
+// The real failure: since ADR 0264 every open BONGOS-V2 goal is titled
+// 'Working area N — <subject>'. A subject word in a draft had nothing to overlap
+// in the title, every goal scored 0, and the suggester returned [] for every idea
+// walked at the 2026-09-12 triage — which also left suggested_goal_id NULL on
+// every filing. These reproduce that board rather than a convenient one.
+
+const WORKING_AREAS = [
+  { id: 1000091, title: 'Working area 7', scope_modules: [], version_id: 'BONGOS-V2' },
+  { id: 1000094, title: 'Working area 10', scope_modules: [], version_id: 'BONGOS-V2' },
+];
+const WA_CRITERIA = {
+  1000091: 'A release is published and an instance can move its pin to it. The grader runs and its findings are readable.',
+  1000094: 'Every authenticated route re-checks the caller rank. A credential never reaches a log.',
+};
+
+await test('the real board: title-only ranking scores every Working area goal ZERO', () => {
+  const got = suggestGoals(WORKING_AREAS, { title: 'the grader returns no findings' }, { versionId: 'BONGOS-V2', includeZero: true });
+  assert.deepEqual(got.map((g) => g.score), [0, 0],
+    'this is the bug, pinned: the naming convention left the ranker nothing to match');
+  assert.deepEqual(suggestGoals(WORKING_AREAS, { title: 'the grader returns no findings' }, { versionId: 'BONGOS-V2' }), [],
+    'and so the suggester returned nothing at all');
+});
+
+await test('with criteria, the same draft finds its goal, with the matched terms shown', () => {
+  const got = suggestGoals(
+    WORKING_AREAS,
+    { title: 'the grader returns no findings' },
+    { versionId: 'BONGOS-V2', criteriaByGoal: new Map(Object.entries(WA_CRITERIA)) }
+  );
+  assert.equal(got.length, 1, 'only the goal whose criteria talk about grading');
+  assert.equal(got[0].id, 1000091);
+  assert.ok(got[0].score > 0);
+  assert.ok(got[0].matched_terms.includes('grader'), `expected 'grader' among ${JSON.stringify(got[0].matched_terms)}`);
+});
+
+await test('a criterion match weighs LESS than the same word in the title', () => {
+  const byTitle = { id: 10, title: 'Grader health', scope_modules: [], version_id: 'BONGOS-V2' };
+  const byCriteria = { id: 11, title: 'Working area 7', scope_modules: [], version_id: 'BONGOS-V2' };
+  const got = suggestGoals(
+    [byCriteria, byTitle],
+    { title: 'grader' },
+    { versionId: 'BONGOS-V2', criteriaByGoal: new Map([['11', 'the grader runs nightly']]) }
+  );
+  assert.equal(got[0].id, 10, 'a goal NAMED for the subject still outranks one that merely mentions it');
+  assert.ok(got[0].score > got[1].score);
+});
+
+await test('a term in both title and criteria is counted ONCE, at the title weight', () => {
+  const g = { id: 12, title: 'Grader health', scope_modules: [], version_id: 'BONGOS-V2' };
+  const withCriteria = suggestGoals([g], { title: 'grader' }, { versionId: 'BONGOS-V2', criteriaByGoal: new Map([['12', 'grader grader grader']]) });
+  const without = suggestGoals([g], { title: 'grader' }, { versionId: 'BONGOS-V2' });
+  assert.equal(withCriteria[0].score, without[0].score, 'repeating itself must not inflate a goal');
+});
+
+await test('no criteriaByGoal: ranking is EXACTLY what it was before (the pure function stays DB-free)', () => {
+  const draft = { title: 'the hall sidebar collapses on mobile' };
+  const a = suggestGoals([HALL_GOAL, ECON_GOAL], draft, { versionId: 'BONGOS-V1' });
+  const b = suggestGoals([HALL_GOAL, ECON_GOAL], draft, { versionId: 'BONGOS-V1', criteriaByGoal: null });
+  assert.deepEqual(a, b);
+  assert.equal(a[0].id, 81);
+});
+
+await test('suggestGoalForCapture reads the criteria, so suggested_goal_id is populated on the real board', async () => {
+  const calls = [];
+  const got = await suggestGoalForCapture(
+    { title: 'the grader returns no findings', body: '' },
+    { db: fakeDb({ versions: [{ id: 'BONGOS-V2', status: 'building' }], goals: WORKING_AREAS, criteria: WA_CRITERIA, calls }) }
+  );
+  assert.ok(got, 'this returned NULL before task 1003859 — which is why suggested_goal_id was null on every filing');
+  assert.equal(got.id, 1000091);
+  assert.equal(got.version_id, 'BONGOS-V2');
+  assert.ok(calls.some((c) => c && c.criteriaFor), 'the criteria read must actually be issued');
+});
+
+await test('a criteria read that THROWS degrades to title-only ranking, never to a lost filing', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses on mobile', body: '' },
+    { db: fakeDb({ versions: [BUILDING], goals: [HALL_GOAL, ECON_GOAL], criteria: {}, throws: 'criteria' }) }
+  );
+  assert.ok(got, 'a bug report must survive a criteria read that fails');
+  assert.equal(got.id, 81, 'and still rank on what it can see');
+});
+
+await test('a db with NO listCriterionTextForGoals at all still works (older core, or a lean fake)', async () => {
+  const got = await suggestGoalForCapture(
+    { title: 'the hall sidebar collapses on mobile', body: '' },
+    { db: fakeDb({ versions: [BUILDING], goals: [HALL_GOAL, ECON_GOAL] }) }
+  );
+  assert.equal(got.id, 81);
+});
+
+// ---------------------------------------------------------------------------
+// a PRIVATE goal's criteria are never ranked on (task 1003859, grade round 1)
+// ---------------------------------------------------------------------------
+//
+// score + matched_terms make a ranker into a word-guessing oracle: one candidate
+// word per request tells you whether that word appears in the ranked text. The
+// suggester already exposes private goals' TITLES (GET /goals does too — a wider
+// status quo this task does not settle), but their done-when prose is a different
+// order of exposure, so the criteria read stops at the visibility line.
+
+const PRIVATE_GOAL = { id: 900, title: 'Working area 12', scope_modules: [], version_id: 'BONGOS-V2', visibility: 'private' };
+const PUBLIC_GOAL = { id: 901, title: 'Working area 13', scope_modules: [], version_id: 'BONGOS-V2', visibility: 'public' };
+
+await test('the criteria of a PRIVATE goal are never fetched — not even to rank', async () => {
+  const asked = [];
+  const db = {
+    listGoals: async () => [PRIVATE_GOAL, PUBLIC_GOAL],
+    listCriterionTextForGoals: async (ids) => { asked.push(...ids.map(String)); return new Map(); },
+  };
+  const res = fakeRes();
+  await goalSuggestHandler({ db, LIMITS: { TITLE: 200 } })(
+    { query: { version: 'BONGOS-V2', title: 'embargo' } }, res
+  );
+  assert.deepEqual(asked, ['901'], 'only the public goal may contribute criterion text');
+  assert.ok(!asked.includes('900'), 'a private goal must not be probeable one word at a time');
+});
+
+await test('a private goal still ranks on its TITLE — this narrows nothing that already worked', () => {
+  const got = suggestGoals([PRIVATE_GOAL], { title: 'working area 12' }, { versionId: 'BONGOS-V2' });
+  assert.equal(got.length, 1, 'the title-level status quo is a separate decision, left exactly as it was');
+});
+
+await test('every goal private ⇒ no criteria read is issued at all', async () => {
+  let called = 0;
+  const db = {
+    listGoals: async () => [PRIVATE_GOAL],
+    listCriterionTextForGoals: async () => { called++; return new Map(); },
+  };
+  await goalSuggestHandler({ db, LIMITS: { TITLE: 200 } })({ query: { version: 'BONGOS-V2', title: 'x y z' } }, fakeRes());
+  assert.equal(called, 0, 'a query with nothing rankable must not be issued');
+});
+
 summary();