@bongos/core 1.19.895 → 1.19.896

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.895",
-  "core_contract": "1.19.895",
-  "source_commit": "e1f8d85b302ea3a742b16cc5ec06911132ae7f78",
+  "core_version": "1.19.896",
+  "core_contract": "1.19.896",
+  "source_commit": "bcf7936c9c65f2b945caeb9c1f6fb3d11138d340",
   "source_ref": "HEAD",
-  "built_at": "2026-09-19T23:04:46.322Z",
+  "built_at": "2026-09-20T00:11:11.958Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 498,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2274,
+    "functional_verbatim": 2276,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2798,
-  "tree_sha256": "b3d7ed781a5cfdc09c1f4cb1d361b1630e18adb02f1d9abf09c70b8867d6b496",
+  "file_count": 2800,
+  "tree_sha256": "2d40ce33d5827af7ceac90c039e54216dd6edccda58e072dd13220ac1d9c587b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2612,7 +2612,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "14add7d8f56069acae77405671c2b1b4e7dadfd03eb4cd36ab08cbcd9f6ed9a9"
+      "sha256": "8817c3a21981fb8a7b8a771fd7041b2c0fe086873aefc4128184f12c503bfb77"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3709,6 +3709,11 @@
       "mode": "0000644",
       "sha256": "ae3e405c7e59fbc13e23ae2a4ba945176f2369a150c997d9b8134e49991f273b"
     },
+    {
+      "path": "migrations/core_250_cascade_requests_do_not_auto_promote.sql",
+      "mode": "0000644",
+      "sha256": "599449a48b3850eb457a34630a7bd5d95d354602f1a9e9b887593183a457cd21"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -5477,7 +5482,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "5d17541d837a06903be832814a74218c9fee8b9119dd870c88273743be5a5efa"
+      "sha256": "ba8a41a33d3612f41509d50c65533f169b4008bbc8a01df783dbd03fe872afa4"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -7717,12 +7722,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9ae4e1d11cdbeca421ec3a967b7130085744c14df5901d501bd8129974f65c20"
+      "sha256": "367843e43813dc8865d06e51ccfeed4c44deb8da04dc4328a5f28a8305cba264"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "adcd6bd6b27ed6e43e143613beb81d9d063244bf5ccdf948ec3b59a89bd15401"
+      "sha256": "7fb341305fc64634b77558a93b0788a4a98ec658acebea090e1299740d2d2f27"
     },
     {
       "path": "public-docs/index.html",
@@ -9727,7 +9732,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ae29e03c67edd61e903c64c4583c3febdfdea3ac75422e7b3075125f0b79f4e4"
+      "sha256": "99326b732eb82a5c9bb26e0ec54f196378a4a4f89e647aebb1e32c9d2d52d4eb"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12672,7 +12677,12 @@
     {
       "path": "tests/promotion_sweep.mjs",
       "mode": "0000644",
-      "sha256": "43246276a75ec8e7d01610b4f6c6988434144338804614b37b062c7a43a8beca"
+      "sha256": "c0c88682ef2b43ae582cfe41ac39e0213b50aaf0cae2e9cbd314007a7aa64b89"
+    },
+    {
+      "path": "tests/promotion_triggers_skip_cascade.mjs",
+      "mode": "0000644",
+      "sha256": "ce1de49cfe554f3e5fa4ae9a784a8ba41d537571c9ae6307f72c2710e693f6aa"
     },
     {
       "path": "tests/prose_edits.mjs",
@@ -13722,7 +13732,7 @@
     {
       "path": "tests/task_unblocked_open_blocker.mjs",
       "mode": "0000644",
-      "sha256": "57a776dc56011bfe792a7a30ab29598bfc1b5b52f26ea0ef74faae5fbba26f6d"
+      "sha256": "503692cc227e43292c133abba0fe17307fedd4b32be56e457a690b7be88c1586"
     },
     {
       "path": "tests/task_visual_route_gate.mjs",

package/docs/module-api-changelog.md

@@ -2264,5 +2264,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.893 with no explicit bump. run 35473999345. (task 1002620)
   1.19.895 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.894 with no explicit bump. run 35475074265. (task 1002620)
+  1.19.896 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.895 with no explicit bump. run 35478072367. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_250_cascade_requests_do_not_auto_promote.sql

@@ -0,0 +1,126 @@
+-- core_250 a cascade REQUEST is never auto-promoted out of backlog
+-- Applied under task 1004077.
+--
+-- WHY. 'backlog' means two different things and only one of them is drainable
+-- by a machine:
+--
+--   waiting on a TRIGGER   a dependency has not shipped -- mechanically
+--                          unblockable, and what these triggers are for
+--   waiting on a PERSON    a generated REQUEST nobody has triaged
+--
+-- modules/lifecycle/cascade.js files every task it generates at 'backlog' and
+-- never 'ready' (one of the four properties tests/cascade.mjs pins), and writes
+-- a preamble onto each one telling the reader it "is a REQUEST, filed at
+-- backlog, and it goes through the board's ordinary triage". Nothing enforced
+-- that downstream, so the board's ordinary triage was skipped by a machine.
+--
+-- WHAT IT COST. modules/hall-ui/public/studio.js reads the artist's queue as
+-- `?discipline=artist&status=backlog`. A cascade task carries no dependencies,
+-- so task_is_fully_unblocked() is trivially true and it qualified for promotion
+-- the instant it existed. Task 1004037 was filed at 19:53:57 and promoted at
+-- 19:54:54 -- 57 seconds, no person involved. Every artist review was swept out
+-- of the artist's room about a minute after arriving and reappeared in
+-- /builder-start as ordinary claimable work; all four open on 2026-09-19 had
+-- been drained. One was then claimed into a git worktree and judged by a grader
+-- panel whose four lenses explicitly do not read a sentence (ADR 0298): an
+-- artist review carried out without an artist, while the studio sat empty.
+--
+-- WHY HERE AS WELL AS IN THE SWEEP. The report-only sweep in
+-- modules/lifecycle/db-tasks.js (PROMOTABLE_BACKLOG_WHERE) is fixed in the same
+-- task, but it is not the only promoter. Each trigger below matches a
+-- dependency edge that may be anchored at the task OR AT ITS GOAL
+-- (`d.from_kind = 'goal' AND d.from_id = t.goal_id`), and a cascade review
+-- INHERITS the reviewed task's goal (cascade.js property 3). So a goal-level
+-- edge promotes a cascade row that has no dependencies of its own. Fixing only
+-- the sweep would leave that path open and the defect would return
+-- intermittently, which is worse than leaving it alone.
+--
+-- SHAPE. `AND t.source IS DISTINCT FROM 'cascade'` sits beside the existing
+-- `AND t.kind <> 'spike'`, which is the established precedent in these same
+-- functions for "this sort of row does not auto-promote". IS DISTINCT FROM, not
+-- <>, because source is nullable and `NULL <> 'cascade'` is NULL, which would
+-- silently stop promoting every task that has no source at all.
+--
+-- NOT task_is_fully_unblocked(). That predicate answers "are this task's
+-- dependencies satisfied", it is shared with the claim gate, and teaching it to
+-- also mean "has a human triaged this" would change what a refused claim means.
+--
+-- Forward-safe: CREATE OR REPLACE only, no DROP, no column change, and the
+-- bodies are 163's verbatim apart from the one added line. A rolled-back code
+-- pin runs fine against these -- the clause narrows what promotes and an older
+-- release neither reads nor writes `tasks.source` on this path.
+
+-- (a) a task shipped
+CREATE OR REPLACE FUNCTION promote_dependents_on_ship()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.status = 'shipped' AND (OLD.status IS DISTINCT FROM 'shipped') THEN
+    UPDATE tasks t
+       SET status = 'ready', promoted_at = COALESCE(t.promoted_at, now()), updated_at = now()
+     WHERE t.status = 'backlog'
+       AND t.kind <> 'spike'
+       AND t.source IS DISTINCT FROM 'cascade'
+       AND EXISTS (
+         SELECT 1 FROM dependencies d
+          WHERE d.to_kind = 'task' AND d.to_id = NEW.id
+            AND ( (d.from_kind = 'task'      AND d.from_id = t.id)
+               OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+               OR (d.from_kind = 'criterion' AND d.from_id IN (
+                     SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)) )
+       )
+       AND task_is_fully_unblocked(t.id);
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- (b) a criterion satisfied
+CREATE OR REPLACE FUNCTION promote_dependents_on_criterion_satisfy()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.satisfied = true AND (OLD.satisfied IS DISTINCT FROM true) THEN
+    UPDATE tasks t
+       SET status = 'ready', promoted_at = COALESCE(t.promoted_at, now()), updated_at = now()
+     WHERE t.status = 'backlog'
+       AND t.kind <> 'spike'
+       AND t.source IS DISTINCT FROM 'cascade'
+       AND EXISTS (
+         SELECT 1 FROM dependencies d
+          WHERE d.to_kind = 'criterion' AND d.to_id = NEW.id
+            AND ( (d.from_kind = 'task'      AND d.from_id = t.id)
+               OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+               OR (d.from_kind = 'criterion' AND d.from_id IN (
+                     SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)) )
+       )
+       AND task_is_fully_unblocked(t.id);
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- (c) a goal achieved
+CREATE OR REPLACE FUNCTION promote_dependents_on_goal_achieve()
+RETURNS TRIGGER AS $$
+BEGIN
+  IF NEW.status = 'achieved' AND (OLD.status IS DISTINCT FROM 'achieved') THEN
+    UPDATE tasks t
+       SET status = 'ready', promoted_at = COALESCE(t.promoted_at, now()), updated_at = now()
+     WHERE t.status = 'backlog'
+       AND t.kind <> 'spike'
+       AND t.source IS DISTINCT FROM 'cascade'
+       AND EXISTS (
+         SELECT 1 FROM dependencies d
+          WHERE d.to_kind = 'goal' AND d.to_id = NEW.id
+            AND ( (d.from_kind = 'task'      AND d.from_id = t.id)
+               OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+               OR (d.from_kind = 'criterion' AND d.from_id IN (
+                     SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)) )
+       )
+       AND task_is_fully_unblocked(t.id);
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- The triggers themselves are unchanged; 163 created them and CREATE OR REPLACE
+-- above swaps the bodies underneath them in place.

package/modules/lifecycle/db-tasks.js

@@ -1129,8 +1129,36 @@ async function updateTaskStatus(id, status) {
 //
 // The UPDATE repeats the WHERE rather than trusting the ids it just read, so a
 // row that stops qualifying between the two statements is not promoted anyway.
+// 'backlog' MEANS TWO DIFFERENT THINGS, and this sweep may only drain one of
+// them (task 1004077). A task waiting on a TRIGGER — a dependency that has not
+// shipped — is mechanically unblockable, and draining those is what this sweep
+// was built for. A task waiting on a PERSON is a generated REQUEST nobody has
+// triaged, and "no unmet dependency" says nothing about whether a human has
+// looked at it. The system already knows the two are different: /backlog-review
+// exists to "separate rows waiting on a PERSON from rows waiting on a TRIGGER",
+// and it separates them by hand because nothing in the data did.
+//
+// Every cascade row is the second kind. cascade.js files at 'backlog' and never
+// 'ready' — one of the four properties tests/cascade.mjs pins — and the preamble
+// it writes onto every generated task says so to the reader: "it is a REQUEST,
+// filed at backlog, and it goes through the board's ordinary triage".
+//
+// WHAT IT COST. A cascade task carries dependencies: [], so it was trivially
+// "fully unblocked" and qualified the instant it existed. Measured on task
+// 1004037: filed 19:53:57, promoted 19:54:54 — 57 seconds, by this sweep, with
+// no person involved. studio.js:476 reads the artist's queue as
+// `?discipline=artist&status=backlog`, so every artist review was swept out of
+// the artist's room about a minute after arriving and reappeared in
+// /builder-start as ordinary claimable work. All four reviews open on
+// 2026-09-19 had been drained. One was then claimed into a worktree and graded
+// by a panel whose four lenses do not read a sentence (ADR 0298) — an artist
+// review performed without an artist, while the studio sat empty.
+//
+// The exclusion is by SOURCE, not by discipline: engineer-scoping-on-full-idea
+// is equally a request, and the preamble above is written on both.
 const PROMOTABLE_BACKLOG_WHERE = `
    WHERE t.status = 'backlog'
+     AND t.source IS DISTINCT FROM 'cascade'
      AND task_is_fully_unblocked(t.id)
      AND NOT EXISTS (
            SELECT 1

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.895",
+  "version": "1.19.896",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.895",
+      "version": "1.19.896",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.895",
+  "version": "1.19.896",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.895'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.896'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/promotion_sweep.mjs

@@ -61,6 +61,11 @@ const EXCLUDED = [
   { id: 2000001, title: 'a dependency has not shipped', goal_id: 1000106, why: 'unmetDep' },
   { id: 2000002, title: 'carries an open blocker', goal_id: 1000106, why: 'openBlocker' },
   { id: 2000003, title: 'already out of backlog', goal_id: 1000106, why: 'notBacklog' },
+  // task 1004077. A cascade-filed REQUEST waits on a PERSON, not on a trigger,
+  // so this sweep must never drain it. It is the row most likely to qualify by
+  // accident: cascade.js files with no dependencies at all, so every other
+  // guard here passes it.
+  { id: 2000004, title: 'a cascade request nobody has triaged', goal_id: 1000106, why: 'cascade' },
 ];
 const FIXTURE = [...QUALIFIES, ...EXCLUDED];
 
@@ -69,10 +74,15 @@ function admittedBy(sql, rows) {
   const backlogGuard = /status\s*=\s*'backlog'/i.test(sql);
   const depGuard = /task_is_fully_unblocked\s*\(/i.test(sql);
   const blockerGuard = /task_blockers/i.test(sql) && /b\.status\s*=\s*'open'/i.test(sql);
+  // IS DISTINCT FROM, not <>: source is nullable, and `NULL <> 'cascade'` is
+  // NULL, which would stop promoting every sourceless task instead. A <>
+  // spelling must NOT satisfy this guard.
+  const cascadeGuard = /source\s+IS\s+DISTINCT\s+FROM\s+'cascade'/i.test(sql);
   return rows.filter((r) => {
     if (r.why === 'notBacklog' && backlogGuard) return false;
     if (r.why === 'unmetDep' && depGuard) return false;
     if (r.why === 'openBlocker' && blockerGuard) return false;
+    if (r.why === 'cascade' && cascadeGuard) return false;
     return true;
   });
 }
@@ -135,6 +145,36 @@ await test('a task carrying an open blocker is NOT promoted', async () => {
   assert.ok(!idsOf(out.promoted).includes(2000002), 'and never promoted');
 });
 
+await test('a cascade REQUEST is NOT promoted — it waits on a person, not a trigger', async () => {
+  // task 1004077. This is the regression the whole task exists for. cascade.js
+  // files every generated task at 'backlog' and never 'ready', and tells its
+  // reader it "goes through the board's ordinary triage" — but a cascade row
+  // carries no dependencies, so before this guard it was trivially "fully
+  // unblocked" and this sweep promoted it within a minute of filing. That
+  // emptied the studio, whose queue is `?discipline=artist&status=backlog`:
+  // measured on task 1004037, filed 19:53:57 and promoted 19:54:54.
+  const pool = mkPool();
+  const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  assert.ok(!idsOf(out.candidates).includes(2000004),
+    'a cascade request became a promotion candidate — the source guard is gone from the SELECT, '
+    + 'and every artist review will be swept out of the studio about a minute after it is filed');
+  assert.ok(!idsOf(out.promoted).includes(2000004), 'and never promoted');
+});
+
+await test('the cascade guard is in the SQL as IS DISTINCT FROM, not <>', async () => {
+  // Narrow on purpose. `t.source <> 'cascade'` reads as equivalent and is not:
+  // source is nullable and `NULL <> 'cascade'` is NULL, so the <> spelling
+  // stops promoting every task with no source at all — a much larger, much
+  // quieter bug than the one being fixed.
+  const pool = mkPool();
+  await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });
+  const select = pool.calls.find((c) => /^\s*SELECT/i.test(c.sql)).sql;
+  assert.match(select, /source\s+IS\s+DISTINCT\s+FROM\s+'cascade'/i,
+    'the SELECT must exclude cascade rows with IS DISTINCT FROM');
+  assert.doesNotMatch(select, /source\s*<>\s*'cascade'/i,
+    'the <> spelling silently withholds every sourceless task instead');
+});
+
 await test('a task already out of backlog is NOT touched', async () => {
   const pool = mkPool();
   const out = await dbTasks.promoteUnblockedBacklogTasks(pool, { armed: true });

package/tests/promotion_triggers_skip_cascade.mjs

@@ -0,0 +1,117 @@
+// tests/promotion_triggers_skip_cascade.mjs
+//
+// The SECOND promoter (task 1004077). Static shape guard for core_250, in the
+// style of tests/task_unblocked_open_blocker.mjs's guard for core_245 — and for
+// the same reason: CI runs a DB-free unit gate, so a migration that has not
+// been applied anywhere is otherwise asserted by nothing at all.
+//
+// WHY THE TRIGGERS NEED THEIR OWN GUARD. tests/promotion_sweep.mjs covers the
+// JS sweep. The sweep is not the only thing that promotes. Each of the three
+// migration-163 trigger functions matches a dependency edge that may be
+// anchored at the task OR AT ITS GOAL (`d.from_kind = 'goal' AND d.from_id =
+// t.goal_id`), and a cascade review INHERITS the reviewed task's goal
+// (cascade.js property 3). So a goal-level edge promotes a cascade row that has
+// no dependencies of its own. Fixing only the sweep would have left that path
+// open and made the defect come back intermittently — which is worse than not
+// fixing it, because an intermittent drain is much harder to see than a
+// constant one.
+//
+// What this proves and where the proof stops: that the SQL in the migration
+// file carries the guard, and that no later migration has silently redefined
+// these functions without it. It does not prove the migration applied. That
+// needs Postgres and is called out in the ship notes rather than papered over.
+//
+// Run:  node tests/promotion_triggers_skip_cascade.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync, readdirSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+
+const MIG = 'core_250_cascade_requests_do_not_auto_promote.sql';
+
+// The three promotion triggers, by the state transition each reacts to.
+const TRIGGERS = [
+  'promote_dependents_on_ship',
+  'promote_dependents_on_criterion_satisfy',
+  'promote_dependents_on_goal_achieve',
+];
+
+// Comments carry the rationale; strip them before asserting on the executable
+// body so prose can never stand in for the real SQL.
+const body = read('migrations', MIG).replace(/^\s*--.*$/gm, '').replace(/\s+/g, ' ');
+
+// The body of one function, so a guard present in ONE cannot satisfy an
+// assertion about another — the defect this whole task is about was a guard
+// that existed in one place and not the other.
+function fnBody(name) {
+  const start = body.indexOf(`CREATE OR REPLACE FUNCTION ${name}()`);
+  assert.notEqual(start, -1, `${MIG} does not redefine ${name}`);
+  const after = body.slice(start + 1);
+  const next = after.indexOf('CREATE OR REPLACE FUNCTION');
+  return next === -1 ? after : after.slice(0, next);
+}
+
+const { test, summary } = makeRunner();
+
+await test('core_250 redefines all three promotion triggers', () => {
+  for (const name of TRIGGERS) {
+    assert.match(body, new RegExp(`CREATE OR REPLACE FUNCTION ${name}\\(\\)`), `${name} is redefined`);
+  }
+  assert.doesNotMatch(body, /DROP\s+FUNCTION/i, 'CREATE OR REPLACE only — a DROP would take the triggers with it');
+});
+
+await test('each trigger refuses to promote a cascade row', () => {
+  for (const name of TRIGGERS) {
+    assert.match(fnBody(name), /t\.source IS DISTINCT FROM 'cascade'/,
+      `${name} promotes cascade requests — an artist review reached by a goal-level edge is still `
+      + 'swept out of the studio, and the sweep-only fix does not cover it');
+  }
+});
+
+await test('the guard is IS DISTINCT FROM, never <>', () => {
+  // Narrow on purpose, and not a style note. tasks.source is nullable, so
+  // `NULL <> 'cascade'` is NULL and the <> spelling stops promoting every task
+  // with no source at all — a much larger and much quieter bug than the one
+  // being fixed here.
+  for (const name of TRIGGERS) {
+    assert.doesNotMatch(fnBody(name), /t\.source\s*<>\s*'cascade'/,
+      `${name} uses <>, which withholds every sourceless task instead of every cascade one`);
+  }
+});
+
+await test('nothing else was weakened while adding the guard', () => {
+  // core_250 restates whole function bodies, so it inherits only what it
+  // restates — the exact mechanism by which the open-blocker clause was lost
+  // twice (see tests/task_unblocked_open_blocker.mjs). Assert the guards that
+  // were already there survived the retype.
+  for (const name of TRIGGERS) {
+    const fn = fnBody(name);
+    assert.match(fn, /t\.status = 'backlog'/, `${name} still promotes only from backlog`);
+    assert.match(fn, /t\.kind <> 'spike'/, `${name} still skips spikes`);
+    assert.match(fn, /task_is_fully_unblocked\(t\.id\)/, `${name} still re-checks the shared predicate`);
+    assert.match(fn, /status = 'ready'/, `${name} still promotes to ready`);
+  }
+});
+
+await test('core_250 is the LAST definition of each trigger in migrations/', () => {
+  // The drift tripwire, and the assertion that would have caught migration 177
+  // on the day it landed. A later whole-body redefinition inherits only what it
+  // restates, so this fails the moment someone redefines one of these functions
+  // without carrying the cascade guard forward.
+  const files = readdirSync(join(repoRoot, 'migrations')).filter((f) => f.endsWith('.sql')).sort();
+  for (const name of TRIGGERS) {
+    const defines = new RegExp(`CREATE OR REPLACE FUNCTION ${name}\\(\\)`);
+    const defs = files.filter((f) => defines.test(read('migrations', f)));
+    assert.ok(defs.includes(MIG), `${MIG} defines ${name}`);
+    assert.equal(defs[defs.length - 1], MIG,
+      `a later migration redefines ${name} and must restate the cascade guard: ${defs.join(', ')}`);
+  }
+});
+
+summary('promotion-trigger cascade guard');

package/tests/task_unblocked_open_blocker.mjs

@@ -113,10 +113,22 @@ await test('every OTHER gate still spells "open" the same way', () => {
   // predicate is fixed that guard is belt-and-braces — and it stays, because a
   // sweep that mass-promotes must not inherit a single point of failure from a
   // predicate that has already been reverted twice.
+  // Asserted as the TWO things this test names, not as one verbatim copy of the
+  // whole clause. The literal pin that used to stand here broke on task
+  // 1004077, which ADDED a guard (`t.source IS DISTINCT FROM 'cascade'`) — a
+  // strictly stronger predicate that this test then reported as a regression.
+  // A pin that reds when the clause gets SAFER is testing the string, not the
+  // rule. Both halves are still asserted independently, so neither can be
+  // dropped quietly.
+  const sweepClause = (code('modules', 'lifecycle', 'db-tasks.js')
+    .match(/PROMOTABLE_BACKLOG_WHERE = `([^`]*)`/) || [])[1];
+  assert.ok(sweepClause, 'PROMOTABLE_BACKLOG_WHERE is no longer a single template literal');
+  assert.match(sweepClause, /task_is_fully_unblocked\(t\.id\)/,
+    'the sweep still calls the shared predicate');
   assert.match(
-    code('modules', 'lifecycle', 'db-tasks.js'),
-    /PROMOTABLE_BACKLOG_WHERE = ` WHERE t\.status = 'backlog' AND task_is_fully_unblocked\(t\.id\) AND NOT EXISTS \( SELECT 1 FROM task_blockers tb JOIN blockers b ON b\.id = tb\.blocker_id WHERE tb\.task_id = t\.id AND b\.status = 'open'\)`/,
-    'the sweep still calls the predicate AND keeps its own open-blocker guard'
+    sweepClause,
+    /NOT EXISTS \( SELECT 1 FROM task_blockers tb JOIN blockers b ON b\.id = tb\.blocker_id WHERE tb\.task_id = t\.id AND b\.status = 'open'\)/,
+    'and keeps its OWN open-blocker guard rather than inheriting the predicate as a single point of failure'
   );
 });