@bongos/core 1.19.945 → 1.19.947

package/modules/hall-ui/public/goal-map.js

@@ -0,0 +1,209 @@
+// goal-map.js — the goal map page (task 1003479, goal 1000089; ADR 0227 §6 item 3
+// and its §10.4 amendment). One read, GET /goals/graph, three surfaces from it:
+//   1. the map — the goals tied to another goal by a dependency, drawn in layers;
+//   2. the stand-alone list — the goals that have no edge, which §10.4 says belong
+//      in a list and not as dots on a canvas that has nothing to say about them;
+//   3. the table — EVERY goal, with both directions of each dependency by name.
+//
+// THE TABLE IS THE PAGE AND THE MAP IS THE ENHANCEMENT (ADR 0227 §5). Every fact
+// the picture carries is a cell in the table, on screen by default and not behind
+// a "view as table" toggle. The picture is therefore a `role="img"` figure with a
+// caption that says where the same facts are, and its nodes are NOT links or
+// focus stops — a keyboard or screen-reader reader gets each goal, once, from the
+// table, rather than thirty-six hidden interactive elements from a drawing.
+//
+// THERE IS NO CONTROL that changes what is drawn (ADR 0227 §7): no "show every
+// task", no "densify". The only input is the aggregate the endpoint returns,
+// which carries no task identity, so views A and D are unreachable by
+// construction and not by a flag that happens to be off.
+//
+// The layout is goal-map-lib.js (pure, run by tests/goal_map_lib.mjs). This file
+// draws what it returns, with createElementNS and textContent — the atlas's
+// idiom — so a goal title (builder-authored text) never becomes markup.
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const SVGNS = 'http://www.w3.org/2000/svg';
+  const kit = window.OTBKit;
+  const lib = window.OTBGoalMapLib;
+  const { escapeHtml } = window.OTB;
+  const $ = (id) => document.getElementById(id);
+
+  const hallBase = () => (location.hostname.startsWith('builders.') ? '' : '/builders');
+  const goalHref = (id) => `${hallBase()}/goals#/goal/${encodeURIComponent(id)}`;
+
+  function svgEl(tag, attrs, parent) {
+    const el = document.createElementNS(SVGNS, tag);
+    Object.keys(attrs || {}).forEach((k) => el.setAttribute(k, attrs[k]));
+    if (parent) parent.appendChild(el);
+    return el;
+  }
+  function text(parent, cls, x, y, content) {
+    const t = svgEl('text', { class: cls, x, y }, parent);
+    t.textContent = content;
+    return t;
+  }
+
+  // ---- the map -----------------------------------------------------------------
+
+  function drawGraph(a, lay, cats) {
+    const svg = svgEl('svg', {
+      class: 'gm-svg', viewBox: `0 0 ${lay.width} ${lay.height}`, width: lay.width, height: lay.height,
+      role: 'img', 'aria-labelledby': 'gm-cap', focusable: 'false',
+    });
+    const defs = svgEl('defs', {}, svg);
+    const marker = svgEl('marker', { id: 'gm-arrow', viewBox: '0 0 10 10', refX: 9, refY: 5, markerWidth: 7, markerHeight: 7, orient: 'auto' }, defs);
+    svgEl('path', { class: 'gm-arrowhead', d: 'M0 0 L10 5 L0 10 z' }, marker);
+
+    const edges = svgEl('g', { class: 'gm-edges' }, svg);
+    lay.edges.forEach((e) => {
+      const path = svgEl('path', { class: 'gm-edge', d: e.d, 'stroke-width': e.width, 'marker-end': 'url(#gm-arrow)' }, edges);
+      const dependent = lib.displayTitle(a.byId[e.from]);
+      const dependency = lib.displayTitle(a.byId[e.to]);
+      svgEl('title', {}, path).textContent = `${dependent} waits on ${dependency} — ${lib.plural(e.count, 'task')}`;
+    });
+
+    // The node's WEIGHT (ADR 0227 §6 item 3: "node weight = task count"), as a
+    // fraction of the busiest goal ACTUALLY DRAWN — a scale that means something
+    // on this map, not on the whole corpus most of which never appears here.
+    const maxTotal = lay.nodes.reduce((m, p) => Math.max(m, a.byId[p.id].task_total || 0), 0);
+
+    const nodes = svgEl('g', { class: 'gm-nodes' }, svg);
+    lay.nodes.forEach((p) => {
+      const n = a.byId[p.id];
+      const g = svgEl('g', { class: `gm-node gm-c${lib.colourOf(n, cats)}`, transform: `translate(${p.x} ${p.y})` }, nodes);
+      const cat = n.category ? n.category.label : 'No category';
+      svgEl('title', {}, g).textContent = `${lib.displayTitle(n)} — ${cat} — ${n.task_done} of ${n.task_total} tasks done`
+        + ` — waits on ${lib.plural(n.depends_on || 0, 'goal')}, needed by ${lib.plural(n.depended_on_by || 0, 'goal')}`;
+      svgEl('rect', { class: 'gm-card', width: p.w, height: p.h, rx: 8 }, g);
+      svgEl('rect', { class: 'gm-stripe', width: 6, height: p.h, rx: 3 }, g);
+      text(g, 'gm-name', 16, 22, lib.clip(lib.displayTitle(n), lib.TITLE_CHARS));
+      text(g, 'gm-cat', 16, 38, lib.clip(cat, lib.SUB_CHARS));
+      text(g, 'gm-tasks', 16, 53, `${n.task_done} of ${lib.plural(n.task_total, 'task')} done`);
+      const trackW = p.w - 32;
+      svgEl('rect', { class: 'gm-weight-track', x: 16, y: 60, width: trackW, height: 3, rx: 1.5 }, g);
+      const frac = lib.weightOf(n.task_total, maxTotal);
+      if (frac > 0) svgEl('rect', { class: 'gm-weight-fill', x: 16, y: 60, width: Math.max(3, trackW * frac), height: 3, rx: 1.5 }, g);
+    });
+    return svg;
+  }
+
+  function renderGraph(a, cats, described) {
+    const host = $('gm-graph');
+    if (!a.connected) {
+      host.innerHTML = `<p class="scroll__lede">${escapeHtml(described.graph || described.summary)}</p>`;
+      return;
+    }
+    host.innerHTML = `
+      <figure class="gm-figure">
+        <figcaption id="gm-cap" class="scroll__lede">
+          An arrow runs from the goal that has to ship first to the goal that waits on it, and a thicker line means more
+          tasks are waiting. Every goal in this map, and every dependency, is also in the table below.
+        </figcaption>
+        <div class="gm-scroll" id="gm-scroll" tabindex="0" role="region" aria-label="Goal map — scrolls sideways inside this box"></div>
+      </figure>`;
+    $('gm-scroll').appendChild(drawGraph(a, lib.layout(a), cats));
+  }
+
+  function renderLegend(cats) {
+    const host = $('gm-legend');
+    if (!cats.list.length && !cats.uncategorised) { host.hidden = true; return; }
+    const swatch = (cls) => `<span class="gm-swatch ${cls}" aria-hidden="true"></span>`;
+    host.innerHTML = cats.list.map((c) => `<li>${swatch(`gm-c${c.colour}`)}${escapeHtml(c.label)} <span class="gm-n">${c.count}</span></li>`).join('')
+      + (cats.uncategorised ? `<li>${swatch('gm-cnone')}No category <span class="gm-n">${cats.uncategorised}</span></li>` : '');
+    host.hidden = false;
+  }
+
+  // ---- the stand-alone goals ------------------------------------------------------
+
+  function renderAlone(a) {
+    const section = $('gm-alone-scroll');
+    if (!a.isolated.length || !a.connected) { section.hidden = true; return; }
+    $('gm-alone-lede').textContent = `${lib.plural(a.isolated.length, 'goal')} ${a.isolated.length === 1 ? 'has' : 'have'} no task that waits on another goal’s work, `
+      + 'and none that another goal waits on, so there is nothing to draw between them and another goal. They are listed here instead of drawn as dots.';
+    $('gm-alone').innerHTML = a.isolated.map((id) => {
+      const n = a.byId[id];
+      const label = lib.displayTitle(n);
+      const facts = (n.category ? `${escapeHtml(n.category.label)} · ` : '') + lib.plural(n.task_total, 'task');
+      const inner = `<span>${escapeHtml(label)}</span><span class="gm-n">${facts}</span>`;
+      return n.title
+        ? `<li><a class="fact-chip gm-chip" href="${goalHref(id)}">${inner}</a></li>`
+        : `<li><span class="fact-chip gm-chip">${inner}</span></li>`;
+    }).join('');
+    section.hidden = false;
+  }
+
+  // ---- the table (primary) ----------------------------------------------------------
+
+  const depList = (list) => (list.length
+    ? `<ul class="gm-deps">${list.map((x) => `<li>${escapeHtml(x.title)} <span class="gm-n">· ${lib.plural(x.count, 'task')}</span></li>`).join('')}</ul>`
+    : '<span class="gm-none">—</span>');
+
+  function rowHtml(r) {
+    const title = r.isPrivate
+      ? `<span class="gm-private">${escapeHtml(r.title)}</span>`
+      : `<a class="lb-name" href="${goalHref(r.id)}">${escapeHtml(r.title)}</a>`;
+    return `<tr>
+      <td>${title}</td>
+      <td>${r.category ? escapeHtml(r.category) : '<span class="gm-none">—</span>'}</td>
+      <td class="ledger__num">${r.done} of ${r.total}</td>
+      <td>${depList(r.waits)}</td>
+      <td>${depList(r.needed)}</td>
+      <td>${escapeHtml(r.clusterLabel)}</td>
+      <td>${escapeHtml(r.version)}</td>
+    </tr>`;
+  }
+
+  function renderTable(a) {
+    const section = $('gm-table-scroll');
+    const rows = lib.tableRows(a);
+    section.hidden = false;
+    const pager = kit.makePager('gm', 'hall-goal-map-per-page', { defaultPerPage: 100 });
+    const ledger = kit.makeLedger({
+      mount: $('gm-table'),
+      columns: ['Goal', 'Category', { label: 'Tasks done', class: 'ledger__num' }, 'Waits on', 'Needed by', 'Cluster', 'Version'],
+      rowHtml,
+      emptyMsg: 'No goal carries any work yet.',
+      pager,
+    });
+    ledger.render(rows);
+    const table = $('gm-table').querySelector('table');
+    if (table) table.setAttribute('aria-label', 'Every goal, with what it waits on and what waits on it');
+  }
+
+  // ---- boot ---------------------------------------------------------------------------
+
+  function notice(msg) {
+    $('gm-sub').textContent = msg;
+    $('gm-graph').innerHTML = `<p class="note">${escapeHtml(msg)}</p>`;
+  }
+
+  async function boot() {
+    let payload;
+    try {
+      const res = await fetch(`${API}/goals/graph`, { credentials: 'same-origin', headers: { Accept: 'application/json' } });
+      if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
+      if (!res.ok) throw new Error(`graph → ${res.status}`);
+      payload = await res.json();
+    } catch (err) {
+      console.error('[goal-map] load failed', err);
+      notice('Couldn’t load the goal map right now.');
+      return;
+    }
+    const a = lib.analyse(payload);
+    const cats = lib.categories(a);
+    const described = lib.describe(a);
+    $('gm-sub').textContent = described.summary;
+    if (!a.order.length) {
+      $('gm-graph').innerHTML = kit.emptyStateHtml(described.summary);
+      return;
+    }
+    renderGraph(a, cats, described);
+    renderLegend(cats);
+    renderAlone(a);
+    renderTable(a);
+  }
+
+  boot();
+})();

package/modules/hall-ui/public/goal-map.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "THE GOAL MAP (task 1003479, goal 1000089; ADR 0227 §6 item 3) through modules/ui-design/kit/render.js. The page reads ONE authenticated aggregate, GET /goals/graph, so against the kit's own stub it renders its signed-out / failed-read state — a state the floors must hold in and is rendered here deliberately. To look at the populated map (the layered picture, the stand-alone chips, the table), run it against the hall-preview harness, whose goals__graph.json fixture carries one large cluster, a triple, pairs, a mutual pair (a loop) and a private goal beside the stand-alone majority:\n\n  node scripts/hall-preview/server.js --port 4620 --fixture-me\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/goal-map.states.json --base-in http://localhost:4620 --base-out http://localhost:4620",
+  "page": "/builders/goal-map",
+  "surface": "hall-ui",
+  "stub": { "prefix": "/builders/" },
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/"],
+  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found", "load failed"],
+  "states": {
+    "map": { "auth": true, "actions": [["wait", 1200]], "expect": { "visible": ["#gm-graph"] } },
+    "out": { "auth": false, "actions": [["wait", 600]] }
+  },
+  "reducedMotion": { "auth": true, "actions": [["wait", 1200]] }
+}

package/modules/hall-ui/public/goals.html

@@ -42,6 +42,9 @@
       <div class="page-head page-head--board">
         <h1 class="page-head__h">Goals</h1>
         <p class="page-head__sub" id="goals-sub">Loading goals…</p>
+        <!-- task 1003479: the goal map has no nav slot of its own (the sky's rule —
+             a map that is reachable but not load-bearing), so this is its door. -->
+        <p class="page-head__sub"><a href="/builders/goal-map">See which goals wait on each other →</a></p>
       </div>
 
       <main id="hall-main">

package/modules/lifecycle/goal-graph.js

@@ -0,0 +1,176 @@
+'use strict';
+
+// modules/lifecycle/goal-graph.js — the goal graph's data: one node per goal, one
+// edge per pair of goals whose tasks depend on each other (task 1003479, goal
+// 1000089, ADR 0227 §6 item 3 and its §10.4 amendment).
+//
+// WHY THIS IS AN AGGREGATE AND NOT A TASK LIST. ADR 0227 refused a whole-corpus
+// task map: 3,253 tasks are confetti, and the readable thing is the ~70-goal
+// graph. So the reduction happens in Postgres — task counts per goal (the same
+// buckets goal-rollup.js uses, so the two boards cannot show different numbers)
+// and a COUNT of task-level dependencies that cross a goal boundary — and the
+// payload is a few kilobytes however many tasks exist. Nothing in this file ever
+// returns a task id or a task title.
+//
+// THE EDGE DIRECTION IS "WAITS ON". An edge {from, to, count} says `count` tasks
+// in goal `from` depend on tasks in goal `to`. Only edges between two DIFFERENT
+// goals are kept: a dependency inside one goal is that goal's own business and
+// belongs to the per-goal forest (task 1003480), not to the map of goals.
+//
+// VISIBILITY (ADR 0112's leak rule). A private goal's prose is the secret, not
+// its existence or its counts, so a viewer who is neither a member nor an Archon
+// still gets the node — its task counts and its edges — but `title` and
+// `category` come back null. The client draws that as "a private goal" rather
+// than dropping it, because dropping a node would silently turn its neighbours
+// into isolated dots and misstate the very structure this view exists to show.
+//
+// A CATEGORY IS A LABEL HERE AND NOTHING MORE (ADR 0192): it is decorated onto
+// the node for the reader and no query, filter or edge below reads it.
+
+const api = require('../../src/module-api');
+const { pool } = api;
+const goalCategory = require('./goal-category');
+const { DONE_STATUSES, CUT_STATUSES } = require('./task-status');
+
+// goalGraphRows — the two raw reads. Returns { goals, edges }: `goals` one row per
+// goal that carries at least one task, `edges` one row per ordered pair of goals.
+// deps.pool honours the test seam (NODE_ENV==='test' only), like every helper here.
+async function goalGraphRows({ versionId = null, viewerId = null, viewerIsArchon = false } = {}, deps = {}) {
+  const activePool = (deps.pool && process.env.NODE_ENV === 'test') ? deps.pool : pool;
+  // A repeated ?version= parses as an array; binding that against a ::text
+  // parameter is a driver-level 500, not a clean refusal, so it is flattened to
+  // its first value before it ever reaches the query (GET /goals has the same
+  // gap; fixing it there is a separate task).
+  const version = Array.isArray(versionId) ? (versionId[0] ?? null) : versionId;
+  const [goals, edges] = await Promise.all([
+    activePool.query(
+      // The outer JOIN tasks already requires at least one task per goal, so
+      // there is no separate EXISTS to filter goals with none.
+      `SELECT g.id::text                                          AS goal_id,
+              g.title, g.status, g.version_id, g.category_id,
+              (g.visibility IS DISTINCT FROM 'private'
+                 OR $2::boolean
+                 OR bool_or(gm.builder_id IS NOT NULL)) AS visible,
+              COUNT(*) FILTER (WHERE t.status <> ALL($4::text[]))::int AS task_total,
+              COUNT(*) FILTER (WHERE t.status = ANY($5::text[]))::int  AS task_done
+         FROM goals g
+         JOIN tasks t ON t.goal_id = g.id
+         LEFT JOIN goal_members gm ON gm.goal_id = g.id AND gm.builder_id = $3::bigint
+        WHERE ($1::text IS NULL OR g.version_id = $1)
+        GROUP BY g.id, g.title, g.status, g.version_id, g.category_id
+        ORDER BY g.version_id, g.sort_order, g.id`,
+      [version, viewerIsArchon === true, viewerId, CUT_STATUSES, DONE_STATUSES]
+    ),
+    activePool.query(
+      `SELECT ft.goal_id::text AS from_goal_id,
+              tt.goal_id::text AS to_goal_id,
+              COUNT(*)::int    AS count
+         FROM dependencies d
+         JOIN tasks ft ON d.from_kind = 'task' AND ft.id = d.from_id
+         JOIN tasks tt ON d.to_kind   = 'task' AND tt.id = d.to_id
+         JOIN goals fg ON fg.id = ft.goal_id
+         JOIN goals tg ON tg.id = tt.goal_id
+        WHERE ft.goal_id <> tt.goal_id
+          AND ($1::text IS NULL OR (fg.version_id = $1 AND tg.version_id = $1))
+        GROUP BY ft.goal_id, tt.goal_id
+        ORDER BY ft.goal_id, tt.goal_id`,
+      [version]
+    ),
+  ]);
+  return { goals: goals.rows, edges: edges.rows };
+}
+
+// shapeGraph — the wire shape. Pure, so a test pins it with no database.
+//
+//   nodes: [{ goal_id, title, status, version_id, category, task_total, task_done,
+//             depends_on, depended_on_by }]
+//   edges: [{ from, to, count }]      — `from` waits on `to`
+//   counts: { goals, connected, isolated, edges }
+//
+// `depends_on` / `depended_on_by` are DISTINCT GOAL counts, not task counts: the
+// table this feeds says "waits on 3 goals", and a reader adding up task edges to
+// find out how many goals are involved would get the wrong number.
+//
+// An edge whose endpoint is not among the nodes is DROPPED, not drawn to nowhere.
+// That happens legitimately when a version filter scopes the goals but a stale
+// row lingers, and an edge with a missing end is a line pointing at nothing.
+function shapeGraph({ goals = [], edges = [] } = {}, categoryById = new Map()) {
+  const known = new Set(goals.map((g) => String(g.goal_id)));
+  const kept = [];
+  const seen = new Set();
+  for (const e of edges) {
+    const from = String(e.from_goal_id);
+    const to = String(e.to_goal_id);
+    if (from === to || !known.has(from) || !known.has(to)) continue;
+    const key = `${from}>${to}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    kept.push({ from, to, count: Number(e.count) || 0 });
+  }
+
+  const waitsOn = new Map();
+  const blocks = new Map();
+  for (const e of kept) {
+    if (!waitsOn.has(e.from)) waitsOn.set(e.from, new Set());
+    waitsOn.get(e.from).add(e.to);
+    if (!blocks.has(e.to)) blocks.set(e.to, new Set());
+    blocks.get(e.to).add(e.from);
+  }
+
+  const nodes = goals.map((g) => {
+    const id = String(g.goal_id);
+    const visible = g.visible !== false;
+    const cat = visible && g.category_id != null ? categoryById.get(String(g.category_id)) : null;
+    return {
+      goal_id: id,
+      title: visible ? g.title : null,
+      status: g.status,
+      version_id: g.version_id,
+      category: cat ? { id: String(cat.id), slug: cat.slug, label: cat.label } : null,
+      task_total: Number(g.task_total) || 0,
+      task_done: Number(g.task_done) || 0,
+      depends_on: (waitsOn.get(id) || new Set()).size,
+      depended_on_by: (blocks.get(id) || new Set()).size,
+    };
+  });
+
+  const connected = nodes.filter((n) => n.depends_on + n.depended_on_by > 0).length;
+  return {
+    nodes,
+    edges: kept,
+    counts: { goals: nodes.length, connected, isolated: nodes.length - connected, edges: kept.length },
+  };
+}
+
+// goalGraph — read + shape. `categories` is injectable so the whole path runs in a
+// test with a fake pool and no category table.
+async function goalGraph(opts = {}, deps = {}) {
+  const [rows, byId] = await Promise.all([
+    goalGraphRows(opts, deps),
+    (deps.categoryIndex || goalCategory.categoryIndex)(deps),
+  ]);
+  return shapeGraph(rows, byId);
+}
+
+// goalGraphHandler — GET /goals/graph. A factory, so a test drives it with a stub
+// read and no database (the goal-category.js handler precedent). Identity comes
+// from the authenticated request, never the query: the viewer decides whether a
+// private goal's title comes back, and a caller-supplied id would let anyone ask
+// as somebody else.
+function goalGraphHandler({ read = goalGraph, log = console } = {}) {
+  return async function getGoalGraph(req, res) {
+    try {
+      const graph = await read({
+        versionId: (req.query && req.query.version) || null,
+        viewerId: req.builder.id,
+        viewerIsArchon: req.builder.rank === 'archon',
+      });
+      return res.json(graph);
+    } catch (err) {
+      log.error('[gds] GET /goals/graph', err);
+      return res.fail('graph_failed', { status: 500, message: 'internal error' });
+    }
+  };
+}
+
+module.exports = { goalGraph, goalGraphRows, shapeGraph, goalGraphHandler };

package/modules/lifecycle/routes/goals.js

@@ -30,6 +30,7 @@ const goalSuggest = require('../goal-suggest.js'); // task 1003062 — pre-creat
 const goalEdits = require('../goal-edits.js'); // task 1003102 — goal self-edit handlers
 const goalCategory = require('../goal-category.js'); // task 1003275 — the ADVISORY human category (gates nothing)
 const goalRollup = require('../goal-rollup.js'); // task 1003278 — per-goal rollups computed in SQL, not in the browser
+const goalGraph = require('../goal-graph.js'); // task 1003479 — the goal graph: nodes + cross-goal edges, aggregated in SQL
 const { suggestCriteria } = require('../criterion-suggest');
 const { classifyTaskKind, VALID_KINDS, WRITABLE_DISCIPLINES, resolveWriteDiscipline, TASK_FIELD_BOUNDS } = require('../task-classifier');
 const { validateOrRespond, parseId, LIMITS } = api;
@@ -210,6 +211,9 @@ module.exports = function buildGoalsRouter() {
     }
   });
 
+  // rank: any-builder — GET /goals/graph, the goal board's map (task 1003479, ADR 0227); before /goals/:id.
+  router.get('/goals/graph', auth.requireBuilder, goalGraph.goalGraphHandler({ log }));
+
   // GET /goals?version=&status= — list goals (read).
   // rank: any-builder — viewing the goal board.
   router.get('/goals', auth.requireBuilder, async (req, res) => {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.945",
+  "version": "1.19.947",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.945",
+      "version": "1.19.947",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.945",
+  "version": "1.19.947",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1277,7 +1277,7 @@ const CHECKS = [
   // one (ADR 0289). Rationale + the seam→consumer table live in that file.
   require('./seam-wiring-guard.js').checkSeamWiring,
   require('./home-isolation-guard.js').checkHomeIsolation, // Check 34 — task 1003763: a test that sets HOME for a child without USERPROFILE isolates NOTHING on win32, so it silently stops testing what its comment says. Three tasks fixed this one site at a time. Rationale in that file.
-  require('./scope-map-guard.js').checkDevsecopsOwnsItsChecks, // Check 35 — task 1003949: a check file no MODULE_SCOPE_MAP key owns cannot be authorized by the goal scoped to own it, and the list drifts once per new check. Rationale in that file.
+  ...['checkDevsecopsOwnsItsChecks', 'checkEveryModuleDirIsScoped', 'checkNoNewUnownedRoot'].map((k) => require('./scope-map-guard.js')[k]), // Check 35 — task 1003949: a check file no MODULE_SCOPE_MAP key owns cannot be authorized by the goal scoped to own it, and the list drifts once per new check. Check 36 — task 1004132: the same defect one level up, a carved module whose own directory no key claims (modules/specialities/ shipped that way). Sharing the line per the ratchet convention above. Rationale in that file.
   require('./adr-namespace.js').checkAdrNumbering, require('./exec-path-guard.js').checkExecPathsStatic, // Check 32 — task 1003371 / B50: what the server EXECUTES, out of whose tree — the blind spot all three 2026-08-29 CRITICALs shared. Rationale + reviewed exemptions live in that file. Sharing Check 31's line (the 19c/19d + 23/24 precedent above): fitness.js is AT the 1,500 ratchet and a new check cannot afford a line until task 1003825 buys it back.
 ];
 

package/scripts/gds/scope-map-guard.js

@@ -117,4 +117,184 @@ function checkDevsecopsOwnsItsChecks() {
       + 'unless CI says otherwise (task 1003949).',
   };
 }
-module.exports = { checkDevsecopsOwnsItsChecks, siblingRequires, unownedBy, FITNESS };
+// PURE — every module directory on disk, by key. A module is a modules/<key>/ dir
+// carrying module.json (the ADR 0083 manifest), which is the same structural test
+// the loader's discoverModules() uses: a key is what has a manifest, never a
+// hand-kept roster. Exported so the scan is testable against a fixture tree —
+// an empty result here looks identical to a clean repo, which is the failure the
+// sibling check above exists to refuse.
+function moduleDirsOnDisk(modulesRoot) {
+  let entries = [];
+  try { entries = fs.readdirSync(modulesRoot, { withFileTypes: true }); } catch { return []; }
+  return entries
+    .filter((e) => e.isDirectory() && fs.existsSync(path.join(modulesRoot, e.name, 'module.json')))
+    .map((e) => e.name)
+    .sort();
+}
+
+// A carved module whose own directory no MODULE_SCOPE_MAP key claims (task 1004132).
+//
+// THE DRIFT THIS STOPS, and it is the sibling of the check above rather than a new
+// idea: modules/specialities/ shipped a full module — manifest, db slice, routes, two
+// migrations — with no key here at all. scopeSubset() therefore resolved every file in
+// it to no territory, so a goal scoped to `specialities` was refused out_of_scope for
+// touching the module it is named after. It was the ONLY on-disk module in that state,
+// which is exactly why nobody noticed: 21 of 22 were fine.
+//
+// The rule is deliberately narrow. It does NOT require every repo path to have an
+// owner — src/, scripts/ and bin/ are unowned ON PURPOSE (ADR 0086: a goal grants
+// authority BOUNDED to module territory, and POST /tasks stays Archon-only for
+// ungoverned creation), so a broader "every root is owned" check would encode the
+// opposite of the design. What must hold is narrower and absolute: if a directory
+// declares itself a module, a goal must be able to be scoped to it.
+function checkEveryModuleDirIsScoped() {
+  const name = 'every carved module owns its own directory (task 1004132)';
+  const dirs = moduleDirsOnDisk(path.join(REPO_ROOT, 'modules'));
+
+  // Same anti-vacuity rule as the check above: this repo HAS modules, so an empty
+  // scan means the manifest test broke, not that the tree is clean.
+  if (dirs.length === 0) {
+    return {
+      name,
+      ok: false,
+      hardFail: true,
+      violations: ['modules/: found NO directory carrying a module.json. That is a broken scan, '
+        + 'not a clean result — moduleDirsOnDisk() in scope-map-guard.js needs looking at.'],
+      warnings: [],
+      note: 'the scan produced an empty set, which cannot be right.',
+    };
+  }
+
+  const { MODULE_SCOPE_MAP } = require('../../src/bongos/module-scope-map.js');
+  const globsOf = (v) => (Array.isArray(v) ? v : (v && v.globs) || []);
+  const claimed = new Set();
+  for (const v of Object.values(MODULE_SCOPE_MAP)) {
+    // A key may claim another module's dir (a cross-cutting owner), so collect every
+    // modules/<key>/ glob from EVERY key rather than only from the same-named one.
+    for (const g of globsOf(v)) {
+      const m = /^modules\/([^/]+)\/$/.exec(g);
+      if (m) claimed.add(m[1]);
+    }
+  }
+
+  const unscoped = dirs.filter((k) => !claimed.has(k));
+  const violations = unscoped.map((k) => `modules/${k}/ carries a module.json but no MODULE_SCOPE_MAP `
+    + `key claims it — scopeSubset() resolves the whole module to no territory, so a goal scoped to `
+    + `'${k}' is denied out_of_scope for touching the module it is named after. Add a '${k}' key `
+    + `owning 'modules/${k}/'.`);
+
+  return {
+    name,
+    ok: unscoped.length === 0,
+    hardFail: unscoped.length > 0,
+    violations,
+    warnings: [],
+    note: `${dirs.length} carved module(s) on disk, each claimed by a MODULE_SCOPE_MAP key.`,
+  };
+}
+
+// PURE — every tracked top-level root, as `name` or `name/`. Exported so the scan
+// is testable against a fixture list rather than only against this repo.
+function trackedRoots(files) {
+  const out = new Set();
+  for (const f of files || []) {
+    if (!f) continue;
+    const i = f.indexOf('/');
+    out.add(i === -1 ? f : `${f.slice(0, i)}/`);
+  }
+  return [...out].sort();
+}
+
+// PURE — does ANY glob reach into this root? A root is "carved" the moment one
+// does; src/ and scripts/ are partially owned and that is the normal in-progress
+// state ADR 0086 §4 describes ("auto-tightens as ADR 0083 moves code into
+// modules/<key>/"). What this answers is the narrower question: is this root
+// territory the scope map has never heard of at all?
+function rootIsTouched(root, globs) {
+  return (globs || []).some((g) => g === root || g.startsWith(root) || root.startsWith(g));
+}
+
+// New unowned territory, and stale entries in the record of the old (task 1004132).
+//
+// THE GAP THIS CLOSES, and it is the one the grade round caught me leaving open.
+// I had argued that because the core is unowned BY DESIGN (ADR 0086: authority is
+// bounded to module territory, POST /tasks stays Archon-only for ungoverned
+// creation), no general check should exist. That is half right and wholly
+// insufficient: the design says WHICH roots may be unowned, it does not stop the
+// set growing. Without this, a new top-level directory lands tomorrow, no module
+// claims it, and nothing anywhere fails — the exact shape that let
+// modules/specialities/ sit unowned for its whole life.
+//
+// So the decision is recorded as DATA (UNOWNED_ROOTS in module-scope-map.js) and
+// this check enforces it in BOTH directions, the discipline
+// tests/host_topology_skips.mjs uses for its own allowlist:
+//   - a root that is neither carved nor listed  -> new territory, fail
+//   - a listed root that is now carved or gone  -> stale entry, fail
+// A one-directional check would let the list rot into a rubber stamp.
+function checkNoNewUnownedRoot(fileList) {
+  const name = 'no new unowned top-level root (task 1004132)';
+  let files = fileList;
+  if (!files) {
+    files = require('node:child_process')
+      .execFileSync('git', ['ls-files'], { cwd: REPO_ROOT, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
+      .trim().split('\n').filter(Boolean);
+  }
+  const roots = trackedRoots(files);
+
+  // Same anti-vacuity rule as its two siblings: this repo HAS tracked files, so an
+  // empty scan is a broken `git ls-files`, not a clean tree.
+  if (roots.length === 0) {
+    return {
+      name,
+      ok: false,
+      hardFail: true,
+      violations: ['git ls-files returned NO tracked files. That is a broken scan, not a clean '
+        + 'result — trackedRoots() in scope-map-guard.js needs looking at.'],
+      warnings: [],
+      note: 'the scan produced an empty set, which cannot be right.',
+    };
+  }
+
+  const map = require('../../src/bongos/module-scope-map.js');
+  const globs = [...map.globsForModules(map.moduleKeys()), ...map.SHARED_GLOBS];
+  const listed = map.UNOWNED_ROOTS || {};
+
+  const violations = [];
+  for (const r of roots) {
+    if (rootIsTouched(r, globs)) {
+      if (Object.prototype.hasOwnProperty.call(listed, r)) {
+        violations.push(`'${r}' is listed in UNOWNED_ROOTS but a module glob now reaches it — the `
+          + 'entry is stale. Delete it; a root leaving that list is the map tightening as intended.');
+      }
+      continue;
+    }
+    if (!Object.prototype.hasOwnProperty.call(listed, r)) {
+      violations.push(`'${r}' is tracked but NO module glob and no SHARED_GLOBS entry reaches it, and `
+        + 'it is not in UNOWNED_ROOTS. New unowned territory: no goal can ever authorize a task that '
+        + `touches it. Give it an owning module, or add it to UNOWNED_ROOTS in module-scope-map.js `
+        + 'with the reason it has none.');
+    }
+  }
+  for (const r of Object.keys(listed)) {
+    if (!roots.includes(r)) {
+      violations.push(`UNOWNED_ROOTS lists '${r}', which is not a tracked root any more — stale entry, `
+        + 'delete it so the list keeps meaning something.');
+    }
+  }
+
+  return {
+    name,
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${roots.length} tracked root(s); ${Object.keys(listed).length} recorded as deliberately `
+      + 'unowned (ADR 0086 — core is Archon territory). Shrink-only: an entry may leave, not appear silently.',
+  };
+}
+
+module.exports = {
+  checkDevsecopsOwnsItsChecks, siblingRequires, unownedBy, FITNESS,
+  checkEveryModuleDirIsScoped, moduleDirsOnDisk,
+  checkNoNewUnownedRoot, trackedRoots, rootIsTouched,
+};