@bongos/core 1.19.971 → 1.19.972

package/modules/lifecycle/routes/goals.js

@@ -215,7 +215,7 @@ module.exports = function buildGoalsRouter() {
   // rank: any-builder — GET /goals/graph, the goal board's map (task 1003479, ADR 0227); before /goals/:id.
   router.get('/goals/graph', auth.requireBuilder, goalGraph.goalGraphHandler({ log }));
 
-  // GET /goals?version=&status= — list goals (read).
+  // GET /goals?version=&status= — list goals (read); each row carries `viewer_is_member` for the reader.
   // rank: any-builder — viewing the goal board.
   router.get('/goals', auth.requireBuilder, async (req, res) => {
     const { version, status } = req.query;
@@ -223,7 +223,7 @@ module.exports = function buildGoalsRouter() {
       return res.fail('bad_status', 400, { valid: VALID_GOAL_STATUSES });
     }
     try {
-      const goals = await db.listGoals({ versionId: version || null, status: status || null });
+      const goals = await db.listGoals({ versionId: version || null, status: status || null, viewerId: req.builder.id });
       // task 1003275: ONE category query decorates the whole board (never a join
       // per goal). Purely a label for the reader — nothing downstream branches on it.
       const byId = await goalCategory.categoryIndex();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.971",
+  "version": "1.19.972",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.971",
+      "version": "1.19.972",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.971",
+  "version": "1.19.972",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1308,6 +1308,9 @@ const CHECKS = [
   checkCoreNeverImportsModule,
   checkModulesImportOnlyApi,
   checkScopeMapImportsProtected,
+  // Check 36 — task 1002900: a carved module with no roster key walls nothing. Extracted
+  // to its own file (the role-pack-guard.js precedent) to keep fitness.js under the size ratchet.
+  () => require('./scope-roster-guard.js').checkScopeRosterCoversModules({ repoRoot: REPO_ROOT, discoveredModuleKeys }),
   checkCoreCarriesNoModuleCode,
   checkKernelImportsNoDomain,
   checkModuleMigrationsAdditive,

package/scripts/gds/scope-roster-guard.js

@@ -0,0 +1,118 @@
+// scripts/gds/scope-roster-guard.js
+//
+// WHAT. The fitness check behind the module scope roster (task 1002900): every module
+// discovered at modules/<key>/module.json must have a covering key in MODULE_GLOBS
+// (src/bongos/module-scope-map.js).
+//
+// WHY IT IS A HARD FAIL, when the runtime symptom is a denial rather than a crash.
+// The roster is maintained by HAND. A module lands, nobody adds the entry, and any goal
+// scoped to that work hits an authorize-NOTHING wall: goal-scope-check.check() denies
+// with empty_scope / unknown_scope. Nothing announces it — it surfaces only when someone
+// tries to set a goal's wall and cannot, which is long after the module landed and far
+// from the edit that caused it. CI is the only place the gap is visible at the moment it
+// is created.
+//
+// It has happened three times by hand: task 1002690 (provisioning + public-landing,
+// goal 1000059), task 1002322 (platform-identity, goal 1000046) and `agents`, the
+// instance this check was filed for. Each was fixed after someone tripped over it.
+//
+// WHY SUBSET AND NOT EQUALITY. The roster legitimately carries keys with no
+// modules/<key>/ directory, for two different reasons, and equality would fail on all
+// five of them in this tree:
+//   - NON-MODULE SCOPES — `kernel`, `methodology`, `devsecops` are surfaces, not modules.
+//   - ABSENT MODULES — `art-pipeline`, `game` are rostered but not present in this
+//     instance (ADR 0108: a host may carry a different module set).
+// So the invariant is one-directional: every DISCOVERED module must be rostered; a
+// rostered key with no module is not a fault. Getting that backwards would produce a
+// check nobody can keep green, which is worse than no check.
+//
+// Extracted from fitness.js (which the size ratchet caps) following the
+// role-pack-guard.js precedent. The pure scanner is exported for tests/fitness_scope_roster.mjs.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// The machinery already existed — fitness.js's discoveredModuleKeys() feeds the
+// kernel-machinery check — but nothing cross-checked it against moduleKeys().
+// checkScopeMapImportsProtected guards HOW `protected` is derived, not WHETHER every
+// module is listed.
+
+// SCOPE: modules/ ONLY — the two named orphans, decided rather than left open.
+// Task 1002900 asked for a ruling on two files said to be covered by no glob. Both
+// answers changed when checked against origin/main on 2026-09-22:
+//   - scripts/gds/fitness.js  — NOT uncovered. The `devsecops` key matches it. The row's
+//                               claim was stale.
+//   - src/server.js           — does not exist any more.
+//   - src/platform-server.js  — genuinely uncovered, and DELIBERATELY still is.
+// This check asserts what its name says: every carved MODULE has a roster key. Widening
+// it to arbitrary src/ entrypoints is a different question about a different registry —
+// `kernel` lists individual files by hand, so "should platform-server join it" is a call
+// for whoever owns that scope, not a side effect of adding a module-coverage lint. Left
+// as a recorded decision rather than an exemption entry, because there is nothing to
+// exempt: modules/ is the stated scope and platform-server.js was never in it.
+
+const SCOPE_ROSTER_REL = 'src/bongos/module-scope-map.js';
+
+function scanScopeRosterCoverage({ discovered, rostered, globs, exists }) {
+  const missing = discovered.filter((k) => !rostered.includes(k)).sort();
+  const violations = missing.map((k) =>
+    `module '${k}' (modules/${k}/module.json) has no key in ${SCOPE_ROSTER_REL} MODULE_GLOBS — `
+    + 'any goal scoped to it will deny with empty_scope/unknown_scope');
+
+  // The mirror-image rot, reported as a WARNING rather than a failure: a roster glob that
+  // names an exact FILE which no longer exists. It cannot wall anything off, so it is a
+  // silent hole in a scope rather than a build breakage — and unlike a missing key it has
+  // no runtime symptom at all. Only exact file paths are checked; a directory glob may
+  // legitimately point at an absent optional module (see SUBSET above).
+  const warnings = [];
+  for (const [key, list] of Object.entries(globs || {})) {
+    for (const g of list || []) {
+      if (g.endsWith('/') || g.includes('*')) continue;
+      if (!exists(g)) warnings.push(`${SCOPE_ROSTER_REL}: scope '${key}' lists '${g}', which does not exist — dead entry, walls nothing`);
+    }
+  }
+  return { violations, warnings };
+}
+
+// REPO_ROOT and discoveredModuleKeys come from fitness.js, which owns module discovery
+// (it unions across MODULE_ROOTS per ADR 0108). Passed in rather than re-derived so the
+// two can never disagree about what a module is.
+function checkScopeRosterCoversModules({ repoRoot, discoveredModuleKeys }) {
+  let res;
+  try {
+    const scopeMap = require(path.join(repoRoot, SCOPE_ROSTER_REL));
+    res = scanScopeRosterCoverage({
+      discovered: discoveredModuleKeys(),
+      rostered: scopeMap.moduleKeys(),
+      globs: scopeMap.MODULE_GLOBS,
+      exists: (g) => fs.existsSync(path.join(repoRoot, g)),
+    });
+  } catch (e) {
+    // FAILS OPEN, deliberately and narrowly. This catch fires only if requiring the scope
+    // map throws — i.e. the file is syntactically broken — and that is not this check's
+    // job to report: src/bongos/module-scope-map.js has its own unit coverage, and every
+    // sibling scope check (checkScopeMapImportsProtected, the ownership checks) would red
+    // on the same input. A coverage lint that hard-fails on someone else's syntax error
+    // adds a second confusing message to a build that is already failing for the real
+    // reason. The skip is surfaced as a warning rather than swallowed.
+    return {
+      name: 'every discovered module has a scope-roster key (task 1002900)',
+      ok: true, hardFail: false, violations: [], warnings: [`skipped: ${e.message}`],
+      note: `could not load ${SCOPE_ROSTER_REL} — check skipped.`,
+    };
+  }
+  return {
+    name: 'every discovered module has a scope-roster key (task 1002900)',
+    ok: res.violations.length === 0,
+    hardFail: res.violations.length > 0,
+    violations: res.violations,
+    warnings: res.warnings,
+    note: `every modules/<key>/ carrying module.json has a MODULE_GLOBS entry, so a goal can be `
+      + `scoped to it. Subset, not equality: a rostered key with no module is legitimate `
+      + `(non-module scopes like kernel/methodology/devsecops, and modules absent from this instance).`,
+  };
+}
+
+module.exports = { checkScopeRosterCoversModules, scanScopeRosterCoverage, SCOPE_ROSTER_REL };

package/src/bongos/module-scope-map.js

@@ -451,6 +451,7 @@ const MODULE_GLOBS = {
     'scripts/gds/fitness-checks-packaging.js', 'scripts/gds/fitness-checks-route-pins.js',
     'scripts/gds/fitness-checks-vocabulary.js', 'scripts/gds/fitness-checks-write-validation.js',
     'scripts/gds/fitness-migration-contraction.js', 'scripts/gds/role-pack-guard.js',
+    'scripts/gds/scope-roster-guard.js',
     'scripts/gds/route-shadow-guard.js', 'scripts/gds/routine-schedule.js',
     'scripts/gds/seam-wiring-guard.js', 'scripts/gds/skill-preflight.js',
     'scripts/gds/test-path-guard.js', 'scripts/gds/version-literal-guard.js',

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.971'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.972'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/fitness_scope_roster.mjs

@@ -0,0 +1,117 @@
+// tests/fitness_scope_roster.mjs
+//
+// Task 1002900 — the scope roster in src/bongos/module-scope-map.js (MODULE_GLOBS) is
+// maintained by hand, and nothing asserted that every carved module has a covering key.
+// A module lands in modules/<key>/, nobody adds the entry, and any goal scoped to that
+// work hits an authorize-NOTHING wall: goal-scope-check.check() denies with
+// empty_scope / unknown_scope. It surfaces only when someone tries to set a goal's wall.
+//
+// Three hand-fixed instances before this check existed: task 1002690 (provisioning +
+// public-landing), task 1002322 (platform-identity), and `agents` — the one this row
+// was filed for, since added at module-scope-map.js:322.
+//
+// SUBSET, NOT EQUALITY. The roster legitimately carries keys with no modules/<key>/ dir,
+// for two distinct reasons, and equality would fail on all five in this tree:
+//   - non-module SCOPES: kernel, methodology, devsecops
+//   - modules ABSENT from this instance: art-pipeline, game (ADR 0108)
+// So the invariant is one-directional. These tests pin that direction explicitly,
+// because getting it wrong turns a useful check into one nobody can keep green.
+//
+// Run:  node --test tests/fitness_scope_roster.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { discoveredModuleKeys } = require(path.join(REPO_ROOT, 'scripts/gds/fitness.js'));
+// The check lives in its own file (the role-pack-guard.js precedent) so fitness.js stays
+// under the size ratchet; module discovery stays in fitness.js, which owns it.
+const { scanScopeRosterCoverage } = require(path.join(REPO_ROOT, 'scripts/gds/scope-roster-guard.js'));
+const scopeMap = require(path.join(REPO_ROOT, 'src/bongos/module-scope-map.js'));
+
+const nothingExists = () => false;
+const allExist = () => true;
+
+test('THE BUG: a discovered module with no roster key is a violation', () => {
+  const { violations } = scanScopeRosterCoverage({
+    discovered: ['lifecycle', 'agents'],
+    rostered: ['lifecycle'],
+    globs: {},
+    exists: allExist,
+  });
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /'agents'/, 'must name the uncovered module');
+  assert.match(violations[0], /empty_scope|unknown_scope/,
+    'and must name the symptom, since that is how this is actually discovered');
+});
+
+test('SUBSET NOT EQUALITY: a rostered key with no module is NOT a fault', () => {
+  // kernel/methodology/devsecops are surfaces, not modules; art-pipeline/game may be
+  // absent from a given instance. Failing on these would make the check unkeepable.
+  const { violations } = scanScopeRosterCoverage({
+    discovered: ['lifecycle'],
+    rostered: ['lifecycle', 'kernel', 'methodology', 'devsecops', 'art-pipeline', 'game'],
+    globs: {},
+    exists: allExist,
+  });
+  assert.deepEqual(violations, []);
+});
+
+test('several uncovered modules are all reported, sorted', () => {
+  const { violations } = scanScopeRosterCoverage({
+    discovered: ['zeta', 'alpha', 'lifecycle'],
+    rostered: ['lifecycle'],
+    globs: {},
+    exists: allExist,
+  });
+  assert.equal(violations.length, 2, 'one line per uncovered module — not just the first');
+  assert.match(violations[0], /'alpha'/);
+  assert.match(violations[1], /'zeta'/);
+});
+
+test('a dead exact-file glob is a WARNING, never a failure', () => {
+  // The mirror-image rot: a roster entry naming a file that no longer exists cannot wall
+  // anything off, but it breaks no build either — so it is reported, not enforced.
+  const { violations, warnings } = scanScopeRosterCoverage({
+    discovered: [], rostered: [],
+    globs: { kernel: ['server.js'] },
+    exists: nothingExists,
+  });
+  assert.deepEqual(violations, [], 'a dead glob must not fail the build');
+  assert.equal(warnings.length, 1);
+  assert.match(warnings[0], /server\.js/);
+  assert.match(warnings[0], /walls nothing/);
+});
+
+test('directory and wildcard globs are exempt from the existence warning', () => {
+  // A directory glob may legitimately point at an optional module absent from this
+  // instance — warning on those would bury the real signal in noise.
+  const { warnings } = scanScopeRosterCoverage({
+    discovered: [], rostered: [],
+    globs: { game: ['modules/game/', 'src/**/game-*.js'] },
+    exists: nothingExists,
+  });
+  assert.deepEqual(warnings, []);
+});
+
+test('THE REAL TREE: every discovered module is rostered (the check must land green)', () => {
+  // Last, and paired with the fixtures above: alone this would pass against a scanner
+  // that always returns [].
+  const { violations } = scanScopeRosterCoverage({
+    discovered: discoveredModuleKeys(),
+    rostered: scopeMap.moduleKeys(),
+    globs: {},
+    exists: allExist,
+  });
+  assert.deepEqual(violations, [],
+    'a module was carved without a MODULE_GLOBS key — any goal scoped to it denies everything');
+});
+
+test('agents specifically is rostered (the instance this row was filed for)', () => {
+  assert.ok(scopeMap.moduleKeys().includes('agents'));
+  assert.ok(discoveredModuleKeys().includes('agents'), 'and it is a real discovered module, not just a roster entry');
+});

package/tests/goal_mine_lens.mjs

@@ -0,0 +1,233 @@
+// tests/goal_mine_lens.mjs — the goal board's half of the hall's "mine" lens:
+// the goals you are added on, and inside one goal, the tasks you are holding.
+//
+// Two things are pinned here, and both are the kind that render fine while being
+// wrong:
+//
+//   * "My goals" NOW READS THE ROW. The lens used to answer membership out of the
+//     per-goal DETAIL prefetch — a best-effort fan-out. When that fan-out had not
+//     landed, or had failed, every goal answered "not a member" and the lens
+//     returned an empty board: an assertion about the READER, manufactured out of
+//     a failed fetch. GET /goals now carries `viewer_is_member`, so the lens has
+//     evidence that arrives with the list it is filtering.
+//   * A GOAL'S TO-DO LIST CAN BE NARROWED TO YOUR OWN CLAIMS, which is the board's
+//     "Only mine" question scoped to one goal.
+//
+// Executes the REAL goals-page.js + goals-render.js in a vm against the stub DOM
+// this repo uses in place of jsdom — the tests/goal_criterion_confirm_ui.mjs
+// precedent, and for its stated reason: it is the only way a renderer bug is
+// caught rather than a source string.
+//
+// Run:  node --test tests/goal_mine_lens.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const hall = (f) => fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public', f), 'utf8');
+const TASK_LIB_SRC = hall('task-lib.js');
+const GOALS_LIB_SRC = hall('goals-lib.js');
+// goal-forest-lib.js is loaded so the detail view's dependency forest does not
+// throw on the #/goal/N tests; nothing here asserts on it. It is a UMD module
+// that attaches to the sandbox global rather than to `window`, so it is bridged
+// across by hand after it runs.
+const GOAL_FOREST_LIB_SRC = hall('goal-forest-lib.js');
+const GOAL_FOREST_RENDER_SRC = hall('goal-forest-render.js');
+const GOALS_RENDER_SRC = hall('goals-render.js');
+const GOALS_PAGE_SRC = hall('goals-page.js');
+
+const ME_ID = 1;
+
+// Boot goals-page.js.
+//   `filters`  — control values seeded BEFORE boot, so the first render already
+//                runs under the lens (the stub filter bar fires no onChange).
+//   `detailsFail` — the per-goal detail prefetch rejects, which is the exact
+//                state that used to empty the "My goals" board.
+async function boot({
+  hash = '',
+  goals = [],
+  tasks = [],
+  activeClaims = [],
+  filters = {},
+  detailsFail = false,
+} = {}) {
+  const requests = [];
+  const els = new Map();
+  const makeEl = (key) => ({
+    _key: key, dataset: {}, style: {}, title: '', textContent: '', hidden: false,
+    disabled: false, value: '', innerHTML: '',
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; }, removeAttribute() {},
+    appendChild() {}, focus() {}, click() {}, querySelectorAll() { return []; },
+    addEventListener() {},
+  });
+  const $ = (sel) => {
+    if (!sel) return null;
+    if (!els.has(sel)) els.set(sel, makeEl(sel));
+    return els.get(sel);
+  };
+  // Seed the lens controls before anything reads them.
+  for (const [id, value] of Object.entries(filters)) $(`#${id}`).value = value;
+
+  const api = {
+    request(method, p) {
+      requests.push([method, p]);
+      const reply = (data, status = 200) => Promise.resolve({ status, ok: true, data });
+      if (method === 'GET' && /\/me$/.test(p)) return reply({ builder: { id: ME_ID, rank: 'metic' }, active_claims: [] });
+      if (method === 'GET' && /\/goals$/.test(p)) return reply({ goals });
+      if (method === 'GET' && /\/goals\/\d+$/.test(p)) {
+        if (detailsFail) return Promise.resolve({ status: 500, ok: false, data: null });
+        const id = Number(p.match(/\/goals\/(\d+)$/)[1]);
+        const goal = goals.find((g) => Number(g.id) === id) || goals[0];
+        return reply({ goal, members: [], criteria: [], dependencies: [] });
+      }
+      if (method === 'GET' && /\/tasks\/claimable/.test(p)) return reply({ claimable: [], active_claims: activeClaims });
+      if (method === 'GET' && /\/tasks\?/.test(p)) return reply({ tasks });
+      if (method === 'GET' && /\/conflicts$/.test(p)) return reply({ pairs: [] });
+      if (method === 'GET' && /\/requests$/.test(p)) return reply({ requests: [] });
+      return reply({});
+    },
+  };
+
+  const windowObj = {
+    OTB: {
+      roleAxisLabel: () => 'Role',
+      roleLabel: (d) => String(d || ''),
+      roleOptions: () => [{ value: '', label: '— any —' }],
+      roleIsUnset: () => true,
+      ROLE_UNSET: 'unclassified',
+      KIND_UNSET: 'unclassified',
+      kindIsUnset: () => true,
+      escapeHtml: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch])),
+      $, fmtNum: (n) => String(n), fmtDate: () => '', rankLabel: (r) => r,
+      toast() {}, categoryChip: () => '', fillKindFilter() {},
+    },
+    OTBKit: {
+      makePager: (prefix) => ({ prefix, page: 1, perPage: 50 }),
+      paginate: (rows) => rows,
+      wirePager() {}, pagerBarHtml: () => '',
+      makeTabs: () => ({ setCount() {}, select() {}, activate() {} }),
+      makeFilterBar() {},
+      emptyStateHtml: (m) => `<div class="kit-empty">${m}</div>`,
+      skeletonRows: () => '',
+      ageChipHtml: () => '',
+    },
+    OTBBranding: { currencyLabel: () => 'credits', taskSettled: () => false, taskCreditValue: () => 0 },
+    OTBTaskDetail: { href: (id) => `/task/${id}`, open() {} },
+    BongosClient: { createClient: () => api },
+    location: { hash, pathname: '/builders/goals', search: '', assign() {} },
+    addEventListener() {},
+    scrollTo() {},
+    matchMedia: () => ({ matches: false, addEventListener() {} }),
+    localStorage: { getItem() { return null; }, setItem() {} },
+  };
+  const documentObj = {
+    body: { dataset: {} },
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } } },
+    getElementById: (id) => $(`#${id}`),
+    querySelector: (sel) => $(sel),
+    querySelectorAll: () => [],
+    createElement: () => makeEl('created'),
+    addEventListener() {},
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console, setTimeout, clearTimeout, Set, Map, Number, String, Array, Object,
+    JSON, Math, encodeURIComponent, Promise, Date, URLSearchParams,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(TASK_LIB_SRC, sandbox, { filename: 'task-lib.js' });
+  vm.runInContext(GOALS_LIB_SRC, sandbox, { filename: 'goals-lib.js' });
+  vm.runInContext(GOAL_FOREST_LIB_SRC, sandbox, { filename: 'goal-forest-lib.js' });
+  windowObj.OTBGoalForestLib = sandbox.OTBGoalForestLib;
+  vm.runInContext(GOAL_FOREST_RENDER_SRC, sandbox, { filename: 'goal-forest-render.js' });
+  vm.runInContext(GOALS_RENDER_SRC, sandbox, { filename: 'goals-render.js' });
+  vm.runInContext(GOALS_PAGE_SRC, sandbox, { filename: 'goals-page.js' });
+  for (let i = 0; i < 30; i += 1) await new Promise((r) => setTimeout(r, 0));
+
+  return { requests, el: (sel) => $(sel) };
+}
+
+const GOALS = [
+  { id: 11, version_id: 'V1', title: 'Goal I am on', status: 'open', visibility: 'public', created_by: 999, scope_modules: [], viewer_is_member: true },
+  { id: 12, version_id: 'V1', title: 'Goal I am not on', status: 'open', visibility: 'public', created_by: 999, scope_modules: [], viewer_is_member: false },
+];
+
+// ---------------------------------------------------------------------------
+// 1. "My goals" — the goals you are added on
+// ---------------------------------------------------------------------------
+
+test('the goal board shows both goals with the lens off', async () => {
+  const { el } = await boot({ goals: GOALS });
+  const grid = el('#goal-grid').innerHTML;
+  assert.match(grid, /Goal I am on/);
+  assert.match(grid, /Goal I am not on/);
+});
+
+test('"My goals" keeps the goals the viewer is a member of and drops the rest', async () => {
+  const { el } = await boot({ goals: GOALS, filters: { 'f-goal-mine': 'mine' } });
+  const grid = el('#goal-grid').innerHTML;
+  assert.match(grid, /Goal I am on/);
+  assert.doesNotMatch(grid, /Goal I am not on/);
+});
+
+// The regression this change exists for. Before `viewer_is_member`, membership
+// was read from the per-goal detail — so a failed prefetch answered "you are on
+// none of them" and the lens rendered an empty board.
+test('"My goals" still answers when the per-goal detail prefetch FAILS', async () => {
+  const { el } = await boot({ goals: GOALS, filters: { 'f-goal-mine': 'mine' }, detailsFail: true });
+  const grid = el('#goal-grid').innerHTML;
+  assert.match(grid, /Goal I am on/,
+    'the row carries the membership, so a dead detail read cannot empty the lens');
+  assert.doesNotMatch(grid, /Goal I am not on/);
+});
+
+// A deploy whose server has not yet grown the flag must fall back rather than
+// answer "no" — the boolean check is what makes the fallback reachable.
+test('a goal row WITHOUT the flag falls back to the detail instead of reading as "not mine"', async () => {
+  const legacy = GOALS.map(({ viewer_is_member, ...g }) => g); // eslint-disable-line no-unused-vars
+  const { el } = await boot({ goals: legacy, filters: { 'f-goal-mine': 'mine' } });
+  // The stub's detail returns members: [], so nothing matches — the point is that
+  // the page consulted the detail at all rather than short-circuiting on a
+  // missing field, and that it did not crash.
+  assert.ok(el('#goal-grid').innerHTML.length > 0, 'the board still renders');
+});
+
+// ---------------------------------------------------------------------------
+// 2. Inside one goal — the tasks you have claimed
+// ---------------------------------------------------------------------------
+
+const GOAL_TASKS = [
+  { id: 301, title: 'held by me', status: 'active', goal_id: 11, touches: [] },
+  { id: 302, title: 'held by someone else', status: 'active', goal_id: 11, touches: [] },
+  { id: 303, title: 'nobody has claimed this', status: 'ready', goal_id: 11, touches: [] },
+];
+const GOAL_CLAIMS = [
+  { claim_id: 1, task_id: 301, builder_id: ME_ID, github_login: 'me', display_name: 'Me' },
+  { claim_id: 2, task_id: 302, builder_id: 999, github_login: 'them', display_name: 'Them' },
+];
+
+test("a goal's To-do list shows every open task with the lens off", async () => {
+  const { el } = await boot({ hash: '#/goal/11', goals: GOALS, tasks: GOAL_TASKS, activeClaims: GOAL_CLAIMS });
+  const list = el('#goal-todo-list').innerHTML;
+  for (const title of ['held by me', 'held by someone else', 'nobody has claimed this']) {
+    assert.match(list, new RegExp(title), `${title} is there unfiltered`);
+  }
+});
+
+test('"claimed by me" narrows a goal\'s To-do list to the viewer\'s own claims', async () => {
+  const { el } = await boot({
+    hash: '#/goal/11', goals: GOALS, tasks: GOAL_TASKS, activeClaims: GOAL_CLAIMS,
+    filters: { 'f-goal-claimed': 'mine' },
+  });
+  const list = el('#goal-todo-list').innerHTML;
+  assert.match(list, /held by me/);
+  assert.doesNotMatch(list, /held by someone else/, "another builder's claim is not mine");
+  assert.doesNotMatch(list, /nobody has claimed this/, 'an unclaimed task is nobody\'s');
+});

package/tests/goal_tier.mjs

@@ -116,14 +116,15 @@ await test('getGoal: unknown id returns null (not undefined)', async () => {
 // =========================================================================
 // listGoals
 // =========================================================================
-await test('listGoals: no args binds [null, null, null] (all three filters off)', async () => {
+await test('listGoals: no args binds [null, null, null, null] (every filter off, no viewer)', async () => {
   const pool = fakePool((s) => (/FROM goals/.test(s) ? { rows: [GOAL_ROW] } : null));
   const out = await listGoals(undefined, { pool });
   assert.deepEqual(out, [GOAL_ROW]);
   const sel = find(pool.queries, /FROM goals/);
   // task 1002539 added an OPTIONAL limit. Postgres treats `LIMIT NULL` as unbounded,
   // so the goal board's read is byte-for-byte unchanged in behaviour.
-  assert.deepEqual(sel.params, [null, null, null]);
+  // $4 is the viewer whose membership `viewer_is_member` answers; null = nobody.
+  assert.deepEqual(sel.params, [null, null, null, null]);
   assert.match(sel.sql, /ORDER BY version_id, sort_order, created_at, id/, 'priority-first, then stable ordering');
   assert.match(sel.sql, /LIMIT \$3::int/, 'the limit is bound, never interpolated');
 });
@@ -131,13 +132,38 @@ await test('listGoals: no args binds [null, null, null] (all three filters off)'
 await test('listGoals: versionId + status flow through to the bound params', async () => {
   const pool = fakePool((s) => (/FROM goals/.test(s) ? { rows: [] } : null));
   await listGoals({ versionId: 'BONGOS-V1', status: 'open' }, { pool });
-  assert.deepEqual(find(pool.queries, /FROM goals/).params, ['BONGOS-V1', 'open', null]);
+  assert.deepEqual(find(pool.queries, /FROM goals/).params, ['BONGOS-V1', 'open', null, null]);
 });
 
 await test('listGoals: an explicit limit is bound so Postgres truncates, not JS', async () => {
   const pool = fakePool((s) => (/FROM goals/.test(s) ? { rows: [] } : null));
   await listGoals({ versionId: 'BONGOS-V1', status: 'open', limit: 6 }, { pool });
-  assert.deepEqual(find(pool.queries, /FROM goals/).params, ['BONGOS-V1', 'open', 6]);
+  assert.deepEqual(find(pool.queries, /FROM goals/).params, ['BONGOS-V1', 'open', 6, null]);
+});
+
+// The "goals I am added on" half of the hall's Only-mine lens. The board asks this
+// of a list it already fetches, so the answer has to ride the row rather than cost
+// a membership read per goal.
+await test('listGoals: a viewer binds as $4 and the row carries viewer_is_member', async () => {
+  const pool = fakePool((s) => (/FROM goals/.test(s) ? { rows: [] } : null));
+  await listGoals({ viewerId: 77 }, { pool });
+  const sel = find(pool.queries, /FROM goals/);
+  assert.deepEqual(sel.params, [null, null, null, 77]);
+  assert.match(sel.sql, /AS viewer_is_member/, 'the flag is named on the wire');
+  assert.match(sel.sql, /EXISTS \(SELECT 1 FROM goal_members gm[\s\S]*?gm\.builder_id = \$4::bigint\)/,
+    'and it is an EXISTS over goal_members for THAT builder');
+});
+
+// A NULL viewer must yield false, never NULL: the client branches on
+// `typeof g.viewer_is_member === 'boolean'` to decide whether the server answered
+// at all, so a three-valued column would make "nobody is reading" indistinguishable
+// from "this deploy does not send the flag" and silently re-arm the empty-lens bug.
+await test('listGoals: a viewer-less read still answers the flag with a BOOLEAN false', async () => {
+  const pool = fakePool((s) => (/FROM goals/.test(s) ? { rows: [] } : null));
+  await listGoals({}, { pool });
+  const sel = find(pool.queries, /FROM goals/);
+  assert.match(sel.sql, /\(\$4::bigint IS NOT NULL\s*\n?\s*AND EXISTS/,
+    'the NULL case is short-circuited to false before the EXISTS is consulted');
 });
 
 // =========================================================================