@bongos/core 1.20.11 → 1.20.12

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.11",
-  "core_contract": "1.20.11",
-  "source_commit": "53c0ee60054e5b6b7843f4ee840fc822898d8d99",
+  "core_version": "1.20.12",
+  "core_contract": "1.20.12",
+  "source_commit": "157de30a7a166f1941ba54aaa8f57964f7f73362",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T05:16:32.448Z",
+  "built_at": "2026-09-30T11:33:34.437Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 556,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2625,
+    "functional_verbatim": 2626,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3207,
-  "tree_sha256": "f95cbf2fee02b00d47be2fbff2d2b529242ea16d3e13f3648e26058a7b7158f3",
+  "file_count": 3208,
+  "tree_sha256": "0da694c2943c85befcb0d6d52c1d9ae4480c66b425a0393140773878b4483763",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2772,7 +2772,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "372ffa01d1e2ae4940f5f2642b2ada1aceb4379c28dbd8606bcb24831a10dbd7"
+      "sha256": "86429e308db13d625c1255ae509c712448f405ada592fc1ea1c2fe6fe8866d46"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3944,6 +3944,11 @@
       "mode": "0000644",
       "sha256": "6f502903c02f48a65370d2ca167b42a5ea514bed38bb9862d34465ea627191f2"
     },
+    {
+      "path": "migrations/core_264_claimable_respects_dependencies.sql",
+      "mode": "0000644",
+      "sha256": "2f578b536ed624b204fc201c0a5e8033a2417c189c9caaa8f2148408f76ae481"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -6142,7 +6147,7 @@
     {
       "path": "modules/lifecycle/db-tasks.js",
       "mode": "0000644",
-      "sha256": "d0844d8f53c003e6026918ad2c132262a358b8c64951aa7927eace1e37fcd41f"
+      "sha256": "bf527e80db47d586361be82ef568842e011484313f09cc6405d1c351f9e15df7"
     },
     {
       "path": "modules/lifecycle/db-versions.js",
@@ -8857,12 +8862,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2a308d4441905642a136968b84c97ec21567998a3642fb009e48022289a719a4"
+      "sha256": "464fd91cbcd4c95177dde0d4e40720505686cfd677a575c0f7d7a8415f9a957b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d6912677f65474e50cee14ba12e123fe78c779a502d32958d3461e28ba172875"
+      "sha256": "2f825d119f8d7b46e1f4ffab61515532848aa2634b53b6b66adbf1581bffc3b3"
     },
     {
       "path": "public-docs/index.html",
@@ -8882,7 +8887,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "74f7b0934941d9fa4f088bdbeead254888acf3c6ef6858f8f56f76b1e53ada76"
+      "sha256": "fdb871eaf32d4f1b1525a225cc5b28207359df70e1714f735eb060fac12743aa"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10802,7 +10807,7 @@
     {
       "path": "src/bongos/optimizer.js",
       "mode": "0000644",
-      "sha256": "eaa5ba49269f8188222b0c979ea60e05f1e6ddc1a0ba8064f735a3f8ac25e0ce"
+      "sha256": "70b093c1a7d3b9b7c169694a3dba463221297c14efde12efccf23b0a0a94dc4e"
     },
     {
       "path": "src/bongos/package-registry.js",
@@ -10997,7 +11002,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5316b73eafc987d6d4a9acd90784e38ef427f2212c659c7761a832210424b8c4"
+      "sha256": "159b8f961396d15ce8bf1a5589ec100b0b9b1d0bc02ccb8b1c37a8ce82512dd7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11697,7 +11702,7 @@
     {
       "path": "tests/claimable_blocker_status.mjs",
       "mode": "0000644",
-      "sha256": "1aae622cb425a287309bc68f5537d754ff9e31b2c4cd8506c7ec72288da69220"
+      "sha256": "9106c65ea3c157953660a7e1af006724be9e781e1f74e95b36ccd76e20ffe987"
     },
     {
       "path": "tests/claims_bind_session.mjs",

package/docs/module-api-changelog.md

@@ -2679,5 +2679,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.9 with no explicit bump. run 36670625760. (task 1002620)
   1.20.11 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.10 with no explicit bump. run 36672606449. (task 1002620)
+  1.20.12 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.11 with no explicit bump. run 36709211337. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/migrations/core_264_claimable_respects_dependencies.sql

@@ -0,0 +1,115 @@
+-- core_264 — claimable_tasks must also consult the DEPENDENCY graph (task
+-- 1004190, finding #60 of the task 1000379 audit).
+--
+-- THE DEFECT. core_239's view filters on status, smoke titles, open blockers and
+-- touches-overlap — and never once on `dependencies`. So a task sitting at
+-- 'ready' whose predecessor has not shipped is ADVERTISED by /builder-start, the
+-- optimizer and every claimable feed, and only `POST /claims` refuses it
+-- (DEPS_NOT_SHIPPED, step 10 of the refusal ladder in modules/lifecycle/CLAUDE.md).
+-- That is the "feed lies" family: the queue offers work the server will not let
+-- you take. core_239 named this gap by number in its own header and deferred it
+-- deliberately; this is the deferred half.
+--
+-- HOW A 'ready' ROW GETS UNSHIPPED DEPS AT ALL. The migration-163 auto-promotion
+-- triggers gate backlog -> ready on task_is_fully_unblocked, so the common path
+-- cannot produce one. The paths that CAN: a hand-promoted row
+-- (POST /tasks/:id/promote), a dependency edge ADDED after the task reached
+-- 'ready' (nothing demotes it), and a dependency target that leaves 'shipped'
+-- later. db-claims.js calls its own dep check "the second line of defence" for
+-- exactly these; the feed had no first line at all.
+--
+-- WHICH PREDICATE, AND WHY NOT task_is_fully_unblocked. There are two dependency
+-- predicates in this codebase and they disagree on ONE case:
+--
+--   unsatisfiedDeps (modules/lifecycle/db-deps-criteria.js) — what POST /claims
+--     actually runs. Each arm JOINs the target table, so an edge whose target row
+--     no longer exists produces no row and does not gate.
+--   task_is_fully_unblocked (core_245) — what the promotion triggers run. Its
+--     header states the opposite reading: an orphaned `to` "counts as un-done ->
+--     task stays blocked (fail-closed)".
+--
+-- Calling task_is_fully_unblocked here would have been the shorter line, and it
+-- would have re-created core_239's bug inverted: a task with one orphaned edge
+-- would vanish from the feed while POST /claims cheerfully accepted it —
+-- workable by id, unfindable in the queue, permanently, with no blocker row to
+-- explain it. The DONE-WHEN of this task is that the view and the claim path
+-- AGREE, so the view mirrors unsatisfiedDeps' three UNION arms verbatim, not the
+-- promotion predicate. Fail-closed is the right default when the two gates are
+-- answering different questions; here they are answering the SAME question and
+-- matching beats hedging. (The blocker clause below is untouched and stays
+-- fail-closed — that one IS core_239's own question.)
+--
+-- ABANDONED STAYS GATING. `x.status <> 'shipped'` counts 'abandoned' as un-done,
+-- so a task behind a cut prerequisite is now hidden from the feed rather than
+-- offered and refused. That is the owner ruling of 2026-08-21 (modules/lifecycle/
+-- CLAUDE.md) applied consistently, NOT finding #61: nothing here skips abandoned,
+-- and the loud surfaces the ruling made load-bearing are untouched —
+-- `scripts/gds/audit-deps.js --stranded`, `/backlog-review`'s depGated bucket and
+-- the dead_deps refusal hint all read the dependency graph directly, never this
+-- view.
+--
+-- THE THREE OTHER COPIES. The same view body is inlined as CLAIMABLE_SQL in
+-- modules/lifecycle/db-tasks.js and inside src/bongos/optimizer.js's query (task
+-- 2181: raw-table reads so the feed cannot park behind a view DDL lock). core_239
+-- changed the view alone and the feed did not move for the whole life of task
+-- 1003913. Both copies carry this clause as of this change, and
+-- tests/claimable_blocker_status.mjs pins all three against each other.
+--
+-- COST, AND WHY THIS SHIPS NO INDEX. This is the /builder-start hot path, so the
+-- question is fair and the answer is that every lookup the clause makes is already
+-- covered — which is why there is no index migration beside this one:
+--
+--   the three from_kind arms  -> idx_dependencies_from (from_kind, from_id), migration 163.
+--                                All three probe the SAME two columns, so the planner
+--                                can BitmapOr three index scans rather than seq-scan.
+--   the criterion arm's IN    -> idx_task_criteria_task (task_id), migration 055.
+--   the three doneness EXISTS -> the primary keys of tasks / done_when_criteria / goals.
+--
+-- `d.to_kind` / `d.to_id` appear only as filters on rows already found through the
+-- from-side index, never as a lookup key, so idx_dependencies_to is not on this path.
+-- Asserted, not just claimed: tests/claimable_blocker_status.mjs fails if either
+-- named index leaves migrations/, because a comment cannot notice that.
+--
+-- Idempotent: DROP VIEW IF EXISTS + CREATE, the shape core_231 and core_239 used.
+-- The column list stays the `t.*` wildcard plus the calibrated-minutes column,
+-- byte-identical to core_239 (core_227's header records six columns that silently
+-- never reached the feed because a rewrite spelled the list out instead).
+
+BEGIN;
+
+DROP VIEW IF EXISTS claimable_tasks;
+CREATE VIEW claimable_tasks AS
+SELECT t.*,
+       pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
+  FROM tasks t
+ WHERE t.status = 'ready'
+   AND t.title NOT LIKE '\_\_smoke\_\_%' ESCAPE '\'
+   AND NOT EXISTS (
+     SELECT 1
+       FROM task_blockers tb
+       LEFT JOIN blockers b ON b.id = tb.blocker_id
+      WHERE tb.task_id = t.id
+        AND (b.id IS NULL OR b.status = 'open')
+   )
+   AND NOT EXISTS (
+     SELECT 1
+       FROM dependencies d
+      WHERE ((d.from_kind = 'task'      AND d.from_id = t.id)
+          OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+          OR (d.from_kind = 'criterion' AND d.from_id IN (
+                SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)))
+        AND ((d.to_kind = 'task'      AND EXISTS (SELECT 1 FROM tasks              x WHERE x.id = d.to_id AND x.status <> 'shipped'))
+          OR (d.to_kind = 'criterion' AND EXISTS (SELECT 1 FROM done_when_criteria x WHERE x.id = d.to_id AND x.satisfied = false))
+          OR (d.to_kind = 'goal'      AND EXISTS (SELECT 1 FROM goals              x WHERE x.id = d.to_id AND x.status <> 'achieved')))
+   )
+   AND NOT EXISTS (
+     SELECT 1 FROM claims c
+       JOIN tasks t2 ON t2.id = c.task_id
+      WHERE c.released_at IS NULL
+        AND t2.touches && t.touches
+   );
+
+COMMIT;
+
+INSERT INTO schema_migrations (version) VALUES ('core_264_claimable_respects_dependencies')
+  ON CONFLICT (version) DO NOTHING;

package/modules/lifecycle/db-tasks.js

@@ -883,11 +883,52 @@ const OPEN_BLOCKER_GUARD = `
           AND (b.id IS NULL OR b.status = 'open')
      )`;
 
+// THE DEPENDENCY GUARD, spelled ONCE (task 1004190, finding #60).
+//
+// The sibling of OPEN_BLOCKER_GUARD, and it was missing entirely until now: the
+// claimable feed filtered on status, smoke titles, open blockers and touches
+// overlap, and never on `dependencies`. A task at 'ready' whose predecessor has
+// not shipped was ADVERTISED here and then refused by POST /claims with
+// DEPS_NOT_SHIPPED — the same "the feed lies" family core_239 fixed for blockers.
+//
+// THIS MIRRORS unsatisfiedDeps (db-deps-criteria.js), NOT task_is_fully_unblocked.
+// The two predicates disagree on one case and the disagreement is deliberate on
+// both sides: an edge whose target row no longer exists does NOT gate a claim
+// (each of unsatisfiedDeps' arms JOINs the target, so an orphan produces no row)
+// and DOES block promotion (core_245's header calls that fail-closed). Copying the
+// promotion predicate into the feed would hide a task POST /claims would accept —
+// core_239's bug inverted, and invisible to the builder looking for it. The feed
+// must say exactly what the claim gate will do, so the three UNION arms of
+// unsatisfiedDeps are reproduced here verbatim.
+//
+// `x.status <> 'shipped'` keeps 'abandoned' gating, per the owner ruling of
+// 2026-08-21 (see ./CLAUDE.md). A task behind a cut prerequisite is now hidden
+// rather than offered-and-refused; the surfaces that must stay LOUD about it read
+// the dependency graph directly (audit-deps.js --stranded, /backlog-review, the
+// dead_deps refusal hint) and never this feed.
+//
+// ONE query interpolates it, not two. SESSION_FIT_SQL is deliberately left alone:
+// it is only ever JOINed onto this feed (here and in optimizer.js), so the guard
+// already applies to every row it can see, and adding it there would change what
+// the tasks_session_fit VIEW means with no migration saying so.
+const UNSHIPPED_DEPS_GUARD = `
+     AND NOT EXISTS (
+       SELECT 1
+         FROM dependencies d
+        WHERE ((d.from_kind = 'task'      AND d.from_id = t.id)
+            OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+            OR (d.from_kind = 'criterion' AND d.from_id IN (
+                  SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)))
+          AND ((d.to_kind = 'task'      AND EXISTS (SELECT 1 FROM tasks              x WHERE x.id = d.to_id AND x.status <> 'shipped'))
+            OR (d.to_kind = 'criterion' AND EXISTS (SELECT 1 FROM done_when_criteria x WHERE x.id = d.to_id AND x.satisfied = false))
+            OR (d.to_kind = 'goal'      AND EXISTS (SELECT 1 FROM goals              x WHERE x.id = d.to_id AND x.status <> 'achieved')))
+     )`;
+
 const CLAIMABLE_SQL = `
   SELECT t.*, pms_calibrated_minutes(t.est_minutes, t.kind) AS est_minutes_calibrated
     FROM tasks t
    WHERE t.status = 'ready'
-     AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'${OPEN_BLOCKER_GUARD}
+     AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'${OPEN_BLOCKER_GUARD}${UNSHIPPED_DEPS_GUARD}
      AND NOT EXISTS (
        SELECT 1 FROM claims c
          JOIN tasks t2 ON t2.id = c.task_id

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.11",
+  "version": "1.20.12",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.11",
+      "version": "1.20.12",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.11",
+  "version": "1.20.12",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8118,5 +8118,11 @@
       "id": "1004404",
       "text": "You can now choose which skills your speciality offers from Settings, not just through the API. You can do it when you create the speciality or later from its card. Each skill is listed with a plain description and what it cos"
     }
+  ],
+  "1.20.12": [
+    {
+      "id": "1004190",
+      "text": "The task list no longer offers you work the system will refuse: a job waiting on another job that hasn't finished yet is now hidden until it's actually ready to start."
+    }
   ]
 }

package/src/bongos/optimizer.js

@@ -52,6 +52,31 @@ const OPEN_BLOCKER_GUARD = `
                  AND (b.id IS NULL OR b.status = 'open')
             )`;
 
+// The dependency guard, once (task 1004190, finding #60). Same predicate as
+// migration core_264 and as db-tasks.js's UNSHIPPED_DEPS_GUARD, duplicated ACROSS
+// those files for the ADR 0083 reason above and deduplicated WITHIN this one.
+//
+// It mirrors unsatisfiedDeps (the claim gate), not task_is_fully_unblocked (the
+// promotion predicate): the two disagree on an edge whose target row is gone, and
+// the feed must say what POST /claims will actually do. Full rationale in
+// core_264's header.
+//
+// Only the claimable body below interpolates it — the session-fit body is JOINed
+// onto that body, so every row it can see is already guarded, and putting it there
+// would change what the tasks_session_fit VIEW means with no migration saying so.
+const UNSHIPPED_DEPS_GUARD = `
+            AND NOT EXISTS (
+              SELECT 1
+                FROM dependencies d
+               WHERE ((d.from_kind = 'task'      AND d.from_id = t.id)
+                   OR (d.from_kind = 'goal'      AND d.from_id = t.goal_id)
+                   OR (d.from_kind = 'criterion' AND d.from_id IN (
+                         SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)))
+                 AND ((d.to_kind = 'task'      AND EXISTS (SELECT 1 FROM tasks              x WHERE x.id = d.to_id AND x.status <> 'shipped'))
+                   OR (d.to_kind = 'criterion' AND EXISTS (SELECT 1 FROM done_when_criteria x WHERE x.id = d.to_id AND x.satisfied = false))
+                   OR (d.to_kind = 'goal'      AND EXISTS (SELECT 1 FROM goals              x WHERE x.id = d.to_id AND x.status <> 'achieved')))
+            )`;
+
 const VALID_MODES = ['active', 'check-in', 'autonomous'];
 const DEFAULT_MAX_PARALLEL = 3;
 
@@ -90,7 +115,7 @@ async function optimizeSession({ builderId, mode, timeBudgetMin, maxParallel })
            FROM tasks t
           WHERE t.status = 'ready'
             AND t.title NOT LIKE '\\_\\_smoke\\_\\_%' ESCAPE '\\'
-${OPEN_BLOCKER_GUARD}
+${OPEN_BLOCKER_GUARD}${UNSHIPPED_DEPS_GUARD}
             AND NOT EXISTS (
               SELECT 1 FROM claims c
                 JOIN tasks t2 ON t2.id = c.task_id

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.11'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.12'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/claimable_blocker_status.mjs

@@ -13,6 +13,16 @@
 // feed. Latent when found (every blocker was open), but eleven tasks were one
 // resolve away from vanishing.
 //
+// TASK 1004190 WIDENED THIS FILE TO THE SECOND CLAUSE. core_239's header deferred
+// the OTHER gap in the same view by name — it never consulted `dependencies`, so a
+// 'ready' task whose predecessor had not shipped was advertised by /builder-start
+// and then refused by POST /claims with DEPS_NOT_SHIPPED. core_264 closes it. The
+// "LAST definition" test below is what forced the blocker clause to be carried
+// forward into that rewrite rather than lost the way 177 lost migration 176's;
+// it now pins core_264, and every clause assertion here reads the LIVE definition,
+// because a correct older migration still sitting in the tree proves nothing about
+// what Postgres runs.
+//
 // Run:  node tests/claimable_blocker_status.mjs
 
 import { strict as assert } from 'node:assert';
@@ -25,7 +35,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 const repoRoot = join(__dirname, '..');
 const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
 
-const MIG = 'core_239_claimable_respects_blocker_status.sql';
+const MIG = 'core_264_claimable_respects_dependencies.sql';
 const mig = read('migrations', MIG);
 // Comments carry the rationale; strip them when asserting on the executable body
 // so a claim in prose can never stand in for the real SQL.
@@ -33,7 +43,7 @@ const body = mig.replace(/^\s*--.*$/gm, '').replace(/\s+/g, ' ');
 
 const { test, summary } = makeRunner();
 
-await test('239 replaces claimable_tasks, in core_231-s drop-and-create shape', () => {
+await test('the live migration replaces claimable_tasks, in core_231-s drop-and-create shape', () => {
   assert.match(body, /DROP VIEW IF EXISTS claimable_tasks;/);
   assert.match(body, /CREATE VIEW claimable_tasks AS/);
 });
@@ -74,10 +84,15 @@ await test('the column list stays the t.* wildcard (core_227-s silent-column les
   assert.match(body, /pms_calibrated_minutes\(t\.est_minutes, t\.kind\) AS est_minutes_calibrated/);
 });
 
-await test('239 is the LAST definition of claimable_tasks in migrations/', () => {
+await test('the pinned migration is the LAST definition of claimable_tasks in migrations/', () => {
   // If a later migration redefines the view, it inherits whatever that one says —
   // which is exactly how 177 silently dropped migration 176's blocker clause from
   // task_is_fully_unblocked. Catch the next one at the source.
+  //
+  // This pin is not theoretical: it is what made core_264 (task 1004190) carry
+  // core_239's blocker clause forward instead of replacing it. Moving MIG to the
+  // new file is HALF the job — every clause assertion above then runs against the
+  // new definition, and a rewrite that dropped one reds this file.
   const defs = readdirSync(join(repoRoot, 'migrations'))
     .filter((f) => f.endsWith('.sql'))
     .filter((f) => /CREATE VIEW claimable_tasks/.test(read('migrations', f)))
@@ -201,4 +216,146 @@ await test('the promotion sweep keeps its own, deliberately different, guard', (
     'the sweep resolves the blocker too — it just answers the legacy-link case differently');
 });
 
+/* ───────────────────────────────────────────────────────────────────────────
+   Task 1004190 / finding #60 — THE SECOND CLAUSE.
+
+   core_239 deferred the other half of the same defect by name: the view filtered
+   on status, smoke titles, blockers and touches-overlap and never once on
+   `dependencies`, so a 'ready' task whose predecessor had not shipped was
+   advertised by /builder-start and then refused by POST /claims. core_264 adds
+   the clause, and it has the same three copies the blocker guard does — so it
+   gets the same three-file treatment, because a migration alone did not move the
+   feed last time either.
+   ─────────────────────────────────────────────────────────────────────────── */
+
+// The dependency predicate, lifted out of the LIVE migration. Everything below
+// compares the JS copies against what Postgres actually runs rather than against a
+// second hand-written spelling of the same idea — the same reason GUARDED above is
+// derived from the migration and not typed out here.
+const DEPS_START = 'NOT EXISTS ( SELECT 1 FROM dependencies d';
+const DEPS_END = "x.status <> 'achieved'))) )";
+function depsClause(src, what) {
+  const i = src.indexOf(DEPS_START);
+  const j = i < 0 ? -1 : src.indexOf(DEPS_END, i);
+  assert.ok(i >= 0 && j > i, `${what} carries the dependency clause`);
+  return src.slice(i, j + DEPS_END.length);
+}
+
+await test('the view resolves the same three gating sources as the claim gate', () => {
+  const clause = depsClause(body, MIG);
+  assert.match(clause, /d\.from_kind = 'task' AND d\.from_id = t\.id/, "the task's own edges");
+  assert.match(clause, /d\.from_kind = 'goal' AND d\.from_id = t\.goal_id/, 'plus what it inherits from its goal');
+  assert.match(clause, /d\.from_kind = 'criterion' AND d\.from_id IN \( SELECT tc\.criterion_id FROM task_criteria tc WHERE tc\.task_id = t\.id\)/,
+    'and from every criterion it fulfils');
+  assert.match(clause, /d\.to_kind = 'task' AND EXISTS \(SELECT 1 FROM tasks x WHERE x\.id = d\.to_id AND x\.status <> 'shipped'\)/);
+  assert.match(clause, /d\.to_kind = 'criterion' AND EXISTS \(SELECT 1 FROM done_when_criteria x WHERE x\.id = d\.to_id AND x\.satisfied = false\)/);
+  assert.match(clause, /d\.to_kind = 'goal' AND EXISTS \(SELECT 1 FROM goals x WHERE x\.id = d\.to_id AND x\.status <> 'achieved'\)/);
+});
+
+await test('the view mirrors unsatisfiedDeps (the CLAIM path), not task_is_fully_unblocked (promotion)', () => {
+  // The two dependency predicates in this codebase disagree on exactly one case,
+  // and both sides of the disagreement are deliberate: an edge whose target row no
+  // longer exists gates PROMOTION (core_245's header calls that fail-closed) and
+  // does NOT gate a claim (every unsatisfiedDeps arm JOINs the target, so an orphan
+  // yields no row). Calling task_is_fully_unblocked from the view is the shorter
+  // line and it would hide a task POST /claims accepts — core_239's bug inverted,
+  // with no blocker row to explain it. The done-when of 1004190 is that the feed
+  // and the gate AGREE, so this asserts WHICH one the view copied.
+  assert.doesNotMatch(body, /task_is_fully_unblocked/,
+    'the feed must not borrow the promotion predicate — it answers the orphaned-edge case the other way');
+  const deps = code('modules', 'lifecycle', 'db-deps-criteria.js');
+  const clause = depsClause(body, MIG);
+  for (const frag of [
+    "d.from_kind = 'task' AND d.from_id = t.id",
+    "d.from_kind = 'goal' AND d.from_id = t.goal_id",
+    "d.from_kind = 'criterion' AND d.from_id IN ( SELECT tc.criterion_id FROM task_criteria tc WHERE tc.task_id = t.id)",
+    "x.status <> 'shipped'",
+    'x.satisfied = false',
+    "x.status <> 'achieved'",
+  ]) {
+    assert.ok(deps.includes(frag),
+      `unsatisfiedDeps no longer spells it "${frag}" — the view copied that spelling and must be re-checked against it`);
+    assert.ok(clause.includes(frag), `the view must carry "${frag}" exactly as the claim gate does`);
+  }
+});
+
+await test('each runtime copy declares the dependency guard ONCE, and the claimable query uses it', () => {
+  for (const f of RUNTIME) {
+    const src = code(...f);
+    const decls = (src.match(/const UNSHIPPED_DEPS_GUARD = /g) || []).length;
+    const uses = (src.match(/\$\{UNSHIPPED_DEPS_GUARD\}/g) || []).length;
+    assert.equal(decls, 1, `${f.join('/')} must declare the dependency guard exactly once`);
+    // ONE, where the blocker guard has two — and that asymmetry is the decision,
+    // not an omission. The session-fit body is only ever JOINed onto the claimable
+    // body (here and in listClaimableTasks), so every row it can reach is already
+    // guarded; putting the clause there would change what the tasks_session_fit
+    // VIEW means with no migration saying so.
+    assert.equal(uses, 1, `${f.join('/')}: the CLAIMABLE body interpolates it; the session-fit body deliberately does not`);
+  }
+});
+
+await test('each runtime copy-s dependency guard is the live migration-s predicate, verbatim', () => {
+  const fromMigration = depsClause(body, MIG);
+  for (const f of RUNTIME) {
+    const decl = (code(...f).match(/const UNSHIPPED_DEPS_GUARD = `[^`]*`/) || [])[0];
+    assert.ok(decl, `${f.join('/')} declares the dependency guard as a template literal`);
+    assert.ok(decl.includes(fromMigration),
+      `${f.join('/')}'s dependency guard must be the migration's predicate verbatim — a paraphrase is how the next one drifts`);
+  }
+});
+
+await test('the dependency guard actually reaches the composed claimable statement', () => {
+  const fromMigration = depsClause(body, MIG);
+  for (const f of RUNTIME) {
+    const raw = read(...f);
+    const gm = raw.match(/const UNSHIPPED_DEPS_GUARD = `([\s\S]*?)`;/);
+    assert.ok(gm, `${f.join('/')} declares the dependency guard`);
+    const expanded = raw.split('${UNSHIPPED_DEPS_GUARD}').join(gm[1]).replace(/\s+/g, ' ');
+    const hits = expanded.split(fromMigration).length - 1;
+    assert.equal(hits, 2, `${f.join('/')}: one declaration plus one expanded use`);
+  }
+});
+
+await test('every lookup the dependency clause makes is index-covered', () => {
+  // This runs on the /builder-start hot path, so "a correlated NOT EXISTS with no
+  // index migration beside it" is the right thing to ask about the clause. The
+  // answer is that nothing new was needed — but that answer lived in two OTHER
+  // migrations, which is to say it was unverifiable from here and therefore not
+  // really an answer. Pin it, so deleting the cover reds this file instead of
+  // quietly turning the queue into a seq scan.
+  const allSql = readdirSync(join(repoRoot, 'migrations'))
+    .filter((f) => f.endsWith('.sql'))
+    .map((f) => read('migrations', f))
+    .join('\n');
+  assert.match(allSql, /CREATE INDEX IF NOT EXISTS idx_dependencies_from ON dependencies \(from_kind, from_id\)/,
+    'all three from_kind arms probe (from_kind, from_id) — migration 163');
+  assert.match(allSql, /CREATE INDEX IF NOT EXISTS idx_task_criteria_task\s+ON task_criteria \(task_id\)/,
+    "the criterion arm's IN probes task_criteria by task_id — migration 055");
+  assert.doesNotMatch(allSql, /DROP INDEX[^;]*idx_dependencies_from/,
+    'a later migration drops the index the claimable feed now depends on');
+  assert.doesNotMatch(allSql, /DROP INDEX[^;]*idx_task_criteria_task/,
+    'a later migration drops the index the criterion arm now depends on');
+  // The three doneness EXISTS lookups are by primary key (tasks.id,
+  // done_when_criteria.id, goals.id) and need nothing of their own.
+});
+
+await test('the dependency clause closes every paren it opens, in all three copies', () => {
+  // Nothing in this repo can reach a Postgres, so a stray paren in a clause this
+  // nested ships green and takes the ENTIRE claimable feed down with a syntax error
+  // on the first query after deploy — the feed, the optimizer and /builder-start at
+  // once. Counting is the cheapest real check available, and it is the failure mode
+  // hand-written inline SQL actually has.
+  const sources = [[body, MIG], ...RUNTIME.map((f) => [code(...f), f.join('/')])];
+  for (const [src, what] of sources) {
+    const clause = depsClause(src, what);
+    let depth = 0;
+    for (const ch of clause) {
+      if (ch === '(') depth++;
+      else if (ch === ')') depth--;
+      assert.ok(depth >= 0, `${what}: a closing paren with nothing open`);
+    }
+    assert.equal(depth, 0, `${what}: the clause closes every group it opens`);
+  }
+});
+
 summary();