@bongos/core 1.20.64 → 1.20.66

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.64",
-  "core_contract": "1.20.64",
-  "source_commit": "575676341f5c84eab982a6e546119e8b477740a3",
+  "core_version": "1.20.66",
+  "core_contract": "1.20.66",
+  "source_commit": "b20b1cd9652722eebc2cc8a17369c7bc29c7284a",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T10:53:37.791Z",
+  "built_at": "2026-10-01T11:16:57.096Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 572,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2790,
+    "functional_verbatim": 2793,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3390,
-  "tree_sha256": "52d2e7e9c9429a83086dcfccfa49a001131cd68200e4e4c6713eb3cd7f6326c3",
+  "file_count": 3393,
+  "tree_sha256": "fe92e9b1d448a099b9733514cd16f02219f90b86e1af2612331edbb45aed7a2a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "87352a8f884ec57b9263ac7596f8c66a5f353b633658304f2b531d31b9cf9b44"
+      "sha256": "3350163ed447189b523028f711e3ef1a400ea375ebe7123f2515add8b6a89de1"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "0a2e5d5157aeecb5ba74d68533e8267bc733f06eff2a72025c2fefce196c4c4e"
+      "sha256": "a863d3db1a112c490648e0f2b3eaddf3f2e8c9ebe107ec298ea5ff0c663a5e6a"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "1b62998873e5e55e5ddd827b48b4698e851859c667f2993d2552b79fae4e9009"
+      "sha256": "06bf39230e1c813494dc85130694754d1eb6b3fd55d3e93a684dd238bf6bc22b"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "425cfa53b1e0bf7d7ff08675e7732312fe14e6b6bf84bb3d627beffbebbd73ad"
+      "sha256": "2345d96c47f3851443f8b1adc5dac4556705e7f63f9875a4c62252bf833f17d4"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "1a73be7803ba716ee5e03cdffdb807d2700d8cd398ce4f22a07a3fe809c3aa76"
+      "sha256": "313cfd428b7fd04a9fec6e56cdc1ddabb69af6ca144d7e09d2384a50d48b53df"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2207,7 +2207,7 @@
     {
       "path": "docs/adr/0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md",
       "mode": "0000644",
-      "sha256": "7fe345d475d9540181d12544606c1c2cbfd5510e94c8fbf3599fc48d2790b3cb"
+      "sha256": "b609d870b217440a12839ce675617973aac721e9f017e831ff208e06567c9939"
     },
     {
       "path": "docs/adr/0350-the-hub-holds-a-per-project-write-deploy-key-so-a-hosted-upgrade-reaches-github.md",
@@ -2262,12 +2262,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "630d2344ea6f8a380f99022dfab1d2c4a79b2c1804259f42f6954cb769536407"
+      "sha256": "0abf904bcf32aef68bd70592d09cb986e4538cae62c2b9b268af8904d8a483fb"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "bbfc9546a939b4472a734d121f4db659667ad2e647e005b882a7a7c76589a287"
+      "sha256": "026ea9ba339051ada00869b8363718fae4fcded3be6eae98bcc60a37b9e844dc"
     },
     {
       "path": "docs/architecture.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7a7ee07e1f53d9a35fb896d8b88c0b03ee3437d7b60dcd85f94c49fe2317bd05"
+      "sha256": "a6ca9dad8d9c0bd38f081d1852a161731a62e9b34a759f6740c890ee4b3f7170"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4762,7 +4762,7 @@
     {
       "path": "modules/government/catalog.js",
       "mode": "0000644",
-      "sha256": "0559d78f54b4b8a89ac4e6924d6dad4e2693a7e54f943532e83e4ac966868b76"
+      "sha256": "f3d82f60997e944eb7108c36bafa9d9be8469c5980b5460abfdf410ffa601dea"
     },
     {
       "path": "modules/government/charter.js",
@@ -6654,6 +6654,11 @@
       "mode": "0000644",
       "sha256": "593c5a96579f1df60f1fa232f6f31414541372a8a5277126e78b5046bcd990ac"
     },
+    {
+      "path": "modules/lifecycle/goal-move.js",
+      "mode": "0000644",
+      "sha256": "9f176232145d0e173d9a7fd08906186c127749c409469b7af1c02b071c9f3d23"
+    },
     {
       "path": "modules/lifecycle/goal-rollup.js",
       "mode": "0000644",
@@ -6792,7 +6797,7 @@
     {
       "path": "modules/lifecycle/module.json",
       "mode": "0000644",
-      "sha256": "75b5ab14761c7c83b44219a0d4540b064548a38ecb1de20eab540c5cbebf162b"
+      "sha256": "4eaad6ef027c1e2f3baa2d589a963e721d1f4c20201ed003e412953ea570ee8e"
     },
     {
       "path": "modules/lifecycle/page-tweak-approve.js",
@@ -6909,6 +6914,11 @@
       "mode": "0000644",
       "sha256": "474b9fa9e13a731f39ab15de74a75ee4878155eb2236d25b0f12011c1df99583"
     },
+    {
+      "path": "modules/lifecycle/routes/goal-move.js",
+      "mode": "0000644",
+      "sha256": "9b5ed11cf59a69105d861fc6bd01bddc5c7d3d29913b4d1e9d8daf73434ea083"
+    },
     {
       "path": "modules/lifecycle/routes/goal-route-authz.js",
       "mode": "0000644",
@@ -7142,7 +7152,7 @@
     {
       "path": "modules/npm-release/preview/env.js",
       "mode": "0000644",
-      "sha256": "d9716eea3c3c233eb0397fa0976de9dfcb8a87a8e3b802c5bbea4e5568e691f9"
+      "sha256": "018bdef460587e17cb6bf1fd622a2b14f671a777a1e36e4aeb00e798da5f30c3"
     },
     {
       "path": "modules/npm-release/preview/proxy.js",
@@ -7157,7 +7167,7 @@
     {
       "path": "modules/npm-release/preview/supervisor.js",
       "mode": "0000644",
-      "sha256": "fd27648c4d75e03ec541f1295a05ffd05aae957bbf0748215497b624106cf12e"
+      "sha256": "cd708c56ae7bba361c139aba9cfccbe8501843db1c4f54bcd0c0dcf93e76f83c"
     },
     {
       "path": "modules/npm-release/public/task-widget.js",
@@ -9447,12 +9457,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e76e52c17163b9b22e508e70795ddc77484f81fd47a2ccc156fd39ea4123c39f"
+      "sha256": "3cab8f24d1505f76d3830cba2640a4d75a29b6f77cb288f3e0b73ac72528b829"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "456223fa87e0f237ec34208c0019990f0c76a4fadfd6812797812c1d36113125"
+      "sha256": "ae2d9d106c6a31eb87e19ab5d4da9d433a43bfa14d029773a33f8119236145e1"
     },
     {
       "path": "public-docs/index.html",
@@ -9472,7 +9482,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "412a73973976c63d7bf974f72354cdbeae90720c79b923c97f8b1f7d8cb81e9a"
+      "sha256": "1f738eb89f28f99d21310d526b289097059ddc1f660339a1282461396e06801c"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10157,7 +10167,7 @@
     {
       "path": "scripts/gds/goal.js",
       "mode": "0000644",
-      "sha256": "6cd8b2e7d23a4a8351f4018d2eec9403bb7eb16391e77fa2583a5f4c612e3046"
+      "sha256": "320841b1e4df014966ea9b6b70645ecb7915b412f94b8fa0d9835dae5b9446c5"
     },
     {
       "path": "scripts/gds/grade-correlation-audit.js",
@@ -11492,7 +11502,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "3d7c62d9c3925bc1ebafeae7d90ff09fc22a09c75c2ec47382e12bcff8d017ad"
+      "sha256": "c31e753d353b6c8c6b1f4e9af80a31afc995568aea9fd4ad8ab408e093a6f786"
     },
     {
       "path": "src/bongos/routes.js",
@@ -11652,7 +11662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e63e10c38215257f0811ee1300826615a5922a000872faf02d6aa835043ca281"
+      "sha256": "91a903030df7c3ff180de1a505f0de4dece1cfcbd9fc7131c22c667a2074c648"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13349,6 +13359,11 @@
       "mode": "0000644",
       "sha256": "a465047f1e25c6cdeedf75f53337851224b7207c95d5135d1353504b3c660087"
     },
+    {
+      "path": "tests/goal_move.mjs",
+      "mode": "0000644",
+      "sha256": "7a7caded5d4d1f26b9f37a4c2c55636adc6f10ad2633f2b3260d7c4f31ebacd8"
+    },
     {
       "path": "tests/goal_names.mjs",
       "mode": "0000644",
@@ -14877,7 +14892,7 @@
     {
       "path": "tests/npm_release_preview_diagnosis.mjs",
       "mode": "0000644",
-      "sha256": "9a246f9a29da48eaed7d0f19e156f1f63a48afb0277ab8ce02f7d6dc07c6d92b"
+      "sha256": "1d0fe23920e58d8838d6753750097d55c0c36d32d30d8f14ddd916a8bea908d6"
     },
     {
       "path": "tests/npm_release_preview_divert.mjs",
@@ -14887,7 +14902,7 @@
     {
       "path": "tests/npm_release_preview_env.mjs",
       "mode": "0000644",
-      "sha256": "f25208db9870e67ac3b53456a97fbc02d2ab56a01974c82d1e264222ea063639"
+      "sha256": "9febec41c155f29a2e22a7fa7dc8059be1fe6a36ff1845dceb85f87e695f42c3"
     },
     {
       "path": "tests/npm_release_preview_proxy.mjs",
@@ -14902,7 +14917,7 @@
     {
       "path": "tests/npm_release_preview_supervisor.mjs",
       "mode": "0000644",
-      "sha256": "d699b5b2a6b36169cfcdd925bf6b580c0238a6125174469a0129ca7945b1e69b"
+      "sha256": "f326bc26e3b137dc8e17a22beeb08861181d35dc881ec1762e05377b9d9430e7"
     },
     {
       "path": "tests/npm_release_where.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 484 operations across 73 resource groups
+- 485 operations across 73 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -449,6 +449,8 @@ function createClient(opts = {}) {
       postGoalsIdMembers: (args) => request("POST", "/goals/{id}/members", { hasBody: true }, args),
       // PATCH /goals/{id}/members/{builderId} — rank: any-builder — PATCH /goals/:id/members/:builderId
       patchGoalsIdMembersBuilderId: (args) => request("PATCH", "/goals/{id}/members/{builderId}", { hasBody: true }, args),
+      // POST /goals/{id}/move — rank: archon — POST /goals/:id/move
+      postGoalsIdMove: (args) => request("POST", "/goals/{id}/move", { hasBody: true }, args),
       // POST /goals/{id}/reopen — rank: metic+archon — POST /goals/:id/reopen
       postGoalsIdReopen: (args) => request("POST", "/goals/{id}/reopen", { hasBody: true }, args),
       // GET /goals/{id}/requests — rank: any-builder — GET /goals/:id/requests

package/clients/bongos-client/index.cjs

@@ -448,6 +448,8 @@ function createClient(opts = {}) {
       postGoalsIdMembers: (args) => request("POST", "/goals/{id}/members", { hasBody: true }, args),
       // PATCH /goals/{id}/members/{builderId} — rank: any-builder — PATCH /goals/:id/members/:builderId
       patchGoalsIdMembersBuilderId: (args) => request("PATCH", "/goals/{id}/members/{builderId}", { hasBody: true }, args),
+      // POST /goals/{id}/move — rank: archon — POST /goals/:id/move
+      postGoalsIdMove: (args) => request("POST", "/goals/{id}/move", { hasBody: true }, args),
       // POST /goals/{id}/reopen — rank: metic+archon — POST /goals/:id/reopen
       postGoalsIdReopen: (args) => request("POST", "/goals/{id}/reopen", { hasBody: true }, args),
       // GET /goals/{id}/requests — rank: any-builder — GET /goals/:id/requests

package/clients/bongos-client/index.d.ts

@@ -320,6 +320,8 @@ export interface PostGoalsIdJoinResponse { ok: boolean; member: unknown }
 export interface PostGoalsIdLeaveResponse { ok: boolean }
 export interface PostGoalsIdMembersRequest { membership_kind?: string; builder_id?: StringifiableId }
 export interface PostGoalsIdMembersResponse { ok: boolean; member: unknown }
+export interface PostGoalsIdMoveRequest { version_id: string; admit_reason?: string }
+export interface PostGoalsIdMoveResponse { ok: boolean; goal: unknown; from_version_id: unknown; to_version_id: unknown; moved_task_ids: unknown; moved_criterion_ids: unknown; admitted: unknown }
 export interface PostGoalsIdReopenResponse { ok: boolean; goal: unknown }
 export interface PostGoalsIdRequestsReqIdRespondRequest { action: string }
 export interface PostGoalsIdRequestsReqIdRespondResponse { ok: boolean; action: unknown; request: unknown; member?: unknown }
@@ -893,6 +895,8 @@ export interface BongosClient {
     postGoalsIdMembers(args?: RequestArgs & { body?: PostGoalsIdMembersRequest }): Promise<PostGoalsIdMembersResponse>;
     /** PATCH /goals/{id}/members/{builderId} — rank: any-builder */
     patchGoalsIdMembersBuilderId(args: RequestArgs & { body: PatchGoalsIdMembersBuilderIdRequest }): Promise<PatchGoalsIdMembersBuilderIdResponse>;
+    /** POST /goals/{id}/move — rank: archon */
+    postGoalsIdMove(args: RequestArgs & { body: PostGoalsIdMoveRequest }): Promise<PostGoalsIdMoveResponse>;
     /** POST /goals/{id}/reopen — rank: metic+archon */
     postGoalsIdReopen(args?: RequestArgs): Promise<PostGoalsIdReopenResponse>;
     /** GET /goals/{id}/requests — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -445,6 +445,8 @@ export function createClient(opts = {}) {
       postGoalsIdMembers: (args) => request("POST", "/goals/{id}/members", { hasBody: true }, args),
       // PATCH /goals/{id}/members/{builderId} — rank: any-builder — PATCH /goals/:id/members/:builderId
       patchGoalsIdMembersBuilderId: (args) => request("PATCH", "/goals/{id}/members/{builderId}", { hasBody: true }, args),
+      // POST /goals/{id}/move — rank: archon — POST /goals/:id/move
+      postGoalsIdMove: (args) => request("POST", "/goals/{id}/move", { hasBody: true }, args),
       // POST /goals/{id}/reopen — rank: metic+archon — POST /goals/:id/reopen
       postGoalsIdReopen: (args) => request("POST", "/goals/{id}/reopen", { hasBody: true }, args),
       // GET /goals/{id}/requests — rank: any-builder — GET /goals/:id/requests

package/docs/adr/0349-a-version-preview-is-a-sandboxed-child-the-web-tier-launches.md

@@ -97,6 +97,7 @@ What keeps that exception narrow:
 - A preview started by the live process is stopped when that process exits, but the copy is
   dropped only by the next start or stop. It is one fixed name, so it cannot pile up.
 - **Correction, 2026-09-30 (task 1004466): the proxy strips every upstream `Set-Cookie`.** Same origin means a cookie the child set replaced the live hall's own (`cb_stealth`, the session) and locked the owner out of `/deploy`. The child's cookies now stay with the child; the steering cookie is the only one this module writes, and its clear repeats the set's Path, SameSite and Secure.
+- **Correction, 2026-10-01 (task 1004486): the child is handed `PGUSER`.** The droplet's hall connects by socket peer auth with no `PGUSER`, so the driver names its login from `USER`, which an environment built from nothing does not have: every query in the copy failed. When no `PGUSER` is carried, the child gets the OS user it runs as (the identity peer auth checks anyway). And the dump file, a full copy of the live database, is now deleted as soon as the restore has read it; a service restart had left one in `/tmp` for eleven hours.
 
 ## Consequences
 

package/docs/api/openapi.json

@@ -7470,6 +7470,72 @@
         ]
       }
     },
+    "/goals/{id}/move": {
+      "post": {
+        "operationId": "post_goals_id_move",
+        "tags": [
+          "goals"
+        ],
+        "summary": "POST /goals/:id/move",
+        "description": "(perm:version.create) — re-homes a goal and its tasks across versions.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `version.create` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/lifecycle/routes/goal-move.js",
+        "x-permissions": [
+          "version.create"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostGoalsIdMoveRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostGoalsIdMoveResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/goals/{id}/reopen": {
       "post": {
         "operationId": "post_goals_id_reopen",
@@ -27248,6 +27314,47 @@
           "member"
         ]
       },
+      "PostGoalsIdMoveRequest": {
+        "type": "object",
+        "properties": {
+          "version_id": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 64
+          },
+          "admit_reason": {
+            "type": "string",
+            "maxLength": 2000
+          }
+        },
+        "required": [
+          "version_id"
+        ],
+        "additionalProperties": false
+      },
+      "PostGoalsIdMoveResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "goal": {},
+          "from_version_id": {},
+          "to_version_id": {},
+          "moved_task_ids": {},
+          "moved_criterion_ids": {},
+          "admitted": {}
+        },
+        "required": [
+          "ok",
+          "goal",
+          "from_version_id",
+          "to_version_id",
+          "moved_task_ids",
+          "moved_criterion_ids",
+          "admitted"
+        ]
+      },
       "PostGoalsIdReopenResponse": {
         "type": "object",
         "properties": {
@@ -30890,9 +30997,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 484,
-  "x-schema-count": 511,
+  "x-endpoint-count": 485,
+  "x-schema-count": 513,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 342,
+  "x-response-schemas": 343,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 484 endpoints across 88 route files.
+> **Generated from the live route files** — the route file is authoritative. 485 endpoints across 89 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -296,7 +296,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/goal-task-relevance/:id/decide` | `metic+archon` | `decision`, `note` | task.promote — same atom as the read (task.promote's own gate). |
 | GET | `/api/bongos/goal-task-relevance/pending` | `metic+archon` | — | task.promote (metic+archon) — the reused review-queue atom. |
 
-## `goals` (33)
+## `goals` (34)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -317,6 +317,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/goals/:id/leave` | `any-builder` | — | POST /goals/:id/leave — leave a goal you're in. |
 | POST | `/api/bongos/goals/:id/members` | `any-builder` | `membership_kind`, `builder_id` | POST /goals/:id/members — the goal's own authority (owner \| manager \| Archon) invites a builder to the goal (task 1762: widened from Arch… |
 | PATCH | `/api/bongos/goals/:id/members/:builderId` | `any-builder` | `membership_kind` | PATCH /goals/:id/members/:builderId — membership management by the goal's own authority (task 1735): the owner, a manager, or an Archon p… |
+| POST | `/api/bongos/goals/:id/move` | `archon` | `version_id`, `admit_reason` | (perm:version.create) — re-homes a goal and its tasks across versions. |
 | POST | `/api/bongos/goals/:id/reopen` | `metic+archon` | — | POST /goals/:id/reopen — bring an archived goal back to open (ADR 0086 §6 / BV1.R64). |
 | GET | `/api/bongos/goals/:id/requests` | `any-builder` | — | GET /goals/:id/requests — the goal's own pending invite/join-request queue (task 1953): every pending row on THIS goal, both kinds — outs… |
 | POST | `/api/bongos/goals/:id/requests` | `any-builder` | `note` | POST /goals/:id/requests — a builder asks to join a (private or protected) goal (task 1952 / ADR 0112). |

package/docs/module-api-changelog.md

@@ -2785,5 +2785,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.62 with no explicit bump. run 36850426143. (task 1002620)
   1.20.64 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.63 with no explicit bump. run 36851876428. (task 1002620)
+  1.20.65 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.64 with no explicit bump. run 36852902728. (task 1002620)
+  1.20.66 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.65 with no explicit bump. run 36854308972. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/government/catalog.js

@@ -152,7 +152,7 @@ const PERMISSIONS = [
   // granted is not a gate" argument. That argument was heard and was not the deciding
   // one. The revisit trigger is a concrete one — the first time such a rank exists —
   // and tests/government_catalog.mjs pins the flag so the change cannot land silently.
-  { key: 'version.create', system: false, floor: 'archon', guards: 'POST /versions — create a version + its done-when criteria (ADR 0250 §6 returns it to archon; ADR 0157 had lowered it to metic)' },
+  { key: 'version.create', system: false, floor: 'archon', guards: 'POST /versions — create a version + its done-when criteria (ADR 0250 §6 returns it to archon; ADR 0157 had lowered it to metic); POST /goals/:id/move — re-home a goal across versions (task 1004485)' },
   { key: 'task.confirm.grade_bypass', system: true, floor: 'archon', guards: 'POST /tasks/:id/confirm — ratify past a failed grade (env-relaxable, ADR 0041)' },
   { key: 'dependency.cross_tier.manage', system: true, floor: 'archon', guards: 'POST|DELETE /dependencies — cross-tier structural edges (ADR 0086)' },
   { key: 'goal.scope.manage', system: true, floor: 'archon', guards: 'cross-tier goal-scope edges + protected-scope admission (ADR 0086)' },