@bongos/core 1.20.65 → 1.20.67

package/modules/lifecycle/routes/goal-move.js

@@ -0,0 +1,92 @@
+'use strict';
+
+// modules/lifecycle/routes/goal-move.js — POST /goals/:id/move (task 1004485).
+//
+// Moves an open goal — its criteria and every task in it — to another version.
+// The rules and the write live in ../goal-move.js; this file is the doorway and
+// must never grow a query (the rot.js precedent).
+//
+// GATE: `version.create` (Archon floor). Re-homing a goal changes the scope of
+// TWO versions at once, which is the same authority as authoring a version's
+// scope in the first place — so it reuses that atom rather than minting a new
+// one, and adds no new authority to the system. Pinned in route-rank-check.
+//
+// Body: { version_id, admit_reason? } — `admit_reason` is the Archon override
+// that lets a goal into a version that is already building (the POST /goals R07
+// admission); on a planning target it is accepted and changes nothing.
+//
+// MODULE BOUNDARY: reaches core only through `../../../src/module-api`.
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const db = require('../db');
+const goalMove = require('../goal-move');
+const { validateOrRespond, parseId } = api;
+
+const log = api.logger('lifecycle');
+
+module.exports = function buildGoalMoveRouter() {
+  const router = express.Router();
+
+  // rank: archon (perm:version.create) — re-homes a goal and its tasks across versions.
+  router.post('/goals/:id/move', api.requireBuilder, api.requirePermission('version.create'), async (req, res) => {
+    if (validateOrRespond(req, res, {
+      version_id: { required: true, type: 'string', minLength: 1, maxLength: 64 },
+      admit_reason: { type: 'string', maxLength: 2000 },
+    })) return;
+    const id = parseId(req, res, { code: 'bad_goal_id' });
+    if (id === null) return;
+    const admitReason = (req.body.admit_reason || '').trim() || null;
+    try {
+      const goal = await db.getGoal(id);
+      const [source, target] = goal
+        ? await Promise.all([db.getVersion(goal.version_id), db.getVersion(req.body.version_id)])
+        : [null, null];
+      const decision = goalMove.authorizeGoalMove({ goal, source, target, admitReason });
+      if (!decision.ok) return res.status(decision.status).json(decision.body);
+
+      const moved = await goalMove.moveGoalToVersion({
+        goalId: id,
+        fromVersionId: goal.version_id,
+        toVersionId: target.id,
+        targetStatus: target.status,
+        admission: decision.overrideApplied ? { admittedBy: req.builder.id, reason: admitReason } : null,
+      });
+      const updated = await db.getGoal(id);
+      return res.json({
+        ok: true,
+        goal: updated,
+        from_version_id: moved.fromVersionId,
+        to_version_id: moved.toVersionId,
+        moved_task_ids: moved.taskIds,
+        moved_criterion_ids: moved.criterionIds,
+        admitted: decision.overrideApplied,
+      });
+    } catch (err) {
+      if (err && err.code === 'CRITERION_LINKS_CROSS_GOAL') {
+        return res.fail('criterion_links_cross_goal', {
+          status: 409,
+          message: `Goal #${id} has criterion links that cross its edge — after the move they would join two versions. Unlink them (DELETE /tasks/:id/criteria/:criterionId) or move the task into the goal first. Nothing was changed.`,
+          details: { links: err.links },
+        });
+      }
+      if (err && err.code === 'CRITERION_ID_COLLISION') {
+        return res.fail('criterion_id_collision', {
+          status: 409,
+          message: `A criterion on goal #${id} uses a criterion_id the target version already has. Rename one of them first. Nothing was changed.`,
+        });
+      }
+      if (err && (err.code === 'GOAL_CHANGED' || err.code === 'TARGET_CHANGED')) {
+        return res.fail('changed_during_move', {
+          status: 409,
+          message: 'The goal or the target version changed while the move was running — nothing was changed. Re-read and retry.',
+        });
+      }
+      if (err && err.code === 'GOAL_NOT_FOUND') return res.fail('goal_not_found', 404);
+      log.error(`POST /goals/:id/move: ${err && err.message}`);
+      return res.fail('move_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};

package/modules/lifecycle/task-status.js

@@ -27,7 +27,10 @@
 //     tests/goal_sort_staleness.mjs pins). "Done" there means "no longer in the
 //     queue", which deliberately includes the mid-ship states. It is a progress
 //     ring, not a ledger, and must never be used to decide whether a goal may
-//     close.
+//     close. Note too that the bucketing is NOT a pure function of the status
+//     column: `blocked` there means "has an unshipped dependency", which a
+//     `ready` row can be (ADR 0015 / task 1004487), so neither set below is
+//     enough on its own to bucket a task.
 //
 // NO DEPENDENCIES, deliberately. This file requires nothing — not even
 // `module-api` — so a CLI (`scripts/gds/sequence.js`) can read the vocabulary

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.65",
+  "version": "1.20.67",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.65",
+      "version": "1.20.67",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.65",
+  "version": "1.20.67",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8519,5 +8519,17 @@
       "id": "1004486",
       "text": "Previewing an older version from the deploy page now works on the real server: the preview could not log in to its copy of the database, so every page in it failed. It also no longer leaves a full copy of the live database lyi"
     }
+  ],
+  "1.20.66": [
+    {
+      "id": "1004485",
+      "text": "Goals can now be moved from one version to another, taking their tasks and done-when criteria with them and keeping every task number. Used first to move the two goals that did not make V2 into V3."
+    }
+  ],
+  "1.20.67": [
+    {
+      "id": "1004487",
+      "text": "The hall no longer offers a Claim button on work the system will refuse. If a task gets a new prerequisite after it was opened up for claiming, its page and its goal card now say it is waiting on that other task — and name whi"
+    }
   ]
 }

package/scripts/gds/goal.js

@@ -4,8 +4,11 @@
 // Usage:
 //   node scripts/gds/goal.js list [--version V] [--status open|achieved|archived|all]
 //   node scripts/gds/goal.js show <id>
+//   node scripts/gds/goal.js move <id> --to <version> [--admit-reason "..."]
 //
-// Read-only. Default list filter is --status open.
+// list/show are read-only; default list filter is --status open. `move` re-homes an
+// open goal — its criteria and every task in it — on another version (Archon;
+// POST /goals/:id/move, task 1004485).
 
 const { cliClient, requireSession, arg } = require('./cli-lib');
 
@@ -16,6 +19,7 @@ const LIST_STATUSES = ['open', 'achieved', 'archived', 'all'];
 function usageExit() {
   console.error('usage: node scripts/gds/goal.js list [--version V] [--status open|achieved|archived|all]');
   console.error('       node scripts/gds/goal.js show <id>');
+  console.error('       node scripts/gds/goal.js move <id> --to <version> [--admit-reason "..."]');
   process.exit(2);
 }
 
@@ -208,6 +212,38 @@ async function printTaskBuckets(api, tasks) {
   }
 }
 
+// parseMoveArgs — the argv after `move`: `<id> --to <version> [--admit-reason "..."]`.
+// Returns { id, body } or null (usage error). Pure, so the CLI's own validation
+// is tested rather than trusted (task 1004485).
+function parseMoveArgs(args) {
+  const id = args[0];
+  if (!/^\d+$/.test(id || '')) return null;
+  const rest = args.slice(1);
+  const to = arg('--to', rest);
+  if (!to || !/^[\w.-]+$/.test(to)) return null;
+  const body = { version_id: to };
+  const reason = arg('--admit-reason', rest);
+  if (reason) body.admit_reason = reason;
+  return { id: Number(id), body };
+}
+
+async function move(api, args) {
+  const parsed = parseMoveArgs(args);
+  if (!parsed) usageExit();
+  const { id, body } = parsed;
+  const r = await api.goals.postGoalsIdMove({ id, body });
+  if (!r.ok) {
+    console.error(`move refused (${r.status}):`, (r.data && (r.data.message || r.data.error)) || JSON.stringify(r.data));
+    if (r.data && r.data.details && r.data.details.links) console.error('  crossing links:', JSON.stringify(r.data.details.links));
+    process.exitCode = 1;
+    return;
+  }
+  const d = r.data;
+  console.log(`Goal #${d.goal.id} "${d.goal.title}" moved ${d.from_version_id} → ${d.to_version_id}${d.admitted ? ' (admitted into a building version)' : ''}.`);
+  console.log(`  tasks moved: ${d.moved_task_ids.length}${d.moved_task_ids.length ? ' (' + d.moved_task_ids.join(', ') + ')' : ''}`);
+  console.log(`  criteria moved: ${d.moved_criterion_ids.length}`);
+}
+
 async function main() {
   await requireSession();
   const args = process.argv.slice(2);
@@ -219,6 +255,8 @@ async function main() {
   } else if (cmd === 'show') {
     if (!/^\d+$/.test(args[1] || '')) usageExit();
     await show(api, Number(args[1]));
+  } else if (cmd === 'move') {
+    await move(api, args.slice(1));
   } else {
     usageExit();
   }
@@ -231,4 +269,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { rollup, criterionGlyph, criterionState, bucketTasks, liveTasks };
+module.exports = { rollup, criterionGlyph, criterionState, bucketTasks, liveTasks, parseMoveArgs };

package/scripts/hall-preview/refresh-fixtures.js

@@ -58,7 +58,11 @@ const SNAPSHOTS = [
   ['goals/25/conflicts', 'goals__conflicts'],
   ['goals/25/requests', 'goals__requests'],
   ['tasks/claimable', 'tasks__claimable'],
-  ['tasks?status=ready', 'tasks', trimList('tasks', 60)],
+  // &include=deps (task 1004487) — the goal page's task cards read `blocked_by[]`
+  // to tell a claimable `ready` row from one whose dependencies have not shipped.
+  // Without it every row refreshes with no dependency data and the harness can
+  // only ever demo the claimable half of that fork.
+  ['tasks?status=ready&include=deps', 'tasks', trimList('tasks', 60)],
   ['tasks/2166', 'tasks__detail'],
   ['tasks/peer-votes/feed?limit=25', 'tasks__peer-votes__feed'],
   ['analytics/builder/95?days=90', 'analytics__builder'],

package/src/bongos/route-rank-check.js

@@ -346,6 +346,9 @@ const MODULE_EXPECTED_RANKS = {
     // builder archive/resurrect a shared workspace out from under its members.
     'POST /goals/:id/archive': 'metic+archon',
     'POST /goals/:id/reopen': 'metic+archon',
+    // goal re-home across versions (task 1004485) — changes two versions' scope at
+    // once, so it carries the version-authoring atom (Archon floor), not a goal one.
+    'POST /goals/:id/move': 'perm:version.create',
     // The bounded task-authoring KEYSTONE + self-service membership (ADR 0086 §3,
     // BV1.R60/R61). These are DELIBERATELY 'any-builder': the wall is the IN-HANDLER
     // scope/protected/rank-floor gate (authorizeGoalTaskCreate + goal-scope-check),

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.65'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.67'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/claim_from_task_and_home.mjs

@@ -38,11 +38,32 @@ await test('task.js constructs the shared claim action', () => {
 });
 
 await test('task.js renders a Claim button only when the task is ready', () => {
-  const m = taskJs.match(/if \(t\.status === 'ready'\) \{\s*lifecycle = `([^`]*)`/);
+  const m = taskJs.match(/if \(t\.status === 'ready' && unmetDeps\.length === 0\) \{\s*lifecycle = `([^`]*)`/);
   assert.ok(m, 'no ready-status branch found in the lifecycle chain');
   assert.match(m[1], /id="claim-btn"/);
 });
 
+// Task 1004487 — `ready` alone was never the claim gate's question. A dependency
+// added after promotion leaves the row at `ready` (ADR 0015: the status is
+// deliberately never demoted), and POST /claims refuses it with
+// DEPS_NOT_SHIPPED. core_264 taught the claimable FEED that; this page was the
+// surface it did not reach.
+await test('a dep-blocked ready task gets NO Claim button, and is told why', () => {
+  assert.match(taskJs, /const unmetDeps = deps\.filter\(\(d\) => d\.status !== 'shipped'\);/,
+    'the unmet-dependency predicate must mirror the gate: met iff the target shipped');
+  const refusal = taskJs.match(/\} else if \(t\.status === 'ready'\) \{\s*([\s\S]{0,600}?)\n {4}\} else if/);
+  assert.ok(refusal, 'no dep-blocked ready branch after the claimable one');
+  assert.doesNotMatch(refusal[1], /claim-btn/, 'a task the gate will refuse must not be offered the button');
+  assert.match(refusal[1], /rec-actnote/, 'the refusal is pre-answered in words, like the retire refusals');
+  assert.match(refusal[1], /waiting on/, 'and it names what it is waiting on');
+});
+
+await test("the lifecycle rail's first beat does not call a dep-blocked task 'waiting for a builder'", () => {
+  assert.match(taskJs, /const waitingOnDep = \(t\.dependencies \|\| \[\]\)\.some\(\(d\) => d\.status !== 'shipped'\);/);
+  assert.match(taskJs, /t\.status === 'ready' && waitingOnDep\)\s*\n?\s*\? CLAIM_CAPTION\.blocked/,
+    "a dep-blocked ready row borrows the 'blocked' caption — waiting on another task");
+});
+
 await test('the Claim button click routes through claimAction.claim, not a raw POST', () => {
   const m = taskJs.match(/const claimBtn = \$\('#claim-btn'\);[\s\S]*?\n {4}\}/);
   assert.ok(m, 'claim-btn wiring block not found');

package/tests/dep_blocked_ready_cards.mjs

@@ -0,0 +1,70 @@
+// tests/dep_blocked_ready_cards.mjs — task 1004487.
+//
+// THE BUG. ADR 0015 rules that a dependency added AFTER a task was promoted
+// leaves the row at `ready`: the status answers "was this promoted?", not "is
+// this workable right now?", so nothing demotes it. `core_264` (task 1004190)
+// taught the claimable FEED to ask the dependency graph instead of the status
+// column. The Goals page's task cards were a surface it did not reach — they
+// read `t.status === 'ready'` alone, so a dep-blocked row got a bulk-claim
+// checkbox and a Claim button for work `POST /claims` refuses with
+// DEPS_NOT_SHIPPED.
+//
+// The predicate itself (`hasUnmetDeps` / `readinessOf`) is proven BEHAVIOURALLY
+// in tests/goals_lib.mjs, and the server-side mirror in
+// tests/goal_sort_staleness.mjs. What is left to pin, and what this file pins,
+// is that the card actually CALLS it — and that the data it needs is asked for,
+// because the predicate is silent (correctly) when `blocked_by[]` is absent, so
+// a dropped `?include=deps` would reopen the bug with every test still green.
+//
+// goals-render.js is a browser IIFE reaching for `window` at eval time, so it is
+// read as text — the idiom tests/claim_action.mjs and claim_from_task_and_home.mjs
+// already use for these files.
+//
+// Run:  node tests/dep_blocked_ready_cards.mjs
+
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+import { makeRunner } from './helpers.mjs';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = join(__dirname, '..');
+const read = (...p) => readFileSync(join(repoRoot, ...p), 'utf8');
+const { test, summary } = makeRunner();
+
+const renderJs = read('modules', 'hall-ui', 'public', 'goals-render.js');
+
+await test('the goal page ASKS for the dependency data its cards now read', () => {
+  // Without include=deps every task arrives with no blocked_by[], hasUnmetDeps
+  // answers false for all of them, and the gate below is a no-op that still passes.
+  assert.match(renderJs, /\$\{API\}\/tasks\?goal_id=\$\{encodeURIComponent\(goalId\)\}&include=deps/,
+    'loadGoalTasks must request ?include=deps');
+});
+
+await test('a dep-blocked ready card is not offered the claim affordances', () => {
+  assert.match(renderJs, /const isReadyNow = t\.status === 'ready' && !hasUnmetDeps\(t\);/,
+    "the card's claimable predicate must ask the dependency question, not the status alone");
+  // The checkbox and the Claim button both hang off isReady, so gating that one
+  // name is what removes both.
+  assert.match(renderJs, /const isReady = isReadyNow && !!state\.me;/);
+});
+
+await test('the bulk selection prunes a tick that is no longer claimable', () => {
+  // A tick that survives the prune rides into a bulk claim the server refuses,
+  // which is the same lie one layer down.
+  assert.match(renderJs, /state\.work\.todo\.filter\(\(t\) => t\.status === 'ready' && !hasUnmetDeps\(t\)\)/);
+});
+
+await test('the card takes its lead tag from the lib, never a status echo of its own', () => {
+  // Hiding the checkbox without changing the word would leave the row reading
+  // "ready" with no affordance and no reason — worse than the bug. The tag is
+  // pure, so it lives in goals-lib.js and is proven BEHAVIOURALLY in
+  // tests/goals_lib.mjs; what this pins is that the card calls it and that the
+  // hand-rolled status span it replaced has not grown back beside it.
+  assert.match(renderJs, /: taskStatusTagHtml\(t\)\);/);
+  assert.doesNotMatch(renderJs, /<span class="task__tag" title="Task status">/,
+    'goals-render.js must not re-grow its own status tag');
+});
+
+summary();

package/tests/goal_move.mjs

@@ -0,0 +1,285 @@
+// tests/goal_move.mjs — POST /goals/:id/move re-homes a goal, whole, on another
+// version (task 1004485).
+//
+// Three layers, the goal_archive_disposition / goal_archive_route_e2e split in one
+// file: the pure gate's truth table, the writer's transaction shape against a fake
+// pool (every write inside ONE transaction, tasks moved by version_id AND goal,
+// the cross-goal criterion refusal BEFORE any write), and the real router over a
+// real socket with the db layer stubbed at the module boundary.
+//
+// Run:  node --test tests/goal_move.mjs
+
+import assert from 'node:assert/strict';
+import { test, after } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { authorizeGoalMove, moveGoalToVersion } = require('../modules/lifecycle/goal-move.js');
+
+const OPEN_GOAL = { id: '7', version_id: 'V2', status: 'open', is_maintenance: false };
+const V2 = { id: 'V2', status: 'building' };
+const V3 = { id: 'V3', status: 'planning' };
+
+// ---- the pure gate ----------------------------------------------------------
+
+test('an open goal moves to the planning version', () => {
+  const d = authorizeGoalMove({ goal: OPEN_GOAL, source: V2, target: V3 });
+  assert.deepEqual(d, { ok: true, overrideApplied: false });
+});
+
+test('refusals, each by name', () => {
+  const cases = [
+    [{ goal: null, source: null, target: V3 }, 404, 'goal_not_found'],
+    [{ goal: { ...OPEN_GOAL, is_maintenance: true }, source: V2, target: V3 }, 409, 'maintenance_goal'],
+    [{ goal: { ...OPEN_GOAL, status: 'achieved' }, source: V2, target: V3 }, 409, 'goal_not_open'],
+    [{ goal: { ...OPEN_GOAL, status: 'archived' }, source: V2, target: V3 }, 409, 'goal_not_open'],
+    [{ goal: OPEN_GOAL, source: { id: 'V2', status: 'shipped' }, target: V3 }, 409, 'source_version_shipped'],
+    [{ goal: OPEN_GOAL, source: V2, target: V2 }, 409, 'same_version'],
+    [{ goal: OPEN_GOAL, source: V2, target: null }, 404, 'version_not_found'],
+    [{ goal: OPEN_GOAL, source: V2, target: { id: 'V1', status: 'shipped' } }, 409, 'version_closed'],
+    [{ goal: { ...OPEN_GOAL, version_id: 'V3' }, source: V3, target: V2 }, 409, 'version_not_planning'],
+  ];
+  for (const [input, status, error] of cases) {
+    const d = authorizeGoalMove(input);
+    assert.equal(d.ok, false, error);
+    assert.equal(d.status, status, error);
+    assert.equal(d.body.error, error);
+  }
+});
+
+test('a building target opens only with the admit_reason override, and says so', () => {
+  const goal = { ...OPEN_GOAL, version_id: 'V3' };
+  assert.deepEqual(authorizeGoalMove({ goal, source: V3, target: V2, admitReason: 'owner pulled it back' }),
+    { ok: true, overrideApplied: true });
+  // On a planning target the reason changes nothing — so nothing is recorded.
+  assert.deepEqual(authorizeGoalMove({ goal: OPEN_GOAL, source: V2, target: V3, admitReason: 'x' }),
+    { ok: true, overrideApplied: false });
+});
+
+// ---- the writer ---------------------------------------------------------------
+
+const flat = (q) => String(q.sql).replace(/\s+/g, ' ').trim();
+function txPool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { connect: c.connect, query: (sql, params) => c._client.query(sql, params), queries: c._client.queries };
+}
+function happyPool(over = {}) {
+  return txPool((q) => {
+    for (const [re, rows] of Object.entries(over)) if (new RegExp(re).test(q)) return { rows };
+    if (/FROM goals WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: '7', version_id: 'V2', status: 'open' }] };
+    if (/FROM versions WHERE id = \$1 FOR SHARE/.test(q)) return { rows: [{ status: 'planning' }] };
+    if (/FROM task_criteria/.test(q)) return { rows: [] };
+    if (/UPDATE done_when_criteria/.test(q)) return { rows: [{ id: '51' }] };
+    if (/UPDATE tasks/.test(q)) return { rows: [{ id: '12' }, { id: '3' }] };
+    return { rows: [] };
+  });
+}
+const ARGS = { goalId: 7, fromVersionId: 'V2', toVersionId: 'V3', targetStatus: 'planning' };
+
+test('goal, criteria and every task move inside ONE transaction', async () => {
+  const pool = happyPool();
+  const out = await moveGoalToVersion(ARGS, { pool });
+  assert.deepEqual(out, { fromVersionId: 'V2', toVersionId: 'V3', taskIds: ['3', '12'], criterionIds: ['51'] });
+  const sqls = pool.queries.map(flat);
+  const at = (re) => sqls.findIndex((s) => re.test(s));
+  assert.equal(sqls.filter((s) => s === 'BEGIN').length, 1);
+  assert.equal(sqls.filter((s) => s === 'COMMIT').length, 1);
+  for (const re of [/^UPDATE goals SET version_id = \$2/, /^UPDATE done_when_criteria SET version_id = \$2 WHERE goal_id = \$1/, /^UPDATE tasks SET version_id = \$2/]) {
+    const i = at(re);
+    assert.ok(i > at(/^BEGIN$/) && i < at(/^COMMIT$/), `${re} is inside the transaction`);
+  }
+  // Every task in the goal — not only the open ones — or a shipped task would be
+  // left in a goal of another version.
+  const taskWrite = sqls[at(/^UPDATE tasks/)];
+  assert.match(taskWrite, /WHERE goal_id = \$1 RETURNING/);
+  assert.doesNotMatch(taskWrite, /status/);
+  // The goal is locked before anything is read or written.
+  assert.ok(at(/FROM goals WHERE id = \$1 FOR UPDATE/) < at(/^UPDATE/));
+});
+
+test('a criterion link crossing the goal edge refuses BEFORE any write, and names the pair', async () => {
+  const pool = happyPool({ 'FROM task_criteria': [{ task_id: '12', criterion_id: '900' }] });
+  await assert.rejects(moveGoalToVersion(ARGS, { pool }), (e) => {
+    assert.equal(e.code, 'CRITERION_LINKS_CROSS_GOAL');
+    assert.deepEqual(e.links, [{ task_id: '12', criterion_id: '900' }]);
+    return true;
+  });
+  const sqls = pool.queries.map(flat);
+  assert.equal(sqls.filter((s) => /^UPDATE|^INSERT/.test(s)).length, 0, 'nothing written');
+  assert.ok(sqls.includes('ROLLBACK'));
+});
+
+test('the crossing test asks "exactly one side inside the goal"', async () => {
+  const pool = happyPool();
+  await moveGoalToVersion(ARGS, { pool });
+  const q = pool.queries.map(flat).find((s) => /FROM task_criteria/.test(s));
+  assert.match(q, /\(t\.goal_id IS NOT DISTINCT FROM \$1\) <> \(c\.goal_id IS NOT DISTINCT FROM \$1\)/);
+});
+
+test('a goal or target that changed since the route checked rolls back', async () => {
+  for (const [over, code] of [
+    [{ 'FROM goals WHERE id = \\$1 FOR UPDATE': [{ id: '7', version_id: 'V9', status: 'open' }] }, 'GOAL_CHANGED'],
+    [{ 'FROM goals WHERE id = \\$1 FOR UPDATE': [{ id: '7', version_id: 'V2', status: 'archived' }] }, 'GOAL_CHANGED'],
+    [{ 'FROM versions WHERE id = \\$1 FOR SHARE': [{ status: 'building' }] }, 'TARGET_CHANGED'],
+    [{ 'FROM goals WHERE id = \\$1 FOR UPDATE': [] }, 'GOAL_NOT_FOUND'],
+  ]) {
+    const pool = happyPool(over);
+    await assert.rejects(moveGoalToVersion(ARGS, { pool }), (e) => e.code === code);
+    assert.equal(pool.queries.map(flat).filter((s) => /^UPDATE/.test(s)).length, 0, code);
+  }
+});
+
+test('a criterion slug the target already uses becomes CRITERION_ID_COLLISION', async () => {
+  const pool = txPool((q) => {
+    if (/FROM goals WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: '7', version_id: 'V2', status: 'open' }] };
+    if (/FROM versions WHERE id = \$1 FOR SHARE/.test(q)) return { rows: [{ status: 'planning' }] };
+    if (/UPDATE done_when_criteria/.test(q)) throw Object.assign(new Error('dup'), { code: '23505' });
+    return { rows: [] };
+  });
+  await assert.rejects(moveGoalToVersion(ARGS, { pool }), (e) => e.code === 'CRITERION_ID_COLLISION');
+});
+
+test('the admission is written only when the override opened a building target', async () => {
+  const plain = happyPool();
+  await moveGoalToVersion(ARGS, { pool: plain });
+  assert.equal(plain.queries.map(flat).filter((s) => /lifecycle_goal_version_admissions/.test(s)).length, 0);
+
+  const admitted = happyPool({ 'FROM versions WHERE id = \\$1 FOR SHARE': [{ status: 'building' }] });
+  await moveGoalToVersion({ ...ARGS, targetStatus: 'building', admission: { admittedBy: '3', reason: 'r' } }, { pool: admitted });
+  const ins = admitted.queries.find((q) => /lifecycle_goal_version_admissions/.test(flat(q)));
+  assert.ok(ins, 'admission recorded');
+  assert.deepEqual(ins.params, [7, 'V3', '3', 'r']);
+});
+
+// ---- the route, over a real socket ---------------------------------------------
+
+const express = require('express');
+const api = require('../src/module-api.js');
+const db = require('../modules/lifecycle/db.js');
+const goalMove = require('../modules/lifecycle/goal-move.js');
+
+let permSeen = null;
+api.requireBuilder = (req, _res, next) => { req.builder = { id: '3', rank: 'archon' }; next(); };
+api.requirePermission = (...p) => { permSeen = p; return (_req, _res, next) => next(); };
+
+const GOALS = { 7: { ...OPEN_GOAL }, 8: { id: '8', version_id: 'V2', status: 'open', is_maintenance: true } };
+const VERSIONS = { V2, V3 };
+let writes = [];
+db.getGoal = async (id) => GOALS[Number(id)] ?? null;
+db.getVersion = async (id) => VERSIONS[id] ?? null;
+goalMove.moveGoalToVersion = async (args) => {
+  writes.push(args);
+  GOALS[args.goalId] = { ...GOALS[args.goalId], version_id: args.toVersionId };
+  return { fromVersionId: args.fromVersionId, toVersionId: args.toVersionId, taskIds: ['3', '12'], criterionIds: [] };
+};
+
+const app = express();
+app.use(express.json());
+app.use((req, res, next) => {
+  res.fail = (code, statusOrOpts, details) => {
+    const o = typeof statusOrOpts === 'number' ? { status: statusOrOpts } : (statusOrOpts || {});
+    return res.status(o.status || 400).json({ error: code, message: o.message, details: o.details ?? details });
+  };
+  next();
+});
+app.use('/api/gds', require('../modules/lifecycle/routes/goal-move.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+after(() => server.close());
+const base = `http://127.0.0.1:${server.address().port}/api/gds`;
+const post = async (p, body) => {
+  const r = await fetch(base + p, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body ?? {}) });
+  return { status: r.status, body: await r.json().catch(() => null) };
+};
+
+test('the route is gated on the version-authoring atom', () => {
+  assert.deepEqual(permSeen, ['version.create']);
+  const pins = readFileSync(new URL('../src/bongos/route-rank-check.js', import.meta.url), 'utf8');
+  assert.match(pins, /'POST \/goals\/:id\/move': 'perm:version\.create'/);
+});
+
+test('a move returns the goal on its new version and the tasks that went with it', async () => {
+  writes = [];
+  const r = await post('/goals/7/move', { version_id: 'V3' });
+  assert.equal(r.status, 200, JSON.stringify(r.body));
+  assert.equal(r.body.goal.version_id, 'V3');
+  assert.equal(r.body.from_version_id, 'V2');
+  assert.deepEqual(r.body.moved_task_ids, ['3', '12']);
+  assert.equal(r.body.admitted, false);
+  assert.deepEqual(writes, [{ goalId: 7, fromVersionId: 'V2', toVersionId: 'V3', targetStatus: 'planning', admission: null }]);
+});
+
+test('a refused move writes nothing and renders the gate verbatim', async () => {
+  writes = [];
+  let r = await post('/goals/8/move', { version_id: 'V3' });
+  assert.equal(r.status, 409); assert.equal(r.body.error, 'maintenance_goal');
+  r = await post('/goals/404/move', { version_id: 'V3' });
+  assert.equal(r.status, 404); assert.equal(r.body.error, 'goal_not_found');
+  r = await post('/goals/8/move', {});
+  assert.equal(r.status, 400);
+  r = await post('/goals/8/move', { version_id: 'V3', versionid: 'typo' });
+  assert.equal(r.status, 400, 'an unknown field is rejected, not ignored');
+  assert.equal(writes.length, 0);
+});
+
+test('a crossing criterion link surfaces as 409 with the pairs', async () => {
+  GOALS[9] = { id: '9', version_id: 'V2', status: 'open', is_maintenance: false };
+  const real = goalMove.moveGoalToVersion;
+  goalMove.moveGoalToVersion = async () => { throw Object.assign(new Error('x'), { code: 'CRITERION_LINKS_CROSS_GOAL', links: [{ task_id: '1', criterion_id: '2' }] }); };
+  const r = await post('/goals/9/move', { version_id: 'V3' });
+  goalMove.moveGoalToVersion = real;
+  assert.equal(r.status, 409);
+  assert.equal(r.body.error, 'criterion_links_cross_goal');
+  assert.deepEqual(r.body.details.links, [{ task_id: '1', criterion_id: '2' }]);
+});
+
+// ---- the CLI wrapper ----------------------------------------------------------
+
+test('goal.js move parses a real goal id and version id, and refuses junk', () => {
+  const { parseMoveArgs } = require('../scripts/gds/goal.js');
+  assert.deepEqual(parseMoveArgs(['1000122', '--to', 'BONGOS-V3']), { id: 1000122, body: { version_id: 'BONGOS-V3' } });
+  assert.deepEqual(parseMoveArgs(['7', '--to=V3.1', '--admit-reason', 'owner call']),
+    { id: 7, body: { version_id: 'V3.1', admit_reason: 'owner call' } });
+  for (const bad of [[], ['abc', '--to', 'V3'], ['7'], ['7', '--to'], ['7', '--to', 'V 3'], ['7', '--to', 'V3;rm']]) {
+    assert.equal(parseMoveArgs(bad), null, JSON.stringify(bad));
+  }
+});
+
+// ---- version progress follows the move --------------------------------------
+//
+// The live view counts a version's tasks by tasks.version_id — so the counts move
+// with the goal exactly when the writer re-points every task's version_id, which
+// the transaction test above pins. Both halves are asserted here together: if the
+// view ever counted through goals instead, or the writer stopped touching
+// tasks.version_id, V2's progress would keep counting moved work.
+
+test('version_progress counts by tasks.version_id, and the move rewrites it for every task in the goal', async () => {
+  const { readdirSync } = await import('node:fs');
+  const files = readdirSync(new URL('../migrations/', import.meta.url)).filter((f) => f.endsWith('.sql')).sort();
+  const latest = files.filter((f) => /VIEW version_progress/.test(readFileSync(new URL('../migrations/' + f, import.meta.url), 'utf8'))).pop();
+  assert.ok(latest, 'version_progress view found');
+  const view = readFileSync(new URL('../migrations/' + latest, import.meta.url), 'utf8');
+  assert.match(view, /LEFT JOIN tasks t ON t\.version_id = v\.id/);
+
+  // Before/after against the writer's own statements: a goal holding tasks 3 and
+  // 12 on V2 — after the move both carry V3, so V2 counts 0 of them and V3 counts 2.
+  const tasks = [{ id: '3', goal_id: 7, version_id: 'V2' }, { id: '12', goal_id: 7, version_id: 'V2' }, { id: '99', goal_id: 8, version_id: 'V2' }];
+  const count = (v) => tasks.filter((t) => t.version_id === v).length;
+  assert.equal(count('V2'), 3); assert.equal(count('V3'), 0);
+  const pool = txPool((q, params) => {
+    if (/FROM goals WHERE id = \$1 FOR UPDATE/.test(q)) return { rows: [{ id: '7', version_id: 'V2', status: 'open' }] };
+    if (/FROM versions WHERE id = \$1 FOR SHARE/.test(q)) return { rows: [{ status: 'planning' }] };
+    if (/^UPDATE tasks SET version_id = \$2/.test(q)) {
+      const hit = tasks.filter((t) => t.goal_id === params[0]);
+      for (const t of hit) t.version_id = params[1];
+      return { rows: hit.map((t) => ({ id: t.id })) };
+    }
+    return { rows: [] };
+  });
+  await moveGoalToVersion(ARGS, { pool });
+  assert.equal(count('V2'), 1, 'only the other goal\'s task still counts on V2');
+  assert.equal(count('V3'), 2);
+});