@bongos/core 1.20.81 → 1.20.83

package/modules/lifecycle/done-when.js

@@ -27,6 +27,7 @@ const { pool } = require('../../src/module-api');
 const { nonTerminalSql } = require('./task-status');
 const { SMOKE_NOT_LIKE } = require('./db-shared.js');
 const { executorFor } = require('./db-executor.js');
+const { cancelPendingMembershipRequests } = require('./goal-close-sweep.js');
 // BV1.R16 (task 1003603) — auto-close. Dependency-free module, so requiring it
 // here creates no cycle (db-versions.js requires THIS file, which is why the
 // rule could not live beside closeVersion).
@@ -517,42 +518,91 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null, criterionId = n
                c.satisfied_by_task_id`,
     [scopedTaskId, scopedCriterionId]
   );
-  if (criteria.length === 0) return { criteria: [], goals: [] };
+  // THE SHIP THAT FLIPS NO CRITERION STILL FINISHES ITS GOAL (task 1004513).
+  // Returning here unconditionally was a hole. When every criterion of a goal was
+  // satisfied BEFORE its last task shipped, the UPDATE above matches nothing — and
+  // the other writer (`POST /done-when/:id/satisfy` → achieveGoalIfComplete) had
+  // already run too early, while that task was still open, so it correctly held
+  // the goal open and then nobody ever re-asked. The goal sat `open` with every
+  // criterion satisfied and no work left, until a criterion was satisfied a second
+  // time purely to re-trigger the other door.
+  //
+  // So on the SCOPED ship path, re-check the shipping task's OWN goal against the
+  // same rule the cascade below applies. `exec` is load-bearing here for the same
+  // reason it is there: this task's flip to `shipped` is uncommitted, and on the
+  // module pool the task check would still read `confirmed` — non-terminal — and
+  // hold the goal open exactly as before.
+  //
+  // The UNSCOPED sweep keeps its cheap early return: it holds no task, so there is
+  // no candidate goal to name, and every goal it can close it closes through the
+  // cascade below.
+  if (criteria.length === 0) {
+    if (scopedTaskId == null) return { criteria: [], goals: [] };
+    const { rows: own } = await exec.query(
+      `SELECT goal_id FROM tasks WHERE id = $1::bigint AND goal_id IS NOT NULL`,
+      [scopedTaskId]
+    );
+    const goals = await achieveCompletedGoals(exec, own.map((r) => Number(r.goal_id)));
+    return { criteria: [], goals, versionsClosed: await autoCloseVersionsForGoals(exec, goals) };
+  }
 
   // Cascade. Deliberately re-derived from the table rather than from `criteria`:
   // a goal completes when ALL of its criteria are satisfied, and the ones that
-  // closed in THIS call may not be all of them. Mirrors db.achieveGoalIfComplete
-  // exactly — open goals only, >=1 criterion, zero unsatisfied, AND no unfinished
-  // task (BV1.R09, task 1003596) — but on `exec`, so it sees the flips above
-  // inside the same transaction.
-  //
-  // THE THIRD CLAUSE, and why it must run HERE and not only in db-goals.js. This
-  // is the path that actually fires on every ship (`db-ship.js`) and every
-  // reconciler tick (`publish-reconciler.js`); `achieveGoalIfComplete` covers the
-  // manual `POST /done-when/:id/satisfy`. The two are a DELIBERATE duplicate —
-  // collapsing them into one helper creates a require cycle (db-goals requires
-  // done-when) — so the rule is written twice on purpose and both copies must
-  // move together, or a goal closes correctly through one door and wrongly
-  // through the other. ADR 0250 D2.
-  //
-  // `exec` is load-bearing for THIS clause specifically. The shipping task's flip
-  // to `shipped` is uncommitted at this point in the ship transaction; on the
-  // module pool the subquery would still see it as `confirmed` — non-terminal —
-  // and refuse to close a goal whose last task just landed. Every goal would then
-  // need a second, later trigger to close at all.
-  //
-  // Shipping is NOT blocked by any of this: the ship's own writes are untouched
-  // and this UPDATE simply matches no row, leaving the goal open.
-  //
-  // The subquery is index-served: migration 228 added idx_tasks_goal ON tasks
-  // (goal_id), so this is a small index scan per candidate goal, and the candidate
-  // set is only the goals whose criteria just closed in this call. (Raised in
-  // review off docs/architecture.md, whose tasks index list predated 228 and has
-  // been corrected.)
+  // closed in THIS call may not be all of them. The statement itself is
+  // achieveCompletedGoals, below.
   const goalIds = [...new Set(criteria.map((c) => c.goal_id).filter((g) => g != null))].map(Number);
   // No goal achieved, so no version can have just become closable.
   if (goalIds.length === 0) return { criteria, goals: [], versionsClosed: [] };
-  const { rows: goals } = await exec.query(
+  const goals = await achieveCompletedGoals(exec, goalIds);
+  // BV1.R16 (task 1003603, ADR 0263 §§3–4): a version closes ITSELF once its last
+  // non-maintenance goal achieves. On the caller's `exec`, so it sees the flips
+  // above that have not committed yet — a check on the pool would never close the
+  // version on the ship that actually finished it.
+  //
+  // `autoCloseVersionsForGoals` catches per version and never rethrows: a version
+  // close must not be able to fail a builder's ship. The accepted failure is a
+  // version left un-closed, which the reconciler's next unscoped sweep heals.
+  const versionsClosed = await autoCloseVersionsForGoals(exec, goals);
+  return { criteria, goals, versionsClosed };
+}
+
+// achieveCompletedGoals — the ONE statement that flips a goal open→achieved on
+// the ship/sweep side. Written once because autoSatisfyShippedCriteria now enters
+// it from two places — the criteria this call just closed, and (task 1004513) the
+// shipping task's own goal when it closed none — and two copies of this rule
+// would be two things to keep in step. Takes the caller's `exec` and the candidate
+// goal ids; returns the rows that actually flipped (usually none).
+//
+// Mirrors db.achieveGoalIfComplete exactly — open goals only, >=1 criterion, zero
+// unsatisfied, AND no unfinished task (BV1.R09, task 1003596).
+//
+// THE THIRD CLAUSE, and why it must run HERE and not only in db-goals.js. This is
+// the path that actually fires on every ship (`db-ship.js`) and every reconciler
+// tick (`publish-reconciler.js`); `achieveGoalIfComplete` covers the manual
+// `POST /done-when/:id/satisfy`. The two are a DELIBERATE duplicate — collapsing
+// them into one helper creates a require cycle (db-goals requires done-when) — so
+// the rule is written twice on purpose and both copies must move together, or a
+// goal closes correctly through one door and wrongly through the other. ADR 0250
+// D2.
+//
+// `exec` is load-bearing for THIS clause specifically. The shipping task's flip
+// to `shipped` is uncommitted at this point in the ship transaction; on the module
+// pool the subquery would still see it as `confirmed` — non-terminal — and refuse
+// to close a goal whose last task just landed. Every goal would then need a
+// second, later trigger to close at all.
+//
+// Shipping is NOT blocked by any of this: the ship's own writes are untouched and
+// this UPDATE simply matches no row, leaving the goal open.
+//
+// The subquery is index-served: migration 228 added idx_tasks_goal ON tasks
+// (goal_id), so this is a small index scan per candidate goal, and the candidate
+// set is only the goals this call could possibly have completed. (Raised in review
+// off docs/architecture.md, whose tasks index list predated 228 and has been
+// corrected.)
+async function achieveCompletedGoals(exec, goalIds) {
+  const ids = (goalIds || []).filter((g) => g != null).map(Number);
+  if (ids.length === 0) return [];
+  const { rows } = await exec.query(
     `UPDATE goals g
         SET status = 'achieved', updated_at = now()
       WHERE g.id = ANY($1::bigint[])
@@ -563,18 +613,12 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null, criterionId = n
                           AND ${nonTerminalSql()}
                           AND ${SMOKE_NOT_LIKE.replace(/title/, 't.title')})
      RETURNING g.id, g.title, g.version_id, g.status`,
-    [goalIds]
+    [ids]
   );
-  // BV1.R16 (task 1003603, ADR 0263 §§3–4): a version closes ITSELF once its last
-  // non-maintenance goal achieves. On the caller's `exec`, so it sees the flips
-  // above that have not committed yet — a check on the pool would never close the
-  // version on the ship that actually finished it.
-  //
-  // `autoCloseVersionsForGoals` catches per version and never rethrows: a version
-  // close must not be able to fail a builder's ship. The accepted failure is a
-  // version left un-closed, which the reconciler's next unscoped sweep heals.
-  const versionsClosed = await autoCloseVersionsForGoals(exec, goals);
-  return { criteria, goals, versionsClosed };
+  // Task 1003660: an achieved goal takes no new members — close its pending asks
+  // on the same executor, so the cancel rides the ship transaction.
+  await cancelPendingMembershipRequests(exec, rows.map((g) => g.id));
+  return rows;
 }
 
 // describeAutoClose — the one-line summary of what a close actually closed, or

package/modules/lifecycle/goal-close-sweep.js

@@ -0,0 +1,34 @@
+'use strict';
+// goal-close-sweep.js — closing a goal cancels its outstanding invites + join
+// requests (task 1003660, from idea 1000787).
+//
+// Task 1002887 added the accept-time `goal_not_open` re-check, which refuses a
+// stale invite when someone tries to accept it — but until then the row kept
+// listing in the invitee's inbox as something they could act on. A goal that has
+// left `open` (achieved or archived) can take no new members, so its pending rows
+// are dead; this closes them at the moment the goal closes instead.
+//
+// BOTH kinds ('invite' and 'request') are cancelled, with the same 'cancelled'
+// terminal state addGoalMember uses (core_188: "withdrawn/rescinded"). 'rejected'
+// would stamp a decision on someone nobody made one about, and 'accepted' stays
+// reserved for a flow that actually ran. resolved_by is left NULL: no person
+// resolved it, the goal closing did.
+//
+// Takes the CALLER'S executor, never the module pool, and requires nothing — so
+// the ship-time cascade in done-when.js (which cannot require db-goals.js without
+// a cycle) and every archive path share one statement, and the cancel commits or
+// rolls back with the status flip it belongs to.
+
+async function cancelPendingMembershipRequests(exec, goalIds) {
+  const ids = (Array.isArray(goalIds) ? goalIds : [goalIds]).filter((g) => g != null).map(Number);
+  if (ids.length === 0) return 0;
+  const { rowCount } = await exec.query(
+    `UPDATE goal_membership_requests
+        SET status = 'cancelled', resolved_at = now(), updated_at = now()
+      WHERE goal_id = ANY($1::bigint[]) AND status = 'pending'`,
+    [ids]
+  );
+  return rowCount ?? 0;
+}
+
+module.exports = { cancelPendingMembershipRequests };

package/modules/provisioning/app-status.js

@@ -23,27 +23,40 @@ const RENDER_URL_RE = /^https:\/\/[a-z0-9-]{1,63}\.onrender\.com\/?$/;
 
 // The stages the owner sees, in order. `failed` is not a stage: it is the setup stopping.
 const STAGES = ['creating', 'building', 'live'];
+
+// How long a build may go unanswered before the owner stops being told it is building
+// (task 1004502). Render can give up on a deploy — project 43's timed out in 15 minutes —
+// and with the key gone (ADR 0327) the platform cannot read that verdict. So past this the
+// stage is `quiet`: not a failure (we cannot see one), but no longer a promise, with the
+// way to Render's own deploy history. The poller keeps knocking, so a late answer still
+// turns it `live`. Measured from the runner's last write (`updatedAt`, provision-render.js),
+// which is when `deploying` or `linked` began — the poller's `live` write never touches it.
+const QUIET_AFTER_MS = 20 * 60_000;
 const STAGE_OF = { requested: 'creating', creating: 'creating', deploying: 'building', linked: 'building', live: 'live' };
 
 function serviceLinks(serviceId) {
   if (!SERVICE_ID_RE.test(String(serviceId || ''))) return null;
   const base = `${DASHBOARD}/web/${serviceId}`;
-  return { service: base, env: `${base}/env` };
+  return { service: base, env: `${base}/env`, deploys: `${base}/events` };
 }
 
 function appUrl(url) { return RENDER_URL_RE.test(String(url || '')) ? String(url).replace(/\/+$/, '') : null; }
 
 // The owner's view of app_host: the stage, the address, the links, the failure sentence,
 // and the answers a retry re-sends (never the key — there is none to send).
-function appStatus(appHost, { keyWaiting = false } = {}) {
+function appStatus(appHost, { keyWaiting = false, now = Date.now() } = {}) {
   const h = appHost || null;
   if (!h || h.platform !== 'render') return null;
   if (h.state === 'disconnected') return { platform: 'render', state: 'disconnected', stage: null };
   const failed = h.state === 'failed';
+  const stage = failed ? null : (STAGE_OF[h.state] || 'creating');
+  const since = Date.parse(h.updatedAt || '');
+  const quiet = stage === 'building' && Number.isFinite(since) && now - since > QUIET_AFTER_MS;
   return {
     platform: 'render',
     state: h.state || 'requested',
-    stage: failed ? null : (STAGE_OF[h.state] || 'creating'),
+    stage: quiet ? 'quiet' : stage,
+    quiet,
     // an intent that still holds the lent key has not run yet, so the owner waits rather
     // than retries
     waiting: !!keyWaiting,
@@ -80,4 +93,4 @@ function retryAnswers(h) {
   return r;
 }
 
-module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, RENDER_URL_RE, SERVICE_ID_RE };
+module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, QUIET_AFTER_MS, RENDER_URL_RE, SERVICE_ID_RE };

package/modules/public-landing/public/projects.html

@@ -2333,6 +2333,13 @@ summary{min-height:24px;padding:3px 0;}
       v.hint.setAttribute('role', 'status');
       v.retryForm.appendChild(v.hint);
       v.root.appendChild(v.retryForm);
+    } else if (app.stage === 'quiet') {
+      /* Past the time box (task 1004502): Render may have given up, and with the key gone we
+         cannot see its verdict — so no stage is claimed, the owner is sent to Render's own
+         deploy history, and the watch keeps asking in case the app still comes up. */
+      v.root.appendChild(appPara(['Your app hasn’t answered for over 20 minutes. Render may have stopped the deploy — its deploy history says why.']));
+      if (app.links && app.links.deploys) v.root.appendChild(appPara([appLink(app.links.deploys, 'See its deploys on Render')]));
+      v.root.appendChild(appPara(['If it starts answering, this changes to Live by itself.']));
     } else {
       var at = APP_STAGES.map(function (s) { return s[0]; }).indexOf(app.stage);
       var ol = appEl('ol', 'appStages');

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.81",
+  "version": "1.20.83",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.81",
+      "version": "1.20.83",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.81",
+  "version": "1.20.83",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8631,5 +8631,33 @@
       "id": "1004501",
       "text": "Each builder now chooses which goals their own Autobongos runner works, in Settings, from the goals the project allows. A builder who chooses nothing gets no unattended work. Who may run a runner at all is now a project permis"
     }
+  ],
+  "1.20.82": [
+    {
+      "id": "1004502",
+      "text": "When an app on Render never comes up, its project card no longer says 'building' forever: after 20 minutes it says the app hasn't answered and links straight to the app's deploy history on Render."
+    },
+    {
+      "id": "1004452",
+      "text": "We tested the deploy self-repair on a real throwaway project on the server. When a project has leftover unsaved changes, the platform now fixes them itself and the update goes through. When it hits something it cannot fix, it"
+    },
+    {
+      "id": "1004436",
+      "text": "Every profile now shows an earnings chart for anyone who has earned credits, even artists and ideators who have never shipped a task (before, they got no chart at all). Beside the line, a \"where it came from\" list shows each k"
+    },
+    {
+      "id": "1003660",
+      "text": "Closing a goal now clears its pending invites and join requests, so a stale invite disappears from the invitee's inbox instead of sitting there until someone tries to accept it."
+    },
+    {
+      "id": "1004509",
+      "text": "The Autobongos runner panel on the Gate page is now much lighter to read. While anything is missing it shows a short checklist saying what to do next; once everything is ready it shrinks to one status line with an on/off switc"
+    }
+  ],
+  "1.20.83": [
+    {
+      "id": "1004513",
+      "text": "A goal now finishes by itself when its last task ships. Before, if someone ticked off all of a goal's done-when criteria while one task was still being worked on, the goal stayed open forever once that task landed — it took ti"
+    }
   ]
 }

package/scripts/hall-preview/server.js

@@ -118,6 +118,10 @@ const FIXTURE_FALLBACKS = [
   // the profile's drachmae chart reads the credits ledger (task 1003491): one
   // ledger fixture serves your own (/me/credits, exact match) and any other id.
   [/^builders\/\d+\/credits$/, 'me__credits'],
+  // the profile's earnings figure reads earnings by day and kind (task 1004436):
+  // one engineer's fixture serves any id; the artist and the ideator who never
+  // shipped a task (2001, 2002) carry their own, beside an empty activity record.
+  [/^builders\/\d+\/earnings$/, 'builders__earnings'],
   // the profile's per-craft activity log (task 1003281). One fixture per SECTION
   // rather than per id, because the section is what changes the row shape; the
   // craft and the page window are query string, which fixture matching ignores.

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.81'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.83'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -107,12 +107,14 @@ await test('ASYMMETRY (rollup): the /status rollup is untouched by this task', (
 await test('EXEC: every write goes through the caller-supplied exec (so a ship txn is atomic)', async () => {
   const exec = fakeExec({ rows: [CRIT] }, { rows: [{ id: 77, title: 'g', version_id: 'BONGOS-V1', status: 'achieved' }] });
   const out = await autoSatisfyShippedCriteria(exec, { taskId: 5 });
-  // Three since BV1.R16 (task 1003603): the criterion update, the goal cascade,
-  // and the version auto-close — which is the point, because the third must ride
-  // the SAME exec as the first two or a version would never close on the ship
-  // that finished it.
-  assert.equal(exec.calls.length, 3, 'criterion update + goal cascade + version auto-close');
-  assert.match(exec.calls[2].sql, /UPDATE versions v/, 'and the third is the auto-close, on exec');
+  // Four: the criterion update, the goal cascade, the pending-request sweep for the
+  // goals it just achieved (task 1003660), and the version auto-close (BV1.R16,
+  // task 1003603) — every one must ride the SAME exec or a rolled-back ship could
+  // leave a half-applied close (or a version that never closes on the ship that
+  // finished it).
+  assert.equal(exec.calls.length, 4, 'criterion update + goal cascade + request sweep + version auto-close');
+  assert.match(exec.calls[2].sql, /UPDATE goal_membership_requests/, 'the sweep rides exec');
+  assert.match(exec.calls[3].sql, /UPDATE versions v/, 'and the last is the auto-close, on exec');
   assert.deepEqual(out.criteria, [CRIT]);
   assert.deepEqual(out.goals.map((g) => g.id), [77]);
   const src = readFileSync(new URL('../modules/lifecycle/done-when.js', import.meta.url), 'utf8');
@@ -156,6 +158,26 @@ await test('NO-OP: nothing closed means no cascade query at all', async () => {
   assert.equal(exec.calls.length, 1, 'must not run the goal cascade when no criterion moved');
 });
 
+await test('NO-OP (scoped): a ship that flips no criterion still re-asks its OWN goal (task 1004513)', async () => {
+  // When every criterion was satisfied BEFORE the last task shipped, the ship
+  // flips none — and the early return above used to mean nothing re-checked the
+  // goal, which then sat `open` with all its work done (goal 1000119, 2026-10-01).
+  const exec = fakeExec(
+    { rows: [] },
+    { rows: [{ goal_id: 77 }] },
+    { rows: [{ id: 77, title: 'g', version_id: 'BONGOS-V1', status: 'achieved' }] }
+  );
+  const out = await autoSatisfyShippedCriteria(exec, { taskId: 5 });
+  assert.deepEqual(out.criteria, [], 'no criterion moved — ADR 0183 is untouched');
+  assert.deepEqual(out.goals.map((g) => g.id), [77], 'but the goal closes on the ship that finished it');
+  assert.match(exec.calls[1].sql, /SELECT goal_id FROM tasks WHERE id = \$1::bigint/, 'the shipping task names the candidate');
+  assert.deepEqual(exec.calls[1].params, [5]);
+  assert.match(String(exec.calls[2].sql), /UPDATE goals g/, 'and it runs the SAME cascade statement');
+  assert.match(String(exec.calls[2].sql).replace(/\s+/g, ' '), /NOT EXISTS \(SELECT 1 FROM tasks t WHERE t\.goal_id = g\.id/,
+    'carrying R09 — this entry may not be a looser rule than the cascade');
+  assert.deepEqual(exec.calls[2].params, [[77]], 'scoped to that one goal, nothing wider');
+});
+
 await test('CASCADE: only OPEN goals, only with >=1 criterion and zero unsatisfied', async () => {
   const exec = fakeExec({ rows: [CRIT] }, { rows: [] });
   await autoSatisfyShippedCriteria(exec, { taskId: 5 });

package/tests/autonomy_builder_scope.mjs

@@ -457,7 +457,7 @@ test('autonomy.run is an operational Metic permission, granted to Metic and Arch
 
 test('the owner page draws the PROJECT fence and pauses one builder; the settings panel writes the caller’s own picks', () => {
   const gate = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
-  assert.match(gate, /fence\.project \|\| fence/, 'the switch panel must not draw the owner’s own narrowed picks as the project list');
+  assert.match(gate, /const fence = raw\.project \|\| raw;/, 'the switch panel must not draw the owner’s own narrowed picks as the project list');
   assert.match(gate, /\/autonomy\/runners\/all/);
   assert.match(gate, /\/autonomy\/builders\/\$\{encodeURIComponent\(id\)\}\/pause/);
   const html = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.html'), 'utf8');

package/tests/autonomy_fence_priority.mjs

@@ -206,8 +206,10 @@ test('the gate page renders the priority, lists it first, and posts to the prior
   const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
   // The PROJECT fence's priority (task 1004501): GET /autonomy/fence now answers
   // with the caller's narrowed fence, and the switch panel draws `project`.
-  assert.match(src, /renderFenceGoals\(project\.goals, project\.priority_goal_id\)/, 'the page must pass the priority it read');
+  // The chips (task 1004509) are drawn from that project fence.
+  assert.match(src, /goalChipsHtml\(fence\.goals, fence\.priority_goal_id\)/, 'the page must pass the priority it read');
   assert.match(src, /sendJson\('POST', '\/autonomy\/fence\/priority', \{ goal_id: goalId \}\)/);
-  assert.match(src, /Make priority/);
-  assert.match(src, /Clear priority/);
+  // The star on a chip sets it, and the star on the priority chip clears it.
+  assert.match(src, /Work this goal first/);
+  assert.match(src, /Worked first — click to clear/);
 });

package/tests/autonomy_runner_identity.mjs

@@ -208,7 +208,7 @@ test('the migration adds the four columns, additively', () => {
 
 test('the gate card draws the PC, the account, the code and the restarting label', () => {
   const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/gate.js'), 'utf8');
-  assert.match(src, /restarting: 'Restarting'/);
+  assert.match(src, /Restarting to pick up new code/);
   assert.match(src, /PC <strong>\$\{escapeHtml\(h\.host\)\}<\/strong>/);
   assert.match(src, /Claude account \$\{escapeHtml\(h\.account\)\}/);
   assert.match(src, /behind main/);

package/tests/criterion_goal_attach.mjs

@@ -557,9 +557,13 @@ await test('setGoalStatus writes on the transaction client (task 1003840)', asyn
   const seen = [];
   const fakeClient = { query: async (sql, params) => { seen.push({ sql, params }); return { rows: [{ id: 3, status: 'achieved' }] }; } };
   await realGoals.setGoalStatus({ goalId: 3, status: 'achieved' }, { client: fakeClient });
-  assert.equal(seen.length, 1, 'the UPDATE reached the injected client');
+  // Two since task 1003660: the status flip, then the sweep of the goal's pending
+  // invites/requests. BOTH must land on the injected client, or the sweep would
+  // reintroduce the very pool-vs-transaction deadlock this test guards.
+  assert.equal(seen.length, 2, 'the UPDATE and the request sweep reached the injected client');
   assert.match(seen[0].sql, /UPDATE goals/);
   assert.deepEqual(seen[0].params, [3, 'achieved']);
+  assert.match(seen[1].sql, /UPDATE goal_membership_requests/);
 });
 
 // The wrapper installed above is removed, so nothing after this file's own tests

package/tests/goal_close_cancels_requests.mjs

@@ -0,0 +1,82 @@
+// tests/goal_close_cancels_requests.mjs
+//
+// Task 1003660: closing a goal (achieved / archived) cancels its pending invites
+// and join-requests, so a stale row leaves the inbox instead of waiting to be
+// refused at accept time. DB-free: a SQL-aware fake records the statements.
+//
+// Run:  node tests/goal_close_cancels_requests.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+const { setGoalStatus } = require('../modules/lifecycle/db-goals.js');
+const { cancelPendingMembershipRequests } = require('../modules/lifecycle/goal-close-sweep.js');
+
+const { test, summary } = makeRunner();
+
+function fakePool(handler) {
+  const c = makeSqlAwareClient(handler);
+  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
+}
+const norm = (q) => String(q.sql).replace(/\s+/g, ' ');
+const sweeps = (pool) => pool.queries.filter((q) => /^UPDATE goal_membership_requests/.test(norm(q)));
+const goalRow = (status) => ({ id: 7, status });
+const flip = (status) => (s) => (/^UPDATE goals/.test(s) ? { rows: [goalRow(status)] } : null);
+
+await test('cancelPendingMembershipRequests: cancels BOTH kinds, pending only, for the given goals', async () => {
+  const pool = fakePool(() => ({ rows: [], rowCount: 2 }));
+  const n = await cancelPendingMembershipRequests(pool, [7, '8']);
+  assert.equal(n, 2);
+  const [q] = sweeps(pool);
+  assert.match(norm(q), /SET status = 'cancelled'/);
+  assert.match(norm(q), /status = 'pending'/);
+  assert.doesNotMatch(norm(q), /kind\s*=/, 'neither the invite nor the request arm is excluded');
+  assert.deepEqual(q.params, [[7, 8]]);
+});
+
+await test('cancelPendingMembershipRequests: no ids → no statement', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  assert.equal(await cancelPendingMembershipRequests(pool, []), 0);
+  assert.equal(await cancelPendingMembershipRequests(pool, null), 0);
+  assert.equal(pool.queries.length, 0);
+});
+
+for (const status of ['achieved', 'archived']) {
+  await test(`setGoalStatus(${status}) sweeps the goal's pending requests`, async () => {
+    const pool = fakePool(flip(status));
+    await setGoalStatus({ goalId: 7, status }, { pool });
+    assert.equal(sweeps(pool).length, 1);
+    assert.deepEqual(sweeps(pool)[0].params, [[7]]);
+  });
+}
+
+await test('setGoalStatus(open) — a reopen — sweeps nothing', async () => {
+  const pool = fakePool(flip('open'));
+  await setGoalStatus({ goalId: 7, status: 'open' }, { pool });
+  assert.equal(sweeps(pool).length, 0);
+});
+
+await test('setGoalStatus on an unknown goal sweeps nothing', async () => {
+  const pool = fakePool(() => ({ rows: [] }));
+  await setGoalStatus({ goalId: 99, status: 'archived' }, { pool });
+  assert.equal(sweeps(pool).length, 0);
+});
+
+await test('every in-module writer that archives or achieves a goal also sweeps', async () => {
+  const { readFileSync } = await import('node:fs');
+  const read = (f) => readFileSync(new URL(`../modules/lifecycle/${f}`, import.meta.url), 'utf8');
+  const count = (s, re) => (s.match(re) || []).length;
+  const closes = /status = 'archived'|status = 'achieved'/g;
+  for (const f of ['db-goals.js', 'db-versions.js', 'done-when.js']) {
+    const src = read(f);
+    // setGoalStatus takes the status as a parameter (covered above); every
+    // literal close in these files must have a sweep call.
+    assert.ok(count(src, /cancelPendingMembershipRequests\(/g) >= count(src, closes),
+      `${f}: each literal goal close needs a cancelPendingMembershipRequests call`);
+  }
+});
+
+summary();

package/tests/goal_closure_invariants.mjs

@@ -95,6 +95,14 @@ function makeExec(w) {
         return { rows: closed.map((c) => ({ ...c, satisfied_by_task_id: scoped })) };
       }
 
+      // (1b) task 1004513: the shipping task's OWN goal, asked only when the ship
+      // flipped no criterion — the case where every criterion was already
+      // satisfied and the goal has nothing left but this task.
+      if (/SELECT goal_id FROM tasks WHERE id = \$1/.test(s)) {
+        const t = taskById(Number(params[0]));
+        return { rows: t && t.goal_id != null ? [{ goal_id: t.goal_id }] : [] };
+      }
+
       // (2) the cascade. NOT hand-coded: the model reads the statement it was
       // actually handed and honours only the clauses PRESENT in it — including
       // the terminal set, parsed out of the SQL rather than imported. That is
@@ -256,10 +264,73 @@ test('every statement goes through the caller exec — none reaches the module p
   // nothing reaches the module pool — is exactly what makes auto-close correct on
   // a ship: the goal it keys on was flipped in this uncommitted transaction, and
   // a pool read would not see it.
-  assert.equal(exec.calls.length, 3, 'the criterion close, the cascade and the version auto-close, all on exec');
+  // Task 1003660 added a fourth: the sweep of the achieved goal's pending
+  // invites/requests, between the cascade and the version auto-close.
+  assert.equal(exec.calls.length, 4, 'the criterion close, the cascade, the request sweep and the version auto-close, all on exec');
   assert.match(exec.calls[0].sql, /UPDATE done_when_criteria/);
   assert.match(exec.calls[1].sql, /UPDATE goals g/);
-  assert.match(exec.calls[2].sql, /UPDATE versions v/);
+  assert.match(exec.calls[2].sql, /UPDATE goal_membership_requests/);
+  assert.match(exec.calls[3].sql, /UPDATE versions v/);
+});
+
+// ---------------------------------------------------------------------------
+// 2b. The ship that flips NO criterion still finishes its goal (task 1004513)
+//
+// The hole this pins: satisfy every criterion of a goal while one of its tasks is
+// still open. The manual door (achieveGoalIfComplete, off POST /done-when/:id/
+// satisfy) runs then and correctly declines — a task is unfinished. When that
+// task later ships, the cascade flips no criterion (they are already satisfied),
+// and before this fix the no-criteria early return meant the goal was never
+// re-asked: it sat `open` with everything done. Live on goal 1000119, 2026-10-01.
+// ---------------------------------------------------------------------------
+
+test('a goal whose criteria were ALL satisfied before its last task shipped still closes', async () => {
+  const w = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED()] });
+  const exec = makeExec(w);
+  const out = await autoSatisfyShippedCriteria(exec, { taskId: 200 });
+  assert.deepEqual(out.criteria, [], 'the ship flips no criterion — they were satisfied already');
+  assert.equal(out.goals.length, 1, 'and the goal still reaches achieved');
+  assert.equal(w.goals[0].status, 'achieved');
+  // The wiring, not just the verdict: it asks for the shipping task's own goal
+  // and then runs the SAME cascade statement, on the same exec.
+  assert.match(exec.calls[0].sql, /UPDATE done_when_criteria/);
+  assert.match(exec.calls[1].sql, /SELECT goal_id FROM tasks WHERE id = \$1/);
+  assert.match(exec.calls[2].sql, /UPDATE goals g/);
+  assert.deepEqual(exec.calls[2].params, [[77]], 'scoped to the shipping task\'s goal, nothing wider');
+  assert.match(exec.calls[3].sql, /UPDATE goal_membership_requests/, 'an achieved goal closes its pending asks on this path too (task 1003660)');
+  assert.match(exec.calls[4].sql, /UPDATE versions v/, 'and the version close still rides along');
+});
+
+for (const status of HOLDS_OPEN) {
+  test(`the no-criterion re-check honours the same rule: a '${status}' sibling still holds the goal open`, async () => {
+    const w = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED(), { status }] });
+    const out = await autoSatisfyShippedCriteria(makeExec(w), { taskId: 200 });
+    assert.deepEqual(out.goals, [], 'the re-check is the rule, not a bypass of it');
+    assert.equal(w.goals[0].status, 'open');
+  });
+}
+
+test('the no-criterion re-check reads through the exec it was handed', async () => {
+  // Same instant, two views. Inside the ship transaction task 200 is already
+  // `shipped`; on the module pool it is still `confirmed` — non-terminal — and
+  // the goal must not close. The pair is what proves the read goes through exec.
+  const inTxn = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED()] });
+  const outsideTxn = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [{ status: 'confirmed' }] });
+  assert.equal((await autoSatisfyShippedCriteria(makeExec(inTxn), { taskId: 200 })).goals.length, 1);
+  assert.deepEqual((await autoSatisfyShippedCriteria(makeExec(outsideTxn), { taskId: 200 })).goals, []);
+  assert.equal(outsideTxn.goals[0].status, 'open');
+});
+
+test('a goal-less task closes nothing, and the UNSCOPED sweep keeps its cheap early return', async () => {
+  const orphan = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED({ goal_id: null })] });
+  const orphanExec = makeExec(orphan);
+  assert.deepEqual((await autoSatisfyShippedCriteria(orphanExec, { taskId: 200 })).goals, []);
+  assert.equal(orphanExec.calls.length, 2, 'it asks for the goal, finds none, and stops');
+
+  const sweep = makeExec(world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED()] }));
+  const out = await autoSatisfyShippedCriteria(sweep, {});
+  assert.deepEqual(out, { criteria: [], goals: [] }, 'the sweep holds no task, so it has no goal to name');
+  assert.equal(sweep.calls.length, 1, 'and issues no second statement');
 });
 
 // ---------------------------------------------------------------------------