@bongos/core 1.20.82 → 1.20.83

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.82",
-  "core_contract": "1.20.82",
-  "source_commit": "87ffa8207de98da4226b37da37fb0eb85e7731a6",
+  "core_version": "1.20.83",
+  "core_contract": "1.20.83",
+  "source_commit": "980e604cbc632354d35c59435b102b7a3d89310f",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T22:05:43.104Z",
+  "built_at": "2026-10-01T22:31:25.403Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 576,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3430,
-  "tree_sha256": "4097521e10162eeff35fc3172d0b5265410a17fc910c2ac7ac4949903d217c42",
+  "tree_sha256": "d2ce3028f6211f9c9dd38c0961cd5268376abe20dacd81ecba630b90c3354a94",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2817,7 +2817,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "ef5bd03a518b2fcc1cebdf63dba01b63de7deb6d531143ba97063fa33a3ac3a3"
+      "sha256": "b404ba3341028a75274dbb74618dfdfaa9b1c5ba13cd5ad127d20c8d9c6bd813"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6657,7 +6657,7 @@
     {
       "path": "modules/lifecycle/done-when.js",
       "mode": "0000644",
-      "sha256": "d18ac68962df9ad12f4eb8a51d70b50e68cd9d2e5ac24b400259351dede3883a"
+      "sha256": "bd5dc2082f80376369596c6d8615f134e064dc8689085c31b57a9fd199ffd821"
     },
     {
       "path": "modules/lifecycle/est-advisory.js",
@@ -9542,12 +9542,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f080d5a42b53ea4e940ff9410b6ffb709703164fbb20b47f2c11a5abc5c5bbc4"
+      "sha256": "cf7fdf27d152b1b848b391c4faf64692b6f22afb3ead4a273de774ef3a996e67"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d9cd9956d752e1b71cfe23ec0191aa7f81a74260874170d13139492d459a4006"
+      "sha256": "dcfd94f662fbcece5bfa0fd1202eaadc8a439a08b30728b63473ab1ffb535531"
     },
     {
       "path": "public-docs/index.html",
@@ -9567,7 +9567,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "da9deaaa50bacb5c80e5eaed36f56fe09d7e0d187c7c77a740c17fe3cc3304e3"
+      "sha256": "0fb50a613d2c0c5c5feba19216d13fb2811f168c3ab0f94f83a8353c37b60ada"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -11767,7 +11767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "a9835dd10adca10d6213ab8810b47023ac1a88fc1d917c4cd57d1feec82b0d59"
+      "sha256": "729dd2a3712dc8626174358db32d768a2e00f7349029021dcd37bf0f7db429db"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12212,7 +12212,7 @@
     {
       "path": "tests/auto_satisfy_criteria.mjs",
       "mode": "0000644",
-      "sha256": "aa0194519c4caf41959e316910d449dfcfaa0b1922f779b9078eccedffc5a234"
+      "sha256": "2ad1e7f9f3699f56ce3a6a5e97a312b99a20a20028d96742e9734ac19d801865"
     },
     {
       "path": "tests/autobongos_cadence.mjs",
@@ -13412,7 +13412,7 @@
     {
       "path": "tests/goal_closure_invariants.mjs",
       "mode": "0000644",
-      "sha256": "e0092c01a169485be1862812f3b79a258a81ea7a66cf569a1130c387141d2be0"
+      "sha256": "d14224d4b727e646cbd73d02b3dcab85694021f439af99401aefd5e84a4164cc"
     },
     {
       "path": "tests/goal_conflicts.mjs",

package/docs/module-api-changelog.md

@@ -2821,5 +2821,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.80 with no explicit bump. run 36928688478. (task 1002620)
   1.20.82 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.81 with no explicit bump. run 36932856805. (task 1002620)
+  1.20.83 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.82 with no explicit bump. run 36935503851. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/lifecycle/done-when.js

@@ -518,42 +518,91 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null, criterionId = n
                c.satisfied_by_task_id`,
     [scopedTaskId, scopedCriterionId]
   );
-  if (criteria.length === 0) return { criteria: [], goals: [] };
+  // THE SHIP THAT FLIPS NO CRITERION STILL FINISHES ITS GOAL (task 1004513).
+  // Returning here unconditionally was a hole. When every criterion of a goal was
+  // satisfied BEFORE its last task shipped, the UPDATE above matches nothing — and
+  // the other writer (`POST /done-when/:id/satisfy` → achieveGoalIfComplete) had
+  // already run too early, while that task was still open, so it correctly held
+  // the goal open and then nobody ever re-asked. The goal sat `open` with every
+  // criterion satisfied and no work left, until a criterion was satisfied a second
+  // time purely to re-trigger the other door.
+  //
+  // So on the SCOPED ship path, re-check the shipping task's OWN goal against the
+  // same rule the cascade below applies. `exec` is load-bearing here for the same
+  // reason it is there: this task's flip to `shipped` is uncommitted, and on the
+  // module pool the task check would still read `confirmed` — non-terminal — and
+  // hold the goal open exactly as before.
+  //
+  // The UNSCOPED sweep keeps its cheap early return: it holds no task, so there is
+  // no candidate goal to name, and every goal it can close it closes through the
+  // cascade below.
+  if (criteria.length === 0) {
+    if (scopedTaskId == null) return { criteria: [], goals: [] };
+    const { rows: own } = await exec.query(
+      `SELECT goal_id FROM tasks WHERE id = $1::bigint AND goal_id IS NOT NULL`,
+      [scopedTaskId]
+    );
+    const goals = await achieveCompletedGoals(exec, own.map((r) => Number(r.goal_id)));
+    return { criteria: [], goals, versionsClosed: await autoCloseVersionsForGoals(exec, goals) };
+  }
 
   // Cascade. Deliberately re-derived from the table rather than from `criteria`:
   // a goal completes when ALL of its criteria are satisfied, and the ones that
-  // closed in THIS call may not be all of them. Mirrors db.achieveGoalIfComplete
-  // exactly — open goals only, >=1 criterion, zero unsatisfied, AND no unfinished
-  // task (BV1.R09, task 1003596) — but on `exec`, so it sees the flips above
-  // inside the same transaction.
-  //
-  // THE THIRD CLAUSE, and why it must run HERE and not only in db-goals.js. This
-  // is the path that actually fires on every ship (`db-ship.js`) and every
-  // reconciler tick (`publish-reconciler.js`); `achieveGoalIfComplete` covers the
-  // manual `POST /done-when/:id/satisfy`. The two are a DELIBERATE duplicate —
-  // collapsing them into one helper creates a require cycle (db-goals requires
-  // done-when) — so the rule is written twice on purpose and both copies must
-  // move together, or a goal closes correctly through one door and wrongly
-  // through the other. ADR 0250 D2.
-  //
-  // `exec` is load-bearing for THIS clause specifically. The shipping task's flip
-  // to `shipped` is uncommitted at this point in the ship transaction; on the
-  // module pool the subquery would still see it as `confirmed` — non-terminal —
-  // and refuse to close a goal whose last task just landed. Every goal would then
-  // need a second, later trigger to close at all.
-  //
-  // Shipping is NOT blocked by any of this: the ship's own writes are untouched
-  // and this UPDATE simply matches no row, leaving the goal open.
-  //
-  // The subquery is index-served: migration 228 added idx_tasks_goal ON tasks
-  // (goal_id), so this is a small index scan per candidate goal, and the candidate
-  // set is only the goals whose criteria just closed in this call. (Raised in
-  // review off docs/architecture.md, whose tasks index list predated 228 and has
-  // been corrected.)
+  // closed in THIS call may not be all of them. The statement itself is
+  // achieveCompletedGoals, below.
   const goalIds = [...new Set(criteria.map((c) => c.goal_id).filter((g) => g != null))].map(Number);
   // No goal achieved, so no version can have just become closable.
   if (goalIds.length === 0) return { criteria, goals: [], versionsClosed: [] };
-  const { rows: goals } = await exec.query(
+  const goals = await achieveCompletedGoals(exec, goalIds);
+  // BV1.R16 (task 1003603, ADR 0263 §§3–4): a version closes ITSELF once its last
+  // non-maintenance goal achieves. On the caller's `exec`, so it sees the flips
+  // above that have not committed yet — a check on the pool would never close the
+  // version on the ship that actually finished it.
+  //
+  // `autoCloseVersionsForGoals` catches per version and never rethrows: a version
+  // close must not be able to fail a builder's ship. The accepted failure is a
+  // version left un-closed, which the reconciler's next unscoped sweep heals.
+  const versionsClosed = await autoCloseVersionsForGoals(exec, goals);
+  return { criteria, goals, versionsClosed };
+}
+
+// achieveCompletedGoals — the ONE statement that flips a goal open→achieved on
+// the ship/sweep side. Written once because autoSatisfyShippedCriteria now enters
+// it from two places — the criteria this call just closed, and (task 1004513) the
+// shipping task's own goal when it closed none — and two copies of this rule
+// would be two things to keep in step. Takes the caller's `exec` and the candidate
+// goal ids; returns the rows that actually flipped (usually none).
+//
+// Mirrors db.achieveGoalIfComplete exactly — open goals only, >=1 criterion, zero
+// unsatisfied, AND no unfinished task (BV1.R09, task 1003596).
+//
+// THE THIRD CLAUSE, and why it must run HERE and not only in db-goals.js. This is
+// the path that actually fires on every ship (`db-ship.js`) and every reconciler
+// tick (`publish-reconciler.js`); `achieveGoalIfComplete` covers the manual
+// `POST /done-when/:id/satisfy`. The two are a DELIBERATE duplicate — collapsing
+// them into one helper creates a require cycle (db-goals requires done-when) — so
+// the rule is written twice on purpose and both copies must move together, or a
+// goal closes correctly through one door and wrongly through the other. ADR 0250
+// D2.
+//
+// `exec` is load-bearing for THIS clause specifically. The shipping task's flip
+// to `shipped` is uncommitted at this point in the ship transaction; on the module
+// pool the subquery would still see it as `confirmed` — non-terminal — and refuse
+// to close a goal whose last task just landed. Every goal would then need a
+// second, later trigger to close at all.
+//
+// Shipping is NOT blocked by any of this: the ship's own writes are untouched and
+// this UPDATE simply matches no row, leaving the goal open.
+//
+// The subquery is index-served: migration 228 added idx_tasks_goal ON tasks
+// (goal_id), so this is a small index scan per candidate goal, and the candidate
+// set is only the goals this call could possibly have completed. (Raised in review
+// off docs/architecture.md, whose tasks index list predated 228 and has been
+// corrected.)
+async function achieveCompletedGoals(exec, goalIds) {
+  const ids = (goalIds || []).filter((g) => g != null).map(Number);
+  if (ids.length === 0) return [];
+  const { rows } = await exec.query(
     `UPDATE goals g
         SET status = 'achieved', updated_at = now()
       WHERE g.id = ANY($1::bigint[])
@@ -564,21 +613,12 @@ async function autoSatisfyShippedCriteria(exec, { taskId = null, criterionId = n
                           AND ${nonTerminalSql()}
                           AND ${SMOKE_NOT_LIKE.replace(/title/, 't.title')})
      RETURNING g.id, g.title, g.version_id, g.status`,
-    [goalIds]
+    [ids]
   );
   // Task 1003660: an achieved goal takes no new members — close its pending asks
   // on the same executor, so the cancel rides the ship transaction.
-  await cancelPendingMembershipRequests(exec, goals.map((g) => g.id));
-  // BV1.R16 (task 1003603, ADR 0263 §§3–4): a version closes ITSELF once its last
-  // non-maintenance goal achieves. On the caller's `exec`, so it sees the flips
-  // above that have not committed yet — a check on the pool would never close the
-  // version on the ship that actually finished it.
-  //
-  // `autoCloseVersionsForGoals` catches per version and never rethrows: a version
-  // close must not be able to fail a builder's ship. The accepted failure is a
-  // version left un-closed, which the reconciler's next unscoped sweep heals.
-  const versionsClosed = await autoCloseVersionsForGoals(exec, goals);
-  return { criteria, goals, versionsClosed };
+  await cancelPendingMembershipRequests(exec, rows.map((g) => g.id));
+  return rows;
 }
 
 // describeAutoClose — the one-line summary of what a close actually closed, or

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.82",
+  "version": "1.20.83",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.20.82",
+      "version": "1.20.83",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.20.82",
+  "version": "1.20.83",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8653,5 +8653,11 @@
       "id": "1004509",
       "text": "The Autobongos runner panel on the Gate page is now much lighter to read. While anything is missing it shows a short checklist saying what to do next; once everything is ready it shrinks to one status line with an on/off switc"
     }
+  ],
+  "1.20.83": [
+    {
+      "id": "1004513",
+      "text": "A goal now finishes by itself when its last task ships. Before, if someone ticked off all of a goal's done-when criteria while one task was still being worked on, the goal stayed open forever once that task landed — it took ti"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.20.82'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.20.83'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/auto_satisfy_criteria.mjs

@@ -158,6 +158,26 @@ await test('NO-OP: nothing closed means no cascade query at all', async () => {
   assert.equal(exec.calls.length, 1, 'must not run the goal cascade when no criterion moved');
 });
 
+await test('NO-OP (scoped): a ship that flips no criterion still re-asks its OWN goal (task 1004513)', async () => {
+  // When every criterion was satisfied BEFORE the last task shipped, the ship
+  // flips none — and the early return above used to mean nothing re-checked the
+  // goal, which then sat `open` with all its work done (goal 1000119, 2026-10-01).
+  const exec = fakeExec(
+    { rows: [] },
+    { rows: [{ goal_id: 77 }] },
+    { rows: [{ id: 77, title: 'g', version_id: 'BONGOS-V1', status: 'achieved' }] }
+  );
+  const out = await autoSatisfyShippedCriteria(exec, { taskId: 5 });
+  assert.deepEqual(out.criteria, [], 'no criterion moved — ADR 0183 is untouched');
+  assert.deepEqual(out.goals.map((g) => g.id), [77], 'but the goal closes on the ship that finished it');
+  assert.match(exec.calls[1].sql, /SELECT goal_id FROM tasks WHERE id = \$1::bigint/, 'the shipping task names the candidate');
+  assert.deepEqual(exec.calls[1].params, [5]);
+  assert.match(String(exec.calls[2].sql), /UPDATE goals g/, 'and it runs the SAME cascade statement');
+  assert.match(String(exec.calls[2].sql).replace(/\s+/g, ' '), /NOT EXISTS \(SELECT 1 FROM tasks t WHERE t\.goal_id = g\.id/,
+    'carrying R09 — this entry may not be a looser rule than the cascade');
+  assert.deepEqual(exec.calls[2].params, [[77]], 'scoped to that one goal, nothing wider');
+});
+
 await test('CASCADE: only OPEN goals, only with >=1 criterion and zero unsatisfied', async () => {
   const exec = fakeExec({ rows: [CRIT] }, { rows: [] });
   await autoSatisfyShippedCriteria(exec, { taskId: 5 });

package/tests/goal_closure_invariants.mjs

@@ -95,6 +95,14 @@ function makeExec(w) {
         return { rows: closed.map((c) => ({ ...c, satisfied_by_task_id: scoped })) };
       }
 
+      // (1b) task 1004513: the shipping task's OWN goal, asked only when the ship
+      // flipped no criterion — the case where every criterion was already
+      // satisfied and the goal has nothing left but this task.
+      if (/SELECT goal_id FROM tasks WHERE id = \$1/.test(s)) {
+        const t = taskById(Number(params[0]));
+        return { rows: t && t.goal_id != null ? [{ goal_id: t.goal_id }] : [] };
+      }
+
       // (2) the cascade. NOT hand-coded: the model reads the statement it was
       // actually handed and honours only the clauses PRESENT in it — including
       // the terminal set, parsed out of the SQL rather than imported. That is
@@ -265,6 +273,66 @@ test('every statement goes through the caller exec — none reaches the module p
   assert.match(exec.calls[3].sql, /UPDATE versions v/);
 });
 
+// ---------------------------------------------------------------------------
+// 2b. The ship that flips NO criterion still finishes its goal (task 1004513)
+//
+// The hole this pins: satisfy every criterion of a goal while one of its tasks is
+// still open. The manual door (achieveGoalIfComplete, off POST /done-when/:id/
+// satisfy) runs then and correctly declines — a task is unfinished. When that
+// task later ships, the cascade flips no criterion (they are already satisfied),
+// and before this fix the no-criteria early return meant the goal was never
+// re-asked: it sat `open` with everything done. Live on goal 1000119, 2026-10-01.
+// ---------------------------------------------------------------------------
+
+test('a goal whose criteria were ALL satisfied before its last task shipped still closes', async () => {
+  const w = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED()] });
+  const exec = makeExec(w);
+  const out = await autoSatisfyShippedCriteria(exec, { taskId: 200 });
+  assert.deepEqual(out.criteria, [], 'the ship flips no criterion — they were satisfied already');
+  assert.equal(out.goals.length, 1, 'and the goal still reaches achieved');
+  assert.equal(w.goals[0].status, 'achieved');
+  // The wiring, not just the verdict: it asks for the shipping task's own goal
+  // and then runs the SAME cascade statement, on the same exec.
+  assert.match(exec.calls[0].sql, /UPDATE done_when_criteria/);
+  assert.match(exec.calls[1].sql, /SELECT goal_id FROM tasks WHERE id = \$1/);
+  assert.match(exec.calls[2].sql, /UPDATE goals g/);
+  assert.deepEqual(exec.calls[2].params, [[77]], 'scoped to the shipping task\'s goal, nothing wider');
+  assert.match(exec.calls[3].sql, /UPDATE goal_membership_requests/, 'an achieved goal closes its pending asks on this path too (task 1003660)');
+  assert.match(exec.calls[4].sql, /UPDATE versions v/, 'and the version close still rides along');
+});
+
+for (const status of HOLDS_OPEN) {
+  test(`the no-criterion re-check honours the same rule: a '${status}' sibling still holds the goal open`, async () => {
+    const w = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED(), { status }] });
+    const out = await autoSatisfyShippedCriteria(makeExec(w), { taskId: 200 });
+    assert.deepEqual(out.goals, [], 'the re-check is the rule, not a bypass of it');
+    assert.equal(w.goals[0].status, 'open');
+  });
+}
+
+test('the no-criterion re-check reads through the exec it was handed', async () => {
+  // Same instant, two views. Inside the ship transaction task 200 is already
+  // `shipped`; on the module pool it is still `confirmed` — non-terminal — and
+  // the goal must not close. The pair is what proves the read goes through exec.
+  const inTxn = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED()] });
+  const outsideTxn = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [{ status: 'confirmed' }] });
+  assert.equal((await autoSatisfyShippedCriteria(makeExec(inTxn), { taskId: 200 })).goals.length, 1);
+  assert.deepEqual((await autoSatisfyShippedCriteria(makeExec(outsideTxn), { taskId: 200 })).goals, []);
+  assert.equal(outsideTxn.goals[0].status, 'open');
+});
+
+test('a goal-less task closes nothing, and the UNSCOPED sweep keeps its cheap early return', async () => {
+  const orphan = world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED({ goal_id: null })] });
+  const orphanExec = makeExec(orphan);
+  assert.deepEqual((await autoSatisfyShippedCriteria(orphanExec, { taskId: 200 })).goals, []);
+  assert.equal(orphanExec.calls.length, 2, 'it asks for the goal, finds none, and stops');
+
+  const sweep = makeExec(world({ criteria: [{ satisfied: true, task_ids: [200] }], tasks: [SHIPPED()] }));
+  const out = await autoSatisfyShippedCriteria(sweep, {});
+  assert.deepEqual(out, { criteria: [], goals: [] }, 'the sweep holds no task, so it has no goal to name');
+  assert.equal(sweep.calls.length, 1, 'and issues no second statement');
+});
+
 // ---------------------------------------------------------------------------
 // 3. A ship still LANDS while its goal is held open
 // ---------------------------------------------------------------------------