@bongos/core 1.21.132 → 1.21.133

package/modules/hall-ui/public/goal-author.js

@@ -0,0 +1,197 @@
+// goal-author.js — the Goals page's "author a goal / add a done-when criterion"
+// panel (task 1003463, goal 1000089; ADR 0366 D1.2/D1.3 + D3). The hall could
+// SATISFY a criterion and never AUTHOR one, and had no POST /goals call at all.
+//
+// Two forms, nothing else:
+//   · GOAL — a name, a one-line subtitle, an optional longer description, the
+//     version, an optional category. NO scope field: the goal is created with
+//     spec_task:true, so it arrives with a "Spec goal N" task that gates its other
+//     work, and the scope is set when that task is done. Before submit, the
+//     suggester's matching open goals are shown so reuse is a click.
+//   · CRITERION — the outcome in a sentence; the slug is derived from it.
+//
+// The authority walls stay on the SERVER and this file lets them speak: it sends
+// what was typed and renders the refusal. It never hides the version a Metic
+// "cannot" use or the goal a non-member "cannot" add to — pre-filtering would turn
+// a clear refusal into a form that quietly lacks the option (ADR 0086, ADR 0154).
+//
+// Steps that are interviews — planning a version, inferring scope, drafting
+// criteria or seed tasks, judging reuse, carrying forward — are deliberately
+// absent (ADR 0366 D2). The pure half (bodies, slug, refusal copy) is
+// goal-author-lib.js; this file is the DOM and the two calls.
+(function () {
+  'use strict';
+  const lib = window.OTBGoalAuthor;
+  const { escapeHtml } = window.OTB;
+
+  // mount({ root, api, API, toast, getGoals }) — `api` is the page's typed client
+  // (api.request(method, path, { body }) → { status, ok, data }), `getGoals` the
+  // page's loaded goal rows (so the criterion form lists the goals already on the
+  // board without a second fetch).
+  function mount(opts) {
+    const { root, api, API, toast, getGoals } = opts;
+    if (!root || !lib) return;
+    let loaded = false;
+    let timer = null;
+    let seq = 0;
+
+    root.innerHTML = `
+      <button type="button" class="btn goal-author__open" id="ga-open" aria-expanded="false" aria-controls="ga-panel">New goal</button>
+      <section class="scroll goal-author" id="ga-panel" aria-labelledby="ga-h" hidden>
+        <h2 class="scroll__h" id="ga-h">Author a goal</h2>
+        <form id="ga-goal" class="goal-author__form" novalidate>
+          <label class="goal-author__field">Name
+            <input id="ga-title" type="text" maxlength="${lib.TITLE_MAX}" autocomplete="off" required>
+          </label>
+          <label class="goal-author__field">What it is for <span class="goal-author__hint">One line, under the name</span>
+            <input id="ga-subtitle" type="text" maxlength="${lib.TITLE_MAX}" autocomplete="off">
+          </label>
+          <label class="goal-author__field">Description <span class="goal-author__hint">optional</span>
+            <textarea id="ga-description" rows="3"></textarea>
+          </label>
+          <div class="goal-author__row">
+            <label class="goal-author__field">Version
+              <select id="ga-version" required><option value="">Loading…</option></select>
+            </label>
+            <label class="goal-author__field">Category <span class="goal-author__hint">optional</span>
+              <select id="ga-category"><option value="">— none —</option></select>
+            </label>
+          </div>
+          <div id="ga-suggest" class="goal-author__suggest" aria-live="polite" hidden></div>
+          <p class="goal-author__note">Scope is not asked for here: the goal gets a “Spec goal” task, and the scope is set when that task is done.</p>
+          <p class="goal-author__err" id="ga-goal-err" role="alert" hidden></p>
+          <button type="submit" class="btn btn--primary" id="ga-goal-go">Create goal</button>
+        </form>
+
+        <h2 class="scroll__h goal-author__h2" id="ga-crit-h">Add a done-when criterion</h2>
+        <form id="ga-crit" class="goal-author__form" novalidate aria-labelledby="ga-crit-h">
+          <label class="goal-author__field">Goal
+            <select id="ga-crit-goal" required><option value="">— pick a goal —</option></select>
+          </label>
+          <label class="goal-author__field">What will be true when it is done
+            <textarea id="ga-crit-text" rows="2"></textarea>
+          </label>
+          <p class="goal-author__note" id="ga-crit-slug" aria-live="polite"></p>
+          <p class="goal-author__err" id="ga-crit-err" role="alert" hidden></p>
+          <button type="submit" class="btn btn--primary" id="ga-crit-go">Add criterion</button>
+        </form>
+      </section>`;
+
+    const $q = (id) => root.querySelector(`#${id}`);
+    const panel = $q('ga-panel');
+    const openBtn = $q('ga-open');
+
+    const showErr = (id, text) => { const el = $q(id); el.textContent = text || ''; el.hidden = !text; };
+
+    async function get(path) {
+      try { return await api.request('GET', path, {}); } catch (_) { return { ok: false, status: 0, data: {} }; }
+    }
+
+    function fillGoalChoices() {
+      const sel = $q('ga-crit-goal');
+      const keep = sel.value;
+      const goals = (getGoals() || []).filter((g) => g && g.status === 'open');
+      sel.innerHTML = '<option value="">— pick a goal —</option>' + goals.map((g) =>
+        `<option value="${escapeHtml(String(g.id))}" data-version="${escapeHtml(String(g.version_id || ''))}">${escapeHtml(`${g.version_id || ''} · ${g.title}`)}</option>`).join('');
+      sel.value = keep;
+    }
+
+    async function loadChoices() {
+      if (loaded) return;
+      const [v, c] = await Promise.all([get(`${API}/versions`), get(`${API}/work-categories`)]);
+      if (!v.ok) { showErr('ga-goal-err', 'Could not load the versions. Close and reopen this panel to try again.'); return; }
+      loaded = true;
+      const versions = lib.openVersions(v.data && v.data.versions);
+      const vsel = $q('ga-version');
+      vsel.innerHTML = '<option value="">— pick a version —</option>' + versions.map((x) =>
+        `<option value="${escapeHtml(x.id)}">${escapeHtml(x.label)}</option>`).join('');
+      const cats = (c.data && c.data.categories) || [];
+      $q('ga-category').innerHTML = '<option value="">— none —</option>' + cats.map((x) =>
+        `<option value="${escapeHtml(String(x.id))}">${escapeHtml(x.label)}</option>`).join('');
+    }
+
+    // Reuse is a click: the suggester's open goals for this draft, linked to their
+    // detail view. Best-effort — a failed or empty read just hides the strip.
+    async function suggest() {
+      const box = $q('ga-suggest');
+      const version = $q('ga-version').value;
+      const title = $q('ga-title').value.trim();
+      const mine = ++seq;
+      if (!version || !title) { box.hidden = true; return; }
+      const r = await get(`${API}/goals/suggestions?version=${encodeURIComponent(version)}&title=${encodeURIComponent(title)}&kind=feature&limit=5`);
+      if (mine !== seq) return;
+      const rows = (r.ok && r.data && Array.isArray(r.data.suggestions)) ? r.data.suggestions : [];
+      if (!rows.length) { box.hidden = true; box.innerHTML = ''; return; }
+      box.innerHTML = '<p class="goal-author__hint">These open goals look related — use one instead?</p><ul>' + rows.map((g) =>
+        `<li><a href="#/goal/${encodeURIComponent(String(g.id))}">${escapeHtml(g.title || `Goal ${g.id}`)}</a></li>`).join('') + '</ul>';
+      box.hidden = false;
+    }
+    const suggestSoon = () => { clearTimeout(timer); timer = setTimeout(suggest, 350); };
+
+    function setOpen(open) {
+      panel.hidden = !open;
+      openBtn.setAttribute('aria-expanded', String(open));
+      if (open) { loadChoices(); fillGoalChoices(); $q('ga-title').focus(); }
+    }
+    openBtn.addEventListener('click', () => setOpen(panel.hidden));
+
+    $q('ga-title').addEventListener('input', suggestSoon);
+    $q('ga-version').addEventListener('change', suggestSoon);
+
+    $q('ga-goal').addEventListener('submit', async (e) => {
+      e.preventDefault();
+      showErr('ga-goal-err', '');
+      const fields = {
+        version_id: $q('ga-version').value, title: $q('ga-title').value,
+        subtitle: $q('ga-subtitle').value, description: $q('ga-description').value,
+        category_id: $q('ga-category').value,
+      };
+      const problem = lib.goalFormProblem(fields);
+      if (problem) return showErr('ga-goal-err', problem);
+      const btn = $q('ga-goal-go');
+      btn.disabled = true;
+      try {
+        const res = await api.request('POST', `${API}/goals`, { body: lib.buildGoalBody(fields) });
+        if (!res.ok) return showErr('ga-goal-err', lib.refusalText(res.status, res.data));
+        const goal = (res.data && res.data.goal) || {};
+        // The board derives everything from one boot read, so reload onto the new
+        // goal (a toast would be destroyed on the same tick).
+        if (goal.id != null) window.location.hash = `#/goal/${goal.id}`;
+        window.location.reload();
+      } catch (_) {
+        showErr('ga-goal-err', 'Could not reach the server. Try again in a moment.');
+      } finally { btn.disabled = false; }
+    });
+
+    const slugNote = () => {
+      const slug = lib.criterionSlug($q('ga-crit-text').value);
+      $q('ga-crit-slug').textContent = slug ? `Filed as: ${slug}` : '';
+    };
+    $q('ga-crit-text').addEventListener('input', slugNote);
+
+    $q('ga-crit').addEventListener('submit', async (e) => {
+      e.preventDefault();
+      showErr('ga-crit-err', '');
+      const sel = $q('ga-crit-goal');
+      const opt = sel.options[sel.selectedIndex];
+      const fields = {
+        goal_id: sel.value, version_id: opt ? opt.getAttribute('data-version') : '',
+        outcome: $q('ga-crit-text').value,
+      };
+      const problem = lib.criterionFormProblem(fields);
+      if (problem) return showErr('ga-crit-err', problem);
+      const req = lib.buildCriterionRequest(fields);
+      const btn = $q('ga-crit-go');
+      btn.disabled = true;
+      try {
+        const res = await api.request('POST', `${API}${req.path}`, { body: req.body });
+        if (!res.ok) return showErr('ga-crit-err', lib.refusalText(res.status, res.data));
+        window.location.reload();
+      } catch (_) {
+        showErr('ga-crit-err', 'Could not reach the server. Try again in a moment.');
+      } finally { btn.disabled = false; }
+    });
+  }
+
+  window.OTBGoalAuthorUI = { mount };
+})();

package/modules/hall-ui/public/goals-page.js

@@ -842,6 +842,9 @@
   }
 
   async function boot() {
+    // task 1003463 — authoring a goal / criterion. Optional-called: a stale cached
+    // page without goal-author.js loses the button, never the board.
+    window.OTBGoalAuthorUI?.mount({ root: $('#goal-author-mount'), api, API, toast, getGoals: () => state.goals });
     // Kit shimmer placeholders while the goal list loads (was one "…" div).
     const grid = $('#goal-grid');
     if (grid) {

package/modules/hall-ui/public/goals.css

@@ -563,3 +563,16 @@
 .gf-brief__n { flex-shrink: 0; font-size: 12px; color: var(--ink-faint); }
 .gf-brief__conflicts { margin: 10px 0 0; font-size: 13px; color: var(--ink-soft); }
 .gf-brief__conflicts--live { color: var(--warn); font-weight: 600; }
+
+/* task 1003463 — the author-a-goal / add-a-criterion panel (goal-author.js). */
+.goal-author { margin-top: 12px; }
+.goal-author__form { display: grid; gap: 12px; max-width: 640px; }
+.goal-author__h2 { margin-top: 20px; }
+.goal-author__field { display: grid; gap: 4px; }
+.goal-author__field input, .goal-author__field select, .goal-author__field textarea { width: 100%; box-sizing: border-box; }
+.goal-author__row { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 12px; }
+.goal-author__hint, .goal-author__note { color: var(--ink-soft); font-size: 12.5px; margin: 0; }
+.goal-author__suggest ul { margin: 4px 0 0; padding-left: 18px; }
+.goal-author__suggest li a { display: inline-block; min-height: 24px; line-height: 24px; }
+.goal-author__err { color: var(--danger); margin: 0; }
+.goal-author__open { margin-top: 8px; }

package/modules/hall-ui/public/goals.html

@@ -37,6 +37,8 @@
         <!-- task 1003479: the goal map has no nav slot of its own (the sky's rule —
              a map that is reachable but not load-bearing), so this is its door. -->
         <p class="page-head__sub"><a href="/builders/goal-map">See which goals wait on each other →</a></p>
+        <!-- task 1003463: author a goal / a done-when criterion (goal-author.js). -->
+        <div id="goal-author-mount"></div>
       </div>
 
       <main id="hall-main">
@@ -260,6 +262,8 @@
 <!-- task 1004402: the criterion UAT pills, panel and sign-off (ADR 0351). Loaded
      BEFORE goals-render.js, which reads window.OTBCriterionUat at factory time. -->
 <script src="/builders/criterion-uat-ui.js?v=2026-09-30-uat2"></script>
+<script src="/builders/goal-author-lib.js"></script>
+<script src="/builders/goal-author.js"></script>
 <script src="/builders/goals-render.js?v=2026-09-30-uat2"></script>
 <script src="/builders/goals-page.js?v=2026-09-30-uat2"></script>
 </body>

package/modules/hall-ui/public/goals.states.json

@@ -14,7 +14,8 @@
     "/api/(gds|bongos)/tasks",
     "/api/(gds|bongos)/versions",
     "/api/(gds|bongos)/inbox/",
-    "/api/(gds|bongos)/work-categories"
+    "/api/(gds|bongos)/work-categories",
+    "/api/(gds|bongos)/goals/suggestions"
   ],
   "ignoreConsole": [
     "/api/(gds|bongos)/",
@@ -184,6 +185,38 @@
           "#goal-completion-full .uat-form"
         ]
       }
+    },
+    "author": {
+      "auth": true,
+      "actions": [
+        [
+          "wait",
+          600
+        ],
+        [
+          "click",
+          "#ga-open"
+        ],
+        [
+          "wait",
+          300
+        ]
+      ],
+      "expect": {
+        "visible": [
+          "#ga-panel",
+          "#ga-title",
+          "#ga-version",
+          "#ga-crit-goal"
+        ],
+        "attr": [
+          [
+            "#ga-open",
+            "aria-expanded",
+            "true"
+          ]
+        ]
+      }
     }
   },
   "reducedMotion": {

package/modules/hall-ui/records/goal-authoring.md

@@ -0,0 +1,10 @@
+# Authoring a goal and a done-when criterion — on the Goals page (task 1003463)
+
+**The Goals page can AUTHOR now, not only satisfy (task 1003463, goal 1000089; ADR 0366 D1.2/D1.3/D2/D3).** A "New goal" button under the page head opens one panel with two forms. Pure half `goal-author-lib.js` (`window.OTBGoalAuthor`), DOM half `goal-author.js` (`window.OTBGoalAuthorUI`, mounted from `goals-page.js` behind an optional call so a stale cached page loses the button, never the board).
+
+- **Goal form = name + subtitle + description + version + category, and NO scope field.** It always sends `spec_task: true` (task 1004585): the goal arrives with a "Spec goal N" task that gates its other work and the scope is set when that task is done. The name and subtitle are separate boxes — the goal board's convention (goal 1000072) is that a title does not carry its own explanation.
+- **Reuse is a click.** As the name is typed (350ms debounce, stale answers dropped) the suggester's open goals for that version (`GET /goals/suggestions`) are linked to their detail view above the submit button. Best-effort: a failed read hides the strip.
+- **Criterion form = outcome text; the slug is derived from it** and shown ("Filed as: …"). A slug shaped like a position (C1…) is prefixed, because the server refuses those. The goal's own version rides in the path (`POST /versions/:id/done-when`).
+- **The two authority walls are the server's and the form does not soften them.** It offers every open version and every open goal, sends what was typed, and prints the server's own refusal sentence (`refusalText` only fills in a bare code). Pre-filtering "versions a Metic cannot use" or "goals you do not manage" would turn a clear refusal into a form that quietly lacks the option — the reason ADR 0154's mask was removed in task 1002614. `tests/goal_author_ui.mjs` drives the form's own request through the real goals and done-when routers: a Metic's protected-scope goal is still 403 `archon_required_for_protected_scope`, a non-member's criterion is still 403 `goal_not_yours`, a manager's succeeds.
+- **Deliberately absent (ADR 0366 D2, interview-shaped):** version planning, scope inference, drafting criteria or seed tasks, reuse judgement, carry-forward, and the Archon admission into a building version. The test asserts the UI source names none of `scope_modules`, `succeeds_goal_id`, `admit_reason`.
+- A successful create reloads the page (to `#/goal/N` for a goal) rather than patching `state.goals` by hand: the board's rollups, rings and filters all derive from one boot read.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.132",
+  "version": "1.21.133",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.132",
+      "version": "1.21.133",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.132",
+  "version": "1.21.133",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9794,5 +9794,11 @@
       "id": "1004743",
       "text": "A project whose GitHub sign-in already works now gets that step ticked on its setup checklist automatically, within about five minutes."
     }
+  ],
+  "1.21.133": [
+    {
+      "id": "1003463",
+      "text": "The Goals page can now create a goal and add a done-when criterion to it."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.132'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.133'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/goal_author_ui.mjs

@@ -0,0 +1,210 @@
+// tests/goal_author_ui.mjs — authoring a goal and a done-when criterion from the
+// hall (task 1003463; ADR 0366 D1.2/D1.3/D2/D3). Three layers:
+//   1. the pure lib (goal-author-lib.js) in a vm — the request BODIES the form
+//      sends, the derived slug, and how a refusal is put into words;
+//   2. the page wiring, read as source — the form carries no scope field and no
+//      interview-shaped step;
+//   3. the two server walls the form must not soften, driven with the form's OWN
+//      request through the assembled routers: a Metic's goal on a protected module
+//      is still refused, and a non-member's criterion is still refused.
+//
+// Run:  node --test tests/goal_author_ui.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.NODE_ENV = 'test';
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const PUB = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8');
+
+const win = {};
+const sandbox = { window: win, String, Number, Array, Object, JSON, Math, Date, Set, Map };
+vm.createContext(sandbox);
+vm.runInContext(read('goal-author-lib.js'), sandbox, { filename: 'goal-author-lib.js' });
+const lib = win.OTBGoalAuthor;
+// Objects built inside the vm are another realm's; compare their JSON.
+const plain = (v) => JSON.parse(JSON.stringify(v));
+
+// ── 1. the pure half ─────────────────────────────────────────────────────────
+
+test('the goal body carries spec_task:true and NO scope, successor or admission', () => {
+  const body = lib.buildGoalBody({
+    version_id: ' V9 ', title: '  Hall goal ', subtitle: ' what it is for ', description: '', category_id: '3',
+    scope_modules: ['kernel'], succeeds_goal_id: 5, admit_reason: 'because reasons',
+  });
+  assert.deepEqual(plain(body), { version_id: 'V9', title: 'Hall goal', spec_task: true, subtitle: 'what it is for', category_id: 3 });
+  for (const k of ['scope_modules', 'succeeds_goal_id', 'admit_reason']) assert.ok(!(k in body), `${k} must not be sendable from this form`);
+});
+
+test('an empty subtitle, description and category are omitted rather than sent blank', () => {
+  const body = lib.buildGoalBody({ version_id: 'V9', title: 'x', subtitle: '  ', description: '', category_id: '' });
+  assert.deepEqual(plain(body), { version_id: 'V9', title: 'x', spec_task: true });
+});
+
+test('the goal form asks only for what the server checks first', () => {
+  assert.match(lib.goalFormProblem({ version_id: '', title: 'x' }), /version/i);
+  assert.match(lib.goalFormProblem({ version_id: 'V9', title: '   ' }), /name/i);
+  assert.match(lib.goalFormProblem({ version_id: 'V9', title: 'x'.repeat(lib.TITLE_MAX + 1) }), /under/);
+  assert.equal(lib.goalFormProblem({ version_id: 'V9', title: 'x' }), null);
+});
+
+test('the criterion slug is derived from the outcome text and is never positional', () => {
+  assert.equal(lib.criterionSlug('A goal and a criterion can be authored from the hall!'), 'a-goal-and-a-criterion-can-be-authored-from-the');
+  assert.equal(lib.criterionSlug('C7'), 'criterion-c7', 'a Cn-shaped slug is refused by the server, so it is never produced');
+  assert.equal(lib.criterionSlug('!!!'), '');
+  assert.ok(lib.criterionSlug('word '.repeat(40)).length <= 48);
+  assert.ok(!lib.criterionSlug('café déjà vu').match(/[^a-z0-9-]/));
+});
+
+test('the criterion request is POST /versions/<goal\'s version>/done-when with the goal named', () => {
+  const r = lib.buildCriterionRequest({ goal_id: '12', version_id: 'V 9', outcome: ' Hall can author a goal ' });
+  assert.equal(r.path, '/versions/V%209/done-when');
+  assert.deepEqual(plain(r.body), { criterion_id: 'hall-can-author-a-goal', criterion_md: 'Hall can author a goal', goal_id: 12 });
+  assert.match(lib.criterionFormProblem({ goal_id: '', outcome: 'x' }), /goal/i);
+  assert.match(lib.criterionFormProblem({ goal_id: '3', outcome: ' ' }), /true/i);
+  assert.equal(lib.criterionFormProblem({ goal_id: '3', outcome: 'x' }), null);
+});
+
+test('a refusal keeps the server\'s own sentence and only fills in a bare code', () => {
+  assert.equal(lib.refusalText(403, { error: { code: 'x', message: 'Only an Archon.' } }), 'Only an Archon.');
+  assert.match(lib.refusalText(403, { error: 'goal_not_yours', message: 'Ask the owner.' }), /owner/);
+  assert.match(lib.refusalText(403, { error: { code: 'archon_required_for_protected_scope', message: 'archon_required_for_protected_scope' } }), /Archon/);
+  assert.match(lib.refusalText(409, { error: 'criterion_exists' }), /already exists/);
+  assert.match(lib.refusalText(500, null), /did not go through/);
+});
+
+test('versions are listed by openness only — the rank wall is the server\'s', () => {
+  const v = lib.openVersions([{ id: 'A', status: 'shipped' }, { id: 'B', status: 'building' }, { id: 'C', status: 'planning' }, null]);
+  assert.deepEqual(plain(v).map((x) => x.id), ['B', 'C']);
+});
+
+// ── 2. the page wiring ───────────────────────────────────────────────────────
+
+test('the form has no scope field and none of the interview-shaped steps', () => {
+  const ui = read('goal-author.js');
+  assert.ok(!/scope_modules|ga-scope|succeeds_goal_id|admit_reason/.test(ui), 'no scope / carry-forward / admission control');
+  assert.ok(!/\/goals\/\$\{[^}]*\}\/scope/.test(ui), 'the scope is set by the spec task, not here');
+  assert.match(ui, /goals\/suggestions\?version=/, 'matching open goals are shown before submit');
+  assert.match(ui, /\/goals`, \{ body: lib\.buildGoalBody/, 'POST /goals goes through the pure body builder');
+});
+
+test('goals.html loads the lib before the UI, and goals-page.js mounts it behind a guard', () => {
+  const html = read('goals.html');
+  const at = (f) => html.indexOf(`src="/builders/${f}"`);
+  assert.ok(at('goal-author-lib.js') > 0 && at('goal-author-lib.js') < at('goal-author.js'));
+  assert.ok(at('goal-author.js') < at(html.match(/src="\/builders\/(goals-page\.js[^"]*)"/)[1]));
+  assert.match(html, /id="goal-author-mount"/);
+  assert.match(read('goals-page.js'), /window\.OTBGoalAuthorUI\?\.mount\(/);
+});
+
+// ── 3. the walls, driven with the form's own request ─────────────────────────
+
+const r2 = createRequire(import.meta.url);
+
+async function withRouter(routeFile, rank, setup, fn) {
+  const auth = r2(path.join(ROOT, 'src/bongos/auth.js'));
+  const api = r2(path.join(ROOT, 'src/module-api.js'));
+  const db = r2(path.join(ROOT, 'modules/lifecycle/db.js'));
+  const routePath = r2.resolve(path.join(ROOT, routeFile));
+  const saved = { rb: auth.requireBuilder, rp: auth.requirePermission, tx: api.withTx };
+  const savedDb = {};
+  auth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, rank }; next(); };
+  auth.requirePermission = () => (_req, _res, next) => next();
+  api.withTx = async (f) => f({ query: async () => ({ rows: [] }) });
+  const calls = setup(db, (k) => { savedDb[k] = savedDb[k] || db[k]; });
+  delete r2.cache[routePath];
+  const express = r2('express');
+  const { attachFail } = r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use(r2(routePath)());
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const post = async (p, body) => {
+    const res = await fetch(`http://127.0.0.1:${server.address().port}${p}`, {
+      method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(body),
+    });
+    return { status: res.status, data: await res.json().catch(() => ({})) };
+  };
+  try { await fn(post, calls); } finally {
+    server.close();
+    auth.requireBuilder = saved.rb; auth.requirePermission = saved.rp; api.withTx = saved.tx;
+    for (const [k, v] of Object.entries(savedDb)) db[k] = v;
+    delete r2.cache[routePath];
+  }
+}
+
+const goalSetup = (db, keep) => {
+  const calls = { createGoal: 0 };
+  for (const k of ['getVersion', 'createGoal', 'createTask']) keep(k);
+  db.getVersion = async (id) => ({ id, status: 'planning' });
+  db.createGoal = async (f) => { calls.createGoal += 1; return { id: 42, version_id: f.versionId, title: f.title }; };
+  db.createTask = async (f) => ({ id: 500, ...f });
+  return calls;
+};
+
+test('wall: the form\'s own goal request succeeds for a Metic and creates the spec task', async () => {
+  await withRouter('modules/lifecycle/routes/goals.js', 'metic', goalSetup, async (post, calls) => {
+    const body = lib.buildGoalBody({ version_id: 'V9', title: 'Hall goal', subtitle: 'for the hall' });
+    const res = await post('/goals', body);
+    assert.equal(res.status, 201, JSON.stringify(res.data));
+    assert.equal(res.data.spec_task.id, 500);
+    assert.equal(calls.createGoal, 1);
+  });
+});
+
+test('wall: a Metic still cannot create a goal scoped to a protected module', async () => {
+  await withRouter('modules/lifecycle/routes/goals.js', 'metic', goalSetup, async (post, calls) => {
+    // The hall form cannot send this field; the server must refuse it anyway.
+    const res = await post('/goals', { ...lib.buildGoalBody({ version_id: 'V9', title: 'Hall goal' }), scope_modules: ['kernel'] });
+    assert.equal(res.status, 403);
+    assert.equal(res.data.error && res.data.error.code, 'archon_required_for_protected_scope');
+    assert.equal(calls.createGoal, 0);
+    assert.match(lib.refusalText(res.status, res.data), /Archon/);
+  });
+});
+
+const criterionSetup = (membership) => (db, keep) => {
+  const calls = { createCriterion: 0 };
+  for (const k of ['getVersion', 'getGoal', 'getGoalMember', 'createCriterion']) keep(k);
+  db.getVersion = async (id) => ({ id, status: 'building' });
+  db.getGoal = async (id) => ({ id, version_id: 'V9', status: 'open', created_by: 99 });
+  db.getGoalMember = async () => membership;
+  db.createCriterion = async (f) => { calls.createCriterion += 1; return { criterion_id: f.criterionId }; };
+  return calls;
+};
+
+test('wall: a non-member Metic\'s criterion is refused by the server, with its reason', async () => {
+  await withRouter('modules/lifecycle/routes/done-when.js', 'metic', criterionSetup(null), async (post, calls) => {
+    const req = lib.buildCriterionRequest({ goal_id: '12', version_id: 'V9', outcome: 'Hall can author a goal' });
+    req.body.goal_id = 12;
+    const res = await post(req.path, req.body);
+    assert.equal(res.status, 403);
+    assert.equal(res.data.error, 'goal_not_yours');
+    assert.equal(calls.createCriterion, 0);
+    assert.match(lib.refusalText(res.status, res.data), /owner or a manager/);
+  });
+});
+
+test('wall: the goal\'s manager can add the same criterion through the same request', async () => {
+  await withRouter('modules/lifecycle/routes/done-when.js', 'metic', criterionSetup({ membership_kind: 'lead' }), async (post, calls) => {
+    const req = lib.buildCriterionRequest({ goal_id: '12', version_id: 'V9', outcome: 'Hall can author a goal' });
+    const res = await post(req.path, req.body);
+    assert.equal(res.status, 201, JSON.stringify(res.data));
+    assert.equal(calls.createCriterion, 1);
+  });
+});
+
+test('wall: both routes still sit behind their permission atoms', () => {
+  const g = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/goals.js'), 'utf8');
+  const d = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/done-when.js'), 'utf8');
+  assert.match(g, /router\.post\('\/goals', auth\.requireBuilder, auth\.requirePermission\('goal\.create'\)/);
+  assert.match(d, /router\.post\('\/versions\/:id\/done-when', auth\.requireBuilder, auth\.requirePermission\('criterion\.create'\)/);
+});