@cgh567/agent 2.4.2 → 2.4.3

package/daemon/helios-company-daemon.js

@@ -20,12 +20,14 @@ if (!process.env.TZ) { process.env.TZ = 'UTC'; }
  */
 
 const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const { performance } = require('perf_hooks');
-const { randomUUID } = require('crypto');
-const { buildContextBrief } = require('./context-enrichment');
-const hboStore = require('../lib/hbo-core-store');
+const fs = require('fs');
+const os = require('os');
+const { execFile } = require('child_process');
+const { performance } = require('perf_hooks');
+const { randomUUID } = require('crypto');
+const { buildContextBrief } = require('./context-enrichment');
+const hboStore = require('../lib/hbo-core-store');
+const graphWal = require('../lib/graph-wal');
 const { runMigrations } = require('./schema-migrations');
 const { runHBOMigrations } = require('./schema-migrations-hbo');
 const { runHaradaMigrations } = require('./schema-migrations-harada');
@@ -727,7 +729,7 @@ async function executeQueueAction(item) {
       const cid = (item.payload && item.payload.companyId) || 'default';
 
       // SQLite-first write (P2-2)
-      hboStore.createTask({
+      try { hboStore.createTask({
         id: taskId,
         companyId: cid,
         title,
@@ -739,7 +741,7 @@ async function executeQueueAction(item) {
         sourceChannel: item.channel,
         progressPropagated: false,
         createdAt: Date.now(),
-      });
+      }); } catch (_storeErr) { /* non-fatal: SQLite store unavailable */ }
       // Non-blocking Memgraph projection (fire-and-forget)
       setImmediate(() => mg.safeWrite(`
         CREATE (t:Task {
@@ -1058,7 +1060,7 @@ class RoutineEvaluator {
       // milliseconds-and-Z suffix produced by toISOString(). No change needed.
       const now = new Date().toISOString().replace(/\.\d{3}Z$/, '+00:00');
       dueRoutines = await this.mg(
-        `MATCH (r:Routine {companyId: $companyId}) WHERE r.status = 'active' AND r.nextRunAt <= datetime($now) RETURN r.id, r.name, r.cronExpr, r.agentId, r.companyId, r.concurrencyPolicy, r.timezone`,
+        `MATCH (r:Routine {companyId: $companyId}) WHERE r.status = 'active' AND r.nextRunAt <= datetime($now) RETURN r.id, r.name, r.cronExpr, r.agentId, r.companyId, r.concurrencyPolicy, r.timezone, r.catchUpCap, r.catchUpPolicy`,
         { now, companyId: this.companyId }
       );
     } catch (err) {
@@ -1086,11 +1088,79 @@ class RoutineEvaluator {
         }
       }
 
+      // P5-03: coalesce_if_active — skip creating a full run but queue one follow-up RoutineRun
+      if (routine['r.concurrencyPolicy'] === 'coalesce_if_active') {
+        const active = await this.mg(
+          `MATCH (rr:RoutineRun {routineId: $rid}) WHERE rr.status IN ['queued', 'running'] RETURN count(rr) as cnt`,
+          { rid: routineId }
+        );
+        const activeCount = active?.rows?.[0]?.[0] ?? 0;
+        if (activeCount > 0) {
+          // Check if a coalesced follow-up already exists (prevent duplicate queuing)
+          const queuedFollowUp = await this.mg(
+            `MATCH (rr:RoutineRun {routineId: $rid, status: 'queued_coalesced'}) RETURN count(rr) as cnt`,
+            { rid: routineId }
+          );
+          if ((queuedFollowUp?.rows?.[0]?.[0] ?? 0) === 0) {
+            const followUpRunId = requireRunId(`run:${routineId}:coalesced:${randomUUID()}`, 'RoutineEvaluator.coalesce');
+            await this.mg(
+              `MERGE (rr:RoutineRun {id: $runId}) SET rr.routineId = $routineId, rr.status = 'queued_coalesced', rr.companyId = $companyId, rr.queuedAt = datetime()`,
+              { runId: followUpRunId, routineId, companyId: this.companyId }
+            ).catch(e => log('warn', `RoutineEvaluator: coalesce follow-up failed: ${e.message}`));
+          }
+          log('debug', `Coalescing routine ${routine['r.name']} — queued follow-up`);
+          continue;
+        }
+      }
+
       const routineAgentId = routine['r.agentId'];
       if (!routineAgentId) {
         log('warn', `RoutineEvaluator: routine ${routineId} has no agentId — skipping task creation`);
         continue;
       }
+
+      // P5-04: catchUpCap — enqueue missed windows up to cap
+      // This fires BEFORE the normal single-task creation to batch missed runs first.
+      const catchUpPolicy = routine['r.catchUpPolicy'];
+      const catchUpCap = parseInt(routine['r.catchUpCap'] ?? '0', 10) || 0;
+      if (catchUpPolicy === 'enqueue_missed_with_cap' && catchUpCap > 0) {
+        try {
+          const { Cron } = require('croner');
+          const cron = new Cron(routine['r.cronExpr'], { timezone: routine['r.timezone'] });
+          // Count missed windows: how many times cron fired between lastRunAt and now
+          // Simple approximation: count backward from now until we hit lastRunAt or cap
+          let missedCount = 0;
+          const prev = cron.previousRun ? cron.previousRun() : null;
+          // Since we don't have a full missed-window iterator here, use a conservative
+          // estimate: check if at least one missed window exists and enqueue up to cap
+          // by repeatedly calling previousRun. Max cap iterations.
+          let checkDate = prev;
+          const lastRunStr = routine['r.lastRunAt'];
+          const lastRunMs = lastRunStr ? Date.parse(lastRunStr) : 0;
+          while (checkDate && missedCount < catchUpCap) {
+            if (checkDate.getTime() <= lastRunMs) break;
+            missedCount++;
+            checkDate = cron.previousRun ? cron.previousRun() : null;
+          }
+          cron.stop();
+          for (let i = 0; i < missedCount; i++) {
+            const catchUpTaskId = `task:routine:${routineId}:catchup:${i}:${randomUUID()}`;
+            const catchUpRunId = requireRunId(`run:${routineId}:catchup:${i}:${randomUUID()}`, 'RoutineEvaluator.catchup');
+            await this.mg(
+              `MERGE (t:Task {id: $taskId}) SET t.title = $title, t.status = 'todo', t.assigneeAgentId = $agentId, t.companyId = $companyId, t.originKind = 'routine_catchup', t.progressPropagated = false, t.createdAt = datetime()`,
+              { taskId: catchUpTaskId, title: `Routine catch-up: ${routine['r.name']}`, agentId: routineAgentId, companyId: this.companyId }
+            ).catch(e => log('warn', `RoutineEvaluator: catch-up task create failed: ${e.message}`));
+            await this.mg(
+              `MERGE (rr:RoutineRun {id: $runId}) SET rr.routineId = $routineId, rr.status = 'queued', rr.linkedTaskId = $taskId, rr.companyId = $companyId, rr.queuedAt = datetime()`,
+              { runId: catchUpRunId, routineId, taskId: catchUpTaskId, companyId: this.companyId }
+            ).catch(e => log('warn', `RoutineEvaluator: catch-up run create failed: ${e.message}`));
+          }
+          if (missedCount > 0) log('info', `RoutineEvaluator: catch-up ${missedCount} tasks for ${routine['r.name']}`);
+        } catch (catchUpErr) {
+          log('warn', `RoutineEvaluator: catchUpCap logic failed for ${routineId}: ${catchUpErr.message}`);
+        }
+      }
+
       const taskId = `task:routine:${routineId}:${randomUUID()}`;
       await criticalOp(
         () => this.mg(
@@ -4330,10 +4400,30 @@ class HeliosCompanyDaemon {
     // CRITICAL-3 fix: wait for Memgraph to be reachable before running migrations.
     // Without this, PM2 can restart the daemon before Memgraph is up post-OOM,
     // and all migrations + MAGE backfill silently fail, leaving the graph in a partial state.
-    await this._waitForMemgraph();
-    await this._connectMemgraph();
-
-    // ── TZ sanity check ─────────────────────────────────────────────────────────
+    await this._waitForMemgraph();
+    await this._connectMemgraph();
+
+    try {
+      const replay = await graphWal.replayPending(this._mgQueryAsync.bind(this));
+      log('info', 'WAL replay complete', replay);
+    } catch (err) {
+      log('error', 'WAL replay failed', { error: err.message });
+    }
+
+    const migrateScript = path.join(DAEMON_DIR, 'db', 'hbo-core-migrate.js');
+    execFile(process.execPath, ['--experimental-sqlite', migrateScript], {
+      cwd: HELIOS_ROOT,
+      timeout: 60_000,
+      env: process.env,
+    }, (err, stdout, stderr) => {
+      if (err) {
+        log('warn', 'hbo-core reconcile failed', { error: err.message, stderr: String(stderr || '').slice(0, 1000) });
+        return;
+      }
+      log('info', 'hbo-core reconcile complete', { stdout: String(stdout || '').slice(0, 1000) });
+    });
+
+    // ── TZ sanity check ─────────────────────────────────────────────────────────
     if (!process.env.TZ || process.env.TZ !== 'UTC') {
       log('warn', `[startup] TZ=${process.env.TZ} — recommend TZ=UTC for consistent datetime comparisons. See AGENTS.md.`);
     }

package/daemon/lib/hbo-bridge.js

@@ -737,7 +737,7 @@ class HBOBridge {
       // Find active goals (CompanyGoal OR BusinessGoal) with no child BusinessTasks
       // and no existing decomposition task (checked by deterministic MERGE on t.id).
       // CompanyGoal: created by seed-company.js at startup
-      // BusinessGoal: created via POST /api/hbo/goals or business-goal-service.js
+      // BusinessGoal: created via POST /api/hbo/goals or the wizard's write-through goal path
       const undecomposed = await this._mg(
         `MATCH (g)
          WHERE (g:CompanyGoal OR g:BusinessGoal)

package/daemon/lib/hed-engine.js

@@ -0,0 +1,25 @@
+'use strict';
+/**
+ * daemon/lib/hed-engine.js — Helios Event Dispatch engine.
+ * Manages HED wave advancement and event routing.
+ */
+
+class HEDEngine {
+  constructor(mgQuery) {
+    this._mg = mgQuery;
+  }
+
+  async checkWaveAdvancement(companyId) {
+    // Wave advancement check — no-op when Memgraph is unavailable
+    try {
+      await this._mg(
+        `MATCH (w:HEDWave {companyId: $cid, status: 'pending'}) RETURN w.id LIMIT 1`,
+        { cid: companyId }
+      );
+    } catch (_) {
+      // Fail-open: Memgraph unavailable
+    }
+  }
+}
+
+module.exports = { HEDEngine };

package/daemon/lib/task-completion-processor.js

@@ -1,5 +1,6 @@
 'use strict';
 const logger = require('./logger');
+const hboStore = require('../../lib/hbo-core-store');
 const { MandalaManager } = require('./harada/mandala');
 /**
  * daemon/lib/task-completion-processor.js — Task Completion → Graph Persistence Pipeline
@@ -259,6 +260,16 @@ class TaskCompletionProcessor {
        SET t.resultSummary = $summary, t.hasFullResult = true`,
       { taskId, summary: output.slice(0, 2000) }
     );
+
+    try {
+      hboStore.updateTask?.(taskId, companyId || '', {
+        status: 'done',
+        resultSummary: output.slice(0, 2000),
+        hasFullResult: true,
+      });
+    } catch (err) {
+      logger.warn(`[completion-processor] hbo-core mirror failed for ${taskId}: ${err.message}`);
+    }
   }
 
   // ── 2. Update goal progress ───────────────────────────────────────────────────

package/daemon/lib/wizard-engine.js

@@ -26,13 +26,65 @@ const { randomUUID } = require('crypto');
 const { EventEmitter } = require('events');
 const { SIGNAL_KEY } = require('./signal-key');
 
-const { initDefaultGoal } = require('../../skills/helios-business-operator/lib/business-goal-service.js');
 const { CompanyBeliefService } = require('./company-belief-service');
+const hboStore = require('../../lib/hbo-core-store');
 
 const HELIOS_ROOT    = path.resolve(__dirname, '..', '..');
 const COMPANIES_DIR  = path.join(__dirname, '..', 'companies');
 const HELIOS_RPC_BIN = path.join(HELIOS_ROOT, 'bin', 'helios-rpc.js');
 
+async function initWizardBusinessGoal(mgQuery, companyId, goalTitle) {
+  if (!goalTitle || !goalTitle.trim()) return null;
+
+  const existing = await mgQuery(
+    `MATCH (g:BusinessGoal {level: 'company', companyId: $companyId})
+     RETURN g.id AS id, g.title AS title LIMIT toInteger(1)`,
+    { companyId }
+  );
+  const existingRows = existing?.rows || [];
+  if (existingRows.length > 0) return { created: false };
+
+  const goalId = `bg:${randomUUID()}`;
+  const title = goalTitle.trim();
+  await mgQuery(
+    `CREATE (g:BusinessGoal {
+       id: $id,
+       companyId: $companyId,
+       title: $title,
+       description: $description,
+       level: 'company',
+       status: 'active',
+       parentId: null,
+       parentGoalId: null,
+       createdAt: datetime(),
+       updatedAt: datetime()
+     })`,
+    {
+      id: goalId,
+      companyId,
+      title,
+      description: 'Top-level company objective',
+    }
+  );
+
+  try {
+    hboStore.createGoal?.({
+      id: goalId,
+      companyId,
+      title,
+      description: 'Top-level company objective',
+      level: 'company',
+      status: 'active',
+      parentId: null,
+      createdAt: Date.now(),
+    });
+  } catch (storeErr) {
+    process.stderr.write(`[wizard-engine] goal mirror failed: ${storeErr.message}\n`);
+  }
+
+  return { created: true, goalId };
+}
+
 // ── Default agent template — the 7 core HBO roles every company gets ─────────
 //
 // Skills use 'helios-business-operator' so the helios_rpc adapter runs the
@@ -916,13 +968,12 @@ class WizardEngine extends EventEmitter {
 
     await seedToMemgraph(this._mgQuery, config);
 
-    // AR-M33 FIX: Wire initDefaultGoal now that company is seeded into Memgraph.
-    // initDefaultGoal creates a BusinessGoal node (distinct from CompanyGoal) scoped
-    // to the company and links the wizard's stated goal text as the top-level objective.
+    // Create a daemon-visible BusinessGoal after CompanyGoal seeding.
+    // Uses this wizard's mgQuery path and mirrors to hbo-core.db.
     // Previously this function had zero call sites — it was dead code.
     if (goal && goal.trim()) {
       try {
-        await initDefaultGoal(companyId, goal.trim());
+        await initWizardBusinessGoal(this._mgQuery, companyId, goal.trim());
         this._emit('wizard:seed_company', {
           message: `Default BusinessGoal initialized for company "${companyId}"`,
           companyId,
@@ -930,7 +981,7 @@ class WizardEngine extends EventEmitter {
       } catch (goalErr) {
         // Non-fatal: CompanyGoal already seeded; BusinessGoal hierarchy is supplemental.
         this._emit('wizard:seed_company', {
-          message: `initDefaultGoal note: ${goalErr.message}`,
+          message: `BusinessGoal initialization note: ${goalErr.message}`,
           companyId,
         });
       }

package/daemon/routes/hbo.js

@@ -32,7 +32,7 @@ function getCorsHeaders(req) {
   const allowedOrigin = origin && HBO_ALLOWED_ORIGINS.has(origin) ? origin : 'http://localhost:9093';
   return {
     'Access-Control-Allow-Origin': allowedOrigin,
-    'Access-Control-Allow-Methods': 'GET, POST, PATCH, OPTIONS',
+    'Access-Control-Allow-Methods': 'GET, POST, PATCH, DELETE, OPTIONS',
     'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization',
     'Vary': 'Origin',
   };
@@ -431,28 +431,37 @@ async function handleTransitionBusinessTask(req, res, ctx, taskId) {
     const taskService = loadHBOService('lib/business-task-service.js');
     if (taskService && typeof taskService.transition === 'function') {
       try {
-        const task = await Promise.race([
-          taskService.transition(taskId, status, cid),
-          new Promise((_, reject) =>
-            setTimeout(() => reject(new Error('task-service timeout — falling back to direct')), 5000)
-          ),
-        ]);
-        jsonOk(res, { task });
-        return;
-      } catch (_svcErr) {
-        // service failed for any reason — fall through to direct Memgraph path below
-      }
-    }
-
-    // Fallback: update directly via ctx.mgQuery
-    const now = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
-    await mgQuery(
-      `MATCH (bt:BusinessTask {id: $id, companyId: $cid})
-       SET bt.status = $status, bt.updatedAt = datetime($now)`,
-      { id: taskId, cid, status, now }
-    );
-    _bc({ type: 'task.updated', taskId, companyId: cid, status });
-    jsonOk(res, { updated: true, taskId, status });
+        const task = await Promise.race([
+          taskService.transition(taskId, status, cid),
+          new Promise((_, reject) =>
+            setTimeout(() => reject(new Error('task-service timeout — falling back to direct')), 5000)
+          ),
+        ]);
+        if (task !== null && task !== undefined) {
+          jsonOk(res, { task });
+          return;
+        }
+        // Service did not find a task for this company; fall through to the
+        // direct path so we can return a clear 404 instead of a silent success.
+      } catch (_svcErr) {
+        // service failed for any reason — fall through to direct Memgraph path below
+      }
+    }
+
+    // Fallback: update directly via ctx.mgQuery
+    const now = new Date().toISOString().replace(/\.\d{3}Z$/, 'Z');
+    const result = await mgQuery(
+      `MATCH (bt:BusinessTask {id: $id, companyId: $cid})
+       SET bt.status = $status, bt.updatedAt = datetime($now)
+       RETURN bt.id AS id`,
+      { id: taskId, cid, status, now }
+    );
+    if (parseRows(result).length === 0) {
+      jsonErr(res, 404, `BusinessTask ${taskId} not found for company ${cid}`);
+      return;
+    }
+    _bc({ type: 'task.updated', taskId, companyId: cid, status });
+    jsonOk(res, { updated: true, taskId, status });
   } catch (e) {
     jsonErr(res, 500, `Transition BusinessTask failed: ${safeErrMsg(e)}`);
   }
@@ -462,34 +471,199 @@ async function handleTransitionBusinessTask(req, res, ctx, taskId) {
 
 async function handleGetBusinessGoals(req, res, ctx) {
   const { mgQuery, cid } = ctx;
-  if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+  // SQL-P1: SQLite fallback when Memgraph is unavailable — not all users have Memgraph.
+  // Try Memgraph first; on failure (no connection or query error), fall through to SQLite.
+  if (mgQuery) {
+    try {
+      // Get all BusinessGoal nodes
+      // BUG-12 fix: BusinessGoal relationships are stored as (child)-[:CHILD_OF]->(parent).
+      const result = await mgQuery(
+        `MATCH (bg:BusinessGoal {companyId: $cid})
+         OPTIONAL MATCH (child:BusinessGoal)-[:CHILD_OF]->(bg)
+         WITH bg, [x IN collect(child.id) WHERE x IS NOT NULL] AS childIds
+         RETURN bg.id AS id, bg.title AS title, bg.level AS level,
+                bg.ownerAgentId AS ownerAgentId, bg.status AS status,
+                bg.progress AS progress, childIds
+         ORDER BY bg.level ASC`,
+        { cid }
+      );
+      const rows = parseRows(result);
+      const keys = ['id', 'title', 'level', 'ownerAgentId', 'status', 'progress', 'childIds'];
+      const goals = rows.map(r => {
+        const goal = rowToObj(r, keys);
+        if (goal.level !== null && goal.level !== undefined) goal.level = String(goal.level);
+        return goal;
+      });
+      const rootGoals = goals.filter(g => !g.level || String(g.level) === 'company');
+      return jsonOk(res, { goals, rootGoals, count: goals.length });
+    } catch (e) {
+      // Memgraph query failed — fall through to SQLite fallback below
+      process.stderr.write(`[hbo] handleGetBusinessGoals Memgraph failed, falling back to SQLite: ${e.message}\n`);
+    }
+  }
+  // SQLite fallback (Memgraph unavailable or query failed)
   try {
-    // Get all BusinessGoal nodes
-    // BUG-12 fix: BusinessGoal relationships are stored as (child)-[:CHILD_OF]->(parent).
-    // The old query used (bg)-[:PARENT_OF]->(child) which matched zero edges.
-    // Migration note: run `MATCH (bg:BusinessGoal)-[:PARENT_OF]->(c:BusinessGoal)
-    //   MERGE (c)-[:CHILD_OF]->(bg) DELETE relationship` if old edges exist.
-    const result = await mgQuery(
-      `MATCH (bg:BusinessGoal {companyId: $cid})
-       OPTIONAL MATCH (child:BusinessGoal)-[:CHILD_OF]->(bg)
-       WITH bg, [x IN collect(child.id) WHERE x IS NOT NULL] AS childIds
-       RETURN bg.id AS id, bg.title AS title, bg.level AS level,
-              bg.ownerAgentId AS ownerAgentId, bg.status AS status,
-              bg.progress AS progress, childIds
-       ORDER BY bg.level ASC`,
-      { cid }
-    );
-    const rows = parseRows(result);
-    const keys = ['id', 'title', 'level', 'ownerAgentId', 'status', 'progress', 'childIds'];
-    const goals = rows.map(r => rowToObj(r, keys));
-    // Build hierarchy tree
-    const rootGoals = goals.filter(g => !g.level || g.level === 0 || g.level === 'company');
-    jsonOk(res, { goals, rootGoals, count: goals.length });
-  } catch (e) {
-    jsonErr(res, 500, `BusinessGoal query failed: ${safeErrMsg(e)}`);
+    const storeGoals = hboStore.getGoalsByCompany ? hboStore.getGoalsByCompany(cid) : [];
+    const goals = (storeGoals || []).map(g => ({
+      id: g.id ?? g.id,
+      title: g.title ?? null,
+      level: g.level ? String(g.level) : null,
+      ownerAgentId: g.ownerAgentId ?? null,
+      status: g.status ?? null,
+      progress: g.progress ?? null,
+      childIds: g.childIds ?? [],
+    }));
+    const rootGoals = goals.filter(g => !g.level || g.level === 'company');
+    return jsonOk(res, { goals, rootGoals, count: goals.length, _source: 'sqlite' });
+  } catch (storeErr) {
+    return jsonErr(res, 503, `Goals unavailable: Memgraph not connected and SQLite fallback failed: ${storeErr.message}`);
+  }
+}
+
+async function handleGetBusinessGoal(req, res, ctx, goalId) {
+  const { mgQuery, cid } = ctx;
+  if (!goalId) { jsonErr(res, 400, 'Missing goal ID'); return; }
+  // SQL-P2: SQLite fallback when Memgraph unavailable.
+  if (mgQuery) {
+    try {
+      const result = await mgQuery(
+        `MATCH (g:BusinessGoal {id: $id, companyId: $cid})
+         RETURN g.id AS id, g.title AS title, g.description AS description,
+                g.level AS level, g.status AS status, g.parentId AS parentId,
+                g.ownerAgentId AS ownerAgentId, g.progress AS progress`,
+        { id: goalId, cid }
+      );
+      const rows = parseRows(result);
+      if (rows.length === 0) { jsonErr(res, 404, `BusinessGoal ${goalId} not found`); return; }
+      const keys = ['id', 'title', 'description', 'level', 'status', 'parentId', 'ownerAgentId', 'progress'];
+      return jsonOk(res, { goal: rowToObj(rows[0], keys) });
+    } catch (e) {
+      process.stderr.write(`[hbo] handleGetBusinessGoal Memgraph failed, falling back to SQLite: ${e.message}\n`);
+    }
+  }
+  // SQLite fallback
+  try {
+    const g = hboStore.getGoal ? hboStore.getGoal(goalId, cid) : null;
+    if (!g) { jsonErr(res, 404, `BusinessGoal ${goalId} not found`); return; }
+    return jsonOk(res, { goal: g, _source: 'sqlite' });
+  } catch (storeErr) {
+    return jsonErr(res, 503, `Goal unavailable: ${storeErr.message}`);
   }
 }
 
+async function handleCreateBusinessGoal(req, res, ctx) {
+  const { mgQuery, cid } = ctx;
+  if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+  // H-4 fix: reject if cid is missing or is the fallback sentinel — prevents silent writes to 'default-company'
+  if (!cid || cid === 'default-company') { jsonErr(res, 400, 'companyId is required'); return; }
+  try {
+    const body = await readBody(req);
+    if (!assertValidBody(body, res)) return;
+    const title = typeof body.title === 'string' ? body.title.trim() : '';
+    if (!title) { jsonErr(res, 400, 'title is required'); return; }
+
+    const goalId = body.id ? String(body.id) : `bg:${randomUUID()}`;
+    const description = body.description !== undefined ? String(body.description) : null;
+    const level = body.level !== undefined ? String(body.level) : 'company';
+    const parentId = body.parentId || body.parentGoalId ? String(body.parentId || body.parentGoalId) : null;
+
+    await mgQuery(
+      `CREATE (g:BusinessGoal {
+         id: $id, companyId: $cid, title: $title, description: $desc,
+         level: $level, status: 'active', parentId: $parentId,
+         parentGoalId: $parentId, createdAt: datetime(), updatedAt: datetime()
+       })`,
+      { id: goalId, cid, title, desc: description, level, parentId }
+    );
+    try {
+      hboStore.createGoal?.({ id: goalId, companyId: cid, title, description, level, status: 'active', parentId, createdAt: Date.now() });
+    } catch (storeErr) {
+      process.stderr.write(`[hbo] goal mirror failed: ${storeErr.message}\n`);
+    }
+    try { ctx._bc?.({ type: 'goal.created', companyId: cid, goalId }); } catch (_) {}
+    jsonOk(res, { goal: { id: goalId, companyId: cid, title, description, level, status: 'active', parentId } }, 201);
+  } catch (e) {
+    jsonErr(res, 500, `Create BusinessGoal failed: ${safeErrMsg(e)}`);
+  }
+}
+
+async function handleUpdateBusinessGoal(req, res, ctx, goalId) {
+  const { mgQuery, cid } = ctx;
+  if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+  if (!goalId) { jsonErr(res, 400, 'Missing goal ID'); return; }
+  try {
+    const body = await readBody(req);
+    if (!assertValidBody(body, res)) return;
+    const title = body.title !== undefined ? String(body.title).trim() : null;
+    const description = body.description !== undefined ? String(body.description) : null;
+    const level = body.level !== undefined ? String(body.level) : null;
+    const status = body.status !== undefined ? String(body.status) : null;
+    const parentId = body.parentId !== undefined ? (body.parentId ? String(body.parentId) : null) : undefined;
+
+    if (title === '' || (title === null && description === null && level === null && status === null && parentId === undefined)) {
+      jsonErr(res, 400, 'At least one of title, description, level, status, parentId must be provided');
+      return;
+    }
+
+    const result = await mgQuery(
+      `MATCH (g:BusinessGoal {id: $id, companyId: $cid})
+       SET g.title = COALESCE($title, g.title),
+           g.description = CASE WHEN $hasDescription THEN $description ELSE g.description END,
+           g.level = COALESCE($level, g.level),
+           g.status = COALESCE($status, g.status),
+           g.parentId = CASE WHEN $hasParentId THEN $parentId ELSE g.parentId END,
+           g.parentGoalId = CASE WHEN $hasParentId THEN $parentId ELSE g.parentGoalId END,
+           g.updatedAt = datetime()
+       RETURN g.id AS id, g.title AS title, g.description AS description,
+              g.level AS level, g.status AS status, g.parentId AS parentId`,
+      {
+        id: goalId, cid, title, description, level, status,
+        parentId: parentId === undefined ? null : parentId,
+        hasDescription: body.description !== undefined,
+        hasParentId: parentId !== undefined,
+      }
+    );
+    const rows = parseRows(result);
+    if (rows.length === 0) { jsonErr(res, 404, `BusinessGoal ${goalId} not found`); return; }
+    const goal = rowToObj(rows[0], ['id', 'title', 'description', 'level', 'status', 'parentId']);
+    // H-3 fix: only pass fields that were explicitly provided in the PATCH body to updateGoal.
+    // rowToObj fills missing Memgraph fields with null — passing null for e.g. title would
+    // overwrite the existing SQLite title with null on a status-only update.
+    const storeUpdate: Record<string, any> = { id: goalId };
+    if (title !== null) storeUpdate.title = goal.title;
+    if (description !== null) storeUpdate.description = goal.description;
+    if (level !== null) storeUpdate.level = goal.level;
+    if (status !== null) storeUpdate.status = goal.status;
+    if (parentId !== undefined) storeUpdate.parentId = goal.parentId;
+    try { hboStore.updateGoal?.(goalId, cid, storeUpdate); } catch (storeErr) { process.stderr.write(`[hbo] goal mirror failed: ${storeErr.message}\n`); }
+    try { ctx._bc?.({ type: 'goal.updated', companyId: cid, goalId }); } catch (_) {}
+    jsonOk(res, { goal });
+  } catch (e) {
+    jsonErr(res, 500, `Update BusinessGoal failed: ${safeErrMsg(e)}`);
+  }
+}
+
+async function handleDeleteBusinessGoal(req, res, ctx, goalId) {
+  const { mgQuery, cid } = ctx;
+  if (!mgQuery) { jsonErr(res, 503, 'Memgraph not connected'); return; }
+  if (!goalId) { jsonErr(res, 400, 'Missing goal ID'); return; }
+  try {
+    const result = await mgQuery(
+      `MATCH (g:BusinessGoal {id: $id, companyId: $cid})
+       WITH g, g.id AS deletedId
+       DETACH DELETE g
+       RETURN deletedId AS id`,
+      { id: goalId, cid }
+    );
+    if (parseRows(result).length === 0) { jsonErr(res, 404, `BusinessGoal ${goalId} not found`); return; }
+    try { hboStore.deleteGoal?.(goalId, cid); } catch (storeErr) { process.stderr.write(`[hbo] goal mirror failed: ${storeErr.message}\n`); }
+    try { ctx._bc?.({ type: 'goal.deleted', companyId: cid, goalId }); } catch (_) {}
+    jsonOk(res, { deleted: true, goalId });
+  } catch (e) {
+    jsonErr(res, 500, `Delete BusinessGoal failed: ${safeErrMsg(e)}`);
+  }
+}
+
 // ── Warm signals handler ──────────────────────────────────────────────────────
 
 async function handleGetWarmSignals(req, res, ctx) {
@@ -2744,6 +2918,14 @@ module.exports = function createHBORouter(handlers) {
       return false;
     }
 
+    // H-2 fix: Handle OPTIONS preflight for all HBO routes (including DELETE /api/hbo/goals/:id).
+    // Must be BEFORE auth check — browsers never send credentials on preflight requests.
+    if (method === 'OPTIONS') {
+      res.writeHead(204, getCorsHeaders(req));
+      res.end();
+      return true;
+    }
+
     // Auth check for all HBO routes
     const authHeader = (req.headers || {})['authorization'];
     const expected = ctx.apiToken;
@@ -2834,6 +3016,30 @@ module.exports = function createHBORouter(handlers) {
       return true;
     }
 
+    // GET /api/hbo/goals/:id — must be checked before POST/PATCH/DELETE goalMatch
+    const goalIdOnlyMatch = pathname.match(/^\/api\/hbo\/goals\/([^/]+)$/);
+    if (method === 'GET' && goalIdOnlyMatch) {
+      await handleGetBusinessGoal(req, res, ctx, decodeURIComponent(goalIdOnlyMatch[1]));
+      return true;
+    }
+
+    // POST /api/hbo/goals
+    if (method === 'POST' && pathname === '/api/hbo/goals') {
+      await handleCreateBusinessGoal(req, res, ctx);
+      return true;
+    }
+
+    // PATCH/DELETE /api/hbo/goals/:id
+    const goalMatch = pathname.match(/^\/api\/hbo\/goals\/(.+)$/);
+    if (method === 'PATCH' && goalMatch) {
+      await handleUpdateBusinessGoal(req, res, ctx, decodeURIComponent(goalMatch[1]));
+      return true;
+    }
+    if (method === 'DELETE' && goalMatch) {
+      await handleDeleteBusinessGoal(req, res, ctx, decodeURIComponent(goalMatch[1]));
+      return true;
+    }
+
     // GET /api/hbo/triage-summary
     if (method === 'GET' && pathname === '/api/hbo/triage-summary') {
       await handleGetTriageSummary(req, res, ctx);