@bongos/core 1.19.219 → 1.19.221

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.219",
-  "core_contract": "1.19.219",
-  "source_commit": "c74ac31eedb3ec3676f8517b51302df625298931",
+  "core_version": "1.19.221",
+  "core_contract": "1.19.221",
+  "source_commit": "30b2efb16495a941d6a4b70fd03b772cd69bce23",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T03:06:20.562Z",
+  "built_at": "2026-08-18T03:23:47.936Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 311,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1302,
+    "functional_verbatim": 1303,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1634,
-  "tree_sha256": "4da1158ccf79b2a7a5253dad319cc74192493be9bda2e6a8874df8c60f581cc5",
+  "file_count": 1635,
+  "tree_sha256": "aa35386f9d066c748b4374cf27b4dc5fbf48ccfef32dfb8ef8c60cf44fdb8c96",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1352,7 +1352,7 @@
     {
       "path": "docs/adr/0174-government-terminology-ranks-not-roles.md",
       "mode": "0000644",
-      "sha256": "c645ce8202fa8e8faa59d3aa00a8167477b5223817b760a733b38864d7625c1d"
+      "sha256": "2b813490fe355bfdb783d9b28eee01b97bfb6d7d4343a3f59aeeb6fac185b79b"
     },
     {
       "path": "docs/adr/0175-the-board-room-full-idea-ratification.md",
@@ -2964,6 +2964,11 @@
       "mode": "0000644",
       "sha256": "75913af702d6529c9a5cf2e2c42d9c329eea92ae99274fb71f2524520de4cfbf"
     },
+    {
+      "path": "modules/government/migrations/government_005_seeded_rank_descriptions.sql",
+      "mode": "0000644",
+      "sha256": "dc570f8871b578a8af965ffbc91fc4e195f2e7fce7d7886166f0025ac2b47bce"
+    },
     {
       "path": "modules/government/module.json",
       "mode": "0000644",
@@ -2992,7 +2997,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "c229aec4f02fe970f4a3f798d370eef9b080cd0837f906b574362abda57107ad"
+      "sha256": "872f144bcd788e36f8b8bc87e5bd31f2389169ffa5d930e03d74ba24a0264f3b"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4287,12 +4292,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ac23681c5493a57f1faca551e4896e4a7a4e2dabb6246bf2a84c39ae6e571257"
+      "sha256": "5b55ea236b725452ef02e308616d3827927f68e82a483022a856e4066864dc99"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7122e5cca352a5abc317d25267eba6c0bab955febf2179bf362a896be424d0bc"
+      "sha256": "ec221145b014962cce2d2c9fc9e231a0b296bb65153ba8079e30f2f4e80b9df7"
     },
     {
       "path": "public-docs/index.html",
@@ -4917,7 +4922,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "5cc94859033c924884efa60f50f8a1f7810a85382c42d785d62b804181a195f5"
+      "sha256": "a255afac6eb4a2b8269e896032e8eabf10f104aed5a0f1e8d0a7348695625424"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -5737,7 +5742,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "808b164783dae50e0be37f35dcbcae7b2d474868746a240a957b89130870f483"
+      "sha256": "277097c686b695688dee35d158c4bb8384b4a5a89c61f30c7bda7d9f4b477bee"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5772,7 +5777,7 @@
     {
       "path": "src/bongos/route-rank-check.js",
       "mode": "0000644",
-      "sha256": "422647dc473583a67509644b04e47b8fc2279bb117fa1b6db1030502b5287870"
+      "sha256": "af5bdd9e362923afc1b78a741b5254147678b34cecb7d92f879387cc94a05631"
     },
     {
       "path": "src/bongos/routes.js",
@@ -5907,7 +5912,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d509a7e4f16027ccef999e8aadf1a2cef5368bce5cd0c3bda3b7eb61cbceaa5f"
+      "sha256": "4aa9331871262decd3e4b2a16e1cd9ca58b4e4000228cde02086ad209a1bb4b7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6902,12 +6907,12 @@
     {
       "path": "tests/government_routes.mjs",
       "mode": "0000644",
-      "sha256": "3b2e0ca134737992590132f089d5f93b479ad6cec83a5d2a932412b3edaf4547"
+      "sha256": "7f406d5296489d08804eae5b431d07244e1f2f3464513cccccb72e7b33253c14"
     },
     {
       "path": "tests/government_seed.mjs",
       "mode": "0000644",
-      "sha256": "e7f980f02abfb057d725beaf5730fdd71f4e8249af2180bf4a355632481330d6"
+      "sha256": "8240fef8ed5b7e9a4c16e17e8dd5ffa522a99e320d41229f58f2214e00bcf160"
     },
     {
       "path": "tests/government_session_scope.mjs",

package/docs/adr/0174-government-terminology-ranks-not-roles.md

@@ -55,3 +55,33 @@ This was the closest call in the directive, and it was decided against the alter
 **Rejected: renaming the ladder slugs to match.** `xenos`/`thetes`/`metic`/`archon` are referenced by `builders.rank`, `requireRank`, the protected-path enforcers, the Discord role map, and years of session logs. The directive did not ask for it, and bundling it here would turn a bounded rename into a trust-boundary migration.
 
 **Rejected: a compatibility shim kept indefinitely.** The old `/governance/*` route paths answer for exactly one release, logging each hit, and R05 records the removal release in this ADR's lineage. A permanent alias would mean both vocabularies stay correct forever, which is the state this ADR exists to end.
+
+## Lineage — the compatibility alias, and when it actually went
+
+The Decision above promised the old `/governance/*` route paths would answer for
+**exactly one release**, and that R05 would record the removal release here. That
+record was never written, and the alias outlived the promise by a wide margin.
+
+| | |
+|---|---|
+| Alias shipped | task 1003006 (R05), with the rename |
+| Promised life | one release |
+| Actually removed | **task 1003084**, core 1.19.219+ — many releases later |
+
+Two source comments (`src/bongos/module-scope-map.js`, and the `VOCAB_ALLOW`
+entry in `scripts/gds/fitness.js`) asserted the route aliases had already gone
+with the module-key alias in R05. They had not. A reader who trusted them —
+and the goal 1000068 criterion review nearly did — would conclude the
+compatibility surface no longer existed while production was still 308-ing on
+it. The alias was found by curling live, the same way all three of its original
+defects were.
+
+**The lesson, recorded because it generalises past this ADR:** a removal that is
+promised in prose and pinned by nothing does not happen. The shim had thorough
+tests, but they asserted the shim WORKED — so deleting the shim would have
+deleted its own evidence. Task 1003084 inverts them: `tests/government_routes.mjs`
+now asserts the legacy paths **404**, with a companion assertion that the current
+paths still route so the check cannot pass by everything being broken. A
+time-boxed compatibility surface should ship with the test of its ABSENCE
+written at the same time, disabled until the clock runs out — not with a
+calendar note in a comment.

package/modules/government/migrations/government_005_seeded_rank_descriptions.sql

@@ -0,0 +1,78 @@
+-- government_005_seeded_rank_descriptions.sql — the last "role" on the government
+-- side: the four seeded ranks still DESCRIBE themselves as rank-roles
+-- (task 1003083 / goal 1000068, criterion govt-ranks-not-roles). Decision of
+-- record: ADR 0174.
+--
+-- ── WHAT WAS MISSED, AND WHY ────────────────────────────────────────────────
+-- The rename cleaned the CONFIG TEMPLATE but never the LIVE ROWS.
+-- config/government.neutral.json already reads "Seeded rank — …" for all four,
+-- so the repo looks correct and a fresh instance boots with the right words in
+-- its template. But `GET /api/bongos/government/ranks` reads the DB, and on the
+-- live database every seeded row still carries the text governance_002 wrote:
+--
+--   archon : 'Seeded rank-role — top authority. Adds the admin + system (non-grantable) powers.'
+--   metic  : 'Seeded rank-role — the trusted working rank. Adds review/triage/authoring.'
+--   thetes : 'Seeded rank-role — graduated newcomer. Adds the general claim queue.'
+--   xenos  : 'Seeded rank-role — the sandboxed entry rank. Own-work + public read.'
+--
+-- government_001 renamed the TABLES and government_002 renamed the permission
+-- KEYS; neither touched this column. The hall's Government tab renders these
+-- strings, so the surface goal 1000068 renamed has been displaying the reserved
+-- word to the Owner ever since.
+--
+-- ── WHY THE FITNESS WALL DID NOT CATCH IT ───────────────────────────────────
+-- Check 19 (checkVocabularyWall, scripts/gds/fitness.js) scans FILES on the
+-- government surface, and only .js/.json/.html/.css at that. It cannot see DB
+-- row text. That is the rule working as designed, not a hole in it — which is
+-- precisely why this needed a migration rather than a lint fix.
+--
+-- ── WHY THIS CORRECTS FORWARD INSTEAD OF EDITING governance_002 ─────────────
+-- governance_002 is applied and run-once (schema_migrations is stem-keyed), so
+-- editing its text would change history without changing any database. It also
+-- stays deliberately spelled the old way: it is the factual record of what was
+-- once true, which is exactly the carve-out ADR 0174 grants the historical
+-- migrations. government_002 (the permission-key rename) is the worked example
+-- this copies. On a FRESH install the two converge — governance_002 seeds the
+-- old text, this rewrites it — so both paths end identically.
+--
+-- ── THE GUARD IS LOAD-BEARING ───────────────────────────────────────────────
+-- The WHERE clause matches the OLD SEEDED TEXT EXACTLY rather than blanket-
+-- updating by rank_key. A host may have relabelled a seeded rank through
+-- config (config/government.json may relabel a seeded rank — it may never
+-- re-grant one), and overwriting a deliberate customisation with our template
+-- would be a silent regression dressed as a typo fix. Matching the exact string
+-- governance_002 wrote touches only rows nobody has edited. It also makes this
+-- migration idempotent: re-running it matches nothing.
+--
+-- NAMING ONLY. No grant, floor, or authority change; is_system and seeded_rank
+-- are untouched; no row is inserted or deleted. Safe to run against a database
+-- where some or all four have already been corrected by hand.
+--
+-- ROLLBACK — reverse the mapping (lossless; restores the governance_002 text):
+--   UPDATE government_ranks SET description = replace(description, 'Seeded rank —', 'Seeded rank-role —')
+--    WHERE is_system AND rank_key IN ('xenos','thetes','metic','archon')
+--      AND description LIKE 'Seeded rank —%';
+
+BEGIN;
+
+UPDATE government_ranks AS g
+   SET description = v.new_description
+  FROM (VALUES
+    ('xenos',
+     'Seeded rank-role — the sandboxed entry rank. Own-work + public read.',
+     'Seeded rank — the sandboxed entry rank. Own-work + public read.'),
+    ('thetes',
+     'Seeded rank-role — graduated newcomer. Adds the general claim queue.',
+     'Seeded rank — graduated newcomer. Adds the general claim queue.'),
+    ('metic',
+     'Seeded rank-role — the trusted working rank. Adds review/triage/authoring.',
+     'Seeded rank — the trusted working rank. Adds review/triage/authoring.'),
+    ('archon',
+     'Seeded rank-role — top authority. Adds the admin + system (non-grantable) powers.',
+     'Seeded rank — top authority. Adds the admin + system (non-grantable) powers.')
+  ) AS v(rank_key, old_description, new_description)
+ WHERE g.rank_key = v.rank_key
+   AND g.is_system
+   AND g.description = v.old_description;
+
+COMMIT;

package/modules/government/routes/government.js

@@ -182,61 +182,8 @@ module.exports = function buildGovernmentRouter() {
     return rank;
   }
   const ARCHON = 'archon';
-  const ARCHON_REASON = 'the Archon rank-rank holds every permission and is immutable — it is the rank that can never be locked out of this tab (ADR 0172)';
-  const ASSIGN_REASON = 'a seeded rank-rank is assigned by rank (R95b sync); change the builder\'s rank instead';
-
-  // ── the one-release LEGACY path aliases: /governance/* -> /government/* ────
-  // ADR 0174 committed to keeping the pre-rename paths answering for exactly one
-  // release. The case this actually protects is narrow but real: a browser that
-  // still has the OLD hall page open when the instance upgrades will keep calling
-  // the legacy /governance/* paths against the new server. Everything else that
-  // paths (the hall bundle, the generated client) ships INSIDE the same core
-  // package and moves in lockstep.
-  //
-  // A 308 preserves the method and body, so a PUT/DELETE grant toggle survives
-  // the hop. The alias carries NO gate of its own — it redirects, and the real
-  // route re-runs requireBuilder + requirePermission on the followed request, so
-  // this cannot become a way around the wall.
-  //
-  // REMOVE THIS BLOCK one release after the rename ships (goal 1000068 follow-up).
-  // The `alias` counter in the log line is how we tell whether anything still
-  // calls them before deleting.
-  //
-  // EXPRESS 4 WILDCARD SYNTAX. This is express 4.22 — the wildcard is a bare `*`
-  // and the captured tail is req.params[0]. Express 5's named form (`/*rest`) is
-  // NOT a wildcard here, it is a literal path segment, so it silently matches
-  // nothing and every legacy path 404s. It shipped that way once (task 1003006)
-  // and was only caught by curling the live site after the cutover — the module
-  // parsed fine, so nothing local failed.
-  const LEGACY_PATH_PREFIX = '/governance';
-  // The legacy noun -> the current one, as a NAMED DATA PAIR rather than an
-  // inline regex literal. An inline pattern here was silently rewritten by a
-  // repo-wide sweep so that both sides matched, turning the translation into an
-  // identity function that redirected to a path which does not exist. Naming the
-  // pair and asserting they differ makes that class of damage loud.
-  //
-  // Every line in this block that spells the legacy vocabulary carries the word
-  // LEGACY on purpose: that is what the ADR 0174 fitness allowlist keys on, so
-  // the shim can name what it is compatible with without excusing the whole file.
-  const LEGACY_SEGMENT = 'roles';   // legacy
-  const CURRENT_SEGMENT = 'ranks';
-  if (LEGACY_SEGMENT === CURRENT_SEGMENT) {
-    throw new Error('government legacy alias: the rename pair collapsed to an identity — a sweep has eaten it');
-  }
-  router.all(`${LEGACY_PATH_PREFIX}/*`, (req, res, next) => {
-    const tail = req.params[0] || '';            // express 4: bare * captures here
-    if (!tail) return next();
-    // Translate the leading segment, keep everything after it, keep the query.
-    const translated = tail === LEGACY_SEGMENT || tail.startsWith(`${LEGACY_SEGMENT}/`)
-      ? CURRENT_SEGMENT + tail.slice(LEGACY_SEGMENT.length)
-      : tail;
-    const qs = req.originalUrl.includes('?') ? req.originalUrl.slice(req.originalUrl.indexOf('?')) : '';
-    // req.baseUrl is the router's MOUNT point (/api/gds). Redirecting without it
-    // sends the caller to /government/... at the site root, which 404s.
-    const target = `${req.baseUrl}/government/${translated}${qs}`;
-    console.warn(`[government] legacy path hit: ${req.method} ${req.originalUrl} -> ${target} (ADR 0174 alias; remove one release after the rename)`);
-    return res.redirect(308, target);
-  });
+  const ARCHON_REASON = 'the Archon rank holds every permission and is immutable — it is the rank that can never be locked out of this tab (ADR 0172)';
+  const ASSIGN_REASON = 'a seeded rank is assigned by rank (R95b sync); change the builder\'s rank instead';
 
   // rank: perm government.manage — the full rank list with each rank's grants.
   router.get('/government/ranks', api.requireBuilder, api.requirePermission('government.manage'), async (req, res) => {
@@ -337,7 +284,7 @@ module.exports = function buildGovernmentRouter() {
             ? 'substrate-enforced (ADR 0043) — enforced outside the app by the pre-push hook / main-audit / the rank floor, so a grant row here would confer nothing. Non-grantable to EVERY rank.'
             : catalog.isPrincipalKey(permissionKey)
               ? 'a machine-principal permission — held by an exact builders.system_role identity, never by a rank (ADR 0151 §3)'
-              : 'a system (trust-boundary) permission is non-grantable to a CUSTOM rank; only a sub-Archon rank-rank may carry one (ADR 0172)',
+              : 'a system (trust-boundary) permission is non-grantable to a CUSTOM rank; only a sub-Archon rank may carry one (ADR 0172)',
         });
       }
       const granted = await db.grantRankPermission({ rankKey, permissionKey });
@@ -387,7 +334,7 @@ module.exports = function buildGovernmentRouter() {
       if (!rank.is_system || !catalog.RANK_ORDER.includes(rank.seeded_rank)) {
         return res.fail('rank_has_no_default', 400, {
           rank_key: rankKey,
-          reason: 'only a seeded rank-rank has a catalog default to reset to; revoke a custom rank\'s grants instead',
+          reason: 'only a seeded rank has a catalog default to reset to; revoke a custom rank\'s grants instead',
         });
       }
       // The seed is the floor derivation, which never contains a principal key and

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.219",
+  "version": "1.19.221",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.219",
+      "version": "1.19.221",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.219",
+  "version": "1.19.221",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness.js

@@ -1688,16 +1688,6 @@ const VOCAB_ALLOW = [
        + 'repo, so the old spelling is still read. Dropping it would silently stop '
        + 'honouring a label override someone already configured.',
   },
-  {
-    file: 'modules/government/routes/government.js',
-    match: 'legacy',
-    why: 'the one-release 308 alias from the pre-rename route paths (ADR 0174). A '
-       + 'compatibility shim has to name the thing it is compatible with. The match is '
-       + 'the word LEGACY, and the shim block is written so that every line spelling the '
-       + 'old vocabulary carries it — so the exemption is scoped to the shim rather than '
-       + 'to the whole file, and a stray "role" elsewhere in this file still reds the '
-       + 'build. Delete with the alias block one release after the rename ships.',
-  },
   {
     file: 'modules/government/module.json',
     match: 'role',

package/src/bongos/module-scope-map.js

@@ -171,15 +171,18 @@ const MODULE_GLOBS = {
   //     module. `protected` DERIVES true — its 'modules/governance/' glob is in
   //     PROTECTED_GLOBS (the authz core) — so creating a goal scoped to governance is
   //     Archon-only (BV1.R57 / POST /goals). The config globs are the per-instance
-  //     role templates (R96), listed here as goal territory; the module code lands in
+  //     rank templates (R96), listed here as goal territory; the module code lands in
   //     R93+ (the carve precedes the feature — ADR 0086 §4). Written as exact paths,
   //     not 'config/governance*.json' — the touches convention has no wildcards. ---
   //     RENAMED governance → government (goal 1000068, ADR 0174). The
-  //     transitional `governance` alias key was removed in R05 (task 1003006)
-  //     together with the /governance/* route aliases — the same compatibility
-  //     window. The three live goals that named the old key (1000030, 1000057,
-  //     1000068) had it removed from goals.scope_modules in the same change, so
-  //     no stored row references a key the map no longer defines.
+  //     transitional `governance` alias key was removed in R05 (task 1003006).
+  //     The /governance/* ROUTE aliases outlived it: this comment claimed they
+  //     went in the same change, but they kept 308-ing on production for months
+  //     of releases past the one ADR 0174 allowed them, and the false claim here
+  //     is part of why nobody noticed. They were removed separately, in task
+  //     1003084. The three live goals that named the old key (1000030, 1000057,
+  //     1000068) had it removed from goals.scope_modules in R05, so no stored row
+  //     references a key the map no longer defines.
   government: [
     'modules/government/',
     'config/government.json', 'config/government.neutral.json',

package/src/bongos/route-rank-check.js

@@ -232,7 +232,11 @@ const EXPECTED_RANKS = {
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed
-// governance→government in R05 (task 1003006); the module-key alias is gone.
+// governance→government in R05 (task 1003006), which also removed the module-key
+// alias. The /governance/* ROUTE aliases did NOT go with it — they kept 308-ing
+// in production for many releases past the single one ADR 0174 allowed, and were
+// removed separately in task 1003084. Nothing under /governance/* is routed now,
+// so every pin below is the only spelling of its surface.
 const GOVERNMENT_PINS = {
   'GET /government/ranks': 'perm:government.manage',
   'GET /government/permissions': 'perm:government.manage',

package/src/module-api.js

@@ -865,8 +865,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.217 with no explicit bump. run 32086598601. (task 1002620)
 //   1.19.219 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.218 with no explicit bump. run 32094215476. (task 1002620)
+//   1.19.220 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.219 with no explicit bump. run 32094701831. (task 1002620)
+//   1.19.221 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.220 with no explicit bump. run 32095276039. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.219'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.221'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_routes.mjs

@@ -396,27 +396,25 @@ test('DELETE /governance/assignments validates the builder id param', async () =
   assert.equal(r.status, 400);
 });
 
-// ── the one-release /governance/* compatibility alias (ADR 0174) ──────────────
+// ── the /governance/* alias is GONE (ADR 0174, task 1003084) ──────────────
 //
-// This block exists because the alias shipped BROKEN and nothing caught it.
-// Three independent defects, none visible to a parse check or a unit test that
-// only imports the module:
-//   1. it was written with express 5's named-wildcard syntax (`/*rest`) on an
-//      express 4.22 router, where that is a literal segment — so it matched
-//      nothing and every legacy path 404'd;
-//   2. the redirect omitted req.baseUrl, sending callers to /government/... at
-//      the site root instead of under the /api/gds mount;
-//   3. a repo-wide roles->ranks sweep rewrote the SOURCE side of the
-//      /^\/roles/ -> '/ranks' translation, turning it into an identity that
-//      redirected to a path which does not exist.
+// ADR 0174 gave the pre-rename paths exactly one release. They outlived it by
+// months of releases — still 308-ing on production long after two source
+// comments claimed they had been removed — because nothing asserted the
+// REMOVAL, only the shim's behaviour. Deleting the shim's tests with the shim
+// would have recreated exactly that hole, so the assertions are INVERTED
+// instead: the legacy paths must now 404.
 //
-// All three only surfaced when the running site was curled after the cutover.
-// These tests drive a real router so they cannot repeat that.
-
-// A SECOND server, mounted at /api/gds exactly as production does. The main
-// harness above mounts at the root, so it cannot see a missing req.baseUrl —
-// which was one of the three real defects. Mounting like production is the
-// whole point of these three tests.
+// The shim itself shipped broken three times over (express 5 wildcard syntax on
+// an express 4.22 router; a redirect that dropped req.baseUrl; a repo-wide
+// roles->ranks sweep that rewrote the SOURCE side of the translation into an
+// identity). Every one of those only surfaced when the running site was curled.
+// That is why this block still drives a REAL router mounted the way production
+// mounts it, rather than asserting on source text.
+
+// A SECOND server, mounted at /api/gds exactly as production does — the main
+// harness above mounts at the root, so it cannot tell "no route" from "route at
+// the wrong mount point".
 const aliasApp = express();
 aliasApp.use(express.json());
 aliasApp.use(attachFail);
@@ -429,33 +427,37 @@ after(() => aliasServer.close());
 const hop = (method, p) =>
   fetch(`${ALIAS_BASE}${p}`, { method, redirect: 'manual' });
 
-test('the legacy /governance/* alias redirects, under the mount, with the noun translated', async () => {
-  const cases = [
-    ['GET', '/api/gds/governance/roles', '/api/gds/government/ranks'],
-    ['GET', '/api/gds/governance/permissions', '/api/gds/government/permissions'],
-    ['GET', '/api/gds/governance/assignments', '/api/gds/government/assignments'],
-    ['PUT', '/api/gds/governance/roles/metic/permissions/idea.triage',
-            '/api/gds/government/ranks/metic/permissions/idea.triage'],
-    ['POST', '/api/gds/governance/roles/metic/reset', '/api/gds/government/ranks/metic/reset'],
+test('every legacy /governance/* path is gone — no redirect, no route', async () => {
+  // The exact paths the removed shim used to translate. A 308 here means the
+  // alias is back; a 200 would mean something answers the old vocabulary
+  // directly, which is worse.
+  const legacy = [
+    ['GET', '/api/gds/governance/roles'],
+    ['GET', '/api/gds/governance/permissions'],
+    ['GET', '/api/gds/governance/assignments'],
+    ['PUT', '/api/gds/governance/roles/metic/permissions/idea.triage'],
+    ['POST', '/api/gds/governance/roles/metic/reset'],
+    ['GET', '/api/gds/governance/ranks'],
   ];
-  for (const [method, from, expected] of cases) {
-    const r = await hop(method, from);
-    assert.equal(r.status, 308, `${method} ${from} must 308 — a 404 means the wildcard is not matching`);
-    assert.equal(r.headers.get('location'), expected,
-      `${method} ${from} must keep the /api/gds mount AND translate roles→ranks`);
+  for (const [method, p] of legacy) {
+    const r = await hop(method, p);
+    assert.equal(r.status, 404, `${method} ${p} must 404 — the one-release alias was removed in task 1003084`);
+    assert.equal(r.headers.get('location'), null, `${method} ${p} must not redirect anywhere`);
   }
 });
 
-test('the alias preserves the query string', async () => {
-  const r = await hop('GET', '/api/gds/governance/roles?x=1&y=2');
-  assert.equal(r.headers.get('location'), '/api/gds/government/ranks?x=1&y=2');
+test('the current /government/* paths still route (the removal took only the alias)', async () => {
+  // The guard against over-deletion: proving the old paths 404 is worthless if
+  // the new ones 404 too. These reach the real gate and are refused for lack of
+  // a session — a 401/403, never a 404.
+  for (const p of ['/api/gds/government/ranks', '/api/gds/government/permissions']) {
+    const r = await hop('GET', p);
+    assert.notEqual(r.status, 404, `${p} must still be routed`);
+  }
 });
 
-test('the alias carries no gate of its own — the followed request re-runs the real one', async () => {
-  // A 308 preserves method and body, so the wall is enforced on the FOLLOWED
-  // request by the real route. The alias must never become a way around it.
+test('no source line reintroduces a legacy path alias', () => {
   const src = fs.readFileSync(path.join(ROOT, 'modules', 'government', 'routes', 'government.js'), 'utf8');
-  const block = src.slice(src.indexOf('LEGACY_PATH_PREFIX'), src.indexOf('res.redirect(308'));
-  assert.ok(!/requirePermission|requireBuilder/.test(block),
-    'the alias must not carry its own gate — it redirects, and the real route gates the followed request');
+  assert.ok(!/LEGACY_PATH_PREFIX/.test(src), 'the alias block is gone — do not restore it');
+  assert.ok(!/redirect\(308/.test(src), 'no 308 vocabulary redirect belongs on this surface any more');
 });

package/tests/government_seed.mjs

@@ -37,6 +37,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_001_rename_from_governance.sql',     // ADR 0174 table rename (task 1003004)
   'government_002_rename_permission_keys.sql',     // ADR 0174 key rename (task 1003006)
   'government_003_board_tables.sql',               // ADR 0175 Board Room schema (task 1003016)
+  'government_005_seeded_rank_descriptions.sql',   // ADR 0174 seeded-description text fix (task 1003083)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.
@@ -142,6 +143,35 @@ test('later grant migrations are idempotent + transactional', () => {
   }
 });
 
+// The bug this guards (task 1003083): goal 1000068 renamed the government, and
+// config/government.neutral.json was updated to say "Seeded rank — …". The LIVE
+// government_ranks rows were not, so `GET /government/ranks` — and the hall tab
+// that renders it — kept serving governance_002's "Seeded rank-role — …" long
+// after the rename shipped. Two lists of the same strings, only one maintained:
+// exactly the drift this file exists to prevent, in the one column nobody had
+// pointed a test at. The vocabulary fitness wall cannot see it either — Check 19
+// scans .js/.json/.html/.css files, never DB row text or .sql.
+test('the description correction lands EXACTLY the config template text (no second list that drifts)', () => {
+  const correction = fs.readFileSync(path.join(MIG_DIR, 'government_005_seeded_rank_descriptions.sql'), 'utf8');
+  const neutral = JSON.parse(fs.readFileSync(path.join(ROOT, 'config', 'government.neutral.json'), 'utf8'));
+
+  // Each VALUES row is ('<rank_key>', '<old_description>', '<new_description>').
+  const rows = [...stripComments(correction).matchAll(/\(\s*'([a-z]+)'\s*,\s*'([^']+)'\s*,\s*'([^']+)'\s*\)/g)]
+    .map(([, rankKey, , newDescription]) => [rankKey, newDescription]);
+
+  assert.equal(rows.length, RANK_ORDER.length,
+    'the correction must cover every seeded rank, not a subset');
+
+  for (const [rankKey, newDescription] of rows) {
+    const template = neutral.ranks[rankKey];
+    assert.ok(template, `${rankKey}: not a rank in config/government.neutral.json`);
+    assert.equal(newDescription, template.description,
+      `${rankKey}: the migration writes text the config template does not carry — the two lists have drifted again`);
+    assert.ok(!/\brole/i.test(newDescription),
+      `${rankKey}: "role" is reserved for the crafts (ADR 0174) — a rank describes itself as a rank`);
+  }
+});
+
 test('migration objects are all governance_-namespaced (ADR 0083 §5)', () => {
   for (const sql of [tablesSql, seedSql]) {
     for (const m of sql.matchAll(/CREATE (?:TABLE|INDEX)(?: IF NOT EXISTS)? (\w+)/g)) {