@bongos/core 1.19.232 → 1.19.234

package/modules/government/routes/government.js

@@ -414,6 +414,39 @@ module.exports = function buildGovernmentRouter() {
     }
   });
 
+  // rank: perm board.vote.cast — the Board Room view: open items with their
+  // clock, the OPEN BALLOT, the closed history (R16 of goal 1000069). Gated on
+  // the XENOS-floored vote atom, deliberately: seeing the ballot is part of
+  // casting (§9 — a board whose votes are invisible constrains nobody), and the
+  // room teaches as well as governs (criterion C5). NOT government.manage —
+  // that is the admin tab's atom; the room must be visible to whoever the
+  // constitution may enfranchise. Membership still gates nothing here: this is
+  // a read, and the write (the vote) re-checks membership in-handler.
+  router.get('/government/board/items', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
+    try {
+      const view = await board.boardRoomView({ closedLimit: 20 });
+      res.json({ ...view, viewer_id: String(req.builder.id) });
+    } catch (err) {
+      console.error('[gds] GET /government/board/items', err);
+      res.fail('board_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  // rank: perm board.vote.cast — the Constitution view (R18 of goal 1000069):
+  // the live board block plus the full amendment history, passed and returned
+  // alike. Same atom as the room — reading the rule you vote under is part of
+  // casting, and the section teaches (criterion C5). The live value resolves
+  // fresh per request, so an amendment applied a moment ago reads back
+  // immediately (the same instant-effect posture as everything else here).
+  router.get('/government/constitution', api.requireBuilder, api.requirePermission('board.vote.cast'), async (req, res) => {
+    try {
+      res.json(await board.constitutionView({ historyLimit: 50 }));
+    } catch (err) {
+      console.error('[gds] GET /government/constitution', err);
+      res.fail('constitution_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // rank: perm board.item.open — put an AMENDMENT to the board (R14 of goal
   // 1000069, ADR 0175 §7). The board's other subject never comes through here:
   // a Full Idea's window opens AUTOMATICALLY on grade pass (R07), so requesting

package/modules/hall-ui/public/government.html

@@ -99,6 +99,6 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/government.js?v=2026-08-18-government-ia"></script>
+<script src="/builders/government.js?v=2026-08-18-constitution"></script>
 </body>
 </html>

package/modules/hall-ui/public/government.js

@@ -401,30 +401,195 @@
 
   // ---- the three-section IA (R15) -------------------------------------------
 
-  // Tab order is the spec's — Constitution · Board Room · Ranks & Permissions —
-  // but the INITIAL tab is Ranks until R16/R18 fill the other two: landing the
-  // Archon on a frame when the working surface is one tab over would be IA
-  // winning over usefulness. Flip `initial` to 'constitution' when R18 lands.
-  function wireTabs() {
+  // Tab order is the spec's — Constitution · Board Room · Ranks & Permissions.
+  // A non-archon lands on the Constitution (the page's IA claim: this is the
+  // page that answers "how is this project governed"); the Archon still lands
+  // on Ranks, their working surface.
+  function wireTabs({ isArchon }) {
     window.OTBKit.makeTabs({
       mount: document.getElementById('gov-tabs'),
       hash: true,
-      initial: 'ranks',
+      initial: isArchon ? 'ranks' : 'constitution',
       tabs: [
         { id: 'constitution', label: 'Constitution', panel: 'gov-panel-constitution' },
         { id: 'board-room', label: 'Board Room', panel: 'gov-panel-board' },
         { id: 'ranks', label: 'Ranks & Permissions', panel: 'gov-panel-ranks' },
       ],
     });
-    // The frames' empty states — kit-standard, one line, no fake data. What this
-    // project actually RUNS is config the server owns; rendering it here before
-    // the R18 read exists would mean hardcoding a value that drifts.
-    document.getElementById('gov-constitution').innerHTML = window.OTBKit.emptyStateHtml(
-      'The live constitution — what this project runs today, and how it has changed — appears here when the Board Room opens.',
-    );
-    document.getElementById('gov-board').innerHTML = window.OTBKit.emptyStateHtml(
-      'Nothing is before the board. When a Full Idea clears the completeness grade, its window opens here.',
-    );
+  }
+
+  // ---- the Constitution panel (R18) -------------------------------------------
+
+  // Plain language over the three dials, straight from the SERVER's resolved
+  // value (never hardcoded — an amendment applied a moment ago reads back on
+  // the next load), plus the change history: every closed amendment sitting,
+  // passed and RETURNED alike, each with the rule it was decided under — so a
+  // switch can never be flipped quietly, and every change is auditable against
+  // the constitution of its day.
+
+  function membershipSentence(board) {
+    const m = String(board.membership || '');
+    const rank = m.startsWith('rank:') ? m.slice(5) : null;
+    return rank
+      ? `Every active builder holding the <strong>${escapeHtml(rank)}</strong> rank sits on the board — membership follows the rank, live.`
+      : `Membership predicate: <code>${escapeHtml(m || 'unset')}</code>.`;
+  }
+
+  function passRuleSentence(board) {
+    if (board.pass_rule === 'first_ratifier') {
+      return 'An item is decided by its <strong>first vote</strong> — yes ratifies, no returns. The day-one shape: one member acts, done.';
+    }
+    if (board.pass_rule === 'consent') {
+      return 'Items pass by <strong>consent</strong>: silence is consent, a single reasoned objection returns the item to its author, and a sitting that ends with no votes at all passes.';
+    }
+    return `Pass rule: <code>${escapeHtml(String(board.pass_rule || 'unset'))}</code>.`;
+  }
+
+  function windowSentence(board) {
+    if (board.window_minutes === null || board.window_minutes === undefined) {
+      return 'There is <strong>no clock</strong> — an item stays open until a vote decides it.';
+    }
+    const early = board.close_early_on_full_turnout
+      ? ', closing early the moment every member has voted'
+      : '';
+    return `A sitting runs <strong>${escapeHtml(String(board.window_minutes))} minutes</strong>${early}. An unvoted window nulls that member's vote — absence never blocks.`;
+  }
+
+  function historyRow(h) {
+    const who = escapeHtml(h.proposer_name || h.proposer_login || (h.proposed_by ? `builder ${h.proposed_by}` : 'unknown'));
+    const when = escapeHtml(String(h.closed_at).slice(0, 16).replace('T', ' '));
+    const pill = h.outcome === 'passed'
+      ? '<span class="gov-pill gov-pill--seeded">ratified</span>'
+      : '<span class="gov-pill gov-pill--locked">returned</span>';
+    const under = h.decided_under && h.decided_under.pass_rule
+      ? ` · decided under <code>${escapeHtml(h.decided_under.pass_rule)}</code>`
+      : '';
+    return `<div class="gov-assign-row">
+      <span class="gov-assign-row__who">${who} proposed <code>${escapeHtml(JSON.stringify(h.proposed))}</code>${h.rationale_md ? ` — ${escapeHtml(h.rationale_md)}` : ''}</span>
+      ${pill} <span class="muted">${when}${under}</span>
+    </div>`;
+  }
+
+  async function loadConstitution() {
+    const box = document.getElementById('gov-constitution');
+    let data;
+    try {
+      data = await fetchJson('/government/constitution');
+    } catch (err) {
+      if (err && err.kind === '401') return;
+      box.innerHTML = `<p class="gov-empty">Could not load the constitution just now.</p>`;
+      return;
+    }
+    const b = data.board || {};
+    const history = data.history || [];
+    box.innerHTML = `
+      <section class="gov-section">
+        <div class="gov-section__head">What this project runs today</div>
+        <p class="gov-grid-note">${membershipSentence(b)}</p>
+        <p class="gov-grid-note">${passRuleSentence(b)}</p>
+        <p class="gov-grid-note">${windowSentence(b)}</p>
+        <p class="gov-grid-note muted">As configuration: <code>${escapeHtml(JSON.stringify(b))}</code>. Changing it is a board act — propose an amendment, and it is decided under the rule above.</p>
+      </section>
+      <h2 class="gov-h">How it has changed</h2>
+      ${history.length
+        ? `<div class="gov-section">${history.map(historyRow).join('')}</div>`
+        : `<p class="gov-empty">Never amended — this project still runs its founding constitution.</p>`}
+    `;
+  }
+
+  // ---- the Board Room panel (R16) --------------------------------------------
+
+  // The room renders what the server assembled: open items with the database's
+  // own countdown, the OPEN BALLOT (people, directions, timestamps, objections),
+  // and the closed history. Nothing here decides anything — casting arrives with
+  // R17; this panel is the accountability surface (§9: a board whose votes are
+  // invisible constrains nobody).
+
+  function fmtRemaining(seconds) {
+    if (seconds === null || seconds === undefined) return null;
+    const s = Number(seconds);
+    if (!Number.isFinite(s) || s <= 0) return 'closing…';
+    if (s < 90) return `closes in ${Math.max(1, Math.round(s))}s`;
+    if (s < 5400) return `closes in ${Math.round(s / 60)}m`;
+    return `closes in ${(s / 3600).toFixed(1)}h`;
+  }
+
+  function subjectLine(item) {
+    if (item.subject_type === 'full_idea') {
+      const title = item.subject ? item.subject.title : `idea ${item.subject_id}`;
+      return `<a href="/#/idea/${escapeHtml(String(item.subject_id))}">${escapeHtml(title)}</a> <span class="gov-pill gov-pill--floor">Full Idea</span>`;
+    }
+    return `Constitutional amendment <span class="gov-pill gov-pill--floor">amendment</span>`;
+  }
+
+  function clockLine(item) {
+    if (item.closes_at) {
+      const rem = fmtRemaining(item.remaining_seconds);
+      return rem || 'timed sitting';
+    }
+    const rule = item.constitution && item.constitution.pass_rule;
+    return rule === 'first_ratifier'
+      ? 'no clock — closes on the first vote'
+      : 'no clock';
+  }
+
+  function ballotHtml(item, viewerId) {
+    if (!item.votes.length) {
+      return `<p class="gov-empty">No votes yet${item.closed_at ? ' — closed unopposed' : ''}.</p>`;
+    }
+    const rows = item.votes.map((v) => {
+      const who = escapeHtml(v.display_name || v.github_login || `builder ${v.voter_id}`);
+      const mine = String(v.voter_id) === String(viewerId) ? ' <span class="gov-held-note">your vote</span>' : '';
+      const when = escapeHtml(String(v.cast_at).slice(0, 16).replace('T', ' '));
+      const objection = v.direction === 'no'
+        ? `<div class="gov-perm__guards">objected to <code>${escapeHtml(v.section_key || '')}</code> — ${escapeHtml(v.reason_md || '')}</div>`
+        : '';
+      return `<div class="gov-assign-row"><span class="gov-assign-row__who">${who}${mine}</span>
+        <span class="gov-pill ${v.direction === 'no' ? 'gov-pill--locked' : 'gov-pill--seeded'}">${v.direction}</span>
+        <span class="muted">${when}</span>${objection}</div>`;
+    }).join('');
+    return `<div class="gov-section">${rows}</div>`;
+  }
+
+  function itemCard(item, viewerId) {
+    const yes = item.votes.filter((v) => v.direction === 'yes').length;
+    const no = item.votes.filter((v) => v.direction === 'no').length;
+    const state = item.closed_at
+      ? `<span class="gov-pill ${item.outcome === 'passed' ? 'gov-pill--seeded' : 'gov-pill--locked'}">${escapeHtml(item.outcome || '')}</span>`
+      : `<span class="gov-pill gov-pill--custom">open</span> <span class="muted">${escapeHtml(clockLine(item))}</span>`;
+    const amendmentDetail = item.subject_type === 'constitutional_amendment' && item.subject
+      ? `<div class="gov-perm__guards">proposes: <code>${escapeHtml(JSON.stringify(item.subject.proposed))}</code>${item.subject.rationale_md ? ` — ${escapeHtml(item.subject.rationale_md)}` : ''}</div>`
+      : '';
+    const mine = item.votes.find((v) => String(v.voter_id) === String(viewerId));
+    const myLine = item.closed_at ? '' : (mine
+      ? `<p class="gov-grid-note">You voted <strong>${escapeHtml(mine.direction)}</strong>. One vote per member — no changes.</p>`
+      : `<p class="gov-grid-note">You have not voted on this item. Casting arrives with the vote form.</p>`);
+    return `<section class="gov-section">
+      <div class="gov-section__head">${subjectLine(item)} ${state}</div>
+      ${amendmentDetail}
+      <p class="gov-grid-note">tally: ${yes} yes · ${no} no — sitting under <code>${escapeHtml((item.constitution && item.constitution.pass_rule) || '?')}</code>, membership <code>${escapeHtml((item.constitution && item.constitution.membership) || '?')}</code></p>
+      ${myLine}
+      ${ballotHtml(item, viewerId)}
+    </section>`;
+  }
+
+  async function loadBoard() {
+    const box = document.getElementById('gov-board');
+    let data;
+    try {
+      data = await fetchJson('/government/board/items');
+    } catch (err) {
+      if (err && err.kind === '401') return;
+      box.innerHTML = `<p class="gov-empty">Could not load the Board Room just now.</p>`;
+      return;
+    }
+    const viewerId = data.viewer_id;
+    const open = (data.open || []).map((i) => itemCard(i, viewerId)).join('');
+    const closed = (data.closed || []).map((i) => itemCard(i, viewerId)).join('');
+    box.innerHTML =
+      (open || window.OTBKit.emptyStateHtml('Nothing is before the board. When a Full Idea clears the completeness grade, its window opens here.'))
+      + `<h2 class="gov-h">Closed sittings</h2>`
+      + (closed || `<p class="gov-empty">No sitting has closed yet.</p>`);
   }
 
   // ---- init ----------------------------------------------------------------
@@ -435,11 +600,20 @@
     document.getElementById('gov-sub').textContent = 'Restricted.';
   }
 
+  // Since R16 the page shell admits page.view.government (metic+), and only the
+  // RANKS tab is the archon admin surface — so the seal narrowed from the whole
+  // page to that one panel. Cosmetic defence-in-depth as ever: every
+  // /government/* CRUD endpoint still gates on government.manage server-side,
+  // and the board read carries its own atom.
+  function sealRanksPanel() {
+    const panel = document.getElementById('gov-panel-ranks');
+    const body = document.getElementById('gov-body');
+    // Replace the admin surface with the sealed note, inside its own tab only.
+    panel.innerHTML = '<p class="gov-sealed">Ranks & Permissions is the Archon administration surface. The Constitution and the Board Room are yours to read.</p>';
+    body.hidden = false;
+  }
+
   async function init() {
-    // Confirm rank for a friendly sealed notice; the server gates the page and
-    // every /government endpoint on `government.manage` regardless (cosmetic
-    // defence-in-depth). government.manage is system:true, so only the archon
-    // rank can hold it — rank is an accurate client-side proxy.
     let me;
     try {
       me = await fetchJson('/me');
@@ -449,17 +623,21 @@
       me = null;
     }
     const rank = (me && (me.builder || me).rank || '').toLowerCase();
-    if (rank !== 'archon') { showSealed(); return; }
+    const isArchon = rank === 'archon';
 
     document.getElementById('gov-sub').textContent = 'How this project is governed — the constitution it runs, the Board Room, and the ranks & permissions that administer it.';
     document.getElementById('gov-body').hidden = false;
-    wireTabs();
+    wireTabs({ isArchon });
+    loadBoard();        // the room loads for everyone the page admits
+    loadConstitution(); // so does the rule it runs under (R18)
+
+    if (!isArchon) { sealRanksPanel(); return; }
     wireForms();
     try {
       await load();
     } catch (err) {
       if (err && err.kind === '401') return;
-      if (err && err.kind === '403') { showSealed(); return; }
+      if (err && err.kind === '403') { sealRanksPanel(); return; }
       document.getElementById('gov-grid').innerHTML = `<p class="gov-empty">Could not load government data just now.</p>`;
     }
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.232",
+  "version": "1.19.234",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.232",
+      "version": "1.19.234",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.232",
+  "version": "1.19.234",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/route-rank-check.js

@@ -254,6 +254,12 @@ const GOVERNMENT_PINS = {
   // R14: propose a constitutional amendment (the board's only proposed subject —
   // a Full Idea's window opens automatically on grade pass).
   'POST /government/board/items': 'perm:board.item.open',
+  // R16: the Board Room view — the open ballot is visible to whoever may cast
+  // (xenos-floored atom; the room teaches as well as governs, criterion C5).
+  'GET /government/board/items': 'perm:board.vote.cast',
+  // R18: the Constitution view — the live rule + the amendment history; reading
+  // the rule you vote under is part of casting.
+  'GET /government/constitution': 'perm:board.vote.cast',
 };
 
 // Module-scoped privileged-rank pins: a privileged route that lives in a FEATURE

package/src/bongos/serve-internal.js

@@ -789,8 +789,15 @@ function mountInternalSurfaces(app) {
       || SESSIONS_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernmentPage(req, res, next);
     }
+    // R16 (goal 1000069) widened the government shell from the manage atom
+    // (archon) to page.view.government (metic+): since R15 the page is THREE
+    // rooms — Constitution, Board Room, Ranks & Permissions — and only the
+    // third is the archon admin surface. Its DATA routes all still gate on
+    // government.manage individually (defence in depth unchanged); the board +
+    // constitution reads carry their own atoms. The shell follows the widest
+    // legitimate audience — the audience changed when the page did.
     if (GOVERNMENT_PAGE_RE.test(norm)) {
-      return gdsAuth.requireGovernmentManagePage(req, res, next);
+      return gdsAuth.requireGovernmentPage(req, res, next);
     }
     if (PEOPLE_PAGE_RE.test(norm) || SCOUTING_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);

package/src/module-api.js

@@ -891,8 +891,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.230 with no explicit bump. run 32133132988. (task 1002620)
 //   1.19.232 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.231 with no explicit bump. run 32133691409. (task 1002620)
+//   1.19.233 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.232 with no explicit bump. run 32160823445. (task 1002620)
+//   1.19.234 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.233 with no explicit bump. run 32161368847. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.232'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.234'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_view.mjs

@@ -0,0 +1,129 @@
+// tests/government_board_view.mjs — the Board Room view (BV1.R16 of goal
+// 1000069, ADR 0175 §9): open items with their clock, the open ballot, and the
+// closed history — assembled server-side, decided nowhere.
+//
+// DB-free (db monkeypatched, the sibling board tests' idiom). The invariants:
+//   1. THE VIEW DECIDES NOTHING — it projects rows; the payload carries each
+//      item's SNAPSHOT so the room describes the rule the item actually runs
+//      under, and remaining time is the database's number, passed through.
+//   2. SUBJECTS ARE ENRICHED, HONESTLY — an idea shows its title + author, an
+//      amendment its proposed block; a subject whose row is GONE projects
+//      subject:null rather than being dropped or invented.
+//   3. THE BALLOT IS OPEN — voter identity rides every vote row (§9), and an
+//      objection carries its reason + section for the room to show.
+//   4. THE READ IS GATED ON THE VOTE ATOM, NOT THE MANAGE ATOM — seeing the
+//      ballot is part of casting; the pin (and the generalized gate test in
+//      government_routes.mjs) hold the route to board.vote.cast.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+
+const { boardRoomView } = board;
+
+const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };
+
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); }
+  finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+test('the assembled view: enrichment, the open ballot, the snapshot, the database clock — all passthrough', async () => {
+  const view = await withDb({
+    listOpenBoardItems: async () => [
+      { id: 11n, subject_type: 'full_idea', subject_id: 7n, opened_by: null, opened_at: 'T1', closes_at: 'T2', remaining_seconds: 540, expired: false, closed_at: null, outcome: null, constitution: MONARCHY },
+      { id: 12n, subject_type: 'constitutional_amendment', subject_id: 5n, opened_by: 42n, opened_at: 'T1', closes_at: null, remaining_seconds: null, expired: false, closed_at: null, outcome: null, constitution: MONARCHY },
+    ],
+    listClosedBoardItems: async (limit) => { assert.equal(limit, 20); return [
+      { id: 9, subject_type: 'full_idea', subject_id: 6, opened_by: null, opened_at: 'T0', closes_at: null, closed_at: 'T3', outcome: 'returned', constitution: MONARCHY },
+    ]; },
+    getVotesForItems: async (ids) => {
+      assert.deepEqual(ids.map(String).sort(), ['11', '12', '9'].sort(), 'one ballot query for ALL items, open and closed');
+      return [
+        { item_id: 11n, voter_id: 42n, github_login: 'first-member', display_name: 'First Member', direction: 'yes', reason_md: null, section_key: null, cast_at: 'T2' },
+        { item_id: 9, voter_id: 43, github_login: 'second-member', display_name: null, direction: 'no', reason_md: 'fit is thin', section_key: 'fit', cast_at: 'T2' },
+      ];
+    },
+    getIdeaSubjects: async (ids) => {
+      assert.deepEqual(ids.map(String).sort(), ['6', '7']);
+      return [{ id: 7n, title: 'A big idea', captured_by: 9n }]; // idea 6 is GONE — deleted subject
+    },
+    getAmendmentSubjects: async (ids) => {
+      assert.deepEqual(ids.map(String), ['5']);
+      return [{ id: 5n, proposed: { pass_rule: 'consent' }, rationale_md: 'open up', proposed_by: 42n }];
+    },
+  }, () => boardRoomView());
+
+  assert.equal(view.open.length, 2);
+  assert.equal(view.closed.length, 1);
+
+  const idea = view.open[0];
+  assert.deepEqual(idea.subject, { title: 'A big idea', author_id: '9' }, 'an idea shows its title + author (R17 greys anti-self from this)');
+  assert.equal(idea.remaining_seconds, 540, 'the DATABASE clock, passed through — the client never does clock math');
+  assert.deepEqual(idea.constitution, MONARCHY, 'the SNAPSHOT rides along — the room describes the rule the item runs under');
+  assert.equal(idea.votes.length, 1);
+  assert.equal(idea.votes[0].github_login, 'first-member', 'the ballot is OPEN — identity on every vote row');
+
+  const amendment = view.open[1];
+  assert.deepEqual(amendment.subject, { proposed: { pass_rule: 'consent' }, rationale_md: 'open up', author_id: '42' });
+  assert.equal(amendment.remaining_seconds, null, 'no clock is null, not zero');
+
+  const gone = view.closed[0];
+  assert.equal(gone.subject, null, 'a deleted subject projects null — shown honestly, never dropped or invented');
+  assert.equal(gone.outcome, 'returned');
+  assert.equal(gone.votes[0].section_key, 'fit', 'the objection travels with the closed history');
+  // every id is a string — Postgres bigints and JS numbers must compare equal downstream
+  for (const item of [...view.open, ...view.closed]) {
+    assert.equal(typeof item.id, 'string');
+    assert.equal(typeof item.subject_id, 'string');
+    for (const v of item.votes) assert.equal(typeof v.voter_id, 'string');
+  }
+});
+
+test('an empty board is two empty lists — no error, no placeholder rows', async () => {
+  const view = await withDb({
+    listOpenBoardItems: async () => [],
+    listClosedBoardItems: async () => [],
+    getVotesForItems: async (ids) => { assert.deepEqual(ids, []); return []; },
+    getIdeaSubjects: async (ids) => { assert.deepEqual(ids, []); return []; },
+    getAmendmentSubjects: async (ids) => { assert.deepEqual(ids, []); return []; },
+  }, () => boardRoomView());
+  assert.deepEqual(view, { open: [], closed: [] });
+});
+
+test('the reads are indexed and clock math stays in SQL (source pins)', () => {
+  const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
+  const open = src.slice(src.indexOf('async function listOpenBoardItems'), src.indexOf('async function listClosedBoardItems'));
+  assert.match(open, /EXTRACT\(EPOCH FROM \(closes_at - now\(\)\)\)/, 'remaining time is the DATABASE clock');
+  assert.match(open, /GREATEST\(0,/, 'a just-expired item reads 0, never negative');
+  const closed = src.slice(src.indexOf('async function listClosedBoardItems'), src.indexOf('async function getVotesForItems'));
+  assert.match(closed, /ORDER BY closed_at DESC/, 'newest closes first');
+  const migration = fs.readFileSync(path.join(GOV, 'migrations', 'government_008_closed_items_index.sql'), 'utf8');
+  assert.ok(migration.includes('government_board_items_closed_by_time'), 'the closed-history read is indexed (the R13 grader lesson, applied up front)');
+});
+
+test('the room is gated on the vote atom, and the page shell widened WITH the tab seal (the R16 pair)', () => {
+  const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+  assert.equal(rrc.MODULE_EXPECTED_RANKS.government['GET /government/board/items'],
+    `${rrc.PERM_PIN_PREFIX}board.vote.cast`, 'seeing the ballot is part of casting — never the manage atom');
+  // The page-gate widening and the client-side ranks seal land TOGETHER: the
+  // shell admitting metic+ without the admin tab sealing itself would render a
+  // broken tab; the seal without the widening would seal a page nobody new can
+  // reach. Both halves pinned here so neither can be reverted alone.
+  const serve = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'serve-internal.js'), 'utf8');
+  const idx = serve.indexOf('GOVERNMENT_PAGE_RE.test(norm)');
+  assert.ok(serve.slice(idx, idx + 200).includes('requireGovernmentPage'),
+    'the shell admits page.view.government (metic+), not the manage atom');
+  const client = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.js'), 'utf8');
+  assert.match(client, /sealRanksPanel/, 'the admin tab seals itself for non-archons');
+});

package/tests/government_constitution_view.mjs

@@ -0,0 +1,87 @@
+// tests/government_constitution_view.mjs — the Constitution section (BV1.R18 of
+// goal 1000069, criteria C3/C5): what we run, and how it changed.
+//
+// DB-free (db monkeypatched). The invariants:
+//   1. THE LIVE VALUE IS RESOLVED, NEVER HARDCODED — the view calls R05's
+//      config resolution per request, so an amendment applied a moment ago
+//      reads back immediately, and this vanilla checkout reads as monarchy.
+//   2. THE HISTORY SHOWS RETURNED PROPOSALS TOO — a failed attempt to change
+//      the rules is part of the record ("a switch can never be flipped
+//      quietly" cuts both ways), each row carrying the rule it was DECIDED
+//      UNDER so every change is auditable against the constitution of its day.
+//   3. THE READ RIDES THE VOTE ATOM — reading the rule you vote under is part
+//      of casting; never the manage atom.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+const { BOARD_DEFAULTS } = require(path.join(GOV, 'config.js'));
+
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); }
+  finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+test('the live board block is RESOLVED per request — this vanilla checkout reads monarchy', async () => {
+  const view = await withDb({ listAmendmentHistory: async () => [] }, () => board.constitutionView());
+  assert.deepEqual(view.board, BOARD_DEFAULTS,
+    'no instance pack here, so the resolved value IS the neutral monarchy — never a hardcoded copy');
+  assert.deepEqual(view.history, []);
+});
+
+test('the history projects passed AND returned, with proposer identity and the decided-under snapshot', async () => {
+  const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };
+  const view = await withDb({
+    listAmendmentHistory: async (limit) => {
+      assert.equal(limit, 50);
+      return [
+        { item_id: 30n, amendment_id: 5n, proposed: { pass_rule: 'consent' }, rationale_md: 'open up',
+          proposed_by: 42n, proposer_login: 'sole-archon', proposer_name: 'Sole Archon',
+          opened_at: 'T1', closed_at: 'T2', outcome: 'passed', decided_under: MONARCHY },
+        { item_id: 29, amendment_id: 4, proposed: { window_minutes: 5 }, rationale_md: null,
+          proposed_by: null, proposer_login: null, proposer_name: null,
+          opened_at: 'T0', closed_at: 'T1', outcome: 'returned', decided_under: MONARCHY },
+      ];
+    },
+  }, () => board.constitutionView());
+  assert.equal(view.history.length, 2);
+  const [passed, returned] = view.history;
+  assert.equal(passed.outcome, 'passed');
+  assert.equal(passed.proposer_login, 'sole-archon');
+  assert.deepEqual(passed.decided_under, MONARCHY, 'auditable against the constitution of its day (§7 chain)');
+  assert.equal(returned.outcome, 'returned', 'a failed attempt to change the rules stays on the record');
+  assert.equal(returned.proposed_by, null, 'a departed proposer projects null, honestly');
+  for (const h of view.history) {
+    assert.equal(typeof h.item_id, 'string');
+    assert.equal(typeof h.amendment_id, 'string');
+  }
+});
+
+test('the history read includes returned outcomes and is bounded + close-ordered (SQL pins)', () => {
+  const src = fs.readFileSync(path.join(GOV, 'db.js'), 'utf8');
+  const block = src.slice(src.indexOf('async function listAmendmentHistory'), src.indexOf('// --- amendments'));
+  assert.ok(!block.includes("outcome = 'passed'"), 'returned proposals are part of the record — no outcome filter');
+  assert.match(block, /closed_at IS NOT NULL/, 'closed sittings only — an open proposal is the Board Room tab, not history');
+  assert.match(block, /ORDER BY i\.closed_at DESC/, 'newest change first');
+  assert.match(block, /LIMIT \$1/, 'bounded');
+});
+
+test('the read rides the vote atom, and the client renders the SERVER value (source pins)', () => {
+  const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
+  assert.equal(rrc.MODULE_EXPECTED_RANKS.government['GET /government/constitution'],
+    `${rrc.PERM_PIN_PREFIX}board.vote.cast`);
+  const client = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.js'), 'utf8');
+  assert.match(client, /fetchJson\('\/government\/constitution'\)/, 'the panel loads the resolved value');
+  assert.ok(!/'first_ratifier'[^]*hardcod/i.test(client), 'sanity');
+  assert.match(client, /loadConstitution\(\)/, 'the panel loads for everyone the page admits');
+});

package/tests/government_routes.mjs

@@ -89,8 +89,11 @@ test('every /governance route gates via REAL middleware on exactly its PINNED at
     assert.equal(r.rank, FLOOR_LABEL[floor], `${r.key}: classifies to ${atom}'s floor label (${FLOOR_LABEL[floor]})`);
   }
   // The admin surface's own rule survives the generalization, stated directly:
-  // everything that is not a board route still gates on government.manage.
-  for (const r of classified.filter((x) => !x.key.includes('/board/'))) {
+  // everything outside the Board Room family — the /board/ routes and the
+  // /constitution read (R18: reading the rule you vote under is part of
+  // casting) — still gates on government.manage.
+  const boardFamily = (key) => key.includes('/board/') || key.endsWith('/government/constitution');
+  for (const r of classified.filter((x) => !boardFamily(x.key))) {
     assert.deepEqual(r.perms, ['government.manage'], `${r.key}: the admin surface gates on the manage atom`);
   }
 });

package/tests/government_seed.mjs

@@ -40,6 +40,7 @@ const NON_GRANT_MIGRATIONS = new Set([
   'government_005_seeded_rank_descriptions.sql',   // ADR 0174 seeded-description text fix (task 1003083)
   'government_006_returned_items_index.sql',      // R13 returned-item lookup index (task 1003026)
   'government_007_amendments.sql',                 // R14 amendment proposals table (task 1003027)
+  'government_008_closed_items_index.sql',         // R16 closed-history index (task 1003029)
 ]);
 
 // Permission keys RENAMED after the grant migrations that first granted them.