@bongos/core 1.19.236 → 1.19.238

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.236",
-  "core_contract": "1.19.236",
-  "source_commit": "0a9c519e8b99e0d694e966d655d9b8a2a8f0eb3b",
+  "core_version": "1.19.238",
+  "core_contract": "1.19.238",
+  "source_commit": "f9cb966629cf3f3b846fac291d0a8d3c80ff190c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-18T16:55:12.932Z",
+  "built_at": "2026-08-18T18:46:41.252Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 311,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1320,
+    "functional_verbatim": 1323,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1652,
-  "tree_sha256": "7fe9b6616b232257cbe77dced905478c770425991cbc992686b266c61f984739",
+  "file_count": 1655,
+  "tree_sha256": "0d58a08417103e42620b35bd5880c6abdd9770d6e0b0f2222c3f4161724649b8",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1502,7 +1502,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "a045f8b58bb2e52d770a24fe44524c27afaa4a24acd3e886e1a9a55cff24d3ed"
+      "sha256": "0cb2b0b917f7d75a97d501c4c23e6a791aec4ed5c655025841d91ff8c1c10638"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2687,7 +2687,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "b0bd3bbad51ea1b68f7fd36165d77fce12939cde82b37cd2266a00c103002f4b"
+      "sha256": "5c99db7b6b1b59e595c3c6a7002cf7baa3b130a198213b007448d02a427883f1"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -2739,6 +2739,11 @@
       "mode": "0000644",
       "sha256": "a3261a569a381ed4b19f6f5d32598a9cec09f62be51533fd6b7c5272d53b63d3"
     },
+    {
+      "path": "modules/discord/board-broadcast.js",
+      "mode": "0000644",
+      "sha256": "111b577698792565f55e66f031c6567ac548b4fc5194b51c262843b2bec66198"
+    },
     {
       "path": "modules/discord/bug-attachments.js",
       "mode": "0000644",
@@ -2747,7 +2752,7 @@
     {
       "path": "modules/discord/db.js",
       "mode": "0000644",
-      "sha256": "543afaee208f27d5a6a68c55b08395cd29f1091ffae2bfca1df0cdf9b7b64b5e"
+      "sha256": "8c7f64ab027fa52885e047d47b68c3f6ed2cba79f55aaf8303266973a5370cf8"
     },
     {
       "path": "modules/discord/discord-approvals.js",
@@ -2794,10 +2799,15 @@
       "mode": "0000644",
       "sha256": "52a7e8c1776621e37f0c19800b2e466d869d01750214bfd9f352a64d26ea91e9"
     },
+    {
+      "path": "modules/discord/migrations/discord_001_board_messages.sql",
+      "mode": "0000644",
+      "sha256": "65e75ace1b53a55fd8d0dd6909a9c82c5b87c7eda5cf27662a3c8da73d010514"
+    },
     {
       "path": "modules/discord/module.json",
       "mode": "0000644",
-      "sha256": "20dbf26cfca116f5035e90a7ceec83baa29670bbd5c56dc03a1003db2983edf4"
+      "sha256": "38d30f5a250d708cbbbee1c84a9a417d2a44d51dda1e6e4030f6b577d941491c"
     },
     {
       "path": "modules/discord/pollers/discord-bot.js",
@@ -2812,7 +2822,7 @@
     {
       "path": "modules/discord/routes/discord.js",
       "mode": "0000644",
-      "sha256": "6c3d77cb86ea3f9328de88c8ddf02a1af95e3c95ed92559bf380f627f7f59f48"
+      "sha256": "eeb7c7165f18e33216bff0bb8b846a1674f537a95e8853c0b88fc101c336fb53"
     },
     {
       "path": "modules/discord/ship-broadcast.js",
@@ -2822,7 +2832,7 @@
     {
       "path": "modules/discord/webhook.js",
       "mode": "0000644",
-      "sha256": "ebf32fb813b9ca84eaade229cad2206ea7de35399c121a893b78a46a1b3af0b0"
+      "sha256": "59d2452516f4568c2a99c599275224ff0d2ff86b763066469a567944efbf5f69"
     },
     {
       "path": "modules/economy/CLAUDE.md",
@@ -2902,7 +2912,7 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "d9f0a9fa68180b7aad47e68edcf0859598d03bf2688bbd64ab286b7facd4d8af"
+      "sha256": "5529a57a4aa92c3e1903764079a6a2b7d7eb3920c2f346e642a2158389f26b5d"
     },
     {
       "path": "modules/government/catalog.js",
@@ -3272,12 +3282,12 @@
     {
       "path": "modules/hall-ui/public/government.html",
       "mode": "0000644",
-      "sha256": "b21f881ddb943b46a82a2e613485f451b84dd763f73d3d4cedf7afcf66982d30"
+      "sha256": "7962d925606ec7c33e9579ebe8bdc45ef29b35899bacfb18d36af71a314629e2"
     },
     {
       "path": "modules/hall-ui/public/government.js",
       "mode": "0000644",
-      "sha256": "246a14606c8d7b2d58d4ecb7afb9ed0f8a9d543f8c40d85e321a169ef9750fcd"
+      "sha256": "b1de692afb7abb2bd95a91a31d7c8d244c9a9f702c8ab3d73214bb23472614ec"
     },
     {
       "path": "modules/hall-ui/public/hall-kit.js",
@@ -4322,12 +4332,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f5abc3db63111a1a16cbe3d1dab016100dd4fd2327c515bfca2aeecad46d4fe9"
+      "sha256": "365922d9572fec6980fdb2806b48d83fc6e0892d63d63e909b733c748af6b51c"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "868413f24489f75a2b26faab9a4a60fb25f5348c514aa73895a074da1f15f0e4"
+      "sha256": "d3c6422211a2678deb380518daf5639b83b527f9b1935e3a1f5427589aa1e9c1"
     },
     {
       "path": "public-docs/index.html",
@@ -5942,7 +5952,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "052bbf66213891c419bee8571c5140474a9544fb3a21b8cc0aa12dacaf05a2b9"
+      "sha256": "d303e5511fe7ea46cd1b77a24f27406b59d3a393bfc7bf32b133bff2f85b5b24"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6619,6 +6629,11 @@
       "mode": "0000644",
       "sha256": "9765fcdc48191281115dfaac650719ac8f84257b602d1e83c351e9b9ad6d2949"
     },
+    {
+      "path": "tests/discord_board_broadcast.mjs",
+      "mode": "0000644",
+      "sha256": "db1a02168869e633fccc62137f4db3e0f4efbf4a785db7cc0b49a30a8d4f418a"
+    },
     {
       "path": "tests/discord_bot.mjs",
       "mode": "0000644",

package/docs/file-map.md

@@ -107,7 +107,7 @@
 ├── modules/                    ← self-contained optional feature modules (ADR 0083 / docs/modules-contract.md). Each `modules/<key>/` is a full vertical slice — routes, migrations, skills, seam registrations — reached only through src/module-api.js. The loader discovers them at boot; no core file changes to add one.
 │   ├── dev-box/                ← per-builder cloud dev environments (DigitalOcean + Cloudflare tunnels, sandbox preview, branch publish). Template move (BV1.R43). CLAUDE.md, module.json, routes/box.js, boxes.js, box-access.js, box-onboard.js, do-api.js, cf-tunnel.js, http-api-client.js, box-credential.js.
 │   ├── game/                   ← the playable Example world — Phaser client, Colyseus rooms (WorldRoom/QueueRoom), world/terrain model, game DB tables, static assets. Moved BV1.R49 (task 1418). CLAUDE.md, module.json, routes/game.js, rooms/, world/, public/, migrations/.
-│   ├── discord/                ← outbound ship broadcast + inbound #ideas/#bugs bot + role-sync + channel management + account-link state. Mirror only, never authority (ADR 0033). CLAUDE.md, module.json, routes/discord.js, routes/bug-attachments.js, discord-bot.js, discord-lib.js.
+│   ├── discord/                ← outbound ship broadcast + inbound #ideas/#bugs bot + role-sync + channel management + account-link state + the Board Room mirror. Mirror only, never authority (ADR 0033). CLAUDE.md, module.json, routes/discord.js, routes/bug-attachments.js, discord-bot.js, discord-lib.js, board-broadcast.js (announce a window / edit the outcome onto it — R21/R22 of goal 1000069), migrations/discord_001_board_messages.sql.
 │   ├── art-pipeline/           ← self-improving pixel-art generation pipeline + the four otb-* art skills + the artist discipline. CLAUDE.md, module.json, routes/art-key.js, art/ (lives under art/ at repo root; module owns the route and discipline entry).
 │   ├── memory/                 ← CORE-DOMAIN carve (BV1.R72, default-on): per-builder session memory + the recall/search retrieval layer (ADR 0060) + learnings. CLAUDE.md, module.json, routes/{memory,search,learnings}.js, memory.js, search.js, search-chunker.js, learnings.js.
 │   ├── grading/                ← CORE-DOMAIN carve (BV1.R73, default-on): the grade-a-diff adversarial worker panel + deterministic pre-passes + rubric; registers the `grade` kernel port. CLAUDE.md, module.json, routes/grade.js, grader.js, grader-rubric.json.

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -348,8 +348,14 @@ function createClient(opts = {}) {
       postGovernmentAssignments: (args) => request("POST", "/government/assignments", { hasBody: true }, args),
       // DELETE /government/assignments/{builderId}/{rankKey} — rank: archon — DELETE /government/assignments/:builderId/:rankKey
       deleteGovernmentAssignmentsBuilderIdRankKey: (args) => request("DELETE", "/government/assignments/{builderId}/{rankKey}", { hasBody: false }, args),
+      // GET /government/board/items — rank: any-builder — GET /government/board/items
+      getGovernmentBoardItems: (args) => request("GET", "/government/board/items", { hasBody: false }, args),
+      // POST /government/board/items — rank: metic+archon — POST /government/board/items
+      postGovernmentBoardItems: (args) => request("POST", "/government/board/items", { hasBody: true }, args),
       // POST /government/board/items/{itemId}/votes — rank: any-builder — POST /government/board/items/:itemId/votes
       postGovernmentBoardItemsItemIdVotes: (args) => request("POST", "/government/board/items/{itemId}/votes", { hasBody: true }, args),
+      // GET /government/constitution — rank: any-builder — GET /government/constitution
+      getGovernmentConstitution: (args) => request("GET", "/government/constitution", { hasBody: false }, args),
       // GET /government/permissions — rank: archon — GET /government/permissions
       getGovernmentPermissions: (args) => request("GET", "/government/permissions", { hasBody: false }, args),
       // GET /government/ranks — rank: archon — GET /government/ranks

package/modules/discord/board-broadcast.js

@@ -0,0 +1,212 @@
+// modules/discord/board-broadcast.js — the Board Room announcer
+// (BV1.R21 of goal 1000069, ADR 0175 §8).
+//
+// On window open, the board channel hears that a vote is wanted: the members
+// under the item's SNAPSHOTTED constitution are @mentioned (the mention IS the
+// "vote within X" notice, and Discord's own mobile app IS the mobile push — no
+// new surface), with a deep link straight to the Board Room in the hall.
+//
+// DISCORD IS OUTBOUND-ONLY HERE (§8, and the C6 criterion): this posts, it
+// reads nothing inbound and casts nothing — an objection needs a reason and a
+// section, which a reaction cannot express, so the hall is the only voting
+// surface and this message is a doorway to it.
+//
+// THE MENTION EXCEPTION: webhook.postWebhookMentions allowlists exactly the
+// member ids the GOVERNMENT PORT resolved — server data, never message text —
+// under the item's snapshot, so an amendment mid-sitting cannot change who is
+// summoned to an already-open item. A member without a Discord link is named
+// in text instead (visible, unpinged, honest). #871's parse:[] still stands:
+// nothing typed into content can ever ring anyone.
+//
+// THE MIRROR'S SECOND HALF (R22, task 1003035): when the item closes, the SAME
+// message is edited to carry the outcome, so the channel never shows a stale open
+// window and the room never has to guess which of two messages is current. The
+// item's state lives in the DATABASE — this edit is a mirror of it, never a
+// source, and nothing is ever cast from Discord.
+//
+// BEST-EFFORT BY DESIGN, like every broadcast in this module: it never throws,
+// so a Discord hiccup can never fail a window open or a close — the room in the
+// hall is the durable surface, this is the nudge.
+
+'use strict';
+
+const api = require('../../src/module-api');
+const db = require('./db');
+const webhook = require('./webhook');
+
+// Compose + post the announcement. deps injectable for the DB-free tests:
+//   resolveMembers(constitution) → the government port's resolveBoardMembers
+//   getLink(builderId)           → db.getDiscordLink
+//   post(channel, text, userIds) → webhook.postWebhookMentions
+// Strip markdown-significant characters from a builder-editable name so a
+// crafted display name cannot carry formatting, links or lookalike mentions on
+// the back of a legitimate announcement. The PING vector is already closed by
+// allowed_mentions; this closes the cosmetic/phishing one.
+function plainName(name) {
+  // '.' is stripped too: Discord auto-links bare domains, so a name shaped
+  // like one must not survive as a clickable.
+  return String(name).replace(/[\`*_~|@#>\[\]()<:.\/]/g, '').trim().slice(0, 64) || 'a member';
+}
+
+async function postBoardAnnouncement(payload, deps = {}) {
+  const result = { posted: false, skipped: null, mentioned: [], named: [] };
+  if (!payload || payload.item_id == null) { result.skipped = 'no_item'; return result; }
+  const log = deps.log || console.log;
+  try {
+    const government = deps.government !== undefined ? deps.government : (api.resolveOptional && api.resolveOptional('government'));
+    const resolveMembers = deps.resolveMembers
+      || (government && government.resolveBoardMembers ? (c) => government.resolveBoardMembers(c) : null);
+    if (!resolveMembers) { result.skipped = 'no_government_port'; return result; }
+    const members = await resolveMembers(payload.constitution || {});
+    if (!members || !members.length) { result.skipped = 'empty_board'; return result; }
+
+    // ONE bulk query for the whole board's links — never a per-member await.
+    const getLinks = deps.getLinks
+      || (async (ids) => db.getDiscordLinks(ids));
+    let links = new Map();
+    try { links = await getLinks(members.map((m) => m.builder_id)); } catch (_) { /* unlinked reads as unlinked */ }
+    const mentions = [];
+    for (const m of members) {
+      const link = links.get(String(m.builder_id));
+      const discordId = link && (link.discord_user_id || link.discordUserId);
+      if (discordId) {
+        result.mentioned.push(String(discordId));
+        mentions.push(`<@${discordId}>`);
+      } else {
+        // Named, visible, unpinged — an unlinked member still sees their name
+        // when they read the room; linking is their call, not a gate. Names are
+        // builder-editable profile text, so markdown-significant characters are
+        // stripped: a crafted display name must not carry links or formatting
+        // on the back of a legitimate announcement.
+        const safe = plainName(m.display_name || m.github_login || `builder ${m.builder_id}`);
+        result.named.push(safe);
+        mentions.push(safe);
+      }
+    }
+
+    const subject = subjectLabel(payload.subject_type);
+    const clock = payload.window_minutes
+      ? `within ${payload.window_minutes} minutes`
+      : 'at your convenience — the sitting has no clock and closes on the first vote';
+    const link = itemLink(payload.item_id);
+    const line = `\u{1F3DB}\u{FE0F} ${subject} is before the board (item ${payload.item_id}). `
+      + `${mentions.join(' ')} — your vote is wanted ${clock}. Vote in the hall: ${link}`;
+
+    const post = deps.post || webhook.postWebhookMentions;
+    const sent = await post(CHANNEL, line, result.mentioned);
+    result.posted = true;
+    // Remember WHICH message this was, so R22's close can be edited onto it. A
+    // failed remember is not a failed announcement: the nudge is already in the
+    // channel, and the close then falls back to posting its outcome fresh.
+    const messageId = sent && (sent.message_id || (sent.message && sent.message.id));
+    if (messageId) {
+      const record = deps.recordMessage || ((row) => db.recordBoardMessage(row));
+      try {
+        await record({ itemId: payload.item_id, channel: CHANNEL, messageId: String(messageId) });
+        result.recorded = String(messageId);
+      } catch (e) {
+        log(`[discord] board announcement posted but not recorded (item ${payload.item_id}; the close will post fresh): ${e && e.message}`);
+      }
+    }
+    log(`[discord] board announcement posted (item ${payload.item_id}; ${result.mentioned.length} mentioned, ${result.named.length} named)`);
+  } catch (e) {
+    result.skipped = 'post_failed';
+    log(`[discord] board announcement skipped (window open unaffected): ${e && e.message}`);
+  }
+  return result;
+}
+
+// ── shared composition ───────────────────────────────────────────────────────
+
+const CHANNEL = 'board_room';
+
+function subjectLabel(subjectType) {
+  return subjectType === 'constitutional_amendment' ? 'A constitutional amendment' : 'A Full Idea';
+}
+
+// Straight to THAT item: ?item=<id> — the Board Room panel reads it and scrolls
+// to / highlights the named sitting (the hash stays the tab).
+function itemLink(itemId) {
+  const origin = ((api.branding && api.branding().domains) || {}).buildersOrigin || '';
+  return `${origin ? origin.replace(/\/$/, '') : ''}/government?item=${encodeURIComponent(itemId)}#board-room`;
+}
+
+// ── the close (BV1.R22 of goal 1000069) ──────────────────────────────────────
+
+// PURE. The outcome message that replaces the summons, composed from the event
+// payload alone — no Discord call, no DB read, so the wording is testable and the
+// tally can never disagree with the row the government closed.
+//
+// WHAT IT DELIBERATELY DOES NOT SAY: nobody's name and nobody's vote. The open
+// ballot is a HALL surface (ADR 0175 §9 — votes are visible to everyone there);
+// mirroring who objected into a chat channel turns a reasoned objection into a
+// public callout, and the reason plus its flagged section only make sense
+// alongside the idea. The count is the honest summary; the link is the record.
+function composeOutcomeLine(payload) {
+  const subject = subjectLabel(payload.subject_type);
+  const tally = payload.tally || {};
+  const yes = Number(tally.yes) || 0;
+  const no = Number(tally.no) || 0;
+  const verdict = payload.outcome === 'passed'
+    ? 'RATIFIED by the board'
+    : 'RETURNED to its author';
+  // A zero-vote pass is a real, designed outcome (ADR 0175 §3 — an absence is
+  // nulled, never a block), so it says what happened rather than leaving the
+  // room to read "0 in favour" as a mistake.
+  const counted = (yes + no) === 0
+    ? 'nobody objected before the window closed'
+    : `${yes} in favour, ${no} ${no === 1 ? 'objection' : 'objections'}`;
+  const how = payload.cause === 'expiry'
+    ? 'the window ran out'
+    : 'the vote closed it';
+  const tail = payload.outcome === 'passed'
+    ? 'The record:'
+    : 'The objection and the section it flags are in the hall:';
+  return `\u{1F3DB}\u{FE0F} ${subject} (item ${payload.item_id}) \u2014 ${verdict}. `
+    + `${counted}; ${how}. ${tail} ${itemLink(payload.item_id)}`;
+}
+
+// Mirror the close onto the announcement. Result shape mirrors the announcer's:
+//   { edited, posted, skipped }
+//     edited  — the summons itself now reads as the outcome (the happy path)
+//     posted  — no message to edit, so the outcome went out fresh instead
+//     skipped — a NAMED reason; never a throw, so a Discord hiccup can never fail
+//               a close (the close already committed — this runs after it).
+async function postBoardOutcome(payload, deps = {}) {
+  const result = { edited: false, posted: false, skipped: null };
+  if (!payload || payload.item_id == null) { result.skipped = 'no_item'; return result; }
+  if (payload.outcome !== 'passed' && payload.outcome !== 'returned') { result.skipped = 'no_outcome'; return result; }
+  const log = deps.log || console.log;
+  const line = composeOutcomeLine(payload);
+  try {
+    const getMessage = deps.getMessage || ((itemId) => db.getBoardMessage(itemId));
+    let row = null;
+    try { row = await getMessage(payload.item_id); } catch (_) { /* unreadable reads as unannounced */ }
+    if (row && row.message_id) {
+      const edit = deps.edit || webhook.editWebhook;
+      await edit(row.channel || CHANNEL, row.message_id, line);
+      result.edited = true;
+      const mark = deps.markEdited || ((itemId) => db.markBoardMessageEdited(itemId));
+      // The stamp is bookkeeping ONLY — `edited_at IS NULL` answers "does the
+      // channel still show this as open?" without asking Discord. A failed stamp
+      // must not turn a mirrored close into a reported failure.
+      try { await mark(payload.item_id); } catch (_) { /* the edit is what matters */ }
+      log(`[discord] board close mirrored onto the announcement (item ${payload.item_id}; ${payload.outcome})`);
+      return result;
+    }
+    // Nothing to edit: the window was never announced (Discord off at open time,
+    // an item older than R22), or the id could not be kept. Posting the outcome
+    // fresh keeps the room honest — and because this branch is reached only when
+    // there is NO stored message, a failed edit can never duplicate a notice.
+    const post = deps.post || webhook.postWebhook;
+    await post(CHANNEL, line);
+    result.posted = true;
+    log(`[discord] board close posted fresh — no announcement to edit (item ${payload.item_id}; ${payload.outcome})`);
+  } catch (e) {
+    result.skipped = 'mirror_failed';
+    log(`[discord] board close mirror skipped (the close itself is unaffected): ${e && e.message}`);
+  }
+  return result;
+}
+
+module.exports = { postBoardAnnouncement, postBoardOutcome, composeOutcomeLine };

package/modules/discord/db.js

@@ -46,6 +46,18 @@ async function listDiscordLinks() {
   return rows;
 }
 
+// Bulk twin of getDiscordLink (R21): one query for a whole board's links —
+// the announcer mentions every member, and a per-member await is an N+1 the
+// grader rightly flagged. Returns a Map keyed by builder_id AS A STRING.
+async function getDiscordLinks(builderIds) {
+  if (!builderIds || !builderIds.length) return new Map();
+  const { rows } = await pool.query(
+    `SELECT builder_id, discord_user_id FROM discord_links WHERE builder_id = ANY($1::bigint[])`,
+    [builderIds],
+  );
+  return new Map(rows.map((r) => [String(r.builder_id), r]));
+}
+
 async function getDiscordLink(builderId) {
   const { rows } = await pool.query(
     `SELECT builder_id, discord_user_id, linked_at FROM discord_links WHERE builder_id = $1`,
@@ -67,6 +79,47 @@ async function countRecentDiscordBugFilings(builderId, sinceIso) {
   return rows[0].n;
 }
 
+// --- the board mirror's own bookkeeping (R22 of goal 1000069) ----------------
+//
+// Which message announced which board item, so the close can be EDITED onto the
+// same message instead of appended after it. Mirror state, discord-owned
+// (discord_001_board_messages) — government's schema stays ignorant of whether a
+// mirror exists.
+
+// Upsert: R21 announces once, but a re-announced item (a re-fired hook, a manual
+// re-drive) must leave ONE row pointing at the message that is actually live.
+async function recordBoardMessage({ itemId, channel, messageId }) {
+  const { rows } = await pool.query(
+    `INSERT INTO discord_board_messages (item_id, channel, message_id)
+     VALUES ($1, $2, $3)
+     ON CONFLICT (item_id) DO UPDATE
+       SET channel = EXCLUDED.channel, message_id = EXCLUDED.message_id,
+           posted_at = now(), edited_at = NULL
+     RETURNING item_id, channel, message_id, posted_at, edited_at`,
+    [itemId, channel, String(messageId)],
+  );
+  return rows[0] || null;
+}
+
+async function getBoardMessage(itemId) {
+  const { rows } = await pool.query(
+    `SELECT item_id, channel, message_id, posted_at, edited_at
+       FROM discord_board_messages WHERE item_id = $1`,
+    [itemId],
+  );
+  return rows[0] || null;
+}
+
+// Stamped only after Discord accepted the edit, so `edited_at IS NULL` keeps
+// meaning "the channel still shows this window as open".
+async function markBoardMessageEdited(itemId) {
+  const { rowCount } = await pool.query(
+    `UPDATE discord_board_messages SET edited_at = now() WHERE item_id = $1`,
+    [itemId],
+  );
+  return { stamped: rowCount > 0 };
+}
+
 async function recordApplause({ targetTaskId, discordUserId }) {
   const { rowCount } = await pool.query(
     `INSERT INTO discord_applause (target_task_id, discord_user_id)
@@ -82,8 +135,12 @@ module.exports = {
   getBuilderByDiscordUserId,
   listDiscordLinks,
   getDiscordLink,
+  getDiscordLinks,
   countRecentDiscordBugFilings,
   recordApplause,
+  recordBoardMessage,
+  getBoardMessage,
+  markBoardMessageEdited,
   // kernel db helpers, re-exported off the doorway (one `db.*` namespace)
   insertAuditLog: (...a) => api.insertAuditLog(...a),
   // createTask is a LIFECYCLE write — resolve the `lifecycle` kernel port at call

package/modules/discord/migrations/discord_001_board_messages.sql

@@ -0,0 +1,50 @@
+-- discord_001_board_messages.sql — which message announced which board item
+-- (task 1003035 / R22 of goal 1000069, ADR 0175 §8 / criterion C6).
+--
+-- R21 posts an announcement when a window opens; R22 EDITS THAT SAME MESSAGE when
+-- the item closes, so the channel never shows a stale open window. Editing needs
+-- the message id Discord handed back, and a window can stay open across restarts —
+-- so the id has to be durable, and this is the smallest durable place for it.
+--
+-- WHY THIS TABLE LIVES IN THE DISCORD MODULE, NOT IN GOVERNMENT'S SCHEMA: a Discord
+-- message id is mirror state, not government state (ADR 0033 — Discord is a one-way
+-- window, never authority). government_board_items must stay ignorant of whether a
+-- mirror exists; the mirror remembers its own bookkeeping. Module migrations are
+-- ADDITIVE and NAMESPACED (ADR 0083 §Decision #5 / ADR 0108 §5): every object is
+-- discord_-prefixed, the filename stem is unique across repos, and there is no
+-- down-migration. Idempotent: safe to re-run.
+--
+-- NO FOREIGN KEY to government_board_items ON PURPOSE. A module migration may not
+-- reach across the module boundary into a sibling's table (the same rule that keeps
+-- anti-self-vote in the route rather than in a constraint — see
+-- government_003_board_tables.sql), and the discord module is optional: an instance
+-- that runs the board with Discord disabled must not carry a dangling reference.
+-- A row here whose item is gone is harmless — the mirror simply has nothing to edit.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS discord_board_messages (
+  -- One announcement per board item: the mirror is edited in place, never appended
+  -- to, so PRIMARY KEY (not merely UNIQUE) is the honest shape and the upsert below
+  -- has a conflict target that can never admit a second row for the same sitting.
+  item_id     bigint      PRIMARY KEY,
+
+  -- The channel key (webhook.js CHANNELS), not a Discord snowflake: the edit must
+  -- go back through the SAME webhook that posted, and the webhook URL is resolved
+  -- from this key at edit time (config/env can be re-pointed between the post and
+  -- the close without stranding the row).
+  channel     text        NOT NULL,
+
+  -- Discord snowflakes exceed 2^53 and are strings in Discord's own API — text, so
+  -- no JSON round-trip can ever round one off.
+  message_id  text        NOT NULL,
+
+  posted_at   timestamptz NOT NULL DEFAULT now(),
+
+  -- Set when the close is mirrored. NULL means "announced, not yet resolved" — a
+  -- read that answers "does this channel still show an open window?" without
+  -- asking Discord anything.
+  edited_at   timestamptz
+);
+
+COMMIT;

package/modules/discord/module.json

@@ -6,11 +6,12 @@
   "default": false,
   "maintenance": { "status": "core-maintained" },
   "contributes": {
+    "migrations": true,
     "routes": ["discord", "bug-attachments"],
     "pollers": ["discord-bot"],
     "uiSections": []
   },
   "provides": ["discord.isLinked"],
-  "consumes": ["ideas.capture"],
+  "consumes": ["ideas.capture", "government"],
   "dependencies": { "discord.js": "^14.26.4" }
 }

package/modules/discord/routes/discord.js

@@ -17,6 +17,7 @@ const api = require('../../../src/module-api');
 const auth = require('../auth');
 const db = require('../db');
 const shipBroadcast = require('../ship-broadcast');
+const boardBroadcast = require('../board-broadcast');
 const roleSync = require('../discord-role-sync');
 
 // The module's kernel seams, registered when this factory runs (the loader runs
@@ -43,6 +44,8 @@ const roleSync = require('../discord-role-sync');
 let _shipListenerOff = null;
 let _strandListenerOff = null;
 let _roleSyncListenerOff = null;
+let _boardListenerOff = null;
+let _boardCloseListenerOff = null;
 function registerSeams() {
   if (!api.hasProvider('discord.isLinked')) {
     api.registerProvider('discord.isLinked', async (builderId) => !!(await db.getDiscordLink(builderId)));
@@ -58,6 +61,15 @@ function registerSeams() {
   _shipListenerOff = api.on('task.shipped', (task) => shipBroadcast.postShipBroadcast(task));
   if (_strandListenerOff) _strandListenerOff();
   _strandListenerOff = api.on('task.strand-flagged', (info) => shipBroadcast.postStrandNotice(info));
+  // R21 (goal 1000069): a window opening in the Board Room summons its members
+  // — the government module emits, this module posts. Outbound only (§8).
+  if (_boardListenerOff) _boardListenerOff();
+  _boardListenerOff = api.on('board.item.opened', (payload) => boardBroadcast.postBoardAnnouncement(payload));
+  // R22: the same sitting, closed — the announcement is EDITED into an outcome
+  // notice, so the channel never shows a stale open window. Fires on a return as
+  // well as a pass; still outbound only, still nothing cast from Discord.
+  if (_boardCloseListenerOff) _boardCloseListenerOff();
+  _boardCloseListenerOff = api.on('board.item.closed', (payload) => boardBroadcast.postBoardOutcome(payload));
   if (_roleSyncListenerOff) _roleSyncListenerOff();
   _roleSyncListenerOff = api.on('builder.role-sync-needed', ({ builderId }) =>
     roleSync.syncBuilderRole(builderId).catch((e) =>

package/modules/discord/webhook.js

@@ -7,7 +7,10 @@
 // module needs lives IN the module. scripts/discord/lib.js stays for the two CORE
 // consumers that still post webhooks (src/bongos/approval-broadcast.js + the
 // scripts/discord/post.js CLI). KEEP THE TWO IN SYNC — same channels, same
-// 2000-char cap, same allowed_mentions suppression (#871). Config is read through
+// 2000-char cap, same allowed_mentions suppression (#871) — the R22 board-mirror
+// edit path (postCore's `wait=true` + editWebhook) is deliberately module-only:
+// no core consumer edits a message it posted, so copying it into the twin would
+// add an unused surface rather than keep the two honest. Config is read through
 // the published doorway (configPath) so the path resolves identically.
 //
 // Discord is a one-way window into the GDS (the trust-boundary ADR): this only
@@ -27,6 +30,7 @@ const WEBHOOKS_PATH = api.configPath('discord-webhooks.json');
 const CHANNELS = new Set([
   'ship_news', 'ship_feed', 'security_ship_feed',
   'member_approvals',
+  'board_room',
 ]);
 
 function loadWebhooks() {
@@ -43,7 +47,11 @@ function loadWebhooks() {
   return cfg;
 }
 
-async function postWebhook(channel, text) {
+// One poster core; the two entry points differ ONLY in allowed_mentions.
+// #871's rule holds in both: parse:[] always, so nothing typed INTO content can
+// ever ring — postWebhookMentions adds an explicit server-resolved user
+// allowlist and nothing else.
+function resolveWebhookUrl(channel) {
   if (!CHANNELS.has(channel)) {
     throw new Error(`Unknown Discord channel '${channel}'. Known: ${[...CHANNELS].join(', ')}`);
   }
@@ -54,21 +62,78 @@ async function postWebhook(channel, text) {
       `or env DISCORD_${channel.toUpperCase()}_WEBHOOK. See scripts/discord/README.md.`
     );
   }
-  // Discord hard-caps message content at 2000 chars.
-  const content = String(text).slice(0, 2000);
-  // SECURITY (#871): suppress ALL mention pings. The content is DB-sourced and
-  // attacker-influenceable; allowed_mentions:{parse:[]} renders text verbatim but
-  // fires zero notifications. (Discord defaults to parsing mentions when omitted.)
-  const res = await fetch(url, {
+  return url;
+}
+
+// Discord hard-caps message content at 2000 chars — one place, so a post and an
+// edit of the same text can never disagree about what got truncated.
+function capContent(text) {
+  return String(text).slice(0, 2000);
+}
+
+// R22 (the board mirror) needs the id of the message it just posted so the close
+// can be edited onto it, so the POST asks for the created message back
+// (`?wait=true` — Discord then answers 200 + the message JSON instead of 204 with
+// no body). The extra field is additive: every existing caller ignores the return.
+async function postCore(channel, text, allowedMentions) {
+  const url = resolveWebhookUrl(channel);
+  const res = await fetch(`${url}${url.includes('?') ? '&' : '?'}wait=true`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ content, allowed_mentions: { parse: [] } }),
+    body: JSON.stringify({ content: capContent(text), allowed_mentions: allowedMentions }),
   });
   if (!res.ok) {
     const body = await res.text().catch(() => '');
     throw new Error(`Discord webhook POST -> ${res.status}: ${body.slice(0, 300)}`);
   }
-  return { ok: true, status: res.status }; // 204 No Content on success
+  // `wait=true` answers with the message; a body we cannot parse is not a failed
+  // post — the message IS in the channel, we just cannot edit it later.
+  const message = await res.json().catch(() => null);
+  return { ok: true, status: res.status, message, message_id: message && message.id ? String(message.id) : null };
+}
+
+// SECURITY (#871): suppress ALL mention pings. The content is DB-sourced and
+// attacker-influenceable; allowed_mentions:{parse:[]} renders text verbatim but
+// fires zero notifications. (Discord defaults to parsing mentions when omitted.)
+async function postWebhook(channel, text) {
+  return postCore(channel, text, { parse: [] });
+}
+
+// postWebhookMentions — the ONE sanctioned exception to #871's blanket mention
+// suppression (R21 of goal 1000069: "the mention IS the 'vote within X'
+// notice"). Still parse:[] — nothing typed INTO the content can ever ping — but
+// an explicit `users` allowlist lets exactly the named ids ring. The ids must
+// come from the board-membership resolve (server data), NEVER from message
+// text; the cap of 20 is a sanity bound far above any real board.
+async function postWebhookMentions(channel, text, userIds = []) {
+  const users = [...new Set(userIds.filter((u) => /^\d+$/.test(String(u))))].slice(0, 20).map(String);
+  return postCore(channel, text, { parse: [], users });
+}
+
+// editWebhook — rewrite a message this webhook already posted, in place (R22 of
+// goal 1000069). PATCH /webhooks/<id>/<token>/messages/<message_id>, which is the
+// only edit a webhook is allowed: its OWN messages, in the channel it owns.
+//
+// FULLY SUPPRESSED, ALWAYS. The edit is an outcome notice, not a summons — and an
+// edit that carried a mentions allowlist could re-ring a board that already voted.
+// parse:[] with no `users` is #871's default, and the mention exception stays
+// scoped to the one post that means "your vote is wanted".
+async function editWebhook(channel, messageId, text) {
+  const url = resolveWebhookUrl(channel);
+  const [base] = String(url).split('?');
+  const res = await fetch(`${base.replace(/\/$/, '')}/messages/${encodeURIComponent(String(messageId))}`, {
+    method: 'PATCH',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ content: capContent(text), allowed_mentions: { parse: [] } }),
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    throw new Error(`Discord webhook PATCH -> ${res.status}: ${body.slice(0, 300)}`);
+  }
+  return { ok: true, status: res.status };
 }
 
-module.exports = { CHANNELS, WEBHOOKS_PATH, loadWebhooks, postWebhook };
+module.exports = {
+  CHANNELS, WEBHOOKS_PATH, loadWebhooks, resolveWebhookUrl,
+  postWebhook, postWebhookMentions, editWebhook,
+};

package/modules/government/board.js

@@ -81,9 +81,56 @@ async function openWindowForFullIdea({ ideaId, completenessScore } = {}) {
     windowMinutes: board.window_minutes,
   });
   if (!item) return { opened: false, reason: 'already_open', item: await db.getOpenBoardItem('full_idea', id) };
+  await emitWindowOpened(item);
   return { opened: true, item };
 }
 
+// The window-open courtesy event (R21's feed): emitAsync AFTER the row exists,
+// for non-deciding reactions only — the Discord announcer mentions the members
+// whose vote is wanted and deep-links the hall. Best-effort by construction
+// (emitAsync isolates listener errors), and nothing that decides or pays may
+// subscribe: the row is the durable fact, the event is a nudge.
+async function emitWindowOpened(item) {
+  try {
+    if (api.emitAsync) {
+      await api.emitAsync('board.item.opened', {
+        item_id: String(item.id),
+        subject_type: item.subject_type,
+        subject_id: String(item.subject_id),
+        opened_by: item.opened_by == null ? null : String(item.opened_by),
+        closes_at: item.closes_at || null,
+        window_minutes: item.constitution ? item.constitution.window_minutes ?? null : null,
+        constitution: item.constitution || null,
+      });
+    }
+  } catch (_) { /* a nudge that fails is a quiet sitting, never a failed open */ }
+}
+
+// The close event (R22's Discord mirror): the summons that R21 posted is edited
+// into an outcome notice, so the channel never shows a stale open window. Emitted
+// for a RETURN as well as a pass, with the tally the close already counted — no
+// consumer should have to re-read votes to state what happened. Best-effort by
+// construction, like the open nudge.
+async function emitItemClosed(closed, { cause, votes } = {}) {
+  try {
+    if (!api.emitAsync) return;
+    const cast = votes || [];
+    await api.emitAsync('board.item.closed', {
+      item_id: String(closed.id),
+      subject_type: closed.subject_type,
+      subject_id: String(closed.subject_id),
+      outcome: closed.outcome,
+      cause: cause || 'vote',
+      closed_at: closed.closed_at || null,
+      tally: {
+        yes: cast.filter((v) => v.direction === 'yes').length,
+        no: cast.filter((v) => v.direction === 'no').length,
+        total: cast.length,
+      },
+    });
+  } catch (_) { /* a mirror that fails is a quiet channel, never a failed close */ }
+}
+
 // ── the vote (BV1.R08 of goal 1000069, ADR 0175 §§4/6/9) ────────────────────
 //
 // OPEN BALLOT, ONE VOTE, NO EDITING. A vote is member + direction + timestamp,
@@ -366,6 +413,16 @@ async function closeItem(item, { cause = 'vote' } = {}) {
     } catch (_) { /* emitAsync isolates listener errors; nothing that moves credits subscribes */ }
   }
 
+  // R22's mirror event: BOTH outcomes, after commit, emitAsync. Separate from
+  // `board.item.passed` on purpose — that one is the pass CONTRACT the credit lane
+  // reads (docs/specs/board-room-pass-event-contract.md: seven fields, no tally),
+  // and a mirror needs the opposite things: it fires on a return too, and it
+  // carries the count so the channel can state the outcome without reading the DB.
+  // Widening the contract event to cover returns would put a payer on a path that
+  // also fires for "nothing was ratified". Nothing that decides or pays may
+  // subscribe here — the row is the durable fact, this is a nudge.
+  await emitItemClosed(closed, { cause, votes });
+
   return {
     closed: true, item: closed, outcome, cause, author_karma: authorKarma,
     ...(credit ? { credit } : {}),
@@ -450,6 +507,7 @@ async function proposeAmendment({ proposal, rationaleMd = null, proposedBy } = {
     windowMinutes: board.window_minutes,
   });
   // A fresh amendment id can never collide with the one-open-per-subject index.
+  if (item) await emitWindowOpened(item);
   return { ok: true, amendment, item };
 }
 

package/modules/hall-ui/public/government.html

@@ -99,6 +99,6 @@
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
-<script src="/builders/government.js?v=2026-08-18-vote-form"></script>
+<script src="/builders/government.js?v=2026-08-18-board-announce"></script>
 </body>
 </html>

package/modules/hall-ui/public/government.js

@@ -704,7 +704,7 @@
     const myLine = item.closed_at ? '' : (mine
       ? `<p class="gov-grid-note">You voted <strong>${escapeHtml(mine.direction)}</strong>. One vote per member — no changes.</p>`
       : `<p class="gov-grid-note">You have not voted on this item. Casting arrives with the vote form.</p>`);
-    return `<section class="gov-section">
+    return `<section class="gov-section" id="board-item-${escapeHtml(item.id)}">
       <div class="gov-section__head">${subjectLine(item)} ${state}</div>
       ${amendmentDetail}
       <p class="gov-grid-note">tally: ${yes} yes · ${no} no — sitting under <code>${escapeHtml((item.constitution && item.constitution.pass_rule) || '?')}</code>, membership <code>${escapeHtml((item.constitution && item.constitution.membership) || '?')}</code></p>
@@ -732,6 +732,17 @@
       (open || window.OTBKit.emptyStateHtml('Nothing is before the board. When a Full Idea clears the completeness grade, its window opens here.'))
       + `<h2 class="gov-h">Closed sittings</h2>`
       + (closed || `<p class="gov-empty">No sitting has closed yet.</p>`);
+    // R21: the Discord announcement deep-links ?item=<id>#board-room — land the
+    // reader on THAT sitting. Query, not hash (the hash is the tab, makeTabs
+    // owns it); a missing or unknown id is simply the room as usual.
+    const wanted = new URLSearchParams(window.location.search).get('item');
+    if (wanted) {
+      const el = document.getElementById(`board-item-${wanted}`);
+      if (el) {
+        el.scrollIntoView({ block: 'start' });
+        el.style.outline = '2px solid var(--color-text-success, #4a4)';
+      }
+    }
     // R17: the cast buttons. One delegated listener; the SERVER refuses every
     // illegitimate cast regardless (membership, anti-self, closed, expired) —
     // the form is a courtesy, the route is the wall.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.236",
+  "version": "1.19.238",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.236",
+      "version": "1.19.238",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.236",
+  "version": "1.19.238",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -899,8 +899,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.234 with no explicit bump. run 32161981393. (task 1002620)
 //   1.19.236 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.235 with no explicit bump. run 32162811851. (task 1002620)
+//   1.19.237 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.236 with no explicit bump. run 32164526454. (task 1002620)
+//   1.19.238 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.237 with no explicit bump. run 32172843539. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.236'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.238'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/discord_board_broadcast.mjs

@@ -0,0 +1,289 @@
+// tests/discord_board_broadcast.mjs — announce a window (BV1.R21 of goal
+// 1000069, ADR 0175 §8 / criterion C6): mention the members, deep-link the hall.
+//
+// DB-free, deps-injected (the postShipBroadcast testing shape). The invariants:
+//   1. THE MENTION ALLOWLIST IS EXACTLY THE LINKED MEMBERS — ids come from the
+//      government port's resolve under the item's SNAPSHOT, never from text;
+//      an unlinked member is NAMED, visible and unpinged.
+//   2. OUTBOUND-ONLY AND BEST-EFFORT — a Discord hiccup, a missing port, or an
+//      empty board is a named skip, never a throw (a failed nudge must never
+//      fail a window open).
+//   3. THE EMITTER FIRES ON FRESH OPENS ONLY — an idempotent re-open (the
+//      already_open path) summons nobody twice.
+//   4. #871 SURVIVES — the poster keeps parse:[] and only rings the explicit
+//      user allowlist; content can never ping anyone on its own.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { postBoardAnnouncement } = require(path.join(ROOT, 'modules', 'discord', 'board-broadcast.js'));
+const webhook = require(path.join(ROOT, 'modules', 'discord', 'webhook.js'));
+
+const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };
+const payload = (over = {}) => ({
+  item_id: '11', subject_type: 'full_idea', subject_id: '7', opened_by: null,
+  closes_at: null, window_minutes: null, constitution: MONARCHY, ...over,
+});
+const member = (id, login) => ({ builder_id: String(id), github_login: login, display_name: login });
+
+test('linked members are @mentioned on the allowlist; unlinked members are named, unpinged', async () => {
+  let posted = null;
+  const out = await postBoardAnnouncement(payload({ window_minutes: 90 }), {
+    resolveMembers: async (c) => { assert.deepEqual(c, MONARCHY, 'summoned under the item SNAPSHOT'); return [member(1, 'linked-one'), member(2, 'unlinked-two')]; },
+    getLinks: async (ids) => {
+      assert.deepEqual(ids, ['1', '2'], 'ONE bulk query for the whole board — never a per-member await');
+      return new Map([['1', { discord_user_id: '111222333' }]]);
+    },
+    post: async (channel, text, userIds) => { posted = { channel, text, userIds }; },
+    log: () => {},
+  });
+  assert.equal(out.posted, true);
+  assert.deepEqual(out.mentioned, ['111222333']);
+  assert.deepEqual(out.named, ['unlinked-two']);
+  assert.equal(posted.channel, 'board_room');
+  assert.deepEqual(posted.userIds, ['111222333'], 'the allowlist is EXACTLY the linked members — never parsed from text');
+  assert.ok(posted.text.includes('<@111222333>'));
+  assert.ok(posted.text.includes('unlinked-two'), 'the unlinked member is still named');
+  assert.ok(posted.text.includes('within 90 minutes'), 'the mention IS the vote-within-X notice');
+  assert.ok(posted.text.includes('/government?item=11#board-room'), 'deep-links THAT item — the panel scrolls to it');
+});
+
+test('a clockless sitting says so, and an amendment names its subject honestly', async () => {
+  let text = null;
+  await postBoardAnnouncement(payload({ subject_type: 'constitutional_amendment', subject_id: '5' }), {
+    resolveMembers: async () => [member(1, 'a')],
+    getLinks: async () => new Map([['1', { discord_user_id: '9' }]]),
+    post: async (_c, t) => { text = t; },
+    log: () => {},
+  });
+  assert.ok(text.includes('constitutional amendment'));
+  assert.ok(text.includes('no clock'), 'a monarchy sitting has no deadline to claim');
+});
+
+test('missing port, empty board, and a Discord failure are named skips — NEVER throws', async () => {
+  assert.deepEqual(await postBoardAnnouncement(payload(), { government: null, log: () => {} }),
+    { posted: false, skipped: 'no_government_port', mentioned: [], named: [] });
+  assert.equal((await postBoardAnnouncement(payload(), { resolveMembers: async () => [], log: () => {} })).skipped, 'empty_board');
+  const out = await postBoardAnnouncement(payload(), {
+    resolveMembers: async () => [member(1, 'a')],
+    getLinks: async () => new Map([['1', { discord_user_id: '9' }]]),
+    post: async () => { throw new Error('discord down'); },
+    log: () => {},
+  });
+  assert.deepEqual({ posted: out.posted, skipped: out.skipped }, { posted: false, skipped: 'post_failed' });
+  assert.equal((await postBoardAnnouncement(null, { log: () => {} })).skipped, 'no_item');
+});
+
+test('the emitter fires on FRESH opens only, and the listener is registered (source pins)', () => {
+  const board = fs.readFileSync(path.join(ROOT, 'modules', 'government', 'board.js'), 'utf8');
+  const open = board.slice(board.indexOf('async function openWindowForFullIdea'), board.indexOf('async function emitWindowOpened'));
+  assert.ok(open.indexOf('already_open') < open.indexOf('emitWindowOpened(item)'),
+    'the idempotent re-open path returns BEFORE the emit — nobody is summoned twice');
+  assert.match(board, /emitAsync\('board\.item\.opened'/, 'the event exists');
+  const routes = fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'routes', 'discord.js'), 'utf8');
+  assert.match(routes, /api\.on\('board\.item\.opened', \(payload\) => boardBroadcast\.postBoardAnnouncement\(payload\)\)/,
+    'the discord module subscribes — government emits, discord posts, nothing decides');
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'module.json'), 'utf8'));
+  assert.ok(manifest.consumes.includes('government'), 'the port consumption is declared');
+});
+
+test('#871 survives: the mention poster keeps parse:[] and rings only the explicit allowlist', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'webhook.js'), 'utf8');
+  const block = src.slice(src.indexOf('async function postWebhookMentions'));
+  assert.match(block, /postCore\(channel, text, \{ parse: \[\], users \}\)/,
+    'content can never ping on its own — only the server-resolved ids ring');
+  const plain = src.slice(src.indexOf('async function postWebhook('), src.indexOf('async function postWebhookMentions'));
+  assert.match(plain, /postCore\(channel, text, \{ parse: \[\] \}\)/,
+    'the default poster stays fully suppressed — #871 verbatim');
+  assert.match(block, /slice\(0, 20\)/, 'the allowlist is sanity-bounded');
+  assert.match(block, /\^\\d\+\$/, 'only numeric snowflake ids survive the filter');
+  assert.ok(webhook.CHANNELS.has('board_room'), 'the channel key exists');
+});
+
+test('an unlinked member\'s crafted display name is stripped of markdown and links', async () => {
+  let text = null;
+  await postBoardAnnouncement(payload(), {
+    resolveMembers: async () => [{ builder_id: '3', github_login: 'x', display_name: '[click me](https://evil.example) **@everyone**' }],
+    getLinks: async () => new Map(),
+    post: async (_c, t) => { text = t; },
+    log: () => {},
+  });
+  assert.ok(!text.includes('['), 'no markdown link syntax survives');
+  assert.ok(!/\w\.\w/.test(text.replace(/Vote in the hall:.*$/,'')), 'no linkable residue survives (Discord auto-links bare domains)');
+  assert.ok(!text.includes('**'), 'no formatting survives');
+  assert.ok(!text.includes('@everyone'), 'no lookalike mention survives (the ping was already dead; now the text is too)');
+  assert.ok(text.includes('click me'), 'the words themselves remain — visible, honest, inert');
+});
+
+// ── R22 (task 1003035): the state mirror — closed, and the outcome ───────────
+//
+// The invariants R22 adds:
+//   6. THE SAME MESSAGE CARRIES THE OUTCOME — the summons is EDITED, never
+//      appended to, so the channel can never show a stale open window beside a
+//      closed one. The id comes from the POST (`wait=true`) and is remembered.
+//   7. BOTH OUTCOMES MIRROR — a return is mirrored exactly like a pass; only the
+//      pass CONTRACT event stays pass-only (the credit lane's payload).
+//   8. STILL BEST-EFFORT, STILL OUTBOUND-ONLY — every failure is a named skip,
+//      an unannounced item posts fresh rather than going silent, and an edit
+//      never re-rings the board.
+const { postBoardOutcome, composeOutcomeLine } = require(path.join(ROOT, 'modules', 'discord', 'board-broadcast.js'));
+const closedPayload = (over = {}) => ({
+  item_id: '11', subject_type: 'full_idea', subject_id: '7',
+  outcome: 'passed', cause: 'vote', closed_at: '2026-08-18T12:00:00.000Z',
+  tally: { yes: 1, no: 0, total: 1 }, ...over,
+});
+
+test('the announcement is remembered at post time, so the close has something to edit', async () => {
+  let recorded = null;
+  const out = await postBoardAnnouncement(payload(), {
+    resolveMembers: async () => [member(1, 'a')],
+    getLinks: async () => new Map([['1', { discord_user_id: '9' }]]),
+    post: async () => ({ ok: true, status: 200, message_id: '555000111' }),
+    recordMessage: async (row) => { recorded = row; },
+    log: () => {},
+  });
+  assert.equal(out.posted, true);
+  assert.deepEqual(recorded, { itemId: '11', channel: 'board_room', messageId: '555000111' });
+  assert.equal(out.recorded, '555000111');
+});
+
+test('a poster that returns no id, or a failed remember, still counts as announced', async () => {
+  const quiet = {
+    resolveMembers: async () => [member(1, 'a')],
+    getLinks: async () => new Map([['1', { discord_user_id: '9' }]]),
+    log: () => {},
+  };
+  // The pre-R22 shape (no return value at all) must not become a failure.
+  assert.equal((await postBoardAnnouncement(payload(), { ...quiet, post: async () => {} })).posted, true);
+  const out = await postBoardAnnouncement(payload(), {
+    ...quiet,
+    post: async () => ({ message: { id: '7' } }),
+    recordMessage: async () => { throw new Error('db down'); },
+  });
+  assert.equal(out.posted, true, 'the nudge is already in the channel — a lost id is not a failed announcement');
+  assert.equal(out.recorded, undefined);
+});
+
+test('the close is EDITED onto the same message, and the edit is stamped', async () => {
+  let edited = null; let stamped = null;
+  const out = await postBoardOutcome(closedPayload({ tally: { yes: 2, no: 0, total: 2 } }), {
+    getMessage: async (itemId) => { assert.equal(itemId, '11'); return { item_id: '11', channel: 'board_room', message_id: '555000111' }; },
+    edit: async (channel, messageId, text) => { edited = { channel, messageId, text }; },
+    markEdited: async (itemId) => { stamped = itemId; },
+    log: () => {},
+  });
+  assert.deepEqual({ edited: out.edited, posted: out.posted, skipped: out.skipped }, { edited: true, posted: false, skipped: null });
+  assert.equal(edited.channel, 'board_room');
+  assert.equal(edited.messageId, '555000111');
+  assert.ok(edited.text.includes('RATIFIED'), 'the summons now reads as the outcome');
+  assert.ok(!edited.text.includes('your vote is wanted'), 'nothing stale survives the edit');
+  assert.ok(edited.text.includes('/government?item=11#board-room'), 'the record is still one click away');
+  assert.equal(stamped, '11', 'edited_at answers "is this window still shown as open?" without asking Discord');
+});
+
+test('a RETURN mirrors exactly like a pass — and names neither voter nor reason', async () => {
+  let text = null;
+  const out = await postBoardOutcome(closedPayload({ outcome: 'returned', cause: 'expiry', tally: { yes: 0, no: 1, total: 1 } }), {
+    getMessage: async () => ({ channel: 'board_room', message_id: '9' }),
+    edit: async (_c, _m, t) => { text = t; },
+    markEdited: async () => {},
+    log: () => {},
+  });
+  assert.equal(out.edited, true);
+  assert.ok(text.includes('RETURNED to its author'));
+  assert.ok(text.includes('1 objection'), 'singular reads right at one');
+  assert.ok(text.includes('the window ran out'), 'an expiry close says so');
+  assert.ok(text.includes('in the hall'), 'the reason + flagged section live where the idea is');
+});
+
+test('a zero-vote pass states what happened instead of reading like a bug', () => {
+  const line = composeOutcomeLine(closedPayload({ cause: 'expiry', tally: { yes: 0, no: 0, total: 0 } }));
+  assert.ok(line.includes('nobody objected before the window closed'), 'an absence is nulled, never a block (ADR 0175 §3)');
+  assert.ok(line.includes('RATIFIED'));
+  const amendment = composeOutcomeLine(closedPayload({ subject_type: 'constitutional_amendment', tally: { yes: 3, no: 0 } }));
+  assert.ok(amendment.includes('constitutional amendment'), 'the second subject is named honestly here too');
+  assert.ok(amendment.includes('3 in favour, 0 objections'));
+});
+
+test('an unannounced item posts its outcome fresh rather than going silent', async () => {
+  let posted = null;
+  const out = await postBoardOutcome(closedPayload(), {
+    getMessage: async () => null,
+    post: async (channel, text) => { posted = { channel, text }; },
+    log: () => {},
+  });
+  assert.deepEqual({ edited: out.edited, posted: out.posted }, { edited: false, posted: true });
+  assert.equal(posted.channel, 'board_room');
+  assert.ok(posted.text.includes('RATIFIED'));
+});
+
+test('every mirror failure is a NAMED skip — a close can never be failed by Discord', async () => {
+  assert.equal((await postBoardOutcome(null, { log: () => {} })).skipped, 'no_item');
+  assert.equal((await postBoardOutcome(closedPayload({ outcome: null }), { log: () => {} })).skipped, 'no_outcome');
+  const failed = await postBoardOutcome(closedPayload(), {
+    getMessage: async () => ({ channel: 'board_room', message_id: '9' }),
+    edit: async () => { throw new Error('discord down'); },
+    log: () => {},
+  });
+  assert.deepEqual({ edited: failed.edited, posted: failed.posted, skipped: failed.skipped },
+    { edited: false, posted: false, skipped: 'mirror_failed' },
+    'a failed EDIT never falls back to a second message — the room must not get two notices');
+  // An unreadable bookkeeping read degrades to "unannounced", not to a throw.
+  const unread = await postBoardOutcome(closedPayload(), {
+    getMessage: async () => { throw new Error('db down'); },
+    post: async () => {},
+    log: () => {},
+  });
+  assert.equal(unread.posted, true);
+  // A stamp that fails leaves the mirrored close reported as mirrored.
+  const unstamped = await postBoardOutcome(closedPayload(), {
+    getMessage: async () => ({ channel: 'board_room', message_id: '9' }),
+    edit: async () => {},
+    markEdited: async () => { throw new Error('db down'); },
+    log: () => {},
+  });
+  assert.equal(unstamped.edited, true);
+});
+
+test('government emits the close for BOTH outcomes, after commit, and keeps the pass contract pass-only (source pins)', () => {
+  const board = fs.readFileSync(path.join(ROOT, 'modules', 'government', 'board.js'), 'utf8');
+  const close = board.slice(board.indexOf('async function closeItem'));
+  assert.ok(close.indexOf('closeBoardItem') < close.indexOf('emitItemClosed(closed'),
+    'the mirror event fires AFTER the close commits — the row is the durable fact');
+  const passEmit = close.indexOf("emitAsync('board.item.passed'");
+  assert.ok(passEmit < close.indexOf('emitItemClosed(closed'),
+    "the credit lane's contract event still goes first");
+  const closedEmit = board.slice(board.indexOf('async function emitItemClosed'));
+  assert.match(closedEmit, /emitAsync\('board\.item\.closed'/, 'the event exists');
+  assert.match(closedEmit, /outcome: closed\.outcome/, 'it carries the outcome — a return mirrors too');
+  assert.match(closedEmit, /tally: \{/, 'it carries the tally so no consumer re-reads votes');
+  const passBlock = board.slice(board.indexOf('function passPayload'), board.indexOf('// Close an item'));
+  assert.ok(!/tally/.test(passBlock), 'the pass CONTRACT payload stays the seven fields — no tally (ADR 0175 / the pass-event spec)');
+  const routes = fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'routes', 'discord.js'), 'utf8');
+  assert.match(routes, /api\.on\('board\.item\.closed', \(payload\) => boardBroadcast\.postBoardOutcome\(payload\)\)/,
+    'the discord module subscribes to the close as well');
+});
+
+test('the poster asks for the message back, the edit rings NOBODY, and the mirror table is discord-owned', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'webhook.js'), 'utf8');
+  const core = src.slice(src.indexOf('async function postCore'), src.indexOf('// SECURITY (#871)'));
+  assert.match(core, /wait=true/, 'the POST asks Discord for the created message — that id is what R22 edits');
+  assert.match(core, /message_id: message && message\.id/, 'the id is surfaced to the caller');
+  const edit = src.slice(src.indexOf('async function editWebhook'));
+  assert.match(edit, /method: 'PATCH'/);
+  assert.match(edit, /\/messages\/\$\{encodeURIComponent\(String\(messageId\)\)\}/, 'a webhook may only edit its OWN message');
+  assert.match(edit, /allowed_mentions: \{ parse: \[\] \}/, 'an edit is an outcome notice, not a summons — it must never re-ring the board');
+  assert.ok(!/users/.test(edit), 'the mention exception stays scoped to the one post that means "your vote is wanted"');
+  const sql = fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'migrations', 'discord_001_board_messages.sql'), 'utf8');
+  assert.match(sql, /CREATE TABLE IF NOT EXISTS discord_board_messages/);
+  assert.ok(!/REFERENCES government_board_items/.test(sql),
+    'no FK across the module boundary — the mirror never constrains government\'s schema');
+  assert.match(sql, /item_id\s+bigint\s+PRIMARY KEY/, 'one announcement per sitting, edited in place');
+  const manifest = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'discord', 'module.json'), 'utf8'));
+  assert.equal(manifest.contributes.migrations, true, 'the module now owns a migration and says so');
+});