@bongos/core 1.19.250 → 1.19.252

package/modules/government/board-membership.js

@@ -3,8 +3,8 @@
 // modules/government/board-membership.js — WHO SITS ON THE BOARD, right now
 // (BV1.R06 of goal 1000069, ADR 0175).
 //
-// Resolves the constitution's membership predicate (R05: `board.membership`,
-// grammar `rank:<key>`) to the live member list. Consumed by R07 (who to
+// Resolves the constitution's membership predicate (R05: `board.membership`;
+// the grammar lives in ./membership-predicate) to the live member list. Consumed by R07 (who to
 // announce a window to), R08 (the live membership re-check before a vote
 // counts), and R10 (the tally's denominator).
 //
@@ -34,22 +34,13 @@
 
 const db = require('./db');
 
-// The one predicate grammar v1 defines, mirrored from config.js's MEMBERSHIP_RE
-// (the two must agree; tests/government_board_membership.mjs pins that). The
-// rank key is validated by SHAPE only — whether it names a live rank is the
-// DB's question, answered by the query returning nobody for a key with no
-// assignment rows. Config deliberately cannot see custom ranks (R05), so this
-// is where `rank:some-custom-rank` becomes real or resolves to an empty board.
-const PREDICATE_RE = /^rank:([a-z][a-z0-9_-]*)$/;
-
-// Pure: predicate string -> { rankKey } or null. Null means "unparseable", and
-// every caller must treat null as NOBODY. Exported so R07/R08 can validate a
-// snapshotted constitution's predicate without touching the DB.
-function parseMembershipPredicate(predicate) {
-  if (typeof predicate !== 'string') return null;
-  const m = PREDICATE_RE.exec(predicate);
-  return m ? Object.freeze({ rankKey: m[1] }) : null;
-}
+// The predicate GRAMMAR lives in ./membership-predicate — one parser, shared with
+// R05's config sanitizer (task 1003094). It used to be written twice, as a shape
+// regex there and a parse regex here, pinned only by a property test; the moment
+// the grammar gained a rule a regex cannot express (`+` is legal only on a rank
+// that HAS a ladder position) two hand-written copies became the same drift that
+// produced the bug this fixes. Read that file for the grammar and the reasoning.
+const { parseMembershipPredicate } = require('./membership-predicate');
 
 // The resolve entry point: constitution board block -> the live member list, as
 // a frozen array of { builder_id, github_login, display_name } rows sorted by
@@ -60,7 +51,7 @@ function parseMembershipPredicate(predicate) {
 async function resolveBoardMembers(board) {
   const parsed = parseMembershipPredicate(board && board.membership);
   if (!parsed) return Object.freeze([]); // unparseable predicate → nobody governs
-  const rows = await db.getActiveBuildersWithRank(parsed.rankKey);
+  const rows = await db.getActiveBuildersWithRank(parsed.rankKeys);
   return Object.freeze(rows.map((r) => Object.freeze({
     builder_id: String(r.builder_id),
     github_login: r.github_login,
@@ -75,11 +66,20 @@ async function isBoardMember(builderId, board) {
   if (builderId === null || builderId === undefined || builderId === '') return false;
   const parsed = parseMembershipPredicate(board && board.membership);
   if (!parsed) return false;
-  return db.builderHoldsRankActive(builderId, parsed.rankKey);
+  return db.builderHoldsRankActive(builderId, parsed.rankKeys);
+}
+
+// Would `builderId` sit on the board under this PROPOSED board block? Same
+// question as isBoardMember, named for its one caller — R14's disenfranchisement
+// guard (board.js) — so the intent is legible where it is used and nobody has to
+// infer "we are asking about a constitution that is not in force yet".
+async function wouldBeBoardMember(builderId, proposedBoard) {
+  return isBoardMember(builderId, proposedBoard);
 }
 
 module.exports = {
   parseMembershipPredicate,
   resolveBoardMembers,
   isBoardMember,
+  wouldBeBoardMember,
 };

package/modules/government/board.js

@@ -48,7 +48,12 @@ const db = require('./db');
 // load and un-patchable).
 const governmentConfig = require('./config');
 const { loadGovernmentConfig, PASS_RULES, MAX_WINDOW_MINUTES } = governmentConfig;
-const { isBoardMember, resolveBoardMembers, parseMembershipPredicate } = require('./board-membership');
+const {
+  isBoardMember, resolveBoardMembers, parseMembershipPredicate, wouldBeBoardMember,
+} = require('./board-membership');
+// describeMembership renders a predicate in the words the proposer was thinking
+// in ("metic and above"), for the disenfranchisement refusal (task 1003094).
+const { describeMembership } = require('./membership-predicate');
 
 // ADR 0175 §5: the completeness bar a Full Idea must clear to reach the board.
 // Held equal to economy's IDEA_FULL_PASS_BAR by test — see the header.
@@ -462,7 +467,15 @@ function validateProposedConstitution(raw) {
     if (!known.includes(k)) return { ok: false, reason: 'unknown_field', field: k };
   }
   if (!parseMembershipPredicate(raw.membership)) {
-    return { ok: false, reason: 'bad_membership', expected: "the predicate grammar rank:<key>" };
+    return {
+      ok: false,
+      reason: 'bad_membership',
+      // The refusal TEACHES the grammar, because the person hitting it is trying
+      // to write a constitution and the commonest reason to land here since task
+      // 1003094 is reaching for "and above" — the exact thing that used to be
+      // inexpressible and cost an Archon their own board seat.
+      expected: 'rank:<key> (exactly that rank), rank:<key>+ (that rank and above, standard ranks only), or a comma list such as rank:metic,archon',
+    };
   }
   if (!PASS_RULES.includes(raw.pass_rule)) {
     return { ok: false, reason: 'bad_pass_rule', expected: PASS_RULES };
@@ -493,10 +506,51 @@ function validateProposedConstitution(raw) {
 // anti-self note). Concurrent amendment windows are legal like any concurrent
 // windows; applies land in close order and the last close wins, deterministic
 // because applyBoardAmendment rewrites the whole block.
-async function proposeAmendment({ proposal, rationaleMd = null, proposedBy } = {}) {
+async function proposeAmendment({
+  proposal, rationaleMd = null, proposedBy, acknowledgeSelfRemoval = false,
+} = {}) {
   const v = validateProposedConstitution(proposal);
   if (!v.ok) return { ok: false, ...v };
   if (proposedBy == null || proposedBy === '') return { ok: false, reason: 'missing_proposer' };
+
+  // ── THE DISENFRANCHISEMENT GUARD (task 1003094) ──────────────────────────
+  //
+  // A change to the government that removes the person making it is the ONE
+  // shape that cannot self-correct: once it lands they can no longer vote to
+  // change it back. This is not hypothetical — it is what happened on the R25
+  // rehearsal.
+  // An Archon ratified `rank:metic` under monarchy, the apply worked perfectly,
+  // and the next vote came back 403 not_board_member. The board would have
+  // deadlocked at one member, because an Archon can still PROPOSE
+  // (board.item.open floors at metic) but no longer VOTE.
+  //
+  // REFUSE BY DEFAULT, with an explicit acknowledgement to proceed — the owner's
+  // "refuse or loudly confirm". Not a hard ban: handing the franchise to a wider
+  // body and stepping back is a legitimate constitutional act, and a system that
+  // cannot express it is telling owners what they may decide. The flag is a
+  // SEPARATE PARAMETER, never a field on the proposal, so the acknowledgement
+  // never becomes part of the ratified text (validateProposedConstitution
+  // refuses unknown fields, which keeps that honest).
+  //
+  // Checked against the PROPOSED block and the proposer's LIVE rank, per request
+  // and uncached like every other membership read here.
+  if (!acknowledgeSelfRemoval) {
+    const stillSeated = await wouldBeBoardMember(proposedBy, v.proposal);
+    if (!stillSeated) {
+      return {
+        ok: false,
+        reason: 'proposer_would_lose_their_seat',
+        membership: v.proposal.membership,
+        describes: describeMembership(v.proposal.membership),
+        what_this_means:
+          'This amendment would remove YOU from the board. If it passes you could no longer vote — including to undo it. '
+          + 'If that is deliberate, re-submit with acknowledge_self_removal.',
+        // The commonest cause, named, because the fix is usually one character.
+        hint: 'A bare rank:<key> means EXACTLY that rank. To keep yourself and everyone above, use rank:<key>+.',
+      };
+    }
+  }
+
   const amendment = await db.createAmendment({ proposed: v.proposal, rationaleMd, proposedBy });
   const { board } = loadGovernmentConfig();
   const item = await db.openBoardItem({

package/modules/government/config.js

@@ -154,13 +154,19 @@ const BOARD_DEFAULTS = Object.freeze({
 // default and what an unreadable value falls back to.
 const PASS_RULES = Object.freeze(['first_ratifier', 'consent']);
 
-// A membership predicate is `rank:<key>` — the only grammar v1 defines. It is NOT
-// validated against catalog.RANK_ORDER on purpose: a project may govern by a CUSTOM
-// rank, and custom ranks are DB rows this file cannot see (checking here would make
-// config authoritative over a live rank list, which is exactly the inversion the
-// header forbids). R06 resolves the predicate against the live ranks and yields an
-// empty board if it names nothing — fail-closed there, shape-checked here.
-const MEMBERSHIP_RE = /^rank:[a-z][a-z0-9_-]*$/;
+// A membership predicate names WHO SITS. The grammar and its parser live in
+// ./membership-predicate — ONE implementation, shared with R06's resolver
+// (board-membership.js). They used to be two hand-written regexes pinned only by
+// a property test; task 1003094 added a rule a regex cannot express (`+` is legal
+// only on a rank that HAS a ladder position), and two copies of a rule with a
+// lookup in it is precisely the drift that produced the bug that task fixes.
+//
+// Still NOT validated against a live rank list, and that is unchanged: a project
+// may govern by a CUSTOM rank, which is a DB row this file cannot see. Checking
+// that here would make config authoritative over the live ranks — the inversion
+// the header forbids. R06 resolves against the real rows and yields an empty
+// board if the predicate names nobody: fail-closed there, shape-checked here.
+const { isMembershipPredicate } = require('./membership-predicate');
 
 // A sitting longer than a week is indistinguishable from no clock at all, and a
 // zero/negative window would close every item the instant it opened. Both are far
@@ -178,7 +184,7 @@ const MAX_WINDOW_MINUTES = 7 * 24 * 60;
 // config cannot quietly enfranchise anyone or lower the bar.
 function sanitizeBoard(raw) {
   const r = isObj(raw) ? raw : {};
-  const membership = typeof r.membership === 'string' && MEMBERSHIP_RE.test(r.membership)
+  const membership = typeof r.membership === 'string' && isMembershipPredicate(r.membership)
     ? r.membership
     : BOARD_DEFAULTS.membership;
   const passRule = PASS_RULES.includes(r.pass_rule) ? r.pass_rule : BOARD_DEFAULTS.pass_rule;

package/modules/government/db.js

@@ -252,31 +252,42 @@ async function unassignRank({ builderId, rankKey }) {
 //     that is circumstance, not a rule; this makes it structural, mirroring the
 //     resolver's principal-key drop (R98).
 
-async function getActiveBuildersWithRank(rankKey) {
+// Both reads take a SET of rank keys, not one key (task 1003094). The board
+// predicate grammar gained `rank:metic+` (ladder) and `rank:a,b` (union), and
+// board-membership.js resolves every form — including the bare one — to a set.
+// `= ANY($1)` is the whole change; the exact-match behaviour of a one-element
+// set is byte-identical to the old `= $1`, which is why no ratified constitution
+// changes meaning.
+//
+// DISTINCT is deliberate and not defensive noise: a set can now match a builder
+// through more than one key, and government_builder_ranks does not structurally
+// forbid a second row. Without it a member could be counted twice in the tally's
+// denominator, which silently raises the bar a consent vote has to clear.
+async function getActiveBuildersWithRank(rankKeys) {
   const { rows } = await pool.query(
-    `SELECT br.builder_id, b.github_login, b.display_name
+    `SELECT DISTINCT br.builder_id, b.github_login, b.display_name
        FROM government_builder_ranks br
        JOIN builders b ON b.id = br.builder_id
-      WHERE br.rank_key = $1
+      WHERE br.rank_key = ANY($1)
         AND b.status = 'active'
         AND b.system_role IS NULL
       ORDER BY br.builder_id`,
-    [rankKey],
+    [rankKeys],
   );
   return rows;
 }
 
-async function builderHoldsRankActive(builderId, rankKey) {
+async function builderHoldsRankActive(builderId, rankKeys) {
   const { rows } = await pool.query(
     `SELECT 1
        FROM government_builder_ranks br
        JOIN builders b ON b.id = br.builder_id
       WHERE br.builder_id = $1
-        AND br.rank_key = $2
+        AND br.rank_key = ANY($2)
         AND b.status = 'active'
         AND b.system_role IS NULL
       LIMIT 1`,
-    [builderId, rankKey],
+    [builderId, rankKeys],
   );
   return rows.length > 0;
 }

package/modules/government/membership-predicate.js

@@ -0,0 +1,115 @@
+'use strict';
+
+// modules/government/membership-predicate.js — the board membership predicate
+// GRAMMAR, in one place (task 1003094).
+//
+// WHY THIS FILE EXISTS AT ALL. The grammar was previously written TWICE: a
+// shape regex in config.js (R05's sanitizer) and a parse regex in
+// board-membership.js (R06's resolver), pinned together only by a property test
+// asserting "config keeps it ⇔ the resolver parses it". That worked while the
+// grammar was one literal form. It stops working the moment the grammar has a
+// rule the regex alone cannot express — and this change adds exactly that: `+`
+// is legal only on a rank that HAS a ladder position, which is a lookup, not a
+// character class. Two hand-written copies of a rule with a lookup in it is the
+// same drift that produced the bug this task fixes. So: one parser, two callers.
+//
+// PURE, and requires only ./catalog (which requires nothing), so config.js can
+// use it during boot without dragging in the DB layer.
+//
+// ── THE GRAMMAR ──────────────────────────────────────────────────────────────
+//
+//   rank:metic          exactly metic                       (v1 form, unchanged)
+//   rank:metic+         metic and every rank above it       (ladder)
+//   rank:metic,archon   exactly these ranks                 (union)
+//   rank:xenos+,ops     the ladder from xenos, plus a custom rank
+//
+// THE BUG IT FIXES. v1 defined only `rank:<key>` and resolved it with an EXACT
+// SQL match, so `rank:metic` seated metics ONLY and excluded Archons,
+// `rank:xenos` seated NEWCOMERS ONLY rather than "everyone", and "Metic and
+// above" could not be said at all. On a real-Postgres rehearsal an Archon
+// ratified `rank:metic` and was immediately 403'd off their own board.
+//
+// A BARE KEY STILL MEANS EXACTLY THAT KEY — the owner's decision (2026-08-18),
+// and the reason this change is meaning-preserving: no constitution already on
+// disk, including the shipped monarchy default `rank:archon`, resolves to a
+// different board after an upgrade. Redefining the bare form as "and above"
+// would have silently rewritten every ratified constitution in the fleet.
+//
+// `+` IS DEFINED ONLY ON THE STANDARD LADDER. RANK_ORDER is the four-rung
+// standard ladder; a project's CUSTOM ranks are DB rows with no position on it.
+// "Metic and above" is a real question; "and above" about a rank that sits on no
+// ladder is not, so `rank:some-custom+` is a REFUSAL rather than a guess. A bare
+// custom key is unaffected and still resolves against live rows.
+//
+// FAIL-CLOSED: anything unparseable yields null, and every caller must read null
+// as NOBODY. An unrecognised predicate must never widen the franchise.
+
+const { RANK_ORDER } = require('./catalog');
+
+const PREFIX = 'rank:';
+// One element: a rank key, optionally suffixed `+`.
+const ELEMENT_RE = /^([a-z][a-z0-9_-]*)(\+?)$/;
+
+// Expand one element to the keys it names, or null if it names nothing sayable.
+function expandElement(key, plus) {
+  if (!plus) return [key];
+  const i = RANK_ORDER.indexOf(key);
+  if (i === -1) return null;              // no ladder position → no "above"
+  return RANK_ORDER.slice(i);
+}
+
+// predicate string -> { rankKeys } (frozen, deduped, deterministic) or null.
+//
+// The answer is always a SET, including for the bare single-rank form — a
+// one-element set resolves byte-identically to the old exact match, which is
+// what keeps existing constitutions meaning what they meant.
+function parseMembershipPredicate(predicate) {
+  if (typeof predicate !== 'string') return null;
+  if (!predicate.startsWith(PREFIX)) return null;
+  const body = predicate.slice(PREFIX.length);
+  if (body === '') return null;
+
+  const keys = [];
+  for (const element of body.split(',')) {
+    const m = ELEMENT_RE.exec(element);
+    if (!m) return null;
+    const expanded = expandElement(m[1], m[2] === '+');
+    if (expanded === null) return null;
+    for (const k of expanded) if (!keys.includes(k)) keys.push(k);
+  }
+  if (keys.length === 0) return null;
+  return Object.freeze({ rankKeys: Object.freeze(keys) });
+}
+
+// The shape gate R05's sanitizer needs. Same function, boolean-shaped — so the
+// sanitizer and the resolver can never disagree about what is legal, because
+// there is nothing left for them to disagree with.
+function isMembershipPredicate(predicate) {
+  return parseMembershipPredicate(predicate) !== null;
+}
+
+// Human phrasing for a predicate, for the surfaces that must tell an owner what
+// they are about to enact (R14's guard message, and the charter library in task
+// 1003095). Returns null for an unparseable predicate rather than inventing
+// reassuring prose about something that seats nobody.
+function describeMembership(predicate) {
+  const parsed = parseMembershipPredicate(predicate);
+  if (!parsed) return null;
+  const keys = parsed.rankKeys;
+  if (keys.length === 1) return `exactly ${keys[0]}`;
+  // A contiguous run up the standard ladder reads as "X and above" — the way the
+  // person who typed `metic+` was thinking about it.
+  const i = RANK_ORDER.indexOf(keys[0]);
+  const isLadderRun = i !== -1
+    && keys.length === RANK_ORDER.length - i
+    && keys.every((k, n) => k === RANK_ORDER[i + n]);
+  if (isLadderRun) return `${keys[0]} and above (${keys.join(', ')})`;
+  return keys.join(', ');
+}
+
+module.exports = {
+  RANK_ORDER,
+  parseMembershipPredicate,
+  isMembershipPredicate,
+  describeMembership,
+};

package/modules/government/routes/government.js

@@ -461,6 +461,10 @@ module.exports = function buildGovernmentRouter() {
       subject_type: { required: true, type: 'string', maxLength: 32 },
       proposal: { required: true, type: 'object' },
       rationale_md: { type: 'string', maxLength: 5000 },
+      // Task 1003094's disenfranchisement guard. A SEPARATE FIELD, never part of
+      // `proposal` — validateProposedConstitution refuses unknown fields, so the
+      // acknowledgement can never leak into the text the board ratifies.
+      acknowledge_self_removal: { type: 'boolean' },
     })) return;
     if (req.body.subject_type !== 'constitutional_amendment') {
       return res.fail('subject_opens_automatically', 409, {
@@ -473,8 +477,23 @@ module.exports = function buildGovernmentRouter() {
         proposal: req.body.proposal,
         rationaleMd: req.body.rationale_md ?? null,
         proposedBy: req.builder.id,
+        acknowledgeSelfRemoval: req.body.acknowledge_self_removal === true,
       });
       if (!out.ok) {
+        // The self-removal refusal is a CONFLICT with live state, not a malformed
+        // body — the proposal is perfectly valid, it just would unseat its author.
+        // It carries prose the hall shows verbatim, so it gets its own code and
+        // keeps its explanatory fields rather than being flattened into the
+        // generic invalid_proposal envelope.
+        if (out.reason === 'proposer_would_lose_their_seat') {
+          return res.fail('proposer_would_lose_their_seat', 409, {
+            membership: out.membership,
+            describes: out.describes,
+            what_this_means: out.what_this_means,
+            hint: out.hint,
+            retry_with: { acknowledge_self_removal: true },
+          });
+        }
         return res.fail('invalid_proposal', 400, { reason: out.reason, ...(out.field ? { field: out.field } : {}), ...(out.expected ? { expected: out.expected } : {}) });
       }
       res.status(201).json({ ok: true, amendment: out.amendment, item: out.item });

package/modules/hall-ui/public/government.js

@@ -438,12 +438,61 @@
   // switch can never be flipped quietly, and every change is auditable against
   // the constitution of its day.
 
+  // The predicate grammar, in plain language (task 1003094). This MIRRORS
+  // modules/government/membership-predicate.js — browser code cannot import the
+  // server module, the established pattern here (the five section labels do the
+  // same) — and tests/government_board_vote_ui.mjs holds the two equal.
+  //
+  // Rendering the raw predicate was fine while the only form was `rank:<key>`.
+  // It is not fine now: `rank:metic+` would read as "builders holding the metic+
+  // rank", which names a rank that does not exist and hides the very thing the
+  // suffix says. A constitution panel that misdescribes who governs is the
+  // failure this whole task exists to fix, one layer up.
+  const STANDARD_LADDER = ['xenos', 'thetes', 'metic', 'archon'];
+
+  function membershipRankKeys(predicate) {
+    const m = String(predicate || '');
+    if (!m.startsWith('rank:')) return null;
+    const body = m.slice(5);
+    if (!body) return null;
+    const keys = [];
+    for (const element of body.split(',')) {
+      const match = /^([a-z][a-z0-9_-]*)(\+?)$/.exec(element);
+      if (!match) return null;
+      let expanded;
+      if (match[2] === '+') {
+        const i = STANDARD_LADDER.indexOf(match[1]);
+        if (i === -1) return null;        // "and above" is undefined off the ladder
+        expanded = STANDARD_LADDER.slice(i);
+      } else {
+        expanded = [match[1]];
+      }
+      for (const k of expanded) if (keys.indexOf(k) === -1) keys.push(k);
+    }
+    return keys.length ? keys : null;
+  }
+
   function membershipSentence(board) {
-    const m = String(board.membership || '');
-    const rank = m.startsWith('rank:') ? m.slice(5) : null;
-    return rank
-      ? `Every active builder holding the <strong>${escapeHtml(rank)}</strong> rank sits on the board — membership follows the rank, live.`
-      : `Membership predicate: <code>${escapeHtml(m || 'unset')}</code>.`;
+    const raw = String(board.membership || '');
+    const keys = membershipRankKeys(raw);
+    if (!keys) {
+      // Fail-closed on the surface too: an unparseable predicate seats NOBODY
+      // server-side, and saying so is the whole point — an empty board is loud
+      // and fixable, a board described as working is neither.
+      return `Membership predicate <code>${escapeHtml(raw || 'unset')}</code> cannot be read, so <strong>nobody</strong> sits on the board until it is corrected.`;
+    }
+    const strong = keys.map((k) => `<strong>${escapeHtml(k)}</strong>`);
+    if (keys.length === 1) {
+      return `Every active builder holding the ${strong[0]} rank — and only that rank — sits on the board. Membership follows the rank, live.`;
+    }
+    const i = STANDARD_LADDER.indexOf(keys[0]);
+    const isLadderRun = i !== -1
+      && keys.length === STANDARD_LADDER.length - i
+      && keys.every((k, n) => k === STANDARD_LADDER[i + n]);
+    const list = `${strong.slice(0, -1).join(', ')} and ${strong[strong.length - 1]}`;
+    return isLadderRun
+      ? `Every active builder at ${strong[0]} <em>or above</em> sits on the board — that is ${list}. Membership follows the rank, live.`
+      : `Every active builder holding ${list} sits on the board. Membership follows the rank, live.`;
   }
 
   function passRuleSentence(board) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.250",
+  "version": "1.19.252",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.250",
+      "version": "1.19.252",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.250",
+  "version": "1.19.252",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/publish-manifest.js

@@ -62,6 +62,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/autonomy/',
   'modules/security/',
   'modules/government/',     // the same machinery under its post-ADR-0174 name (goal 1000068, task 1003003). Added in lockstep with the protected-surfaces.json entry: publish_manifest asserts every PROTECTED_GLOB is either topology-excluded or publishable, so registering the glob as protected WITHOUT this line default-denies the module from the published core — the open-source methodology would silently lose its permission machinery at the next release.
+  'modules/copy-desk/',      // the artist's loop over user-facing TEXT (goal 1000074, ADR 0178). default:true, so it MUST be here — and note the ASYMMETRY that makes omitting it worse than useless: its hall surface ships regardless, because modules/hall-ui/ is allowlisted as one subtree. A released core carrying the page and the nav entry but not the routes behind them puts a tab in every instance's hall whose every call 404s. The module and its page are only ever added or removed together; tests/publish_manifest.mjs holds that pair.
   'modules/hall-ui/',
   'modules/status-ui/',
   'modules/dev-box/',
@@ -104,6 +105,14 @@ const PUBLISH_ALLOWLIST = [
   'docs/branding-contract.md',
   'docs/branding-fill-prompt.md',
   'docs/design-contract.md',
+  // RUNTIME DATA that happens to live under docs/, not documentation (ADR 0178).
+  // modules/copy-desk reads the registry on EVERY queue load, and nothing on a
+  // deployed box regenerates it — copy-inventory.js is a commit-it generator run
+  // against a source tree, which an instance does not have. Omit these and a
+  // released instance answers 503 registry_missing forever. They sit under docs/
+  // only because that is where their generator has always written them.
+  'docs/copy-registry.json',
+  'docs/copy-inventory.md',          // the human twin, generated in the same pass
   'docs/file-map.md',
   'docs/repo-map.md',
   'docs/handoff-template.md',         // the portable session-handoff format (methodology)

package/scripts/gds/run-unit-tests.js

@@ -90,6 +90,11 @@ const INTEGRATION = new Set([
   // DB-free lane, where they only "passed" because they self-skip. The pairing guard
   // is in tests/government_live_proof_shape.mjs — every curated entry must name a
   // real test file.
+  // task 1003094: the board FRANCHISE against real SQL. The DB-free sibling covers
+  // the grammar; this covers what the task actually changed — the ANY() rewrite,
+  // the DISTINCT, and that a deactivated builder or a machine principal still
+  // never governs under the widened predicate.
+  'government_board_membership_db',
   'government_fold_bench', 'government_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent', 'reward_mode_cost_plus_only',
   'scouting_rollup_fanout', 'session_records', 'setup_smoke',

package/src/module-api.js

@@ -927,8 +927,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.248 with no explicit bump. run 32199293372. (task 1002620)
 //   1.19.250 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.249 with no explicit bump. run 32203357427. (task 1002620)
+//   1.19.251 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.250 with no explicit bump. run 32204008770. (task 1002620)
+//   1.19.252 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.251 with no explicit bump. run 32205191350. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.250'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.252'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');