@bongos/core 1.19.250 → 1.19.252

package/tests/government_board_amendment.mjs

@@ -79,6 +79,10 @@ test('a proposal files the amendment and opens its window under the constitution
   await withDb({
     createAmendment: async (args) => ({ id: '5', proposed: args.proposed, rationale_md: args.rationaleMd, proposed_by: args.proposedBy }),
     openBoardItem: async (args) => { opened = args; return { id: '21', ...args }; },
+    // Task 1003094's disenfranchisement guard asks, before any write, whether the
+    // proposer would still sit under the PROPOSED block. Here they would (the
+    // proposal keeps rank:archon), so the propose proceeds.
+    builderHoldsRankActive: async () => true,
   }, async () => {
     const out = await proposeAmendment({ proposal: CONSENT_90, rationaleMd: 'time to open up', proposedBy: '42' });
     assert.equal(out.ok, true);
@@ -95,12 +99,94 @@ test('an invalid proposal files NOTHING — refused before any write', async ()
   await withDb({
     createAmendment: async () => { throw new Error('must not be reached'); },
     openBoardItem: async () => { throw new Error('must not be reached'); },
+    builderHoldsRankActive: async () => true,
   }, async () => {
     assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'majority' }, proposedBy: '42' })).ok, false);
     assert.equal((await proposeAmendment({ proposal: CONSENT_90, proposedBy: null })).reason, 'missing_proposer');
   });
 });
 
+// ── the disenfranchisement guard (task 1003094) ──────────────────────────────
+//
+// The shape that cannot self-correct: an amendment that removes the person
+// making it. Once it lands they can no longer vote — including to undo it. This
+// is not hypothetical. On the R25 rehearsal an Archon ratified `rank:metic`
+// under monarchy, the apply worked perfectly, and the next vote came back 403
+// not_board_member. The board would have deadlocked at one member.
+
+test('a proposal that would unseat its own proposer is REFUSED before any write', async () => {
+  await withDb({
+    createAmendment: async () => { throw new Error('must not be reached — nothing may be written'); },
+    openBoardItem: async () => { throw new Error('must not be reached'); },
+    // The proposer is an Archon; the proposed block seats metics ONLY.
+    builderHoldsRankActive: async (_id, rankKeys) => rankKeys.includes('archon'),
+  }, async () => {
+    const out = await proposeAmendment({
+      proposal: { ...CONSENT_90, membership: 'rank:metic' },
+      proposedBy: '42',
+    });
+    assert.equal(out.ok, false);
+    assert.equal(out.reason, 'proposer_would_lose_their_seat');
+    assert.match(out.what_this_means, /would remove YOU from the board/);
+    assert.match(out.hint, /rank:<key>\+/, 'the refusal names the one-character fix');
+  });
+});
+
+test('the guard is satisfied by the LADDER form — the fix the hint points at', async () => {
+  let wrote = false;
+  await withDb({
+    createAmendment: async (args) => { wrote = true; return { id: '9', proposed: args.proposed }; },
+    openBoardItem: async (args) => ({ id: '31', ...args }),
+    builderHoldsRankActive: async (_id, rankKeys) => rankKeys.includes('archon'),
+  }, async () => {
+    const out = await proposeAmendment({
+      proposal: { ...CONSENT_90, membership: 'rank:metic+' },
+      proposedBy: '42',
+    });
+    assert.equal(out.ok, true, 'metic-and-above keeps the Archon seated, so the proposal proceeds');
+    assert.equal(wrote, true);
+  });
+});
+
+test('stepping back is still expressible — with an explicit acknowledgement', async () => {
+  // Deliberately not a hard ban: handing the franchise to a wider body and
+  // stepping back is a legitimate constitutional act, and a system that cannot
+  // express it is telling owners what they may decide.
+  let wrote = false;
+  await withDb({
+    createAmendment: async (args) => { wrote = true; return { id: '10', proposed: args.proposed }; },
+    openBoardItem: async (args) => ({ id: '32', ...args }),
+    builderHoldsRankActive: async () => { throw new Error('the guard must not even ask when acknowledged'); },
+  }, async () => {
+    const out = await proposeAmendment({
+      proposal: { ...CONSENT_90, membership: 'rank:metic' },
+      proposedBy: '42',
+      acknowledgeSelfRemoval: true,
+    });
+    assert.equal(out.ok, true);
+    assert.equal(wrote, true);
+  });
+});
+
+test('the acknowledgement never becomes part of the ratified text', async () => {
+  // It is a separate parameter, not a proposal field — and the strict validator
+  // refuses unknown fields, which is what keeps that honest.
+  const v = validateProposedConstitution({ ...CONSENT_90, acknowledge_self_removal: true });
+  assert.equal(v.ok, false);
+  assert.equal(v.reason, 'unknown_field');
+  assert.equal(v.field, 'acknowledge_self_removal');
+});
+
+test('the bad-membership refusal TEACHES the grammar', () => {
+  // Whoever lands here is trying to write a constitution, and since task 1003094
+  // the commonest reason is reaching for "and above".
+  const v = validateProposedConstitution({ ...CONSENT_90, membership: 'rank:metic++' });
+  assert.equal(v.ok, false);
+  assert.equal(v.reason, 'bad_membership');
+  assert.match(v.expected, /rank:<key>\+/);
+  assert.match(v.expected, /comma list/);
+});
+
 // ── invariants 2+3: the monarchy act, and the subject-typed anti-self ────────
 
 const MONARCHY = Object.freeze({ membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true });
@@ -121,7 +207,7 @@ test('the monarchy act end to end: the sole Archon ratifies their OWN amendment
     let authorAsked = 0;
     await withDb({
       getBoardItemForVote: async () => amendmentItem(),
-      builderHoldsRankActive: async (builderId, rankKey) => builderId === '42' && rankKey === 'archon',
+      builderHoldsRankActive: async (builderId, rankKeys) => builderId === '42' && rankKeys.includes('archon'),
       insertBoardVote: async (args) => { const v = { id: '1', voter_id: args.voterId, direction: args.direction }; votes.push(v); return v; },
       insertVoteKarma: async () => {},
       getVotesForItem: async () => votes,

package/tests/government_board_membership.mjs

@@ -31,12 +31,61 @@ const { parseMembershipPredicate, resolveBoardMembers, isBoardMember } = members
 
 // ── the pure parser ──────────────────────────────────────────────────────────
 
-test('the one v1 grammar parses: rank:<key>', () => {
-  assert.deepEqual(parseMembershipPredicate('rank:archon'), { rankKey: 'archon' });
-  assert.deepEqual(parseMembershipPredicate('rank:metic'), { rankKey: 'metic' });
-  assert.deepEqual(parseMembershipPredicate('rank:triage-helper'), { rankKey: 'triage-helper' },
-    'a CUSTOM rank is legal by shape — whether it seats anyone is the DB\'s answer');
-  assert.deepEqual(parseMembershipPredicate('rank:board_member'), { rankKey: 'board_member' });
+test('a bare rank:<key> still means EXACTLY that key — the meaning-preserving half', () => {
+  // The owner's decision (2026-08-18) was EXPLICIT grammar, not a redefinition:
+  // every constitution already ratified — including the shipped monarchy default
+  // `rank:archon` — must resolve to the same board after an upgrade. Redefining
+  // the bare form as "and above" would have silently rewritten the whole fleet.
+  assert.deepEqual(parseMembershipPredicate('rank:archon'), { rankKeys: ['archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:metic'), { rankKeys: ['metic'] });
+  assert.deepEqual(parseMembershipPredicate('rank:triage-helper'), { rankKeys: ['triage-helper'] },
+    'a CUSTOM rank is legal by shape — whether it seats anyone is the DB answer');
+  assert.deepEqual(parseMembershipPredicate('rank:board_member'), { rankKeys: ['board_member'] });
+});
+
+test('rank:<key>+ means that rank AND ABOVE — the form whose absence unseated an Archon', () => {
+  // THE BUG, in one assertion. Under v1 `rank:metic` was an exact SQL match, so
+  // an Archon who ratified it was 403'd off their own board on the next vote,
+  // and "Metic and above" could not be said at all.
+  assert.deepEqual(parseMembershipPredicate('rank:metic+'), { rankKeys: ['metic', 'archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:xenos+'), { rankKeys: ['xenos', 'thetes', 'metic', 'archon'] },
+    'rank:xenos+ is how you actually say everyone — bare rank:xenos seats NEWCOMERS ONLY');
+  assert.deepEqual(parseMembershipPredicate('rank:archon+'), { rankKeys: ['archon'] },
+    'the top of the ladder and above is just the top — no special case needed');
+});
+
+test('a comma list is an explicit union', () => {
+  assert.deepEqual(parseMembershipPredicate('rank:metic,archon'), { rankKeys: ['metic', 'archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:xenos+,ops'),
+    { rankKeys: ['xenos', 'thetes', 'metic', 'archon', 'ops'] },
+    'the standard ladder and a custom rank compose');
+});
+
+test('a union dedupes and keeps a deterministic order', () => {
+  // The tally denominator is built from this list; a duplicate would raise the
+  // bar a consent vote must clear without anyone amending the constitution.
+  assert.deepEqual(parseMembershipPredicate('rank:metic+,archon'), { rankKeys: ['metic', 'archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:archon,archon'), { rankKeys: ['archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:metic+,xenos+'),
+    { rankKeys: ['metic', 'archon', 'xenos', 'thetes'] },
+    'first occurrence wins its position — deterministic, which is what a denominator needs');
+});
+
+test('+ on a rank with NO ladder position is REFUSED, not guessed', () => {
+  // "Metic and above" is a real question. "and above" about a rank sitting on no
+  // ladder is not, so it fails closed rather than resolving to something
+  // plausible. A BARE custom key is unaffected.
+  assert.equal(parseMembershipPredicate('rank:triage-helper+'), null);
+  assert.equal(parseMembershipPredicate('rank:ops+'), null);
+  assert.equal(parseMembershipPredicate('rank:archon,ops+'), null,
+    'one bad element poisons the whole predicate — a partial franchise is not a safe fallback');
+  assert.deepEqual(parseMembershipPredicate('rank:triage-helper'), { rankKeys: ['triage-helper'] });
+});
+
+test('the parse result is frozen all the way down', () => {
+  const parsed = parseMembershipPredicate('rank:metic+');
+  assert.ok(Object.isFrozen(parsed));
+  assert.ok(Object.isFrozen(parsed.rankKeys), 'a caller must not be able to widen the franchise in place');
 });
 
 test('everything else parses to null — the fail-closed value', () => {
@@ -47,9 +96,15 @@ test('everything else parses to null — the fail-closed value', () => {
     'RANK:ARCHON',                  // grammar is lowercase
     'rank:Archon',
     'role:builder',                 // the rejected role-chamber model — must never parse
-    'rank:archon;metic',            // no lists in v1
+    'rank:archon;metic',            // ';' is not the list separator
     'rank: archon',                 // no whitespace
     'builder:3',                    // naming a PERSON is config-as-authority — refused by shape
+    'rank:archon,',                 // trailing separator
+    'rank:,archon',                 // leading separator
+    'rank:archon,,metic',           // empty element
+    'rank:metic++',                 // one suffix, not a pile
+    'rank:+metic',                  // the suffix is a suffix
+    'rank:metic+archon',            // '+' modifies, it does not join
   ];
   for (const p of junk) {
     assert.equal(parseMembershipPredicate(p), null, `${JSON.stringify(p)} must not parse`);
@@ -89,8 +144,12 @@ const MONARCHY = Object.freeze({ ...BOARD_DEFAULTS });
 
 test('resolveBoardMembers: the happy path — rows come back frozen, ids as strings', async () => {
   await withDb({
-    getActiveBuildersWithRank: async (rankKey) => {
-      assert.equal(rankKey, 'archon', 'the predicate\'s rank key reaches the query verbatim');
+    getActiveBuildersWithRank: async (rankKeys) => {
+      // The db read takes a SET since task 1003094 — every predicate form,
+      // including the bare one, resolves to one. A one-element set queries
+      // byte-identically to the old exact match, which is what keeps every
+      // already-ratified constitution meaning what it meant.
+      assert.deepEqual(rankKeys, ['archon'], 'the predicate rank set reaches the query verbatim');
       return [
         { builder_id: 42n, github_login: 'first-member', display_name: 'First Member' },
         { builder_id: '1000099', github_login: 'second-member', display_name: 'Second Member' },
@@ -117,6 +176,38 @@ test('an unparseable predicate resolves to NOBODY without touching the db', asyn
   });
 });
 
+test('a ladder predicate reaches the query as the whole expanded set', async () => {
+  // The end-to-end shape of the fix: `rank:metic+` must arrive at the SQL as
+  // BOTH metic and archon, or the Archon is off the board exactly as before.
+  let seen = null;
+  await withDb({
+    getActiveBuildersWithRank: async (rankKeys) => {
+      seen = rankKeys;
+      return [{ builder_id: '7', github_login: 'a-metic', display_name: 'A Metic' },
+        { builder_id: '8', github_login: 'an-archon', display_name: 'An Archon' }];
+    },
+  }, async () => {
+    const members = await resolveBoardMembers({ ...MONARCHY, membership: 'rank:metic+' });
+    assert.deepEqual(seen, ['metic', 'archon']);
+    assert.equal(members.length, 2);
+  });
+});
+
+test('THE REGRESSION: an Archon stays on the board under rank:metic+', async () => {
+  // The literal scenario from the R25 rehearsal. Under v1 this returned false
+  // and the owner lost their seat on their own constitution.
+  await withDb({
+    // A faithful stand-in for the real SQL: the builder holds exactly 'archon',
+    // and the query now asks whether that is IN the predicate's set.
+    builderHoldsRankActive: async (builderId, rankKeys) => rankKeys.includes('archon'),
+  }, async () => {
+    assert.equal(await isBoardMember('42', { ...MONARCHY, membership: 'rank:metic+' }), true,
+      'metic-and-above must seat the Archon');
+    assert.equal(await isBoardMember('42', { ...MONARCHY, membership: 'rank:metic' }), false,
+      'and the BARE form must still mean exactly metic — that is the compatibility half');
+  });
+});
+
 test('a predicate naming a rank with no assignments seats an EMPTY board — loud, not widened', async () => {
   await withDb({ getActiveBuildersWithRank: async () => [] }, async () => {
     const members = await resolveBoardMembers({ ...MONARCHY, membership: 'rank:board-of-directors' });
@@ -126,7 +217,7 @@ test('a predicate naming a rank with no assignments seats an EMPTY board — lou
 
 test('isBoardMember: fail-closed on a missing builder id, true only on a live row', async () => {
   await withDb({
-    builderHoldsRankActive: async (builderId, rankKey) => builderId === '42' && rankKey === 'archon',
+    builderHoldsRankActive: async (builderId, rankKeys) => builderId === '42' && rankKeys.includes('archon'),
   }, async () => {
     assert.equal(await isBoardMember('42', MONARCHY), true);
     assert.equal(await isBoardMember('999', MONARCHY), false);

package/tests/government_board_membership_db.mjs

@@ -0,0 +1,150 @@
+// tests/government_board_membership_db.mjs — the board franchise against a REAL
+// Postgres (task 1003094).
+//
+// WHY THIS EXISTS BESIDE THE DB-FREE government_board_membership.mjs. That file
+// covers the pure parser and the resolvers against a stubbed db, which is where
+// the grammar lives. It cannot cover the half this task actually changed: the
+// SQL. `WHERE rank_key = $1` became `WHERE rank_key = ANY($1)` plus a DISTINCT,
+// and a FRANCHISE bug is precisely the kind a stub agrees with and the database
+// does not — the stub returns whatever the test author imagined the query means.
+//
+// What only real SQL can answer:
+//   * does `rank:metic+` genuinely seat the Archon (the regression that cost an
+//     owner their seat on their own constitution);
+//   * do the two STRUCTURAL filters survive the rewrite — a deactivated builder
+//     and a machine principal must still never govern, because a widened
+//     franchise that also admits a bot is a worse bug than the one being fixed;
+//   * does DISTINCT actually hold when a builder matches through two keys — a
+//     double-counted member silently raises the bar a consent vote must clear.
+//
+// It SELF-SKIPS (exit 0) with no reachable Postgres, and is listed in
+// run-unit-tests.js's INTEGRATION set so the DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=postgres://... node tests/government_board_membership_db.mjs
+//
+// It creates its own throwaway `builders` / `government_builder_ranks` rows at
+// ids far above any real row, and deletes them at the end.
+
+import pg from 'pg';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+
+const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`government_board_membership_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}). Set DATABASE_URL to run.`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+let passed = 0, failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL ${name}\n     ${e.message}`); }
+}
+const assert = (await import('node:assert')).strict;
+
+// Minimal stand-ins ONLY when the real tables are absent (throwaway container);
+// against a migrated database these are no-ops and the real tables are used.
+await pool.query(`
+  CREATE TABLE IF NOT EXISTS builders (
+    id bigserial PRIMARY KEY, github_login text, display_name text,
+    status text DEFAULT 'active', system_role text);
+  CREATE TABLE IF NOT EXISTS government_builder_ranks (
+    builder_id bigint, rank_key text);
+`);
+
+// Ids far above any real row, and every login prefixed, so cleanup is exact and
+// this can never touch a real builder or a real rank assignment.
+const B = 990000000;
+const ID = { xenos: B + 1, thetes: B + 2, metic: B + 3, archon: B + 4, gone: B + 5, bot: B + 6, ops: B + 7 };
+const cleanup = async () => {
+  await pool.query('DELETE FROM government_builder_ranks WHERE builder_id >= $1', [B]);
+  await pool.query('DELETE FROM builders WHERE id >= $1', [B]);
+};
+await cleanup();
+await pool.query(`INSERT INTO builders (id, github_login, display_name, status, system_role) VALUES
+  ($1,'gbmdb-x','Xenos','active',NULL),($2,'gbmdb-t','Thetes','active',NULL),
+  ($3,'gbmdb-m','Metic','active',NULL),($4,'gbmdb-a','Archon','active',NULL),
+  ($5,'gbmdb-gone','Deactivated Archon','inactive',NULL),
+  ($6,'gbmdb-bot','A Machine','active','bfg'),
+  ($7,'gbmdb-ops','Custom Ops','active',NULL)`,
+[ID.xenos, ID.thetes, ID.metic, ID.archon, ID.gone, ID.bot, ID.ops]);
+await pool.query(`INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES
+  ($1,'xenos'),($2,'thetes'),($3,'metic'),($4,'archon'),($5,'archon'),($6,'archon'),($7,'gbmdb-ops-rank')`,
+[ID.xenos, ID.thetes, ID.metic, ID.archon, ID.gone, ID.bot, ID.ops]);
+
+const api = require(process.cwd() + '/src/module-api.js');
+api.pool.query = (...a) => pool.query(...a);
+const { resolveBoardMembers, isBoardMember } = require(process.cwd() + '/modules/government/board-membership.js');
+
+const board = (membership) => ({ membership, pass_rule: 'consent', window_minutes: null, close_early_on_full_turnout: true });
+const logins = async (m) => (await resolveBoardMembers(board(m)))
+  .filter((r) => Number(r.builder_id) >= B)          // ignore any real rows on a migrated db
+  .map((r) => r.github_login.replace('gbmdb-', ''));
+
+console.log('the predicate against real SQL');
+
+await t('bare rank:archon is unchanged — exactly archons', async () => {
+  assert.deepEqual(await logins('rank:archon'), ['a']);
+});
+
+await t('THE BUG: bare rank:metic seats metics ONLY (still true, deliberately)', async () => {
+  assert.deepEqual(await logins('rank:metic'), ['m']);
+});
+
+await t('THE FIX: rank:metic+ seats metic AND archon', async () => {
+  assert.deepEqual(await logins('rank:metic+'), ['m', 'a']);
+});
+
+await t('rank:xenos+ is how you say everyone', async () => {
+  assert.deepEqual(await logins('rank:xenos+'), ['x', 't', 'm', 'a']);
+});
+
+await t('bare rank:xenos really does seat NEWCOMERS ONLY — the library\'s lie', async () => {
+  assert.deepEqual(await logins('rank:xenos'), ['x']);
+});
+
+await t('a comma union works, and composes with the ladder', async () => {
+  assert.deepEqual(await logins('rank:metic,archon'), ['m', 'a']);
+  assert.deepEqual(await logins('rank:metic+,gbmdb-ops-rank'), ['m', 'a', 'ops']);
+});
+
+await t('the deactivated and the machine are STILL excluded under the widened form', async () => {
+  // The two structural filters must survive the ANY() rewrite — a widened
+  // franchise that also admits a bot or a departed builder is a worse bug.
+  const l = await logins('rank:xenos+');
+  assert.ok(!l.includes('gone'), 'a deactivated builder never governs');
+  assert.ok(!l.includes('bot'), 'a machine principal never governs');
+});
+
+await t('no duplicate rows when a builder matches through two keys', async () => {
+  await pool.query('INSERT INTO government_builder_ranks (builder_id, rank_key) VALUES ($1, $2)', [ID.archon, 'gbmdb-ops-rank']);
+  try {
+    const l = await logins('rank:archon,gbmdb-ops-rank');
+    assert.deepEqual(l.filter((x) => x === 'a').length, 1,
+      'DISTINCT holds — a double-counted member silently raises the consent bar');
+  } finally {
+    await pool.query("DELETE FROM government_builder_ranks WHERE builder_id=$1 AND rank_key='gbmdb-ops-rank'", [ID.archon]);
+  }
+});
+
+await t('isBoardMember agrees with resolveBoardMembers on every form', async () => {
+  assert.equal(await isBoardMember(ID.archon, board('rank:metic+')), true, 'THE REGRESSION: the Archon keeps their seat');
+  assert.equal(await isBoardMember(ID.archon, board('rank:metic')), false, 'and the bare form still excludes them');
+  assert.equal(await isBoardMember(ID.metic, board('rank:metic+')), true);
+  assert.equal(await isBoardMember(ID.xenos, board('rank:xenos+')), true);
+  assert.equal(await isBoardMember(ID.gone, board('rank:xenos+')), false, 'deactivated');
+  assert.equal(await isBoardMember(ID.bot, board('rank:xenos+')), false, 'machine');
+});
+
+await t('an unparseable predicate still seats nobody against a real db', async () => {
+  assert.deepEqual(await logins('rank:ops+'), [], '+ on a non-ladder rank fails closed');
+  assert.deepEqual(await logins('nonsense'), []);
+});
+
+await cleanup();
+console.log(`\n${passed} passed, ${failed} failed`);
+await pool.end();
+process.exit(failed ? 1 : 0);

package/tests/government_board_vote.mjs

@@ -84,8 +84,10 @@ test('the happy path: a member yes is recorded fresh, with its +1 karma', async
   let insertArgs = null;
   await withDb({
     getBoardItemForVote: async () => openItem(),
-    builderHoldsRankActive: async (builderId, rankKey) =>
-      builderId === '42' && rankKey === 'archon', // the REAL membership parse chose 'archon' from the snapshot
+    builderHoldsRankActive: async (builderId, rankKeys) =>
+      // The db read takes a SET since task 1003094; the REAL membership parse
+      // resolved 'rank:archon' from the snapshot to the one-element set ['archon'].
+      builderId === '42' && rankKeys.includes('archon'),
     getBoardItemAuthor: async () => '7',          // someone else authored the idea
     insertBoardVote: async (args) => { insertArgs = args; return { id: '1', ...args }; },
     insertVoteKarma: async (args) => { karma.push(args); },
@@ -105,7 +107,7 @@ test('membership is the SNAPSHOT\'s rule: a rank the snapshot does not name is r
   // they hold A rank — just not the snapshotted one.
   await withDb({
     getBoardItemForVote: async () => openItem(),
-    builderHoldsRankActive: async (builderId, rankKey) => rankKey === 'metic', // holds metic, not archon
+    builderHoldsRankActive: async (builderId, rankKeys) => rankKeys.includes('metic'), // holds metic, not archon
     getBoardItemAuthor: async () => { throw new Error('must not be reached'); },
     insertBoardVote: async () => { throw new Error('must not be reached'); },
   }, async () => {

package/tests/government_constitution_view.mjs

@@ -86,3 +86,56 @@ test('the read rides the vote atom, and the client renders the SERVER value (sou
   assert.ok(!/'first_ratifier'[^]*hardcod/i.test(client), 'sanity');
   assert.match(client, /loadConstitution\(\)/, 'the panel loads for everyone the page admits');
 });
+
+// ── the hall's membership prose mirrors the server parser (task 1003094) ─────
+//
+// Browser code cannot import the server module (the established pattern here —
+// the five Full Idea section labels are mirrored the same way), so the hall
+// re-implements the predicate grammar to render it in plain language. Two copies
+// of a grammar is exactly the drift that produced the bug this task fixes, so
+// they are held equal here over every form.
+//
+// This matters more than a normal mirror: the Constitution panel is where an
+// owner READS who governs before deciding whether to change it. A panel that
+// misdescribes the franchise is the same failure as a resolver that mis-seats
+// it, one layer up.
+test('the hall renders every predicate form the server actually resolves', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/government.js'), 'utf8');
+
+  // Lift the browser mirror out of the IIFE and run it.
+  const ladder = /const STANDARD_LADDER = (\[[^\]]*\]);/.exec(src);
+  assert.ok(ladder, 'the hall must declare the standard ladder it expands `+` against');
+  const fn = /function membershipRankKeys\(predicate\) \{[\s\S]*?\n  \}/.exec(src);
+  assert.ok(fn, 'membershipRankKeys must be findable — this test lifts it');
+  // eslint-disable-next-line no-new-func
+  const browserKeys = new Function(`const STANDARD_LADDER = ${ladder[1]}; ${fn[0]}; return membershipRankKeys;`)();
+
+  const { parseMembershipPredicate } = require(path.join(ROOT, 'modules/government/membership-predicate.js'));
+
+  const forms = [
+    'rank:archon', 'rank:metic', 'rank:xenos', 'rank:custom-rank',
+    'rank:metic+', 'rank:xenos+', 'rank:archon+',
+    'rank:metic,archon', 'rank:metic+,ops', 'rank:archon,archon',
+    'rank:custom+', 'rank:', 'rank:metic++', 'rank:+metic', 'nonsense', '',
+    'rank:archon,', 'rank:,archon', 'rank:archon,,metic',
+  ];
+  for (const f of forms) {
+    const server = parseMembershipPredicate(f);
+    const browser = browserKeys(f);
+    assert.deepEqual(
+      browser === null ? null : browser,
+      server === null ? null : [...server.rankKeys],
+      `the hall and the server disagree about ${JSON.stringify(f)}`,
+    );
+  }
+});
+
+test('the ladder the hall expands against IS the government ladder', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/government.js'), 'utf8');
+  const { RANK_ORDER } = require(path.join(ROOT, 'modules/government/catalog.js'));
+  const m = /const STANDARD_LADDER = \[([^\]]*)\]/.exec(src);
+  assert.ok(m);
+  const hall = m[1].split(',').map((x) => x.trim().replace(/['"]/g, '')).filter(Boolean);
+  assert.deepEqual(hall, [...RANK_ORDER],
+    'a hall ladder that drifts from catalog.RANK_ORDER renders a franchise nobody has');
+});

package/tests/publish_manifest.mjs

@@ -15,7 +15,15 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+// fs/path/ROOT serve the disk-DERIVED guards at the bottom of this file (task
+// 1003132). They must read the tree rather than a list: an enumerated assertion
+// would miss the next unclassified module exactly as the enumerated allowlist
+// missed the one that prompted them.
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
 
+const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
 const m = require('../scripts/gds/publish-manifest.js');
 const {
@@ -179,6 +187,80 @@ t('every PROTECTED_GLOB is either topology-excluded or publishable (the methodol
     assert.ok(isPublishable(g), `protected surface "${g}" is neither denied nor publishable — re-decide the carve-out`);
   }
 });
+// ── the publish question, asked of the tree itself (task 1003132) ───────────────────
+//
+// THE GAP THESE CLOSE. modules/copy-desk/ was designed, built, tested against a real
+// Postgres, graded, merged and very nearly RELEASED while publishing nothing. Not one
+// of the 429 unit tests, 20+ fitness checks, or the adversarial grader asks the publish
+// question, and the assertions above enumerate representative paths — so a brand-new
+// module key appears in no list and is simply invisible.
+//
+// The failure is worse than "the feature does not ship", because it is ASYMMETRIC: the
+// module's hall page ships anyway (modules/hall-ui/ is one allowlisted subtree), so a
+// release delivers a nav tab and a page whose every API call 404s.
+//
+// Both guards DERIVE from disk. A list here would rot the same way the allowlist did.
+//
+// Modules deliberately not published, on the record. An entry here is a decision
+// someone made, not a gap someone forgot — and every entry needs the task or idea that
+// records the decision, so this can never become a quiet parking lot.
+const KNOWN_UNPUBLISHED_MODULES = new Map([
+  // Same gap as copy-desk, found by the guard below the moment it was written. LATENT
+  // rather than live only because agents is default:false — the day a released instance
+  // enables it, the loader MODULE_NOT_FOUNDs, which is exactly what the provisioning
+  // (task 2135) and platform-identity (task 1002235) allowlist entries exist to prevent.
+  // Left for goal 1000038 rather than fixed here: deciding what the published core
+  // contains for the agents module is that goal's call, not a drive-by from a copy-desk
+  // task. Filed as idea 1000797 with the one-line fix.
+  ['agents', 'idea 1000797'],
+]);
+
+t('every module on disk is either publishable or deliberately unpublished (a new module cannot be silently invisible)', () => {
+  const modulesDir = path.join(ROOT, 'modules');
+  const keys = fs.readdirSync(modulesDir, { withFileTypes: true })
+    .filter((d) => d.isDirectory() && fs.existsSync(path.join(modulesDir, d.name, 'module.json')))
+    .map((d) => d.name);
+  assert.ok(keys.length > 5, `sanity: only ${keys.length} modules found on disk — the scan is broken, not the tree`);
+
+  const unclassified = keys.filter((k) => {
+    const manifest = `modules/${k}/module.json`;
+    return !isPublishable(manifest) && !matchesDeny(manifest) && !KNOWN_UNPUBLISHED_MODULES.has(k);
+  });
+  assert.deepEqual(unclassified, [],
+    'these modules are in neither the allowlist nor a deny list, so they publish NOTHING. Add each to PUBLISH_ALLOWLIST, deny it on the record, or register it in KNOWN_UNPUBLISHED_MODULES with the task that decided it.');
+});
+
+t('every KNOWN_UNPUBLISHED_MODULES entry names a real module and a real decision', () => {
+  // Two ways this exception list rots: an entry outlives the module (and silently
+  // exempts nothing), or an entry outlives the fix (and silently exempts something
+  // already fixed). Both make the guard above weaker than it looks.
+  for (const [key, ref] of KNOWN_UNPUBLISHED_MODULES) {
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules', key, 'module.json')),
+      `KNOWN_UNPUBLISHED_MODULES names "${key}", which is not a module on disk — drop the entry`);
+    assert.ok(/\b(task|idea)\s+\d+/.test(ref),
+      `KNOWN_UNPUBLISHED_MODULES["${key}"] must cite the task or idea that decided it, got "${ref}"`);
+    assert.equal(isPublishable(`modules/${key}/module.json`), false,
+      `"${key}" is now publishable — delete its KNOWN_UNPUBLISHED_MODULES entry so the guard covers it again`);
+  }
+});
+
+t('a hall page named for a module ships only if that module ships (never a tab whose API 404s)', () => {
+  const hallDir = path.join(ROOT, 'modules/hall-ui/public');
+  const modulesDir = path.join(ROOT, 'modules');
+  if (!fs.existsSync(hallDir)) return;
+  const orphans = [];
+  for (const f of fs.readdirSync(hallDir)) {
+    if (!f.endsWith('.html')) continue;
+    const key = f.replace(/\.html$/, '');
+    // Only pages that NAME a module are paired — the hall's own pages (work, goals,
+    // settings…) have no module and are not the subject of this rule.
+    if (!fs.existsSync(path.join(modulesDir, key, 'module.json'))) continue;
+    if (!isPublishable(`modules/${key}/module.json`)) orphans.push(f);
+  }
+  assert.deepEqual(orphans, [],
+    'these hall pages would ship to instances whose backing module does not — a nav tab and a page whose every call 404s. Publish the module, or stop publishing the page.');
+});
+
 t('the topology subset of the protected surfaces is never publishable', () => {
   for (const g of PROTECTED_TOPOLOGY_EXCLUDE) {
     assert.equal(isPublishable(g), false, `topology surface "${g}" must not publish`);

package/tests/rank_tier_single_source.mjs

@@ -107,6 +107,15 @@ const STATIC_LADDER_FILES = [
   'modules/hall-ui/public/ranks.js',
   'modules/hall-ui/public/profile.js',
   'modules/hall-ui/public/watch.js',
+  // task 1003094: the Constitution panel expands the `rank:<key>+` membership
+  // form ("that rank and above") to render who governs in plain language, so it
+  // needs the ladder to expand against. Browser code cannot require the server
+  // module — the established mirror pattern here — and listing it in this array
+  // is what makes the copy provable rather than merely allowed. A second,
+  // government-specific pin lives in tests/government_constitution_view.mjs,
+  // which holds it against catalog.RANK_ORDER and holds the whole browser parser
+  // equal to the server one.
+  'modules/hall-ui/public/government.js',
 ];
 test('static ladder copies carry the exact canonical ladder', () => {
   for (const rel of STATIC_LADDER_FILES) {