@bongos/core 1.19.251 → 1.19.253

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.251",
-  "core_contract": "1.19.251",
-  "source_commit": "d89b9fafaf741c2fa17cad6de936eea18cd0d1db",
+  "core_version": "1.19.253",
+  "core_contract": "1.19.253",
+  "source_commit": "7e98077a8a33b1ef861ab40823c1db64acffc71d",
   "source_ref": "HEAD",
-  "built_at": "2026-08-19T01:11:44.193Z",
+  "built_at": "2026-08-19T01:42:12.781Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 314,
+    "docs_redacted": 315,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1343,
+    "functional_verbatim": 1345,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1679,
-  "tree_sha256": "de0863a7402974903d0ab48444c31aacf315f5a9c366b0c987aeab1ca945809f",
+  "file_count": 1682,
+  "tree_sha256": "942f711051e57b17995dbd18b2ee81dee4466440acb5c3559659f72b4e0291ba",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "14023727fa9eea325fb6ae784d9edea291c228d19e4966618a3d953191a8ef2d"
+      "sha256": "1c790a9dca384a70cba29ba814cff546cdd69eb784f512fb88e06c336b3f75a9"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1374,20 +1374,25 @@
       "mode": "0000644",
       "sha256": "36f95e2bd77c310e1be3632e9b9d84bf014d4d51ae73b450365ed353fefa8923"
     },
+    {
+      "path": "docs/adr/0179-board-membership-predicate-grammar.md",
+      "mode": "0000644",
+      "sha256": "782900e7a2e49c14d7796d94e2b63493659e3c6c3ad8eb8bd721fa589307612b"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "745dc09cea4db07614901e6744eeb11c12a7f45711a40cf35c777315452baf2e"
+      "sha256": "bf9dddba0e72ab43ee6124fbba2a0479f1cb7dfc35ea4005f3382aae98e0066f"
     },
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "b99be08b4c6f2e81b12e3ddf80f4cfaa39423e0c87ff2790857ae16ad755fdc7"
+      "sha256": "3eb89e224eea00629fb69752c7606e9ffed34171ab16fcb82120e030e5db8476"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "1c59dad7ce9c5d20bf2ce8671308b5e66a48516c30dc7b48677b0f0382c39e4b"
+      "sha256": "2fc5bd12b302ff6ef0bc4e0012282bcef8616942c23e9c5f0fbe7c9e6a71d6a9"
     },
     {
       "path": "docs/architecture.md",
@@ -1412,12 +1417,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "016b5c87335bc50708ee19079b9d8c97761f5b6b4b8e340f0e62d041ff528310"
+      "sha256": "46a8ae1438d900645252af1e71da65863b247920899bf9fdb941a7f5f2b09b60"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "b12e7eab2cc00dc0fb5cbee7c1f2b5d95959ea5ff15cd0ce827b3dade3fa9f93"
+      "sha256": "7d1918a10be54cf4fedf58152c50950b89e548a2c5bc8d04a553523b5263058b"
     },
     {
       "path": "docs/design-contract.md",
@@ -2977,12 +2982,12 @@
     {
       "path": "modules/government/board-membership.js",
       "mode": "0000644",
-      "sha256": "5bf474bee95bc8a8982e4a52c9e5b19955a20195dc1affd51c07e99540c8c059"
+      "sha256": "26f212bfb64239e98418618ec3304664180b06f3740b8c4f682f29d3bbf2f3e9"
     },
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "5529a57a4aa92c3e1903764079a6a2b7d7eb3920c2f346e642a2158389f26b5d"
+      "sha256": "e6e01e38328eb6d234c76d7f5aa9e96589fd2c9ef89c105216495303ac1e3fdd"
     },
     {
       "path": "modules/government/catalog.js",
@@ -2992,12 +2997,17 @@
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
-      "sha256": "56bd51c927220b6bc0dc749ad1d591addbed25870e532b8d95da6ba5eab3f763"
+      "sha256": "62fc47cb6775b1af86bf7f22773180b390d584230b87af6bb1ec20a841be57e1"
     },
     {
       "path": "modules/government/db.js",
       "mode": "0000644",
-      "sha256": "d50b12547863df08cf32c606fe91187e1239f5b0d339f9d34ed9f3b5403b3d15"
+      "sha256": "6d85422869793382fc372a43b6a2b745bcb0e8a62c4fec06b780e812ae5066b9"
+    },
+    {
+      "path": "modules/government/membership-predicate.js",
+      "mode": "0000644",
+      "sha256": "57a1054cb3ae65e8b6d9af6657601ea67a20dd658daf442e0fca729165a55461"
     },
     {
       "path": "modules/government/migrations/governance_001_tables.sql",
@@ -3107,7 +3117,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "bf07f55f73d27d738840f4f0e0ffcb8a6d19225e7500dbb36e4a83a1109635db"
+      "sha256": "33f0cf42c404e087a6f3817392299dd2a478f41f748932e108747059b756e703"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -3372,7 +3382,7 @@
     {
       "path": "modules/hall-ui/public/government.js",
       "mode": "0000644",
-      "sha256": "b1de692afb7abb2bd95a91a31d7c8d244c9a9f702c8ab3d73214bb23472614ec"
+      "sha256": "7f8a1ab330391d564e88420fc3577e861869269e71eccaec4d1924f9544b5889"
     },
     {
       "path": "modules/hall-ui/public/hall-kit.js",
@@ -4422,12 +4432,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "535b4a19c6a99a76e5a1b1f0e9e75c823fbc21ae2f723725e15c17b3a09ae071"
+      "sha256": "ade08bd4afada8f234fdb5bd155ad37628bc01040f76de7a378356d338933721"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "e9c3b8dfa23a5939ea668294ae412a68d6d942b51dac0e45974ae907e1ce0ac8"
+      "sha256": "2278bb9510a79406d9ee34e9662df8a81273343075d382d7241b0f360650d199"
     },
     {
       "path": "public-docs/index.html",
@@ -5417,7 +5427,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "dd83af498409b0891ed6cd4de5906a182215040733aae677cee6f26e39d81177"
+      "sha256": "96e8495ffded28083ba458e8d527c5ba25793a20d5f4c0fee5160cff778f4def"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -6047,7 +6057,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "30a0333bfdafb9e52847ae650feb723ed4a912bbec29a5f8e5a29f6ad204cdbb"
+      "sha256": "a12419c00b425a6b98a646cb98e5d20584863185779453e88c52c7036ac1ff62"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6992,7 +7002,7 @@
     {
       "path": "tests/government_board_amendment.mjs",
       "mode": "0000644",
-      "sha256": "7b20463f4d0940c43a5555a7b63d156202d334477267b7d2bc045e27e964d253"
+      "sha256": "54b0d380414a077b072080760a24cfc813d22249f8786b96003ab2e010081b4d"
     },
     {
       "path": "tests/government_board_close.mjs",
@@ -7007,7 +7017,12 @@
     {
       "path": "tests/government_board_membership.mjs",
       "mode": "0000644",
-      "sha256": "1a6f90e319c88ecd3e5588d5a6df44a9848c0adf08efd13bfcc52ac99e84d5d0"
+      "sha256": "aa36727bb3fe750783f0adb82235fa7b2e5b1013c01b773a12d2dff6f0c5ce78"
+    },
+    {
+      "path": "tests/government_board_membership_db.mjs",
+      "mode": "0000644",
+      "sha256": "7da08f5ad67ca1d42d0ef2afb641d1a5f1d5e0c6e0267e8b5f3ad0d275603a36"
     },
     {
       "path": "tests/government_board_view.mjs",
@@ -7017,7 +7032,7 @@
     {
       "path": "tests/government_board_vote.mjs",
       "mode": "0000644",
-      "sha256": "c1b9b0963dde0c033bd0eb411b63032a51edaa3d91751100593b7e3b4999c017"
+      "sha256": "ed31b8c643d2b9279f4d7e70a1f2ab67d8fbe620c1f61ce8496ec858247d7d26"
     },
     {
       "path": "tests/government_board_vote_ui.mjs",
@@ -7037,7 +7052,7 @@
     {
       "path": "tests/government_charter_library.mjs",
       "mode": "0000644",
-      "sha256": "9a52ac8fbbc9e7b0fc4b45841b9dbf831615e5d64eb1e3f0d9c446fc70552629"
+      "sha256": "947af198213dea4f041c7391c1deb28e1db62347d2cbdf18d8be6a4cc252f805"
     },
     {
       "path": "tests/government_claim_eligibility.mjs",
@@ -7052,7 +7067,7 @@
     {
       "path": "tests/government_constitution_view.mjs",
       "mode": "0000644",
-      "sha256": "64fc8006d5b3a562b01a38bfd0ad00a1357969b0ac52ce270e77d4d93eddca80"
+      "sha256": "1fb474588046f937319bde1121f66428300cc0f63e36766ab4543c684a5a09bc"
     },
     {
       "path": "tests/government_fold.mjs",
@@ -7847,7 +7862,7 @@
     {
       "path": "tests/rank_tier_single_source.mjs",
       "mode": "0000644",
-      "sha256": "ab8d36c686f52459d2f751e763ffda9ca7f8ecf7e8376f929cd5feee299557cc"
+      "sha256": "92ab673d4e865c98c9d70ce326b99bee56aab70a3852f2d205af209de8d196ed"
     },
     {
       "path": "tests/rate_limit_public.mjs",

package/clients/bongos-client/index.d.ts

@@ -237,7 +237,7 @@ export interface PostGoalsRequest { version_id: string; title: string; descripti
 export interface PostGoalsResponse { ok: boolean; goal: unknown; succeeds_goal_id: unknown }
 export interface PostGovernmentAssignmentsRequest { builder_id: number; rank_key: string }
 export interface PostGovernmentBoardItemsItemIdVotesRequest { direction: string; reason_md?: string; section_key?: string }
-export interface PostGovernmentBoardItemsRequest { subject_type: string; proposal: Record<string, unknown>; rationale_md?: string }
+export interface PostGovernmentBoardItemsRequest { subject_type: string; proposal: Record<string, unknown>; rationale_md?: string; acknowledge_self_removal?: boolean }
 export interface PostGovernmentBoardItemsResponse { ok: boolean; amendment: unknown; item: unknown }
 export interface PostGovernmentRanksRankKeyResetResponse { ok: boolean; rank_key: unknown; seeded_rank: unknown; permission_count: unknown }
 export interface PostGovernmentRanksRequest { rank_key: string; label: string; description?: string }

package/docs/adr/0179-board-membership-predicate-grammar.md

@@ -0,0 +1,113 @@
+# 0179 — `rank:metic+` means metic and above; a bare `rank:metic` still means exactly metic
+
+- **Status:** Accepted
+- **Date:** 2026-08-19
+- **Tasks:** [#1003094](https://cloudbongos.com/builders#/task/1003094) (goal 1000069, the Board Room). Blocks R25's sign-off ([#1003038](https://cloudbongos.com/builders#/task/1003038)); unblocks the charter-library fix ([#1003095](https://cloudbongos.com/builders#/task/1003095))
+- **Amends:** [ADR 0175](<redacted>.md) §7 — the constitution's `board.membership` predicate
+- **Related:** ADR 0016 (authority server-side, per request, uncached), 0034 (rank inheritance), 0174 (ranks are ranks), 0083 (a module may not import a sibling)
+
+## Context
+
+ADR 0175 gave the constitution a membership predicate with exactly one form, `rank:<key>`, resolved by
+`WHERE rank_key = $1`. An **exact** match. So:
+
+- `rank:metic` seated metics **only** — Archons excluded;
+- `rank:xenos` seated **newcomers only**, not "everyone";
+- **"Metic and above" was inexpressible.**
+
+Everywhere else in this system a rank is a **ladder** and authority is cumulative — ADR 0034's
+inheritance, the floor-derived permission seed, `requireRank('metic','archon')`. Board membership was
+the single place `rank:X` meant *exactly* X, and nothing said so.
+
+Rehearsing R25 end to end on a real Postgres found what that costs. An Archon proposed and ratified
+`{membership: 'rank:metic', pass_rule: 'consent', …}` under the day-one monarchy. The apply worked
+perfectly; the live constitution flipped. Then they tried to vote on the next Full Idea:
+
+```
+POST /government/board/items/7/votes  →  403 { code: 'not_board_member' }
+```
+
+**The owner flipped the switch and fell off their own board.** The escape hatch that saved the sandbox
+is itself the diagnosis: an Archon can still *propose* (`board.item.open` floors at metic) but not
+*vote*, so the board would have deadlocked at one member with no one able to undo it.
+
+The charter library made the same mistake one layer up — it told owners Direct Democracy was
+selectable today by typing `membership rank:xenos (everyone)`, which seats newcomers only. Its own
+recommended charter, "a consent circle of all trusted members", was not expressible at all.
+
+## Decision
+
+### 1. Explicit grammar — a bare key still means exactly that key
+
+The owner's decision (2026-08-18), recorded on the task. Three forms:
+
+```
+rank:metic          exactly metic                     (v1 form, meaning UNCHANGED)
+rank:metic+         metic and every rank above it     (ladder)
+rank:metic,archon   exactly these ranks               (union)
+rank:xenos+,ops     the ladder from xenos, plus a custom rank
+```
+
+**Rejected — Option 1, redefining the bare form as "and above."** It was the smaller diff and it
+matched every other authority read in the system, which is exactly what made it dangerous: it would
+have silently changed the meaning of every constitution already ratified, including the shipped
+monarchy default, the moment an instance upgraded. **Nothing in a government should change meaning
+without a vote.** Because the bare form is untouched, this whole change is meaning-preserving.
+
+**Rejected — Option 3, keep exact-match and fix only the prose.** Cheapest, and it leaves the ladder
+inconsistency and the foot-gun in place. The library would have had to describe a limitation instead
+of stating a rule.
+
+### 2. `+` is defined only on the standard ladder
+
+`RANK_ORDER` is the four-rung standard ladder; a project's **custom** ranks are DB rows with no
+position on it. "Metic and above" is a real question; "and above" about a rank that sits on no ladder
+is not. So `rank:some-custom+` is a **parse refusal**, not a guess — and a refusal resolves to
+**nobody**, per the module's existing fail-closed rule. A bare custom key is unaffected.
+
+### 3. The grammar is written once
+
+It had been written **twice**: a shape regex in R05's config sanitizer and a parse regex in R06's
+resolver, held together by a property test asserting "config keeps it ⇔ the resolver parses it". That
+is sound while the grammar is one literal form. It stops being sound the moment a rule needs a
+*lookup* — and `+` is a lookup. **Two hand-written copies of a rule containing a lookup is the same
+class of drift that produced this bug**, so both now call one pure module,
+`modules/government/membership-predicate.js` (it requires only `catalog`, so the sanitizer can use it
+during boot without dragging in the DB layer).
+
+### 4. The disenfranchisement guard
+
+A change to the government that removes the person making it is **the one shape that cannot
+self-correct**: once it lands they can no longer vote, including to undo it.
+
+`proposeAmendment` now refuses such a proposal **before any write**, naming the one-character fix
+(`rank:<key>+`). It is overridable with an explicit `acknowledge_self_removal` — the owner's "refuse or
+loudly confirm" — because handing the franchise to a wider body and stepping back is a legitimate
+constitutional act, and a system that cannot express it is telling owners what they may decide. The
+acknowledgement is a **separate parameter, never a proposal field**: the strict validator refuses
+unknown fields, which is what keeps it out of the ratified text.
+
+### 5. The surfaces must describe the franchise they actually have
+
+The hall's Constitution panel rendered the raw predicate, which would have read `rank:metic+` as
+"builders holding the **metic+** rank" — naming a rank that does not exist and hiding what the suffix
+does. **A panel that misdescribes who governs is this same bug one layer up**, so it now renders every
+form in plain language, and says plainly that an unreadable predicate seats nobody.
+
+## Consequences
+
+- **No ratified constitution changes meaning.** A one-element rank set queries byte-identically to the
+  old exact match. `rank:archon` — the shipped default — resolves to the same board it always did.
+- **The two DB reads take a set** (`= ANY($1)`), with **DISTINCT**: a set can now match a builder
+  through more than one key, and a double-counted member silently raises the bar a consent vote must
+  clear.
+- **The structural filters had to survive the rewrite**, and are tested against a real Postgres: a
+  deactivated builder and a machine principal still never govern. A widened franchise that also admits
+  a bot would be a worse bug than the one being fixed.
+- **The parse result shape changed** from `{ rankKey }` to `{ rankKeys }`. Deliberate rather than
+  cosmetic — a caller reading "the" key was reading a single-rank assumption that is no longer true.
+- **Task 1003095 can now write the TRUE predicate for each charter** — Direct Democracy becomes
+  `rank:xenos+`, Timocratic Republic `rank:metic+` — rather than rewording around a limitation. That
+  is the sibling fix this ADR unblocks, and it is what makes R26's honesty half pass.
+- **Still not a source of authority truth.** The predicate names ranks; who holds a rank stays a DB
+  row resolved per request, uncached. Nothing here names a builder.

package/docs/adr/README.md

@@ -252,5 +252,6 @@ This keeps the decision history honest and traceable.
 | 0176 | [**Private-repo standup: a per-repo read-only deploy key, minted with the owner's token** ([task 1002735](https://cloudbongos.com/builders#/task/1002735), goal 1000032; walk finding N4, seen live on `mercury` 2026-08-17). A standalone instance's repo is cloned/pushed once with the owner's `repo`-scoped token (ADR 0155), but the durable `origin` rides the shared SSH deploy alias — which GitHub answers "Repository not found" for a private repo it isn't registered on, so every private standup failed at the recurring `git pull --ff-only origin main`, **token or not**. Fix: when the target repo answers *private* to the owner's stored token, provisioning mints the instance its OWN ed25519 deploy key beside the checkout (`.git/cloudbongos-deploy-key` — untracked, survives `git reset --hard`, dies with the checkout), registers it on the repo **read-only** as `cloudbongos-deploy-<slug>` (idempotent by title; a stale same-title key is replaced, never duplicated), then wires the CHECKOUT: `origin` re-pointed at plain `git@github.com` and `core.sshCommand` pinned to the key with `-F /dev/null` so no `~/.ssh/config` identity can shadow it. Public repos take the unchanged shared-alias path; pushes keep preferring the owner-token HTTPS URL (task 1002317), which is why read-only suffices; teardown best-effort revokes by title. Rejected: **GitHub App installation tokens** (hourly expiry means every unattended pull needs a minting sidecar or a hub round-trip) and **registering the shared platform key on the repo** (one shared secret granting the whole platform durable access to private code; per-repo keys keep the blast radius to one repo and are visible to the owner in their own repo settings). Follow-ups: the manage page's flip-to-private stays refused until already-provisioned instances get the same wiring, and builder dev boxes of a private-repo project need their own leg.](<redacted>.md) | provisioning / security |
 | 0177 | [**A goal membership is a `membership_kind`, and the rename ships expand-then-contract** ([task 1003013](https://cloudbongos.com/builders#/task/1003013), goal 1000068). ADR 0174 reserved `role` for the three crafts and enforced it on the GOVERNMENT surface only — by design, since `builders.system_role` and Discord's own noun are legitimate. That left a **fourth** use uncatalogued: `goal_members.role` (`'lead' | 'member'`), the MANAGER predicate behind goal authorization. Renamed to **`membership_kind`** — values unchanged, because the noun was the problem; `rank` is wrong (not a ladder position) and `position` is worse (ADR 0174 uses it as the prose word for a rank, recreating the "rank-role" qualifier collision). A boolean `is_lead` was seriously considered and rejected: the text rename keeps the copied CHECK and stays a reversible change on a live authz column, where `ADD boolean; UPDATE; DROP text` is data-destructive. The migration is **expand-then-contract, never `RENAME COLUMN`** — auto-rollback reverts the code pin and NOT the DB, so `core_220` ADDs the column and keeps the pair in lockstep with a BEFORE trigger (direction decided by which side changed), and a later task DROPs the old column with the `-- forward-unsafe` pragma, a backup, and its own window; no `SET NOT NULL` in step 1, because a static NOT NULL on a column the previous release never heard of is what the forward-safety gate rightly flags. The API field renames with it and carries **no `role` alias** (ADR 0174's Lineage lesson: a time-boxed shim outlives its release), pinned by the test of its absence. The reservation gains a **second narrow wall** rather than a widened first one — line-scoped inside the 5k-line `db.js` to the lines that name `goal_members`, so no allowlist is needed. A **fifth** use (`project_memberships.role`) is catalogued and filed, with this as its pattern.](<redacted>.md) | naming / lifecycle |
 | 0178 | [**The copy desk: a flag carries a judgement, and no column here could ever hold copy** ([task 1003113](https://cloudbongos.com/builders#/task/1003113), R02 of goal 1000074). [ADR 0081](<redacted>.md) made the repo the source of truth for design TOKENS; user-facing TEXT had no equivalent. R01 built the inventory (`copy-inventory.js` → `docs/copy-registry.json`), which answers *what does the product say* but cannot answer *what is wrong with it* — a judgement a person must record. This is that record plus the artist's queue. A new default-on module keyed **`copy-desk`, not `copy`**, for a concrete reason: the branding contract already owns a `copy` block, so the bare word reds the `core carries no module code` fitness check on the English word in `src/branding.js` — and the editorial "copy desk" is the more accurate name anyway. **The reason is required in the route AND in a CHECK constraint**: the route gives a person a usable error, the constraint means no future write path can create the reasonless flag the queue exists to not contain (a pointer with no judgement is *worse* than no flag — it still costs the artist a look). Closing requires a note by the same symmetry, since an unexplained close is indistinguishable from clearing a queue to move a number. The load-bearing decision is **NO LIVE CMS enforced by the schema's SHAPE**: `copy_desk_flags` has no column that could hold replacement text and must never gain one, because that non-goal does not erode via an "add a CMS" commit but via one plausible column, then one plausible read of it — `copy_no_cms.mjs` pins the write surface at exactly two verbs so R03's proposal path changes it in a reviewable diff. Rank is asymmetric: **filing is open to every rank** (the engineer who wrote the toast and the newcomer who could not read the button are the likeliest noticers, and neither is the artist — the reason floor is the quality gate, rank is not), closing is Metic+ **or the author** (withdrawing your own flag is a correction, not triage); nothing gates on craft, since an artist is a craft and not a rank. Duplicates are the only automatic signal (the one of stale/duplicated/off-voice needing no judgement layer) and the count **subtracts settled work**, or it never moves and teaches that the queue is decorative. A vanished target is **reported, never auto-closed** — the id is a hash over the text, so an edit routinely orphans a flag, and closing a human judgement because a hash moved is the family of error ADR 0162 rules out. Deliberately reports **no `generated_at`**: R01's contract is determinism, so a clock is the one field it cannot carry.](<redacted>.md) | design / artist loop |
+| 0179 | [**`rank:metic+` means metic and above; a bare `rank:metic` still means exactly metic** ([task 1003094](https://cloudbongos.com/builders#/task/1003094), goal 1000069). [ADR 0175](<redacted>.md) gave the constitution ONE membership form, `rank:<key>`, resolved by an EXACT SQL match — so `rank:metic` seated metics ONLY (excluding Archons), `rank:xenos` seated NEWCOMERS ONLY rather than "everyone", and "Metic and above" was inexpressible. Everywhere else a rank is a LADDER and authority is cumulative (ADR 0034 inheritance, requireRank('metic','archon'), the floor-derived seed); board membership was the one place it meant "exactly", and nothing said so. Rehearsing R25 on a real Postgres, an Archon ratified `rank:metic` under monarchy — the apply worked perfectly — and the next vote came back 403 not_board_member: **the owner flipped the switch and fell off their own board**, with the board deadlocked at one member because an Archon can still PROPOSE but no longer VOTE. Owner decision: EXPLICIT GRAMMAR. `rank:metic+` (that rank and above), `rank:metic,archon` (union), and **a bare key still means EXACTLY that key** — rejecting the smaller diff (silently redefining the bare form) precisely because it would have changed the meaning of every already-ratified constitution, the monarchy default included, on upgrade: nothing in a government should change meaning without a vote. `+` is defined only on the STANDARD ladder — "and above" about a custom rank with no ladder position is a parse REFUSAL, not a guess, and a refusal seats nobody. The grammar had been written TWICE (a shape regex in the config sanitizer, a parse regex in the resolver, pinned by a property test) — sound for one literal form, unsound the moment a rule needs a LOOKUP, which is the same class of drift that produced the bug; both now call one pure `membership-predicate.js`. Adds the DISENFRANCHISEMENT GUARD: a proposal that would unseat its own proposer is refused before any write, naming the one-character fix, overridable with an explicit `acknowledge_self_removal` (a separate parameter, never a proposal field) because stepping back is a legitimate act. The two DB reads take a set via `= ANY($1)` + DISTINCT (a double-counted member silently raises the consent bar), the structural filters are re-proven against real Postgres (a deactivated builder and a machine principal still never govern), and the hall panel now describes every form in plain language — rendering `rank:metic+` as "the metic+ rank" would be the same bug one layer up. Unblocks task 1003095, which can now write each charter's TRUE predicate rather than wording around a limitation.](<redacted>.md) | government / the board |
 
 > ⚠️ **Numbering collision (known):** two ADRs share `0008`. The numbers were assigned in parallel sessions before the lock could be enforced. The files are kept under their existing filenames to preserve git history, but the table disambiguates them as `0008-a` / `0008-b`. New ADRs should resume at `0040` to avoid further collisions. (`0024` is also a real on-disk duplicate: the cloneable-repo/local-first-memory ADR and the multi-agent-system-architecture ADR were both numbered `0024` in parallel; both keep their filenames, disambiguated as `0024-a` / `0024-b` like `0008`. Likewise `0025` ended up with two on-disk files — the offsite-backup ADR and the structured-criterion↔task-link ADR — both kept under their existing filenames and disambiguated as `0025-a` / `0025-b`; separately, the BFG ADR had also claimed `0025` on 2026-05-30 and yielded to `0026`. A third happened 2026-06-06: `0036` was claimed in parallel by the builders-subdomain ADR ([#726](https://example.com/builders#/task/726)) and this Discord-channels ADR ([#727](https://example.com/builders#/task/727)); the Discord-channels ADR yielded to `0037`. A fourth landed 2026-06-10: `0044` was claimed in parallel by the palette-replacement ADR and the per-box game-preview ADR ([#897](https://example.com/builders#/task/897)); both keep their filenames, disambiguated as `0044-a` / `0044-b` like `0008`. A fifth was caught pre-land 2026-06-13: `0050` was claimed in parallel by the device-flow-admission ADR ([#1000](https://example.com/builders#/task/1000)) and the sandbox-for-everyone ADR ([#1001](https://example.com/builders#/task/1001)); the latter yielded to `0052` before merging, so there is no `0050` duplicate. A sixth was caught pre-land 2026-06-21: the tool-agnostic-design-layer ADR ([#1375](https://example.com/builders#/task/1375)) first collided at `0079` with the value-gated-autonomous-engagement ADR, then at `0080` with the llm-cache-api-transport ADR (both part of the 0075–0080 LLM-cost-reduction series, landed on `main` in parallel); it yielded to `0081` before merging, so there is no `0079`/`0080` design-layer duplicate. A seventh landed 2026-06-23: `0084` was claimed in parallel by the auto-derived-per-task-rank-floor ADR and the remove-default-spend-cap ADR (task 1499); the rank-floor ADR landed on `main` first, so the spend-cap ADR yielded to `0085`, leaving no `0084` duplicate. An eighth landed 2026-06-27: `0095` was claimed in parallel by the borrowed-memory-and-retrieval-concepts ADR (PR #459, landed first) and the cross-agent-context-management ADR ([#1651](https://example.com/builders#/task/1651), PR #460); both keep their filenames, disambiguated as `0095-a` / `0095-b` like `0008`. These two are companions — `0095-a` adopts the memory/retrieval concepts and explicitly defers the grep-vs-semantic question to `0095-b`.)

package/docs/api/openapi.json

@@ -16483,6 +16483,9 @@
           "rationale_md": {
             "type": "string",
             "maxLength": 5000
+          },
+          "acknowledge_self_removal": {
+            "type": "boolean"
           }
         },
         "required": [

package/docs/api-reference.md

@@ -233,7 +233,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/government/assignments` | `archon` | `builder_id`, `rank_key` | government.manage — assign a CUSTOM rank to a builder. |
 | DELETE | `/api/bongos/government/assignments/:builderId/:rankKey` | `archon` | — | government.manage — remove a custom-rank assignment. |
 | GET | `/api/bongos/government/board/items` | `any-builder` | — | board.vote.cast — the Board Room view: open items with their clock, the OPEN BALLOT, the closed history (R16 of goal 1000069). |
-| POST | `/api/bongos/government/board/items` | `metic+archon` | `subject_type`, `proposal`, `rationale_md` | board.item.open — put an AMENDMENT to the board (R14 of goal 1000069, ADR 0175 §7). |
+| POST | `/api/bongos/government/board/items` | `metic+archon` | `subject_type`, `proposal`, `rationale_md`, `acknowledge_self_removal` | board.item.open — put an AMENDMENT to the board (R14 of goal 1000069, ADR 0175 §7). |
 | POST | `/api/bongos/government/board/items/:itemId/votes` | `any-builder` | `direction`, `reason_md`, `section_key` | board.vote.cast — cast a vote on an open board item (R08 of goal 1000069, ADR 0175). |
 | GET | `/api/bongos/government/constitution` | `any-builder` | — | board.vote.cast — the Constitution view (R18 of goal 1000069): the live board block plus the full amendment history, passed and returned … |
 | GET | `/api/bongos/government/permissions` | `archon` | — | government.manage — the permission catalog + principals, straight from code (the catalog is CODE, not a table); no DB read. |