@bongos/core 1.19.251 → 1.19.253

package/modules/government/db.js

@@ -252,31 +252,42 @@ async function unassignRank({ builderId, rankKey }) {
 //     that is circumstance, not a rule; this makes it structural, mirroring the
 //     resolver's principal-key drop (R98).
 
-async function getActiveBuildersWithRank(rankKey) {
+// Both reads take a SET of rank keys, not one key (task 1003094). The board
+// predicate grammar gained `rank:metic+` (ladder) and `rank:a,b` (union), and
+// board-membership.js resolves every form — including the bare one — to a set.
+// `= ANY($1)` is the whole change; the exact-match behaviour of a one-element
+// set is byte-identical to the old `= $1`, which is why no ratified constitution
+// changes meaning.
+//
+// DISTINCT is deliberate and not defensive noise: a set can now match a builder
+// through more than one key, and government_builder_ranks does not structurally
+// forbid a second row. Without it a member could be counted twice in the tally's
+// denominator, which silently raises the bar a consent vote has to clear.
+async function getActiveBuildersWithRank(rankKeys) {
   const { rows } = await pool.query(
-    `SELECT br.builder_id, b.github_login, b.display_name
+    `SELECT DISTINCT br.builder_id, b.github_login, b.display_name
        FROM government_builder_ranks br
        JOIN builders b ON b.id = br.builder_id
-      WHERE br.rank_key = $1
+      WHERE br.rank_key = ANY($1)
         AND b.status = 'active'
         AND b.system_role IS NULL
       ORDER BY br.builder_id`,
-    [rankKey],
+    [rankKeys],
   );
   return rows;
 }
 
-async function builderHoldsRankActive(builderId, rankKey) {
+async function builderHoldsRankActive(builderId, rankKeys) {
   const { rows } = await pool.query(
     `SELECT 1
        FROM government_builder_ranks br
        JOIN builders b ON b.id = br.builder_id
       WHERE br.builder_id = $1
-        AND br.rank_key = $2
+        AND br.rank_key = ANY($2)
         AND b.status = 'active'
         AND b.system_role IS NULL
       LIMIT 1`,
-    [builderId, rankKey],
+    [builderId, rankKeys],
   );
   return rows.length > 0;
 }

package/modules/government/membership-predicate.js

@@ -0,0 +1,115 @@
+'use strict';
+
+// modules/government/membership-predicate.js — the board membership predicate
+// GRAMMAR, in one place (task 1003094).
+//
+// WHY THIS FILE EXISTS AT ALL. The grammar was previously written TWICE: a
+// shape regex in config.js (R05's sanitizer) and a parse regex in
+// board-membership.js (R06's resolver), pinned together only by a property test
+// asserting "config keeps it ⇔ the resolver parses it". That worked while the
+// grammar was one literal form. It stops working the moment the grammar has a
+// rule the regex alone cannot express — and this change adds exactly that: `+`
+// is legal only on a rank that HAS a ladder position, which is a lookup, not a
+// character class. Two hand-written copies of a rule with a lookup in it is the
+// same drift that produced the bug this task fixes. So: one parser, two callers.
+//
+// PURE, and requires only ./catalog (which requires nothing), so config.js can
+// use it during boot without dragging in the DB layer.
+//
+// ── THE GRAMMAR ──────────────────────────────────────────────────────────────
+//
+//   rank:metic          exactly metic                       (v1 form, unchanged)
+//   rank:metic+         metic and every rank above it       (ladder)
+//   rank:metic,archon   exactly these ranks                 (union)
+//   rank:xenos+,ops     the ladder from xenos, plus a custom rank
+//
+// THE BUG IT FIXES. v1 defined only `rank:<key>` and resolved it with an EXACT
+// SQL match, so `rank:metic` seated metics ONLY and excluded Archons,
+// `rank:xenos` seated NEWCOMERS ONLY rather than "everyone", and "Metic and
+// above" could not be said at all. On a real-Postgres rehearsal an Archon
+// ratified `rank:metic` and was immediately 403'd off their own board.
+//
+// A BARE KEY STILL MEANS EXACTLY THAT KEY — the owner's decision (2026-08-18),
+// and the reason this change is meaning-preserving: no constitution already on
+// disk, including the shipped monarchy default `rank:archon`, resolves to a
+// different board after an upgrade. Redefining the bare form as "and above"
+// would have silently rewritten every ratified constitution in the fleet.
+//
+// `+` IS DEFINED ONLY ON THE STANDARD LADDER. RANK_ORDER is the four-rung
+// standard ladder; a project's CUSTOM ranks are DB rows with no position on it.
+// "Metic and above" is a real question; "and above" about a rank that sits on no
+// ladder is not, so `rank:some-custom+` is a REFUSAL rather than a guess. A bare
+// custom key is unaffected and still resolves against live rows.
+//
+// FAIL-CLOSED: anything unparseable yields null, and every caller must read null
+// as NOBODY. An unrecognised predicate must never widen the franchise.
+
+const { RANK_ORDER } = require('./catalog');
+
+const PREFIX = 'rank:';
+// One element: a rank key, optionally suffixed `+`.
+const ELEMENT_RE = /^([a-z][a-z0-9_-]*)(\+?)$/;
+
+// Expand one element to the keys it names, or null if it names nothing sayable.
+function expandElement(key, plus) {
+  if (!plus) return [key];
+  const i = RANK_ORDER.indexOf(key);
+  if (i === -1) return null;              // no ladder position → no "above"
+  return RANK_ORDER.slice(i);
+}
+
+// predicate string -> { rankKeys } (frozen, deduped, deterministic) or null.
+//
+// The answer is always a SET, including for the bare single-rank form — a
+// one-element set resolves byte-identically to the old exact match, which is
+// what keeps existing constitutions meaning what they meant.
+function parseMembershipPredicate(predicate) {
+  if (typeof predicate !== 'string') return null;
+  if (!predicate.startsWith(PREFIX)) return null;
+  const body = predicate.slice(PREFIX.length);
+  if (body === '') return null;
+
+  const keys = [];
+  for (const element of body.split(',')) {
+    const m = ELEMENT_RE.exec(element);
+    if (!m) return null;
+    const expanded = expandElement(m[1], m[2] === '+');
+    if (expanded === null) return null;
+    for (const k of expanded) if (!keys.includes(k)) keys.push(k);
+  }
+  if (keys.length === 0) return null;
+  return Object.freeze({ rankKeys: Object.freeze(keys) });
+}
+
+// The shape gate R05's sanitizer needs. Same function, boolean-shaped — so the
+// sanitizer and the resolver can never disagree about what is legal, because
+// there is nothing left for them to disagree with.
+function isMembershipPredicate(predicate) {
+  return parseMembershipPredicate(predicate) !== null;
+}
+
+// Human phrasing for a predicate, for the surfaces that must tell an owner what
+// they are about to enact (R14's guard message, and the charter library in task
+// 1003095). Returns null for an unparseable predicate rather than inventing
+// reassuring prose about something that seats nobody.
+function describeMembership(predicate) {
+  const parsed = parseMembershipPredicate(predicate);
+  if (!parsed) return null;
+  const keys = parsed.rankKeys;
+  if (keys.length === 1) return `exactly ${keys[0]}`;
+  // A contiguous run up the standard ladder reads as "X and above" — the way the
+  // person who typed `metic+` was thinking about it.
+  const i = RANK_ORDER.indexOf(keys[0]);
+  const isLadderRun = i !== -1
+    && keys.length === RANK_ORDER.length - i
+    && keys.every((k, n) => k === RANK_ORDER[i + n]);
+  if (isLadderRun) return `${keys[0]} and above (${keys.join(', ')})`;
+  return keys.join(', ');
+}
+
+module.exports = {
+  RANK_ORDER,
+  parseMembershipPredicate,
+  isMembershipPredicate,
+  describeMembership,
+};

package/modules/government/routes/government.js

@@ -461,6 +461,10 @@ module.exports = function buildGovernmentRouter() {
       subject_type: { required: true, type: 'string', maxLength: 32 },
       proposal: { required: true, type: 'object' },
       rationale_md: { type: 'string', maxLength: 5000 },
+      // Task 1003094's disenfranchisement guard. A SEPARATE FIELD, never part of
+      // `proposal` — validateProposedConstitution refuses unknown fields, so the
+      // acknowledgement can never leak into the text the board ratifies.
+      acknowledge_self_removal: { type: 'boolean' },
     })) return;
     if (req.body.subject_type !== 'constitutional_amendment') {
       return res.fail('subject_opens_automatically', 409, {
@@ -473,8 +477,23 @@ module.exports = function buildGovernmentRouter() {
         proposal: req.body.proposal,
         rationaleMd: req.body.rationale_md ?? null,
         proposedBy: req.builder.id,
+        acknowledgeSelfRemoval: req.body.acknowledge_self_removal === true,
       });
       if (!out.ok) {
+        // The self-removal refusal is a CONFLICT with live state, not a malformed
+        // body — the proposal is perfectly valid, it just would unseat its author.
+        // It carries prose the hall shows verbatim, so it gets its own code and
+        // keeps its explanatory fields rather than being flattened into the
+        // generic invalid_proposal envelope.
+        if (out.reason === 'proposer_would_lose_their_seat') {
+          return res.fail('proposer_would_lose_their_seat', 409, {
+            membership: out.membership,
+            describes: out.describes,
+            what_this_means: out.what_this_means,
+            hint: out.hint,
+            retry_with: { acknowledge_self_removal: true },
+          });
+        }
         return res.fail('invalid_proposal', 400, { reason: out.reason, ...(out.field ? { field: out.field } : {}), ...(out.expected ? { expected: out.expected } : {}) });
       }
       res.status(201).json({ ok: true, amendment: out.amendment, item: out.item });

package/modules/hall-ui/public/government.js

@@ -438,12 +438,61 @@
   // switch can never be flipped quietly, and every change is auditable against
   // the constitution of its day.
 
+  // The predicate grammar, in plain language (task 1003094). This MIRRORS
+  // modules/government/membership-predicate.js — browser code cannot import the
+  // server module, the established pattern here (the five section labels do the
+  // same) — and tests/government_board_vote_ui.mjs holds the two equal.
+  //
+  // Rendering the raw predicate was fine while the only form was `rank:<key>`.
+  // It is not fine now: `rank:metic+` would read as "builders holding the metic+
+  // rank", which names a rank that does not exist and hides the very thing the
+  // suffix says. A constitution panel that misdescribes who governs is the
+  // failure this whole task exists to fix, one layer up.
+  const STANDARD_LADDER = ['xenos', 'thetes', 'metic', 'archon'];
+
+  function membershipRankKeys(predicate) {
+    const m = String(predicate || '');
+    if (!m.startsWith('rank:')) return null;
+    const body = m.slice(5);
+    if (!body) return null;
+    const keys = [];
+    for (const element of body.split(',')) {
+      const match = /^([a-z][a-z0-9_-]*)(\+?)$/.exec(element);
+      if (!match) return null;
+      let expanded;
+      if (match[2] === '+') {
+        const i = STANDARD_LADDER.indexOf(match[1]);
+        if (i === -1) return null;        // "and above" is undefined off the ladder
+        expanded = STANDARD_LADDER.slice(i);
+      } else {
+        expanded = [match[1]];
+      }
+      for (const k of expanded) if (keys.indexOf(k) === -1) keys.push(k);
+    }
+    return keys.length ? keys : null;
+  }
+
   function membershipSentence(board) {
-    const m = String(board.membership || '');
-    const rank = m.startsWith('rank:') ? m.slice(5) : null;
-    return rank
-      ? `Every active builder holding the <strong>${escapeHtml(rank)}</strong> rank sits on the board — membership follows the rank, live.`
-      : `Membership predicate: <code>${escapeHtml(m || 'unset')}</code>.`;
+    const raw = String(board.membership || '');
+    const keys = membershipRankKeys(raw);
+    if (!keys) {
+      // Fail-closed on the surface too: an unparseable predicate seats NOBODY
+      // server-side, and saying so is the whole point — an empty board is loud
+      // and fixable, a board described as working is neither.
+      return `Membership predicate <code>${escapeHtml(raw || 'unset')}</code> cannot be read, so <strong>nobody</strong> sits on the board until it is corrected.`;
+    }
+    const strong = keys.map((k) => `<strong>${escapeHtml(k)}</strong>`);
+    if (keys.length === 1) {
+      return `Every active builder holding the ${strong[0]} rank — and only that rank — sits on the board. Membership follows the rank, live.`;
+    }
+    const i = STANDARD_LADDER.indexOf(keys[0]);
+    const isLadderRun = i !== -1
+      && keys.length === STANDARD_LADDER.length - i
+      && keys.every((k, n) => k === STANDARD_LADDER[i + n]);
+    const list = `${strong.slice(0, -1).join(', ')} and ${strong[strong.length - 1]}`;
+    return isLadderRun
+      ? `Every active builder at ${strong[0]} <em>or above</em> sits on the board — that is ${list}. Membership follows the rank, live.`
+      : `Every active builder holding ${list} sits on the board. Membership follows the rank, live.`;
   }
 
   function passRuleSentence(board) {
@@ -490,15 +539,40 @@
   // config — a rank-predicate membership plus first_ratifier|consent — so nobody
   // is misled about what a settings change can and cannot reach. Source: the
   // Six-Variables synthesis (Verro Labs, Aug 2026), Parts III–IV, via the spec.
+  // EVERY SELECTABLE CHARTER CARRIES A MACHINE-CHECKABLE PREDICATE (task 1003095).
+  //
+  // This library is the ONLY place in the product that tells an owner what to
+  // type. That makes a wrong `how` line worse than no library at all — and two
+  // of them were wrong. Under the pre-1003094 exact-match grammar,
+  // `membership rank:xenos (everyone)` seated NEWCOMERS ONLY: an owner who
+  // followed this page handed the board to the least-trusted tier and locked
+  // themselves out. Timocratic Republic was true as far as it went and silent
+  // about the same surprise.
+  //
+  // So the claim is no longer prose. `predicate` is the exact string an owner
+  // types, and `seatsRanks` is what it must resolve to — checked in
+  // tests/government_charter_library.mjs against the REAL parser
+  // (modules/government/membership-predicate.js), not against a copy of the
+  // intent. If the grammar ever changes underneath this file again, that test
+  // reds instead of the page quietly lying.
+  //
+  // `predicate: null` means the predicate is the owner's to choose (Foundation
+  // names their own custom rank), which is honest rather than unchecked — the
+  // test asserts such a charter says so in its `how`.
   const CHARTERS = [
     { key: 'monarchy', name: 'Monarchy / BDFL', selectable: true,
-      how: "membership rank:archon · first ratifier · no clock — the shipped default",
+      predicate: 'rank:archon', seatsRanks: ['archon'],
+      how: 'membership rank:archon · first ratifier · no clock — the shipped default',
       blurb: 'One trusted executive decides. Fast, legible, and honest at founding scale; the shape every project actually starts in.' },
     { key: 'timocratic-republic', name: 'Timocratic Republic', selectable: true,
-      how: 'membership by a trusted rank (e.g. rank:metic) · consent · a timed sitting',
+      predicate: 'rank:metic+', seatsRanks: ['metic', 'archon'],
+      how: 'membership rank:metic+ (metic and above — Archons included) · consent · a timed sitting',
       blurb: 'Standing accrues to those actively building: the franchise follows earned rank, not headcount.' },
     { key: 'direct-democracy', name: 'Direct Democracy', selectable: true,
-      how: 'membership rank:xenos (everyone) · consent · a timed sitting',
+      predicate: 'rank:xenos+', seatsRanks: ['xenos', 'thetes', 'metic', 'archon'],
+      // The `+` is load-bearing and is why it is spelled out: a bare rank:xenos
+      // seats newcomers ONLY, which is what this line used to say.
+      how: 'membership rank:xenos+ (every builder — the + is what makes it everyone) · consent · a timed sitting',
       blurb: 'Every builder sits on the board. Consent keeps it unblockable: silence passes, one reasoned objection returns.' },
     { key: 'presidential', name: 'Presidential', selectable: false,
       blurb: 'An ELECTED executive with a fixed term. Needs election machinery this system does not have yet — documented for later.' },
@@ -507,7 +581,12 @@
     { key: 'federation', name: 'Federation', selectable: false,
       blurb: 'Multiple chambers or sub-projects, each self-governing, coordinating through a compact. The >150 shape — documented for later.' },
     { key: 'foundation', name: 'Foundation', selectable: true,
-      how: 'a CUSTOM rank as the trustee body (the Ranks tab creates it) · consent · a timed sitting',
+      // The one selectable charter whose predicate the OWNER names — a custom
+      // rank is a DB row this page cannot know. Deliberately null rather than a
+      // made-up example, and the `how` says so: `+` does not apply to a custom
+      // rank (it has no ladder position), so a bare key is the correct form here.
+      predicate: null, seatsRanks: null,
+      how: 'membership rank:<your-trustee-rank> — a CUSTOM rank you create on the Ranks tab, named exactly (no +, a custom rank has no ladder position) · consent · a timed sitting',
       blurb: 'A written charter carried by a small appointed council. Expressible today by governing through a custom rank.' },
   ];
   const TRAJECTORIES = [

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.251",
+  "version": "1.19.253",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.251",
+      "version": "1.19.253",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.251",
+  "version": "1.19.253",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/run-unit-tests.js

@@ -90,6 +90,11 @@ const INTEGRATION = new Set([
   // DB-free lane, where they only "passed" because they self-skip. The pairing guard
   // is in tests/government_live_proof_shape.mjs — every curated entry must name a
   // real test file.
+  // task 1003094: the board FRANCHISE against real SQL. The DB-free sibling covers
+  // the grammar; this covers what the task actually changed — the ANY() rewrite,
+  // the DISTINCT, and that a deactivated builder or a machine principal still
+  // never governs under the widened predicate.
+  'government_board_membership_db',
   'government_fold_bench', 'government_live_proof', 'linkify_refs', 'memory_isolation',
   'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent', 'reward_mode_cost_plus_only',
   'scouting_rollup_fanout', 'session_records', 'setup_smoke',

package/src/module-api.js

@@ -929,8 +929,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.249 with no explicit bump. run 32203357427. (task 1002620)
 //   1.19.251 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.250 with no explicit bump. run 32204008770. (task 1002620)
+//   1.19.252 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.251 with no explicit bump. run 32205191350. (task 1002620)
+//   1.19.253 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.252 with no explicit bump. run 32205833181. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.251'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.253'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_amendment.mjs

@@ -79,6 +79,10 @@ test('a proposal files the amendment and opens its window under the constitution
   await withDb({
     createAmendment: async (args) => ({ id: '5', proposed: args.proposed, rationale_md: args.rationaleMd, proposed_by: args.proposedBy }),
     openBoardItem: async (args) => { opened = args; return { id: '21', ...args }; },
+    // Task 1003094's disenfranchisement guard asks, before any write, whether the
+    // proposer would still sit under the PROPOSED block. Here they would (the
+    // proposal keeps rank:archon), so the propose proceeds.
+    builderHoldsRankActive: async () => true,
   }, async () => {
     const out = await proposeAmendment({ proposal: CONSENT_90, rationaleMd: 'time to open up', proposedBy: '42' });
     assert.equal(out.ok, true);
@@ -95,12 +99,94 @@ test('an invalid proposal files NOTHING — refused before any write', async ()
   await withDb({
     createAmendment: async () => { throw new Error('must not be reached'); },
     openBoardItem: async () => { throw new Error('must not be reached'); },
+    builderHoldsRankActive: async () => true,
   }, async () => {
     assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'majority' }, proposedBy: '42' })).ok, false);
     assert.equal((await proposeAmendment({ proposal: CONSENT_90, proposedBy: null })).reason, 'missing_proposer');
   });
 });
 
+// ── the disenfranchisement guard (task 1003094) ──────────────────────────────
+//
+// The shape that cannot self-correct: an amendment that removes the person
+// making it. Once it lands they can no longer vote — including to undo it. This
+// is not hypothetical. On the R25 rehearsal an Archon ratified `rank:metic`
+// under monarchy, the apply worked perfectly, and the next vote came back 403
+// not_board_member. The board would have deadlocked at one member.
+
+test('a proposal that would unseat its own proposer is REFUSED before any write', async () => {
+  await withDb({
+    createAmendment: async () => { throw new Error('must not be reached — nothing may be written'); },
+    openBoardItem: async () => { throw new Error('must not be reached'); },
+    // The proposer is an Archon; the proposed block seats metics ONLY.
+    builderHoldsRankActive: async (_id, rankKeys) => rankKeys.includes('archon'),
+  }, async () => {
+    const out = await proposeAmendment({
+      proposal: { ...CONSENT_90, membership: 'rank:metic' },
+      proposedBy: '42',
+    });
+    assert.equal(out.ok, false);
+    assert.equal(out.reason, 'proposer_would_lose_their_seat');
+    assert.match(out.what_this_means, /would remove YOU from the board/);
+    assert.match(out.hint, /rank:<key>\+/, 'the refusal names the one-character fix');
+  });
+});
+
+test('the guard is satisfied by the LADDER form — the fix the hint points at', async () => {
+  let wrote = false;
+  await withDb({
+    createAmendment: async (args) => { wrote = true; return { id: '9', proposed: args.proposed }; },
+    openBoardItem: async (args) => ({ id: '31', ...args }),
+    builderHoldsRankActive: async (_id, rankKeys) => rankKeys.includes('archon'),
+  }, async () => {
+    const out = await proposeAmendment({
+      proposal: { ...CONSENT_90, membership: 'rank:metic+' },
+      proposedBy: '42',
+    });
+    assert.equal(out.ok, true, 'metic-and-above keeps the Archon seated, so the proposal proceeds');
+    assert.equal(wrote, true);
+  });
+});
+
+test('stepping back is still expressible — with an explicit acknowledgement', async () => {
+  // Deliberately not a hard ban: handing the franchise to a wider body and
+  // stepping back is a legitimate constitutional act, and a system that cannot
+  // express it is telling owners what they may decide.
+  let wrote = false;
+  await withDb({
+    createAmendment: async (args) => { wrote = true; return { id: '10', proposed: args.proposed }; },
+    openBoardItem: async (args) => ({ id: '32', ...args }),
+    builderHoldsRankActive: async () => { throw new Error('the guard must not even ask when acknowledged'); },
+  }, async () => {
+    const out = await proposeAmendment({
+      proposal: { ...CONSENT_90, membership: 'rank:metic' },
+      proposedBy: '42',
+      acknowledgeSelfRemoval: true,
+    });
+    assert.equal(out.ok, true);
+    assert.equal(wrote, true);
+  });
+});
+
+test('the acknowledgement never becomes part of the ratified text', async () => {
+  // It is a separate parameter, not a proposal field — and the strict validator
+  // refuses unknown fields, which is what keeps that honest.
+  const v = validateProposedConstitution({ ...CONSENT_90, acknowledge_self_removal: true });
+  assert.equal(v.ok, false);
+  assert.equal(v.reason, 'unknown_field');
+  assert.equal(v.field, 'acknowledge_self_removal');
+});
+
+test('the bad-membership refusal TEACHES the grammar', () => {
+  // Whoever lands here is trying to write a constitution, and since task 1003094
+  // the commonest reason is reaching for "and above".
+  const v = validateProposedConstitution({ ...CONSENT_90, membership: 'rank:metic++' });
+  assert.equal(v.ok, false);
+  assert.equal(v.reason, 'bad_membership');
+  assert.match(v.expected, /rank:<key>\+/);
+  assert.match(v.expected, /comma list/);
+});
+
 // ── invariants 2+3: the monarchy act, and the subject-typed anti-self ────────
 
 const MONARCHY = Object.freeze({ membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true });
@@ -121,7 +207,7 @@ test('the monarchy act end to end: the sole Archon ratifies their OWN amendment
     let authorAsked = 0;
     await withDb({
       getBoardItemForVote: async () => amendmentItem(),
-      builderHoldsRankActive: async (builderId, rankKey) => builderId === '42' && rankKey === 'archon',
+      builderHoldsRankActive: async (builderId, rankKeys) => builderId === '42' && rankKeys.includes('archon'),
       insertBoardVote: async (args) => { const v = { id: '1', voter_id: args.voterId, direction: args.direction }; votes.push(v); return v; },
       insertVoteKarma: async () => {},
       getVotesForItem: async () => votes,

package/tests/government_board_membership.mjs

@@ -31,12 +31,61 @@ const { parseMembershipPredicate, resolveBoardMembers, isBoardMember } = members
 
 // ── the pure parser ──────────────────────────────────────────────────────────
 
-test('the one v1 grammar parses: rank:<key>', () => {
-  assert.deepEqual(parseMembershipPredicate('rank:archon'), { rankKey: 'archon' });
-  assert.deepEqual(parseMembershipPredicate('rank:metic'), { rankKey: 'metic' });
-  assert.deepEqual(parseMembershipPredicate('rank:triage-helper'), { rankKey: 'triage-helper' },
-    'a CUSTOM rank is legal by shape — whether it seats anyone is the DB\'s answer');
-  assert.deepEqual(parseMembershipPredicate('rank:board_member'), { rankKey: 'board_member' });
+test('a bare rank:<key> still means EXACTLY that key — the meaning-preserving half', () => {
+  // The owner's decision (2026-08-18) was EXPLICIT grammar, not a redefinition:
+  // every constitution already ratified — including the shipped monarchy default
+  // `rank:archon` — must resolve to the same board after an upgrade. Redefining
+  // the bare form as "and above" would have silently rewritten the whole fleet.
+  assert.deepEqual(parseMembershipPredicate('rank:archon'), { rankKeys: ['archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:metic'), { rankKeys: ['metic'] });
+  assert.deepEqual(parseMembershipPredicate('rank:triage-helper'), { rankKeys: ['triage-helper'] },
+    'a CUSTOM rank is legal by shape — whether it seats anyone is the DB answer');
+  assert.deepEqual(parseMembershipPredicate('rank:board_member'), { rankKeys: ['board_member'] });
+});
+
+test('rank:<key>+ means that rank AND ABOVE — the form whose absence unseated an Archon', () => {
+  // THE BUG, in one assertion. Under v1 `rank:metic` was an exact SQL match, so
+  // an Archon who ratified it was 403'd off their own board on the next vote,
+  // and "Metic and above" could not be said at all.
+  assert.deepEqual(parseMembershipPredicate('rank:metic+'), { rankKeys: ['metic', 'archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:xenos+'), { rankKeys: ['xenos', 'thetes', 'metic', 'archon'] },
+    'rank:xenos+ is how you actually say everyone — bare rank:xenos seats NEWCOMERS ONLY');
+  assert.deepEqual(parseMembershipPredicate('rank:archon+'), { rankKeys: ['archon'] },
+    'the top of the ladder and above is just the top — no special case needed');
+});
+
+test('a comma list is an explicit union', () => {
+  assert.deepEqual(parseMembershipPredicate('rank:metic,archon'), { rankKeys: ['metic', 'archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:xenos+,ops'),
+    { rankKeys: ['xenos', 'thetes', 'metic', 'archon', 'ops'] },
+    'the standard ladder and a custom rank compose');
+});
+
+test('a union dedupes and keeps a deterministic order', () => {
+  // The tally denominator is built from this list; a duplicate would raise the
+  // bar a consent vote must clear without anyone amending the constitution.
+  assert.deepEqual(parseMembershipPredicate('rank:metic+,archon'), { rankKeys: ['metic', 'archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:archon,archon'), { rankKeys: ['archon'] });
+  assert.deepEqual(parseMembershipPredicate('rank:metic+,xenos+'),
+    { rankKeys: ['metic', 'archon', 'xenos', 'thetes'] },
+    'first occurrence wins its position — deterministic, which is what a denominator needs');
+});
+
+test('+ on a rank with NO ladder position is REFUSED, not guessed', () => {
+  // "Metic and above" is a real question. "and above" about a rank sitting on no
+  // ladder is not, so it fails closed rather than resolving to something
+  // plausible. A BARE custom key is unaffected.
+  assert.equal(parseMembershipPredicate('rank:triage-helper+'), null);
+  assert.equal(parseMembershipPredicate('rank:ops+'), null);
+  assert.equal(parseMembershipPredicate('rank:archon,ops+'), null,
+    'one bad element poisons the whole predicate — a partial franchise is not a safe fallback');
+  assert.deepEqual(parseMembershipPredicate('rank:triage-helper'), { rankKeys: ['triage-helper'] });
+});
+
+test('the parse result is frozen all the way down', () => {
+  const parsed = parseMembershipPredicate('rank:metic+');
+  assert.ok(Object.isFrozen(parsed));
+  assert.ok(Object.isFrozen(parsed.rankKeys), 'a caller must not be able to widen the franchise in place');
 });
 
 test('everything else parses to null — the fail-closed value', () => {
@@ -47,9 +96,15 @@ test('everything else parses to null — the fail-closed value', () => {
     'RANK:ARCHON',                  // grammar is lowercase
     'rank:Archon',
     'role:builder',                 // the rejected role-chamber model — must never parse
-    'rank:archon;metic',            // no lists in v1
+    'rank:archon;metic',            // ';' is not the list separator
     'rank: archon',                 // no whitespace
     'builder:3',                    // naming a PERSON is config-as-authority — refused by shape
+    'rank:archon,',                 // trailing separator
+    'rank:,archon',                 // leading separator
+    'rank:archon,,metic',           // empty element
+    'rank:metic++',                 // one suffix, not a pile
+    'rank:+metic',                  // the suffix is a suffix
+    'rank:metic+archon',            // '+' modifies, it does not join
   ];
   for (const p of junk) {
     assert.equal(parseMembershipPredicate(p), null, `${JSON.stringify(p)} must not parse`);
@@ -89,8 +144,12 @@ const MONARCHY = Object.freeze({ ...BOARD_DEFAULTS });
 
 test('resolveBoardMembers: the happy path — rows come back frozen, ids as strings', async () => {
   await withDb({
-    getActiveBuildersWithRank: async (rankKey) => {
-      assert.equal(rankKey, 'archon', 'the predicate\'s rank key reaches the query verbatim');
+    getActiveBuildersWithRank: async (rankKeys) => {
+      // The db read takes a SET since task 1003094 — every predicate form,
+      // including the bare one, resolves to one. A one-element set queries
+      // byte-identically to the old exact match, which is what keeps every
+      // already-ratified constitution meaning what it meant.
+      assert.deepEqual(rankKeys, ['archon'], 'the predicate rank set reaches the query verbatim');
       return [
         { builder_id: 42n, github_login: 'first-member', display_name: 'First Member' },
         { builder_id: '1000099', github_login: 'second-member', display_name: 'Second Member' },
@@ -117,6 +176,38 @@ test('an unparseable predicate resolves to NOBODY without touching the db', asyn
   });
 });
 
+test('a ladder predicate reaches the query as the whole expanded set', async () => {
+  // The end-to-end shape of the fix: `rank:metic+` must arrive at the SQL as
+  // BOTH metic and archon, or the Archon is off the board exactly as before.
+  let seen = null;
+  await withDb({
+    getActiveBuildersWithRank: async (rankKeys) => {
+      seen = rankKeys;
+      return [{ builder_id: '7', github_login: 'a-metic', display_name: 'A Metic' },
+        { builder_id: '8', github_login: 'an-archon', display_name: 'An Archon' }];
+    },
+  }, async () => {
+    const members = await resolveBoardMembers({ ...MONARCHY, membership: 'rank:metic+' });
+    assert.deepEqual(seen, ['metic', 'archon']);
+    assert.equal(members.length, 2);
+  });
+});
+
+test('THE REGRESSION: an Archon stays on the board under rank:metic+', async () => {
+  // The literal scenario from the R25 rehearsal. Under v1 this returned false
+  // and the owner lost their seat on their own constitution.
+  await withDb({
+    // A faithful stand-in for the real SQL: the builder holds exactly 'archon',
+    // and the query now asks whether that is IN the predicate's set.
+    builderHoldsRankActive: async (builderId, rankKeys) => rankKeys.includes('archon'),
+  }, async () => {
+    assert.equal(await isBoardMember('42', { ...MONARCHY, membership: 'rank:metic+' }), true,
+      'metic-and-above must seat the Archon');
+    assert.equal(await isBoardMember('42', { ...MONARCHY, membership: 'rank:metic' }), false,
+      'and the BARE form must still mean exactly metic — that is the compatibility half');
+  });
+});
+
 test('a predicate naming a rank with no assignments seats an EMPTY board — loud, not widened', async () => {
   await withDb({ getActiveBuildersWithRank: async () => [] }, async () => {
     const members = await resolveBoardMembers({ ...MONARCHY, membership: 'rank:board-of-directors' });
@@ -126,7 +217,7 @@ test('a predicate naming a rank with no assignments seats an EMPTY board — lou
 
 test('isBoardMember: fail-closed on a missing builder id, true only on a live row', async () => {
   await withDb({
-    builderHoldsRankActive: async (builderId, rankKey) => builderId === '42' && rankKey === 'archon',
+    builderHoldsRankActive: async (builderId, rankKeys) => builderId === '42' && rankKeys.includes('archon'),
   }, async () => {
     assert.equal(await isBoardMember('42', MONARCHY), true);
     assert.equal(await isBoardMember('999', MONARCHY), false);