@bongos/core 1.19.362 → 1.19.364

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.362",
-  "core_contract": "1.19.362",
-  "source_commit": "b42159074c029727d0275823a1726cc7cdfcb3a2",
+  "core_version": "1.19.364",
+  "core_contract": "1.19.364",
+  "source_commit": "c0a00b10a71f2436b4c7c3ccf91f71738cd319dc",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T18:50:51.000Z",
+  "built_at": "2026-08-25T19:33:41.499Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 330,
     "agent_docs_stubbed": 22,
-    "functional_verbatim": 1525,
+    "functional_verbatim": 1528,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1877,
-  "tree_sha256": "04f93b354b8a3bf82452a3cbd157be2d4627d0a3a787a06cb4f2b43da5f46681",
+  "file_count": 1880,
+  "tree_sha256": "bc6cc5b48ee9fd713a92fd676a2e776eddc5d7a421b2ac69fba5c2a3d1122825",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2499,6 +2499,11 @@
       "mode": "0000644",
       "sha256": "a379e9f926274559d8c57c9127024463e38b99e3f73962022b9f5d0f4e156a57"
     },
+    {
+      "path": "migrations/core_225_search_chunks_updated_at_idx.sql",
+      "mode": "0000644",
+      "sha256": "1913405bdb9de48ac3ca7ad6705cf44244d20c77d3a6f73700f88e717fb84043"
+    },
     {
       "path": "modules/agents/migrations/agents_001_definitions.sql",
       "mode": "0000644",
@@ -2547,7 +2552,7 @@
     {
       "path": "modules/builder-settings/builder-needs.js",
       "mode": "0000644",
-      "sha256": "276a92a2000f2bc0e9e157791947f2ee7e6bfe934a15a996d42dba13984c26d7"
+      "sha256": "0668dd0b60184bb230e60f13ee38dffb3a7831264e5155c3bafab3a2dce0f7f5"
     },
     {
       "path": "modules/builder-settings/db.js",
@@ -2932,7 +2937,7 @@
     {
       "path": "modules/discord/board-broadcast.js",
       "mode": "0000644",
-      "sha256": "111b577698792565f55e66f031c6567ac548b4fc5194b51c262843b2bec66198"
+      "sha256": "36906948331be98d0e14b7d0a02d0c86533b2d6247a3506e88c5c52827615411"
     },
     {
       "path": "modules/discord/bug-attachments.js",
@@ -3022,7 +3027,7 @@
     {
       "path": "modules/discord/webhook.js",
       "mode": "0000644",
-      "sha256": "59d2452516f4568c2a99c599275224ff0d2ff86b763066469a567944efbf5f69"
+      "sha256": "f8dc8f411b243d19d28b0b2f25fdc08925554e2d1b329ed2571aa7461b8cb64a"
     },
     {
       "path": "modules/economy/CLAUDE.md",
@@ -3107,7 +3112,7 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "e6e01e38328eb6d234c76d7f5aa9e96589fd2c9ef89c105216495303ac1e3fdd"
+      "sha256": "97f51120176aabc2bf414d8b5fff4a7d016b7522ac505c41b3d1fb25b258bfd1"
     },
     {
       "path": "modules/government/catalog.js",
@@ -3122,7 +3127,7 @@
     {
       "path": "modules/government/db.js",
       "mode": "0000644",
-      "sha256": "e48b8e01738969ca589496ee0bea94b5a31995e853a1347f63ca83895d4d28fd"
+      "sha256": "99be259855d63808adca140222eaf8563cff054b06ecc1acdd49594fcfc129fe"
     },
     {
       "path": "modules/government/membership-predicate.js",
@@ -3237,7 +3242,7 @@
     {
       "path": "modules/government/routes/government.js",
       "mode": "0000644",
-      "sha256": "8b29ea6478f4854dd5c74ea3538079db818707a575318634ce4f7504d2768289"
+      "sha256": "a0406671733e7f1a80212652c8d03d95899cdac90093edffe8186b1e11d774a6"
     },
     {
       "path": "modules/government/routes/rank-sync.js",
@@ -4287,7 +4292,7 @@
     {
       "path": "modules/memory/search.js",
       "mode": "0000644",
-      "sha256": "a9b900bcbdbb55b27f15dafe3ee45f57cd0e4dfda0b32cb38b29139b24f4ef68"
+      "sha256": "43ede2e90d0124c42f6f9dfc3695898b83c8e876c01f70b0ae6e9d2f61d41085"
     },
     {
       "path": "modules/onboarding/CLAUDE.md",
@@ -4847,12 +4852,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "6710729cad476af44279d8772d6e901a5d41133ad9da6f4d5879dbb4db66371f"
+      "sha256": "069dd3a2cb3320bdb8ba90936408e7ffa69100e7221f2131f6ff58eb300d0731"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9a2f2882dbd2fd617d1c1297a8aa0b0f68d8db2c9fcbf3fa49dafe57e9690022"
+      "sha256": "6a845cb51d1752ff573c18b2b9a9b078277beebb1d5b352ae04d6730ec4e6bdb"
     },
     {
       "path": "public-docs/index.html",
@@ -5912,7 +5917,7 @@
     {
       "path": "scripts/gds/recall.js",
       "mode": "0000644",
-      "sha256": "191b81d68114cbb920d2aed23398d581d2e1d51f6bc92e243ae7541f454d4b1e"
+      "sha256": "8bb682eebeec8738082a2988f59697da6982d7c727e82352c169abc72a623b78"
     },
     {
       "path": "scripts/gds/redteam-patrol.js",
@@ -5962,7 +5967,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "b3d816af249491e6187676ad084a60aaa72881615f8824a0263c31505d57a149"
+      "sha256": "21726e53ad33bef62c5a2a0e0d59c380927e06cfa00994d5bbfd9669b83ce167"
     },
     {
       "path": "scripts/gds/sandbox-stage.js",
@@ -6647,7 +6652,7 @@
     {
       "path": "src/bongos/routes/me.js",
       "mode": "0000644",
-      "sha256": "0006bf8ec2430532a72c194bcc7517b4008d00b8fa4a73e9a77bc2c6a10c6d26"
+      "sha256": "34e50788c8162430b46e9f204c36396b456d0524bde3063434bb848d7977cf07"
     },
     {
       "path": "src/bongos/routes/modules.js",
@@ -6717,7 +6722,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "bb36f1b2c93e5f051a9db15579ac309703db82bbc0b7efaee82416bfb603b487"
+      "sha256": "b49355a43b920214aa7295016e9776f61a744904be33b2c4c9e88cd987071855"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7462,7 +7467,7 @@
     {
       "path": "tests/discord_board_broadcast.mjs",
       "mode": "0000644",
-      "sha256": "db1a02168869e633fccc62137f4db3e0f4efbf4a785db7cc0b49a30a8d4f418a"
+      "sha256": "f3ac413d7653d3027516eae052523b98206cb54452cb3410602e1bb85c4d4c19"
     },
     {
       "path": "tests/discord_bot.mjs",
@@ -7784,6 +7789,11 @@
       "mode": "0000644",
       "sha256": "7da08f5ad67ca1d42d0ef2afb641d1a5f1d5e0c6e0267e8b5f3ad0d275603a36"
     },
+    {
+      "path": "tests/government_board_summons.mjs",
+      "mode": "0000644",
+      "sha256": "349bf135c0c38fb23d40142e3aaa2a5aada9484a4cead9c5b312450a9f818c07"
+    },
     {
       "path": "tests/government_board_view.mjs",
       "mode": "0000644",
@@ -8762,7 +8772,12 @@
     {
       "path": "tests/recall_corpus_health.mjs",
       "mode": "0000644",
-      "sha256": "ec1ebb9e317221df08c6009d1abd8816da47eda20740ae928cf9f829b8da4951"
+      "sha256": "3b379d1fe9c938dac2ad596c5a74022c5476164a57541481f427f22ab17af35e"
+    },
+    {
+      "path": "tests/recall_freshness_plan_db.mjs",
+      "mode": "0000644",
+      "sha256": "94fd5052df816ffad4eaeaff3ec1dfe580a66e7b588756f3b9ca84b68e01081d"
     },
     {
       "path": "tests/recall_hints.mjs",

package/migrations/core_225_search_chunks_updated_at_idx.sql

@@ -0,0 +1,24 @@
+-- core_225_search_chunks_updated_at_idx.sql — task 1003145 (panel finding on 1003097).
+--
+-- corpusHealth() runs a freshness probe on every zero-result search: the newest
+-- updated_at among the chunks VISIBLE to the caller. Migration 103 indexed tsv,
+-- body trigrams, (source_kind, source_ref) and the owner partial — nothing on
+-- updated_at — so that probe was an aggregate over the whole visible corpus. For a
+-- Metic+ caller the scope predicate matches nearly every row, and during an ingest
+-- outage EVERY search is a zero-result search, so it ran on every request from
+-- every builder for the duration. That is the same cost shape that got the
+-- COUNT(*) removed from this path in the first place; the third subquery kept it.
+--
+-- LEADING COLUMN IS updated_at, NOT THE SCOPE COLUMNS. The obvious index here
+-- looks like (min_rank, owner_builder_id, updated_at), but it cannot serve this
+-- query: the scope predicate is `min_rank = ANY($1)` plus an OR on
+-- owner_builder_id, and neither shape lets a btree deliver rows ordered by a
+-- TRAILING column. Ordering on updated_at instead lets the probe walk the index
+-- newest-first and stop at the first row that passes the scope filter — which, for
+-- the privileged caller that was the worst case, is the first row it reads. The
+-- filter costs a heap fetch per candidate, so the win is bounded by how quickly a
+-- visible row turns up, not by the corpus size. search.js asks for that plan
+-- explicitly (ORDER BY updated_at DESC LIMIT 1) rather than leaving it to the
+-- planner's MIN/MAX transform.
+CREATE INDEX IF NOT EXISTS idx_search_chunks_updated_at
+  ON search_chunks (updated_at DESC);

package/modules/builder-settings/builder-needs.js

@@ -148,7 +148,50 @@ function taskRecommendationsNeed(ctx) {
   };
 }
 
-const NEEDS = [artKeyNeed, helpRequestsNeed, taskRecommendationsNeed];
+// Open BOARD SITTINGS waiting on this builder's vote (task 1003271). Sibling of
+// the two collab needs above, and here for the sharpest version of the same
+// reason: nine items sat before the board for two days with zero votes, not
+// because the board was deadlocked — three of four archons could each have
+// carried any of them with one click — but because nobody was ever told. The
+// only summons that existed was the Discord announcer, which is best-effort by
+// construction: an unconfigured webhook, an unlinked member or a failed POST all
+// end in a swallowed log line. A vote nobody surfaces is merely pending.
+//
+// ctx.pendingBoardVotes — { count, first_item_id } from the `government` port,
+//                         already filtered to what the vote route would ACCEPT
+//                         (member under the item's own snapshotted constitution,
+//                         not the author, has not yet cast, not past deadline).
+//                         null/absent on an instance with government off, which
+//                         reads as "nothing waiting".
+//
+// 'action_needed', unlike the two info-only collab needs: an open sitting is the
+// system genuinely blocked on this person's input — until a member votes, the
+// idea's author waits and nothing decides. The link goes straight to the oldest
+// waiting sitting, because the one that has waited longest is the one to answer.
+function boardVotesNeed(ctx) {
+  const pending = ctx.pendingBoardVotes;
+  const n = Number(pending && pending.count) || 0;
+  if (n <= 0) return null;
+  const firstId = pending && pending.first_item_id;
+  // Deep-link the named sitting when we know it (?item=<id> — the Board Room
+  // panel scrolls to and highlights it; the hash stays the tab), else the room.
+  const href = firstId
+    ? `/government?item=${encodeURIComponent(firstId)}#board-room`
+    : '/government#board-room';
+  const subject = n === 1 ? 'An idea is' : `${n} ideas are`;
+  return {
+    id: 'board_votes',
+    title: n === 1 ? 'An idea is waiting on your vote' : 'Ideas are waiting on your vote',
+    what: 'You sit on the board, and a Full Idea that cleared the completeness grade needs a decision.',
+    state: 'action_needed',
+    severity: 'info',
+    message: `${subject} before the board and cannot be decided until a member votes. `
+      + 'Voting happens in the hall, where the idea is in front of you and an objection can name its reason.',
+    action: { label: n === 1 ? 'Open the sitting' : 'Open the Board Room', href },
+  };
+}
+
+const NEEDS = [artKeyNeed, helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed];
 
 // ---- founding grace (task 1002739 / direction §5.6, idea 1000701) -----------
 //
@@ -226,7 +269,7 @@ module.exports = {
   computeNeeds,
   // exported for tests / direct reuse
   artKeyNeed,
-  helpRequestsNeed, taskRecommendationsNeed,
+  helpRequestsNeed, taskRecommendationsNeed, boardVotesNeed,
   foundingGraceActive,
   FOUNDING_GRACE_DAYS,
   SETTINGS_PATH,

package/modules/discord/board-broadcast.js

@@ -27,6 +27,14 @@
 // BEST-EFFORT BY DESIGN, like every broadcast in this module: it never throws,
 // so a Discord hiccup can never fail a window open or a close — the room in the
 // hall is the durable surface, this is the nudge.
+//
+// AND IT IS NO LONGER THE ONLY SUMMONS (task 1003271). Being best-effort meant
+// an unconfigured webhook or an unlinked member ended in a swallowed log line,
+// and nine sittings once sat two days with zero votes because nobody was told.
+// The durable summons is now the builder-needs roster on /me (government's
+// pendingBoardVotesFor → the `board_votes` need), which every session and hall
+// visit already reads. This stays what §8 says it is: a notification, never a
+// ballot.
 
 'use strict';
 
@@ -59,6 +67,24 @@ async function postBoardAnnouncement(payload, deps = {}) {
     if (!resolveMembers) { result.skipped = 'no_government_port'; return result; }
     const members = await resolveMembers(payload.constitution || {});
     if (!members || !members.length) { result.skipped = 'empty_board'; return result; }
+    // task 1003271: an unconfigured webhook is an OPERATOR action, not weather.
+    // Reported distinctly (and named in the log) so "this instance never wired
+    // the board channel" stops looking identical to "Discord answered 500" —
+    // that ambiguity is why nine sittings went unannounced without anyone
+    // knowing which of the two to fix. The hall's builder-needs summons is the
+    // durable one either way; this is the nudge.
+    //
+    // Only asked when the REAL webhook poster is the one about to run: an
+    // injected `post` (the tests, and any future non-webhook transport) resolves
+    // no URL, so a missing one tells us nothing about whether it can deliver.
+    const configured = deps.hasWebhook || webhook.hasWebhook;
+    if (!deps.post && typeof configured === 'function' && !configured(CHANNEL)) {
+      result.skipped = 'channel_not_configured';
+      log(`[discord] board announcement skipped for item ${payload.item_id}: no webhook for '${CHANNEL}'. `
+        + `Set it in ${webhook.WEBHOOKS_PATH} or env DISCORD_${CHANNEL.toUpperCase()}_WEBHOOK. `
+        + `The hall summons (builder-needs) is unaffected — members are still told in the hall.`);
+      return result;
+    }
 
     // ONE bulk query for the whole board's links — never a per-member await.
     const getLinks = deps.getLinks
@@ -111,7 +137,8 @@ async function postBoardAnnouncement(payload, deps = {}) {
     log(`[discord] board announcement posted (item ${payload.item_id}; ${result.mentioned.length} mentioned, ${result.named.length} named)`);
   } catch (e) {
     result.skipped = 'post_failed';
-    log(`[discord] board announcement skipped (window open unaffected): ${e && e.message}`);
+    log(`[discord] board announcement skipped for item ${payload.item_id} (window open unaffected; `
+      + `the hall summons still stands): ${e && e.message}`);
   }
   return result;
 }

package/modules/discord/webhook.js

@@ -133,7 +133,21 @@ async function editWebhook(channel, messageId, text) {
   return { ok: true, status: res.status };
 }
 
+// Is a channel actually wired up? (task 1003271.) Callers whose post is
+// best-effort swallow every failure, which makes "this instance never configured
+// the webhook" indistinguishable from "Discord returned 500" in the logs — and
+// the first is an operator action while the second is weather. This answers the
+// cheap half without attempting a post. False for an unknown channel too: a name
+// nothing can resolve is not configured.
+function hasWebhook(channel) {
+  try {
+    return !!(CHANNELS.has(channel) && loadWebhooks()[channel]);
+  } catch (_) {
+    return false;
+  }
+}
+
 module.exports = {
-  CHANNELS, WEBHOOKS_PATH, loadWebhooks, resolveWebhookUrl,
+  CHANNELS, WEBHOOKS_PATH, loadWebhooks, resolveWebhookUrl, hasWebhook,
   postWebhook, postWebhookMentions, editWebhook,
 };

package/modules/government/board.js

@@ -719,7 +719,74 @@ async function latestRejectionForIdea(ideaId) {
   });
 }
 
+// ── the summons: what is waiting on THIS member's vote (task 1003271) ───────
+//
+// THE PROBLEM THIS EXISTS TO FIX. Nine items sat open for two days with zero
+// votes. The board was not deadlocked — three of the four archons could each
+// have carried any of them with one click — they simply never learned a vote was
+// wanted. The Discord announcer (R21) is the only summons there has ever been,
+// and it is BEST-EFFORT BY CONSTRUCTION: an unconfigured webhook, an unlinked
+// member, or a failed POST all end in a swallowed log line. A nudge that can
+// silently not happen cannot be the only nudge.
+//
+// So the durable summons is the one surface every session and every hall visit
+// already reads: the builder-needs roster on /me (ADR 0073). This function is
+// its counter. Discord stays exactly what §8 says it is — a notification, not a
+// ballot — and voting stays hall-only (ADR 0175 §8, owner decision 2026-08-25).
+//
+// WHY MEMBERSHIP IS RESOLVED HERE AND NOT IN SQL. Each item snapshots the
+// constitution it opened under, so "may this builder vote on THIS item" is a
+// per-item predicate over the LIVE rank rows — the ADR 0016 posture the rest of
+// this module keeps (per request, uncached). Resolved once per DISTINCT
+// predicate rather than once per item, so nine items under one constitution cost
+// one membership resolve, not nine.
+//
+// It counts what the vote route would ACCEPT, so the roster can never promise a
+// ballot the route then refuses:
+//   - open, not past its deadline        (the SQL's WHERE)
+//   - this builder has not already cast  (UNIQUE(item_id, voter_id) — one vote each)
+//   - this builder is a board member under the item's OWN snapshot
+//   - this builder is not the subject's author (the anti-self-vote line, §3)
+// Fail-closed on an unreadable constitution: parseMembershipPredicate yields
+// nobody, so a malformed snapshot summons no one rather than everyone.
+async function pendingVotesFor(builderId) {
+  const empty = Object.freeze({ count: 0, first_item_id: null });
+  if (builderId === null || builderId === undefined || builderId === '') return empty;
+  let rows;
+  try {
+    rows = await db.openBoardItemsAwaitingVoter(builderId);
+  } catch (_) {
+    // A summons that cannot be counted is a quiet session, never a failed /me.
+    return empty;
+  }
+  if (!rows || !rows.length) return empty;
+
+  // One membership answer per distinct predicate. The predicate string IS the
+  // cache key: two items under the same membership have the same answer, and the
+  // resolve is a DB read we should not repeat nine times on the session hot path.
+  const membershipCache = new Map();
+  const votable = [];
+  for (const row of rows) {
+    if (row.already_voted) continue;
+    // The author does not vote on their own item (§3). Null author = nobody to
+    // disqualify, so the item stays votable.
+    if (row.author_id != null && String(row.author_id) === String(builderId)) continue;
+    const constitution = row.constitution || {};
+    const key = String(constitution.membership || '');
+    if (!membershipCache.has(key)) {
+      membershipCache.set(key, await isBoardMember(builderId, constitution).catch(() => false));
+    }
+    if (!membershipCache.get(key)) continue;
+    votable.push(row);
+  }
+  if (!votable.length) return empty;
+  // Oldest first (the SQL's ORDER BY), so the deep link lands on the sitting
+  // that has been waiting longest rather than an arbitrary one.
+  return Object.freeze({ count: votable.length, first_item_id: String(votable[0].id) });
+}
+
 module.exports = {
+  pendingVotesFor,
   FULL_IDEA_PASS_BAR,
   ideaPassesBar,
   openWindowForFullIdea,

package/modules/government/db.js

@@ -618,6 +618,52 @@ async function getExpiredOpenBoardItems(limit = 100) {
   return rows;
 }
 
+// The summons read (task 1003271): every OPEN item this builder could still
+// vote on, with the two facts that decide it — who authored the subject, and
+// whether this builder has already cast. Membership is NOT decided here: it
+// depends on the item's SNAPSHOTTED constitution predicate, which board.js
+// resolves against the live rank rows (the ADR 0016 posture — per request,
+// uncached). This query's job is to make that resolution cheap by handing back
+// everything else in ONE round trip instead of three per item.
+//
+// Expired items are excluded: a sitting past its deadline is the expiry sweep's
+// to close, and nagging someone to vote on it would be asking for a vote the
+// close will not count.
+//
+// The author join mirrors getBoardItemAuthor exactly — full_idea authorship is
+// idea_inbox.captured_by, and anything else is opened_by. Kept as a LEFT JOIN so
+// an item whose idea row is gone still appears with a null author (it has no
+// author to disqualify, so it stays votable) rather than vanishing from the count.
+//
+// INDEXES THIS RELIES ON — all three already exist (government_003), which is why
+// this adds no migration:
+//   - government_board_items_open_by_deadline ON (closes_at) WHERE closed_at IS NULL
+//     — a PARTIAL index whose predicate is exactly this query's `closed_at IS NULL`,
+//       and whose key is the `closes_at` it then filters on.
+//   - government_board_votes_one_per_voter UNIQUE (item_id, voter_id) — the votes
+//     LEFT JOIN's two columns, in that order, so "did this voter cast on this item"
+//     is one index probe rather than a scan of the item's ballot.
+//   - idea_inbox's primary key, for the author join.
+// The open set is also intrinsically small (an open item is one awaiting a decision,
+// not history — the closed rows are the unbounded side, per ADR 0175 §4).
+async function openBoardItemsAwaitingVoter(voterId) {
+  const { rows } = await pool.query(
+    `SELECT i.id, i.subject_type, i.subject_id, i.constitution, i.opened_at, i.closes_at,
+            CASE WHEN i.subject_type = 'full_idea' THEN idea.captured_by ELSE i.opened_by END AS author_id,
+            (v.id IS NOT NULL) AS already_voted
+       FROM government_board_items i
+       LEFT JOIN idea_inbox idea
+              ON i.subject_type = 'full_idea' AND idea.id = i.subject_id
+       LEFT JOIN government_board_votes v
+              ON v.item_id = i.id AND v.voter_id = $1
+      WHERE i.closed_at IS NULL
+        AND (i.closes_at IS NULL OR i.closes_at >= now())
+      ORDER BY i.opened_at`,
+    [voterId],
+  );
+  return rows;
+}
+
 // Author-ratification karma (+3, board.js AUTHOR_RATIFY_KARMA_DELTA) — fired by
 // the R10 close on a passed item. IDEMPOTENT: the reason key is unique per item
 // and the INSERT is one atomic WHERE-NOT-EXISTS statement (the economy
@@ -645,6 +691,7 @@ async function insertVoteKarma({ voterId, itemId, delta }) {
 }
 
 module.exports = {
+  openBoardItemsAwaitingVoter,
   getPermissionKeysForBuilder,
   getRankKeysForBuilder,
   getSeededRanks,

package/modules/government/routes/government.js

@@ -93,6 +93,12 @@ const governmentPort = {
   // bar gate lives INSIDE board.js (a sub-bar idea never reaches the board, and
   // no caller is trusted to pre-filter). Returns, never throws into capture.
   openBoardWindowForIdea: board.openWindowForFullIdea,
+  // task 1003271: how many open sittings are waiting on THIS builder's vote
+  // (member under the item's own snapshot, not the author, has not yet cast).
+  // On the port because the summons is rendered by the kernel's builder-needs
+  // roster on /me — the one surface every session already reads — and core
+  // imports no module (ADR 0093).
+  pendingBoardVotesFor: board.pendingVotesFor,
   // R13: the feedback a board-returned idea carries back to its author — the
   // resubmit path in modules/ideas resolves this to show what was objected to
   // and to check whether the flagged section actually changed.

package/modules/memory/search.js

@@ -331,7 +331,8 @@ async function markChunkUsefulness(
 // NOTE for anyone reading task 1003097's brief: it points at "migration 127
 // search_ingest_runs" as an ingest ledger to consult. No such table exists in
 // this repo (the search schema is migration 103, search_chunks alone), so
-// freshness here is derived from MAX(updated_at) on the chunks themselves.
+// freshness here is derived from updated_at on the chunks themselves — which is
+// why it reports the last CONTENT CHANGE and not the last ingest run (1003145).
 // Who may be told about content they cannot read. Metic+ is the boundary this
 // repo already uses for the permission/methodology core (ADR 0043), and
 // distinguishing "the index is empty" from "everything is above your rank"
@@ -350,7 +351,7 @@ const PRIVILEGED_DIAGNOSTIC_RANKS = ['metic', 'archon'];
 // keeping in view:
 //
 //   SCOPING (ADR 0016). The first cut returned unfiltered total/doc/db counts and
-//   a global last_indexed_at to every caller — an oracle for the size,
+//   a global freshness stamp to every caller — an oracle for the size,
 //   composition and freshness of content the caller may not read. This route
 //   family deliberately avoids that (fetchChunkBody answers one 404 for both
 //   "missing" and "not yours"). Now: the caller's own view is scoped with the
@@ -360,10 +361,23 @@ const PRIVILEGED_DIAGNOSTIC_RANKS = ['metic', 'archon'];
 //   COST. It also ran a full-table COUNT(*) — and during an actual outage EVERY
 //   search is a zero-result search, so that scan would run on every request from
 //   every builder for the duration. But nothing here needs a COUNT: the states
-//   turn on whether ANY row exists, not how many. EXISTS short-circuits at the
-//   first matching row, so this is two index-assisted probes rather than a scan,
-//   and it stays flat as the corpus grows. Dropping the exact numbers also
+//   turn on whether ANY row exists, not how many. Dropping the exact numbers also
 //   removes the last of the oracle.
+//
+// WHAT THIS QUERY COSTS (task 1003145). The comment here used to say "two
+// index-assisted probes rather than a scan", counting only the EXISTS pair and
+// forgetting the third subquery — which was a filtered MAX(updated_at), an
+// AGGREGATE over the whole visible corpus, on a column migration 103 never
+// indexed. Wrong, and load-bearing wrong: a future reader sizing this path would
+// have trusted it. What runs now, all three bounded in the common case:
+//   * the two EXISTS probes stop at the first matching row;
+//   * the freshness probe is ORDER BY updated_at DESC LIMIT 1 over
+//     idx_search_chunks_updated_at (migration 225), so it walks the index
+//     newest-first and stops at the first row that passes the scope filter.
+// The honest remaining worst case is a caller who can see NOTHING: no row passes
+// the filter, so the visible-probe and the freshness probe each read to the end
+// before they can answer. That is the `nothing_visible` state — one of the
+// outages these three states exist to NAME, not a steady-state cost.
 async function corpusHealth({ builderId, builderRank } = {}, { pool: p = pool, client = null } = {}) {
   const allowedRanks = ranksAtOrBelow(builderRank);
   const ownerId = Number.isInteger(builderId) ? builderId : (Number(builderId) || null);
@@ -379,10 +393,27 @@ async function corpusHealth({ builderId, builderRank } = {}, { pool: p = pool, c
            -- for everyone else), and cheap either way because EXISTS stops at
            -- the first row.
            EXISTS (SELECT 1 FROM search_chunks) AS any_at_all,
-           (SELECT MAX(updated_at) FROM search_chunks
+           -- FRESHNESS — and NOT "when the ingest last ran". Both ingesters
+           -- delta-gate their upsert (updated_at = now() fires only when a
+           -- chunk's content actually CHANGED — search-ingest-md.js,
+           -- search-ingest-db.js), so this is the newest CONTENT CHANGE the
+           -- caller can see, and a healthy nightly ingest over an unchanged
+           -- corpus leaves it perfectly still. Named for what it measures after
+           -- task 1003145: the old name, last_indexed_at, promised a liveness
+           -- signal it cannot deliver. Real ingest liveness would need an
+           -- ingest-run ledger, not a proxy on chunk mtimes.
+           --
+           -- ORDER BY … LIMIT 1 rather than MAX(): the same answer on a NOT NULL
+           -- column, but it ASKS for the bounded plan instead of depending on the
+           -- planner's MIN/MAX transform still firing. Scoped with the SAME
+           -- predicate as the search — an unscoped stamp was the freshness half
+           -- of the oracle described above.
+           (SELECT updated_at FROM search_chunks
              WHERE min_rank = ANY($1::text[])
                AND (owner_builder_id IS NULL OR owner_builder_id = $2::bigint)
-           ) AS last_indexed_at
+             ORDER BY updated_at DESC
+             LIMIT 1
+           ) AS last_content_change_at
   `;
   const runner = client || p;
   let rows;
@@ -392,13 +423,13 @@ async function corpusHealth({ builderId, builderRank } = {}, { pool: p = pool, c
     // ENRICHMENT ONLY — it runs to EXPLAIN a zero result, so it must never turn
     // a working search into an error. Nulls fail closed through
     // classifyEmptyResult, which never reports health it cannot prove.
-    return { any_visible: null, any_at_all: null, last_indexed_at: null, privileged };
+    return { any_visible: null, any_at_all: null, last_content_change_at: null, privileged };
   }
   const r = rows[0] || {};
   return {
     any_visible: r.any_visible === true || r.any_visible === false ? r.any_visible : null,
     any_at_all: r.any_at_all === true || r.any_at_all === false ? r.any_at_all : null,
-    last_indexed_at: r.last_indexed_at || null,
+    last_content_change_at: r.last_content_change_at || null,
     privileged,
   };
 }
@@ -409,9 +440,11 @@ async function corpusHealth({ builderId, builderRank } = {}, { pool: p = pool, c
 function classifyEmptyResult(health) {
   const anyVisible = health && typeof health.any_visible === 'boolean' ? health.any_visible : null;
   const privileged = !!(health && health.privileged);
-  // Never echo the unscoped probe. last_indexed_at is already scoped to the
-  // caller's own view by the query.
-  const safe = { last_indexed_at: (health && health.last_indexed_at) || null };
+  // Never echo the unscoped probe. last_content_change_at is already scoped to
+  // the caller's own view by the query, and is non-null ONLY when any_visible is
+  // true (the same predicate matches nothing in every other state), so in
+  // practice it rides along with no_match and is null on all three bad ones.
+  const safe = { last_content_change_at: (health && health.last_content_change_at) || null };
 
   if (anyVisible === null) {
     return {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.362",
+  "version": "1.19.364",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.362",
+      "version": "1.19.364",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.362",
+  "version": "1.19.364",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/recall.js

@@ -93,7 +93,17 @@ function renderNoMatch({ q, corpus }) {
       lines: [`No matches for "${q}". The index covers repo docs + (nightly) DB prose; try fewer / different terms, or it may not be indexed yet.`],
     };
   }
-  const stamp = corpus.last_indexed_at ? ` Last indexed: ${corpus.last_indexed_at}.` : '';
+  // "Corpus last changed", NOT "last indexed" — the server derives this from
+  // updated_at on the chunks, and both ingesters delta-gate their upsert, so it
+  // moves when CONTENT changes and stands still through a healthy ingest over an
+  // unchanged corpus. It was labelled "Last indexed:" until task 1003145, which
+  // read as an ingest-liveness signal it was never measuring.
+  //
+  // Both keys are read for the version-skew window: this CLI ships before the
+  // server pin moves, so an OLD server still answers with last_indexed_at. Same
+  // value either way — only the name was wrong.
+  const changedAt = corpus.last_content_change_at || corpus.last_indexed_at;
+  const stamp = changedAt ? ` Corpus last changed: ${changedAt}.` : '';
   if (corpus.healthy) {
     return { stream: 'out', exitCode: 0, lines: [`No matches for "${q}". ${corpus.message}${stamp}`] };
   }

package/scripts/gds/run-unit-tests.js

@@ -107,7 +107,14 @@ const INTEGRATION = new Set([
   // never governs under the widened predicate.
   'government_board_membership_db',
   'government_fold_bench', 'government_live_proof', 'linkify_refs', 'memory_isolation',
-  'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent', 'reward_mode_cost_plus_only',
+  'memory_pull', 'needs_rebase', 'parallel-load', 'profile_rollup_consent',
+  // task 1003145: whether the PLANNER uses the migration 225 index for the recall
+  // freshness probe. The DB-free sibling (recall_corpus_health) pins the query
+  // shape and that the migration declares the index; only a real Postgres can
+  // answer whether the probe stops at the first visible row or reads the corpus —
+  // and an unverified claim about exactly that is the comment this task fixed.
+  'recall_freshness_plan_db',
+  'reward_mode_cost_plus_only',
   'scouting_rollup_fanout', 'session_records',
   // task 1003217: the cost-row RAISE against real SQL. Every claim in it IS the
   // SQL — an ON CONFLICT DO UPDATE guarded to move a row only upward, and a

package/src/bongos/routes/me.js

@@ -105,7 +105,7 @@ module.exports = function buildMeRouter() {
       builder, activeClaims, estVsActual, unlocked, lockedWithProgress, streakInfo,
       recentGrades, builderAvg, onboardingRow, shipCount, recentKarma, karma30d, discordLink, boxConnected, cliAuthed,
       behaviorPrefs, geminiKeyRow, needsRebaseTasks, foundingBuilder, helpRequestCount,
-      taskRecommendationCount,
+      taskRecommendationCount, boardVotesPending,
     ] = await Promise.all([
       db.getBuilderById(req.builder.id),
       lc().getActiveClaimsForBuilder(req.builder.id),
@@ -192,6 +192,19 @@ module.exports = function buildMeRouter() {
           return await lifecycle.openTaskRecommendationsFor(req.builder.id);
         } catch (_) { return 0; }
       })(),
+      // task 1003271: open board sittings waiting on THIS builder's vote, via
+      // the `government` port — core imports no module (ADR 0093). Nine items
+      // once sat for two days with nobody told, because the Discord announcer
+      // (best-effort by construction) was the only summons; this is the durable
+      // one. Same fan-out slot and fail-open posture as the two collab reads
+      // above: a board read must never be able to break a profile.
+      (async () => {
+        try {
+          const government = seams.resolveOptional('government');
+          if (!government || !government.pendingBoardVotesFor) return null;
+          return await government.pendingBoardVotesFor(req.builder.id);
+        } catch (_) { return null; }
+      })(),
     ]);
     // V3.R84 (#302), criterion C3: the builder's month-to-date spend vs their
     // monthly budget. Surfaced here so the CLI (session-start ping) and the hall
@@ -333,6 +346,10 @@ module.exports = function buildMeRouter() {
         // module (ADR 0093); undefined when lifecycle is off, which the need reads
         // as "nothing asked".
         openHelpRequests: helpRequestCount,
+        // task 1003271: { count, first_item_id } of open board sittings awaiting
+        // this builder's vote; null when government is off, which the need reads
+        // as "nothing waiting".
+        pendingBoardVotes: boardVotesPending,
         // task 1003173 (C03, goal 1000075): open task recommendations waiting on
         // this builder, read through the same `lifecycle` port so core never
         // imports the module (ADR 0093).

package/src/module-api.js

@@ -1154,8 +1154,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.360 with no explicit bump. run 32883230235. (task 1002620)
 //   1.19.362 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.361 with no explicit bump. run 32886106098. (task 1002620)
+//   1.19.363 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.362 with no explicit bump. run 32889324497. (task 1002620)
+//   1.19.364 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.363 with no explicit bump. run 32890225073. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.362'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.364'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/discord_board_broadcast.mjs

@@ -79,6 +79,45 @@ test('missing port, empty board, and a Discord failure are named skips — NEVER
   assert.equal((await postBoardAnnouncement(null, { log: () => {} })).skipped, 'no_item');
 });
 
+test('an unconfigured board channel is its OWN named skip, not a generic failure (task 1003271)', async () => {
+  // WHY THIS DISTINCTION EARNS A TEST. Nine sittings went unannounced and the
+  // logs could not say whether the webhook was never configured (an operator
+  // action) or Discord had failed (weather). Both used to read 'post_failed'.
+  const deps = {
+    resolveMembers: async () => [member(1, 'a')],
+    getLinks: async () => new Map(),
+    hasWebhook: () => false,
+    log: () => {},
+  };
+  const out = await postBoardAnnouncement(payload(), deps);
+  assert.deepEqual({ posted: out.posted, skipped: out.skipped },
+    { posted: false, skipped: 'channel_not_configured' });
+
+  // Configured but failing is still the OTHER skip — the two never collapse.
+  const failed = await postBoardAnnouncement(payload(), {
+    ...deps, hasWebhook: () => true, post: async () => { throw new Error('discord down'); },
+  });
+  assert.equal(failed.skipped, 'post_failed');
+
+  // An INJECTED poster resolves no webhook URL, so a missing one must not stop
+  // it — otherwise every deps-injected caller would report a false skip.
+  let sent = null;
+  const injected = await postBoardAnnouncement(payload(), {
+    ...deps, hasWebhook: () => false, post: async (_c, text) => { sent = text; return { message_id: '5' }; },
+    recordMessage: async () => {},
+  });
+  assert.equal(injected.posted, true, 'an injected poster is never gated on webhook config');
+  assert.ok(sent && sent.includes('before the board'));
+});
+
+test('hasWebhook answers false for an unknown channel and for a configured-but-absent one', () => {
+  assert.equal(webhook.hasWebhook('definitely_not_a_channel'), false);
+  assert.ok(webhook.CHANNELS.has('board_room'), 'the board channel is a known key');
+  // Its truth here depends on the environment, so pin the TYPE, not the value —
+  // a boolean is the contract the caller branches on.
+  assert.equal(typeof webhook.hasWebhook('board_room'), 'boolean');
+});
+
 test('the emitter fires on FRESH opens only, and the listener is registered (source pins)', () => {
   const board = fs.readFileSync(path.join(ROOT, 'modules', 'government', 'board.js'), 'utf8');
   const open = board.slice(board.indexOf('async function openWindowForFullIdea'), board.indexOf('async function emitWindowOpened'));

package/tests/government_board_summons.mjs

@@ -0,0 +1,222 @@
+// tests/government_board_summons.mjs — the summons: what is waiting on THIS
+// member's vote (task 1003271).
+//
+// THE BUG THIS PINS. Nine sittings sat open for two days with zero votes. The
+// board was never deadlocked — three of four archons could each have carried any
+// item with one click — they were simply never told, because the Discord
+// announcer was the only summons and it is best-effort by construction (an
+// unconfigured webhook, an unlinked member and a failed POST all end in a
+// swallowed log line). The durable summons is now the builder-needs roster.
+//
+// The rules pinned here:
+//   1. THE COUNT MATCHES WHAT THE VOTE ROUTE WOULD ACCEPT — a member, not the
+//      author, not already cast. Anything the route would refuse must not be
+//      counted, or the roster promises a ballot the route then denies.
+//   2. THE AUTHOR IS EXCLUDED, and that is the whole live symptom: the owner
+//      authored all nine, so their own count is zero while a peer's is nine.
+//   3. MEMBERSHIP IS PER-ITEM, off the item's OWN snapshotted constitution —
+//      never the live config — and resolved ONCE PER DISTINCT PREDICATE.
+//   4. FAIL-CLOSED AND FAIL-OPEN IN THE RIGHT DIRECTIONS: an unreadable
+//      predicate summons nobody; a DB error yields a zero count, never a throw
+//      (this runs on the /me session hot path and must not break a profile).
+//
+// DB-free (db monkeypatched — the sibling board tests' idiom).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+const needs = require(path.join(ROOT, 'modules', 'builder-settings', 'builder-needs.js'));
+
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); }
+  finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+const ARCHON = { membership: 'rank:archon', pass_rule: 'first_ratifier' };
+
+// One open item. author_id/already_voted are what the SQL hands back.
+const item = (id, { author = null, voted = false, constitution = ARCHON } = {}) => ({
+  id: String(id),
+  subject_type: 'full_idea',
+  subject_id: String(1000000 + Number(id)),
+  constitution,
+  opened_at: `2026-08-2${(Number(id) % 9) + 1}T00:00:00Z`,
+  closes_at: null,
+  author_id: author == null ? null : String(author),
+  already_voted: voted,
+});
+
+// ── rule 2: the live symptom — author sees nothing, a peer sees all nine ─────
+
+test('the author of every open item is summoned to none of them', async () => {
+  // The exact live shape: 9 items, all authored by builder 1000025, membership
+  // rank:archon, and 1000025 IS an archon. The vote route would refuse each one
+  // (anti_self_vote), so the roster must not claim any are waiting on them.
+  const items = Array.from({ length: 9 }, (_, i) => item(i + 1, { author: 1000025 }));
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => items,
+    builderHoldsRankActive: async () => true, // they really are an archon
+  }, async () => {
+    const out = await board.pendingVotesFor(1000025);
+    assert.equal(out.count, 0, 'the author must be summoned to zero of their own sittings');
+    assert.equal(out.first_item_id, null);
+  });
+});
+
+test('a peer archon who authored none of them is summoned to all nine', async () => {
+  const items = Array.from({ length: 9 }, (_, i) => item(i + 1, { author: 1000025 }));
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => items,
+    builderHoldsRankActive: async () => true,
+  }, async () => {
+    const out = await board.pendingVotesFor(1000094); // scootermack, not the author
+    assert.equal(out.count, 9);
+    // Oldest first — the sitting that has waited longest is the one to answer.
+    assert.equal(out.first_item_id, '1');
+  });
+});
+
+// ── rule 1: the count matches what the route would accept ────────────────────
+
+test('an already-cast vote is not counted again', async () => {
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => [
+      item(1, { author: 7, voted: true }),
+      item(2, { author: 7, voted: false }),
+    ],
+    builderHoldsRankActive: async () => true,
+  }, async () => {
+    const out = await board.pendingVotesFor(1);
+    assert.equal(out.count, 1, 'one vote each — a cast item is settled for this voter');
+    assert.equal(out.first_item_id, '2');
+  });
+});
+
+test('a non-member is summoned to nothing, however many items are open', async () => {
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => [item(1, { author: 7 }), item(2, { author: 7 })],
+    builderHoldsRankActive: async () => false, // not an archon
+  }, async () => {
+    const out = await board.pendingVotesFor(999);
+    assert.equal(out.count, 0);
+  });
+});
+
+test('an item with no author at all stays votable (nobody to disqualify)', async () => {
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => [item(1, { author: null })],
+    builderHoldsRankActive: async () => true,
+  }, async () => {
+    assert.equal((await board.pendingVotesFor(1000025)).count, 1);
+  });
+});
+
+// ── rule 3: membership is per-item, and resolved once per predicate ──────────
+
+test('membership comes from the ITEM snapshot, not one global answer', async () => {
+  // Two items under DIFFERENT constitutions: this builder sits on one board only.
+  const metic = { membership: 'rank:metic+', pass_rule: 'first_ratifier' };
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => [
+      item(1, { author: 7, constitution: ARCHON }),
+      item(2, { author: 7, constitution: metic }),
+    ],
+    builderHoldsRankActive: async (_id, rankKeys) => rankKeys.includes('metic'),
+  }, async () => {
+    const out = await board.pendingVotesFor(1000027);
+    assert.equal(out.count, 1, 'only the sitting whose snapshot enfranchises them');
+    assert.equal(out.first_item_id, '2');
+  });
+});
+
+test('one membership resolve per DISTINCT predicate, not one per item', async () => {
+  let calls = 0;
+  const items = Array.from({ length: 9 }, (_, i) => item(i + 1, { author: 7 }));
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => items,
+    builderHoldsRankActive: async () => { calls++; return true; },
+  }, async () => {
+    const out = await board.pendingVotesFor(5);
+    assert.equal(out.count, 9);
+    assert.equal(calls, 1, 'nine items under one constitution cost ONE resolve');
+  });
+});
+
+// ── rule 4: the two failure directions ──────────────────────────────────────
+
+test('an unreadable membership predicate summons nobody (fail-closed)', async () => {
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => [
+      item(1, { author: 7, constitution: { membership: 'not a predicate' } }),
+    ],
+    // Would say yes if it were ever asked — the parse must refuse first.
+    builderHoldsRankActive: async () => true,
+  }, async () => {
+    assert.equal((await board.pendingVotesFor(1)).count, 0);
+  });
+});
+
+test('a DB error yields a zero count, never a throw (the /me hot path)', async () => {
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => { throw new Error('boom'); },
+  }, async () => {
+    const out = await board.pendingVotesFor(1);
+    assert.equal(out.count, 0);
+    assert.equal(out.first_item_id, null);
+  });
+});
+
+test('a missing builder id is answered without touching the database', async () => {
+  await withDb({
+    openBoardItemsAwaitingVoter: async () => { throw new Error('must not be called'); },
+  }, async () => {
+    for (const id of [null, undefined, '']) {
+      assert.equal((await board.pendingVotesFor(id)).count, 0);
+    }
+  });
+});
+
+// ── the need the count feeds ─────────────────────────────────────────────────
+
+test('zero pending votes produces NO need row', () => {
+  // An empty state is not an input the system needs from you — the sibling
+  // collab needs take the same line.
+  assert.equal(needs.boardVotesNeed({}), null);
+  assert.equal(needs.boardVotesNeed({ pendingBoardVotes: { count: 0 } }), null);
+  assert.equal(needs.boardVotesNeed({ pendingBoardVotes: null }), null);
+});
+
+test('pending votes are action_needed and deep-link the oldest sitting', () => {
+  const n = needs.boardVotesNeed({ pendingBoardVotes: { count: 9, first_item_id: '1' } });
+  assert.equal(n.id, 'board_votes');
+  assert.equal(n.state, 'action_needed');
+  assert.equal(n.action.href, '/government?item=1#board-room');
+  // The hash is the TAB (makeTabs owns it); the item is a query param.
+  assert.match(n.action.href, /#board-room$/);
+});
+
+test('a count with no item id still links the room', () => {
+  const n = needs.boardVotesNeed({ pendingBoardVotes: { count: 2 } });
+  assert.equal(n.action.href, '/government#board-room');
+});
+
+test('the need reaches computeNeeds as an action_needed item', () => {
+  const out = needs.computeNeeds({
+    rank: 'archon', ownKeySet: true,
+    pendingBoardVotes: { count: 3, first_item_id: '4' },
+  });
+  const row = out.items.find((i) => i.id === 'board_votes');
+  assert.ok(row, 'the registry must carry the new need');
+  assert.equal(out.has_action_needed, true);
+  // action_needed sorts first, so a renderer taking "the first one" gets it.
+  assert.equal(out.items[0].id, 'board_votes');
+});

package/tests/recall_corpus_health.mjs

@@ -122,13 +122,27 @@ test('an outage goes to STDERR with a non-zero exit', () => {
 });
 
 test('a genuine miss stays ordinary stdout with exit 0', () => {
-  const corpus = { ...classifyEmptyResult({ any_visible: true, any_at_all: true, privileged: false }), last_indexed_at: '2026-08-20T00:00:00.000Z' };
+  const corpus = { ...classifyEmptyResult({ any_visible: true, any_at_all: true, privileged: false }), last_content_change_at: '2026-08-20T00:00:00.000Z' };
   const out = renderNoMatch({ q: 'nonexistent gibberish', corpus });
   assert.equal(out.stream, 'out');
   assert.equal(out.exitCode, 0);
   const text = out.lines.join('\n');
   assert.doesNotMatch(text, /RECALL IS NOT ANSWERING/, 'never cry outage on an honest miss');
-  assert.match(text, /Last indexed: 2026-08-20/, 'freshness is still surfaced');
+  assert.match(text, /Corpus last changed: 2026-08-20/, 'freshness is still surfaced');
+  // task 1003145: the stamp comes from chunk updated_at, and both ingesters
+  // delta-gate their upsert — so it moves on CONTENT CHANGE and stands perfectly
+  // still through a healthy ingest of an unchanged corpus. Labelling it "Last
+  // indexed" sold it as ingest liveness, the one thing it cannot report.
+  assert.doesNotMatch(text, /Last indexed/, 'the stamp must not claim to be an ingest-liveness signal');
+});
+
+test('the stamp still renders for an OLD server sending the former key', () => {
+  // Same version-skew reason the no-diagnostic case below is covered: the CLI
+  // ships before the server pin moves, so for a while it talks to a server that
+  // still answers last_indexed_at. Same value, older name — read both.
+  const corpus = { ...classifyEmptyResult({ any_visible: true, any_at_all: true, privileged: false }), last_indexed_at: '2026-08-19T00:00:00.000Z' };
+  const text = renderNoMatch({ q: 'anything', corpus }).lines.join('\n');
+  assert.match(text, /Corpus last changed: 2026-08-19/, 'the older key still renders, under the true label');
 });
 
 test('a server that sends no diagnostic keeps the previous behaviour', () => {
@@ -178,7 +192,28 @@ test('corpusHealth probes EXISTENCE, scoped with the same predicate as the searc
   assert.match(body, /EXISTS \(/, 'existence probes instead');
   assert.match(body, /min_rank = ANY/, 'the visible probe is rank-scoped');
   assert.match(body, /owner_builder_id IS NULL OR owner_builder_id/, 'with the search\'s own ownership predicate');
-  assert.match(body, /MAX\(updated_at\)/, 'freshness, also scoped');
+  // task 1003145: the freshness probe used to be MAX(updated_at) — an AGGREGATE
+  // over the whole visible corpus, on an unindexed column, while the comment
+  // beside it claimed the path held no scan. ORDER BY … LIMIT 1 over
+  // idx_search_chunks_updated_at (migration 225) stops at the first row that
+  // passes the scope filter instead.
+  assert.doesNotMatch(body, /MAX\(updated_at\)/, 'freshness must not be an aggregate scan');
+  assert.match(body, /ORDER BY updated_at DESC\s+LIMIT 1/, 'it asks for the bounded plan explicitly');
+  const freshness = body.slice(body.indexOf('SELECT updated_at FROM search_chunks'));
+  assert.match(freshness.slice(0, freshness.indexOf('LIMIT 1')), /min_rank = ANY/,
+    'and the freshness probe carries the search’s scope predicate too');
+});
+
+test('the freshness probe has an index to walk (migration 225)', () => {
+  // The LIMIT 1 only bounds anything if updated_at is ORDERED by an index —
+  // otherwise the planner sorts the visible corpus to answer it, which is the
+  // same scan wearing a new name. Migration 103 indexed tsv / body / source /
+  // owner and NOT updated_at, which is how the aggregate went unnoticed.
+  const dir = path.join(ROOT, 'migrations');
+  const sql = fs.readdirSync(dir).filter((f) => /search_chunks/.test(f))
+    .map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
+  assert.match(sql, /CREATE INDEX IF NOT EXISTS idx_search_chunks_updated_at[\s\S]{0,80}\(updated_at DESC\)/,
+    'search_chunks must carry a descending index on updated_at');
 });
 
 test('the route hands the caller ONLY the classifier output', () => {

package/tests/recall_freshness_plan_db.mjs

@@ -0,0 +1,171 @@
+// tests/recall_freshness_plan_db.mjs — task 1003145, against a REAL Postgres.
+//
+// WHY THIS EXISTS BESIDE tests/recall_corpus_health.mjs. That file is DB-free: it
+// pins the SHAPE of the freshness probe (ORDER BY ... LIMIT 1, not an aggregate)
+// and that migration 225 declares an index on updated_at. Neither of those is the
+// claim that actually matters, which is a claim about the DATABASE: that the
+// planner USES that index, so the probe stops at the first visible row instead of
+// reading the visible corpus.
+//
+// That distinction IS the bug being fixed here. The old code said MAX(updated_at)
+// under a comment promising "two index-assisted probes rather than a scan" — a
+// statement about the plan that nothing checked, and that was false. Answering it
+// with only a text tripwire on the SQL would repeat the mistake one level up: the
+// shape can be right while the plan is still a scan (no index, a lost ANALYZE, an
+// ORDER BY the index cannot serve). So this asks the planner directly.
+//
+// It also proves the REWRITE IS SEMANTICALLY IDENTICAL — ORDER BY updated_at DESC
+// LIMIT 1 returns exactly what MAX(updated_at) returned under the same predicate —
+// because the point was to make the probe cheaper, not to change the answer.
+//
+// The SQL under test is SLICED OUT OF modules/memory/search.js rather than copied,
+// so this cannot keep passing against a query the module no longer runs.
+//
+// It SELF-SKIPS (exit 0) with no reachable Postgres, and is listed in
+// run-unit-tests.js INTEGRATION set so the DB-free lane never runs it.
+//
+// Run:  DATABASE_URL=postgres://... node tests/recall_freshness_plan_db.mjs
+//
+// It CREATES its own throwaway search_chunks and drops it again, so point it at a
+// scratch database, never a real one.
+
+import pg from 'pg';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+import { strict as assert } from 'node:assert';
+
+const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
+const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL || undefined });
+
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`recall_freshness_plan_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}). Set DATABASE_URL to run.`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+// Same posture as tests/claims_requested_worktree_db.mjs: this DROPs and CREATEs
+// search_chunks, so refuse anything that looks like a real GDS database.
+const { rows: realRows } = await pool.query(
+  `SELECT to_regclass('public.builders') IS NOT NULL AS has_builders`);
+if (realRows[0].has_builders) {
+  console.log('recall_freshness_plan_db.mjs SKIPPED — this database has a `builders` table, so it is not a scratch DB. It DROPs and CREATEs search_chunks; point it at a throwaway Postgres.');
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+let passed = 0;
+let failed = 0;
+async function test(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// ---- the query under test, taken from the module itself ----
+
+const searchSrc = fs.readFileSync(path.join(ROOT, 'modules/memory/search.js'), 'utf8');
+const OPEN = '(SELECT updated_at FROM search_chunks';
+const start = searchSrc.indexOf(OPEN);
+assert.ok(start > 0, 'the freshness subquery must be findable in modules/memory/search.js');
+const end = searchSrc.indexOf(') AS last_content_change_at', start);
+assert.ok(end > start, 'the freshness subquery must still be aliased last_content_change_at');
+// Drop the wrapping parens so it stands alone as a statement.
+const FRESHNESS_SQL = searchSrc.slice(start + 1, end);
+assert.match(FRESHNESS_SQL, /ORDER BY updated_at DESC/, 'sanity: sliced the ordered form');
+
+// The privileged caller — the case the task named, where the scope predicate
+// matches nearly every row and the aggregate therefore scanned nearly everything.
+const ALL_RANKS = ['xenos', 'thetes', 'metic', 'archon'];
+const OWNER = 1;
+
+async function explain(sql) {
+  const { rows } = await pool.query(`EXPLAIN (FORMAT JSON) ${sql}`, [ALL_RANKS, OWNER]);
+  return JSON.stringify(rows[0]['QUERY PLAN']);
+}
+
+// ---- fixture ----
+
+await pool.query('DROP TABLE IF EXISTS search_chunks');
+// Only the columns this probe touches. The real table (migration 103) carries the
+// tsvector, the trigram body and the rest; none of them participate in this plan.
+await pool.query(`
+  CREATE TABLE search_chunks (
+    id               bigserial PRIMARY KEY,
+    min_rank         text NOT NULL DEFAULT 'xenos',
+    owner_builder_id bigint,
+    updated_at       timestamptz NOT NULL DEFAULT now()
+  )`);
+// Enough rows that a sequential scan plus a top-N sort is visibly the worse plan.
+await pool.query(`
+  INSERT INTO search_chunks (min_rank, owner_builder_id, updated_at)
+  SELECT (ARRAY['xenos','thetes','metic','archon'])[1 + (i % 4)],
+         CASE WHEN i % 50 = 0 THEN 1 + (i % 7) ELSE NULL END,
+         now() - (i || ' minutes')::interval
+    FROM generate_series(1, 20000) AS i`);
+await pool.query('ANALYZE search_chunks');
+
+await test('WITHOUT the index the probe is the scan the old comment denied', async () => {
+  const plan = await explain(FRESHNESS_SQL);
+  assert.match(plan, /Seq Scan/, 'baseline: with no index on updated_at this reads the table');
+  assert.doesNotMatch(plan, /idx_search_chunks_updated_at/, 'and cannot be using an index that does not exist yet');
+});
+
+await test('migration 225 applies cleanly', async () => {
+  const sql = fs.readFileSync(path.join(ROOT, 'migrations/core_225_search_chunks_updated_at_idx.sql'), 'utf8');
+  await pool.query(sql);
+  await pool.query('ANALYZE search_chunks');
+  const { rows } = await pool.query(
+    `SELECT 1 FROM pg_indexes WHERE tablename = 'search_chunks' AND indexname = 'idx_search_chunks_updated_at'`);
+  assert.equal(rows.length, 1, 'the migration must create idx_search_chunks_updated_at');
+});
+
+await test('WITH the index the planner walks it and stops — no scan', async () => {
+  // THE CLAIM THE COMMENT MAKES. Everything else in this file is scaffolding for
+  // this assertion: the probe must reach its answer through the index, not by
+  // reading the visible corpus.
+  const plan = await explain(FRESHNESS_SQL);
+  assert.match(plan, /idx_search_chunks_updated_at/, 'the freshness probe must use the updated_at index');
+  assert.match(plan, /Index Scan/, 'and reach it by an index scan');
+  assert.doesNotMatch(plan, /Seq Scan/, 'no sequential scan may remain on this path');
+  assert.doesNotMatch(plan, /"Node Type":"Sort"/, 'and no sort — the index already supplies the order');
+});
+
+await test('the probe reads a bounded number of rows, not the corpus', async () => {
+  const { rows } = await pool.query(
+    `EXPLAIN (ANALYZE, FORMAT JSON) ${FRESHNESS_SQL}`, [ALL_RANKS, OWNER]);
+  const plan = rows[0]['QUERY PLAN'][0].Plan;
+  // A privileged caller matches nearly every row, so the first row the index hands
+  // back already passes the filter. That is the inversion this index buys: the
+  // worst case for the old aggregate is the best case for this plan.
+  assert.ok(plan['Actual Rows'] <= 1, `expected at most 1 row out, got ${plan['Actual Rows']}`);
+  const read = JSON.stringify(plan).match(/"Actual Rows": ?(\d+)/g).map((m) => Number(m.split(':')[1]));
+  assert.ok(Math.max(...read) < 100, `plan should touch a handful of rows, not 20000 (saw ${Math.max(...read)})`);
+});
+
+await test('the rewrite returns exactly what MAX(updated_at) returned', async () => {
+  // The point was to make the probe cheaper, NOT to change the answer. Equivalent
+  // on a NOT NULL column, and this pins it rather than trusting the reasoning.
+  const { rows: viaOrder } = await pool.query(FRESHNESS_SQL, [ALL_RANKS, OWNER]);
+  const { rows: viaMax } = await pool.query(
+    `SELECT MAX(updated_at) AS updated_at FROM search_chunks
+      WHERE min_rank = ANY($1::text[])
+        AND (owner_builder_id IS NULL OR owner_builder_id = $2::bigint)`, [ALL_RANKS, OWNER]);
+  assert.equal(String(viaOrder[0].updated_at), String(viaMax[0].updated_at));
+});
+
+await test('a caller who can see NOTHING still gets null, not a wrong stamp', async () => {
+  // The scope predicate is load-bearing (ADR 0016): a freshness stamp that outran
+  // the caller scope would be the freshness half of the oracle this diagnostic was
+  // rewritten to remove. No visible row must mean no stamp.
+  const { rows } = await pool.query(FRESHNESS_SQL, [['nobody'], 999999]);
+  assert.equal(rows.length, 0, 'nothing visible must yield no row, hence a null stamp');
+});
+
+await pool.query('DROP TABLE IF EXISTS search_chunks');
+await pool.end();
+
+console.log('');
+console.log(`recall_freshness_plan_db: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);