@bongos/core 1.19.363 → 1.19.365

package/modules/discord/webhook.js

@@ -133,7 +133,21 @@ async function editWebhook(channel, messageId, text) {
   return { ok: true, status: res.status };
 }
 
+// Is a channel actually wired up? (task 1003271.) Callers whose post is
+// best-effort swallow every failure, which makes "this instance never configured
+// the webhook" indistinguishable from "Discord returned 500" in the logs — and
+// the first is an operator action while the second is weather. This answers the
+// cheap half without attempting a post. False for an unknown channel too: a name
+// nothing can resolve is not configured.
+function hasWebhook(channel) {
+  try {
+    return !!(CHANNELS.has(channel) && loadWebhooks()[channel]);
+  } catch (_) {
+    return false;
+  }
+}
+
 module.exports = {
-  CHANNELS, WEBHOOKS_PATH, loadWebhooks, resolveWebhookUrl,
+  CHANNELS, WEBHOOKS_PATH, loadWebhooks, resolveWebhookUrl, hasWebhook,
   postWebhook, postWebhookMentions, editWebhook,
 };

package/modules/government/board.js

@@ -214,10 +214,13 @@ function validateVote({ direction, reasonMd, sectionKey } = {}) {
 
 // Cast a vote on an open item. Returns a typed result, never throws for a
 // policy refusal — the route maps each to its status:
-//   { ok: true,  vote, fresh: true, karma_delta }   — recorded now
-//   { ok: true,  vote, fresh: false }               — idempotent re-cast
+//   { ok: true,  vote, fresh: true, karma_delta, self_cast }  — recorded now
+//   { ok: true,  vote, fresh: false, self_cast }               — idempotent re-cast
 //   { ok: false, reason: 'item_not_found' | 'item_closed' | 'vote_window_expired'
-//               | 'not_board_member' | 'anti_self_vote' | <validateVote reason> }
+//               | 'not_board_member' | <validateVote reason> }
+// 'anti_self_vote' is GONE as of task 1003273 — an author may cast; what they
+// cannot do is decide alone, which shouldCloseAfterVote and tallyOutcome enforce.
+// A self-cast is recorded and visible but earns no karma (karma_delta: 0).
 async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKey = null } = {}) {
   const id = Number(itemId);
   if (!Number.isFinite(id) || id <= 0) return { ok: false, reason: 'item_not_found' };
@@ -237,20 +240,34 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
   const constitution = item.constitution || {};
   if (!(await isBoardMember(voterId, constitution))) return { ok: false, reason: 'not_board_member' };
 
-  // ANTI-SELF IS A FULL-IDEA RULE, NOT AN AMENDMENT RULE (R14, ADR 0175 §§7/11).
-  // The bright line exists because an idea's author GAINS from ratification
-  // (credits, legitimacy) — ceremonial self-ratification is what it prevents.
-  // An amendment pays nothing, and §7 explicitly blesses the monarchy act:
-  // under a one-Archon board with no clock, the proposer must be able to
-  // ratify their own amendment or the subject is dead on arrival — and adding
-  // a special escape for that case is the bootstrap exception §7 forbids.
-  // Skipping anti-self FOR AMENDMENTS is the rule that needs no exceptions.
-  if (item.subject_type === 'full_idea') {
-    const authorId = await db.getBoardItemAuthor(item);
-    if (authorId != null && String(authorId) === String(voterId)) {
-      return { ok: false, reason: 'anti_self_vote' };
-    }
-  }
+  // THE AUTHOR MAY NOW VOTE (task 1003273, owner decision 2026-08-25). The old
+  // rule refused an author's cast outright, which is defensible on a board of
+  // strangers and dead-ended here: every open item was authored by the one member
+  // reading them, so the room offered nine sittings and no ballot.
+  //
+  // WHAT REPLACES IT IS NOT A WEAKER RULE, IT IS A RULE IN A DIFFERENT PLACE.
+  // "An author never decides alone" is enforced where deciding actually happens —
+  // shouldCloseAfterVote (an author's cast never ends the sitting) and
+  // tallyOutcome (a majority with no non-author yes cannot carry, and an author's
+  // 'no' cannot return their own idea). Refusing the CAST was only ever a proxy
+  // for those, and it was the proxy that produced the deadlock.
+  //
+  // So there is no anti-self branch here any more, for either subject type. The
+  // amendment carve-out ADR 0175 §§7/11 blessed is subsumed rather than removed:
+  // a sole Archon proposing an amendment could always ratify it, and still can —
+  // that path never had a non-author to wait for, and an amendment pays nothing,
+  // which is why it was carved out in the first place.
+  //
+  // NO KARMA FOR VOTING ON YOUR OWN ITEM. The +1 exists to reward the work of
+  // reading someone else's idea and taking a position on it; paying it for a
+  // self-cast would make an author's own ballot a tiny income stream, and the
+  // owner's rule is that a self-vote confers no advantage.
+  // Not even asked for an amendment — the carve-out means there is nothing to
+  // learn, and the read is a query on the vote path.
+  const subjectAuthorId = authorRuleApplies(item.subject_type)
+    ? await db.getBoardItemAuthor(item)
+    : null;
+  const isSelfCast = subjectAuthorId != null && String(subjectAuthorId) === String(voterId);
 
   const inserted = await db.insertBoardVote({
     itemId: id, voterId, direction: v.direction, reasonMd: v.reasonMd, sectionKey: v.sectionKey,
@@ -258,12 +275,15 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
   if (!inserted) {
     // UNIQUE(item_id, voter_id) — the idempotent path. Return what stands.
     const existing = await db.getBoardVote(id, voterId);
-    return { ok: true, vote: existing, fresh: false };
+    return { ok: true, vote: existing, fresh: false, self_cast: isSelfCast };
   }
   // Karma rides the FRESH insert only, and the whole route refused a closed or
   // expired item above, so every paid vote is by construction in-window.
+  if (isSelfCast) {
+    return { ok: true, vote: inserted, fresh: true, karma_delta: 0, self_cast: true };
+  }
   await db.insertVoteKarma({ voterId, itemId: id, delta: VOTE_KARMA_DELTA });
-  return { ok: true, vote: inserted, fresh: true, karma_delta: VOTE_KARMA_DELTA };
+  return { ok: true, vote: inserted, fresh: true, karma_delta: VOTE_KARMA_DELTA, self_cast: false };
 }
 
 // ── close + tally (BV1.R10 of goal 1000069, ADR 0175 §3) ────────────────────
@@ -299,19 +319,128 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
 // `WHERE outcome = 'passed'` shape survives precisely because closing and
 // emitting are separate acts.
 
-// The whole counting rule. Absence is nulled by what this function DOESN'T
-// read: only cast votes exist here.
-function tallyOutcome(votes) {
-  return (votes || []).some((v) => v.direction === 'no') ? 'returned' : 'passed';
+// ── the author's own vote (task 1003273) ────────────────────────────────────
+//
+// THE RULE THE OWNER CHOSE, and the deadlock it replaces. The old line was flat:
+// an author could not vote on their own idea at all. That is defensible on a
+// board of strangers and produced a dead end here — every open item was authored
+// by the one person looking at them, so the Board Room showed nine sittings and
+// no ballot. The rule now: AN AUTHOR MAY VOTE, AND MAY NEVER DECIDE ALONE.
+//
+// "Never decide alone" is enforced in two places, because there are two ways to
+// decide something:
+//   1. by CLOSING it     — shouldCloseAfterVote requires a NON-AUTHOR vote, so
+//      an author's cast never trips the trigger that ends the sitting;
+//   2. by CARRYING it    — the majority tally requires at least one non-author
+//      YES, so a majority made only of the author cannot ratify.
+// An author's vote still counts toward the majority NUMERATOR (it is a real
+// vote — they sit on the board), it just can never be the whole of it.
+//
+// AND AN AUTHOR CAN NEVER MAKE THEIR OWN IDEA WORSE. Their 'no' is excluded from
+// the objection test, so voting on your own idea cannot return it — otherwise the
+// safest thing an author could do would be to stay silent, which is a strange
+// incentive to build into a board.
+// THE AUTHOR RULE IS A FULL_IDEA RULE, and that subject-typing is load-bearing
+// rather than tidy (ADR 0175 §§7/11). An idea's author GAINS from ratification
+// (credits, karma, legitimacy), which is what "never decide alone" guards. An
+// amendment pays nothing, and §7 explicitly blesses the monarchy act: on a
+// one-Archon board the proposer must be able to ratify their own amendment or
+// the whole subject type is dead on arrival — and a special escape for that case
+// is precisely the bootstrap exception §7 forbids. So the carve-out is not an
+// exception to the author rule, it is the author rule's scope.
+//
+// Everything downstream reads the author through this: for an amendment the
+// deciding author is NULL, so the trigger and the tally behave exactly as they
+// did before task 1003273.
+const authorRuleApplies = (subjectType) => subjectType === 'full_idea';
+
+// The author id that the DECIDING rules should see: the real one for a full
+// idea, nobody for an amendment.
+const decidingAuthorId = (subjectType, authorId) =>
+  (authorRuleApplies(subjectType) ? authorId : null);
+
+const isAuthorVote = (v, authorId) =>
+  authorId != null && String(v.voter_id) === String(authorId);
+
+// Votes that can DECIDE: everyone but the subject's author.
+const decidingVotes = (votes, authorId) =>
+  (votes || []).filter((v) => !isAuthorVote(v, authorId));
+
+// Strictly more than half — never >=. On an even board of 4 that is 3, not 2:
+// "more than half" is the honest reading of majority, and a tie is not a
+// majority. Of the resolved MEMBERSHIP, not of the votes cast, so low turnout
+// cannot quietly pass something on two voices out of nine.
+function hasMajority(yesCount, memberCount) {
+  if (!Number.isFinite(memberCount) || memberCount <= 0) return false;
+  return yesCount * 2 > memberCount;
+}
+
+// The whole counting rule. Under the two absence-passes rules, absence is nulled
+// by what this function DOESN'T read: only cast votes exist here. Under
+// `majority` absence is the opposite — it is counted, via the membership
+// denominator — which is exactly what makes silence not assent.
+function tallyOutcome(votes, { constitution = {}, members = null, authorId = null } = {}) {
+  const list = votes || [];
+  if (constitution.pass_rule === 'majority') {
+    const yes = list.filter((v) => v.direction === 'yes');
+    const memberCount = Array.isArray(members) ? members.length : 0;
+    // Both conditions, or it returns: a majority of the membership said yes, AND
+    // at least one voice that was not the author's is among them.
+    const carried = hasMajority(yes.length, memberCount)
+      && yes.some((v) => !isAuthorVote(v, authorId));
+    return carried ? 'passed' : 'returned';
+  }
+  // first_ratifier / consent / anything unknown: one reasoned objection returns
+  // the idea, anything else — including ZERO votes — passes. The author's own
+  // vote is excluded so they cannot return their own idea.
+  return decidingVotes(list, authorId).some((v) => v.direction === 'no') ? 'returned' : 'passed';
+}
+
+// Is this majority sitting already DECIDED, whatever the absent members do? Once
+// the yes votes clear the bar the outcome cannot change (there is no
+// vote-changing in v1), and once enough members have voted the OTHER way that the
+// remaining ones cannot reach the bar, it cannot change either. Closing then is
+// not impatience — it is refusing to hold a sitting whose answer is already
+// fixed, which is the same reason consent closes on full turnout.
+function majorityDecided({ votes, members, authorId }) {
+  const list = votes || [];
+  const memberCount = Array.isArray(members) ? members.length : 0;
+  if (!memberCount) return false; // an empty board decides nothing
+  const yes = list.filter((v) => v.direction === 'yes');
+  // Already carried — but only if a non-author yes is among them, since a
+  // majority that is only the author can still be joined by someone who makes
+  // it legitimate. Closing early there would deny the item its one real voice.
+  if (hasMajority(yes.length, memberCount) && yes.some((v) => !isAuthorVote(v, authorId))) return true;
+  // Already unreachable: even if every member who has not voted votes yes, the
+  // bar cannot be met. A member who voted 'no' cannot vote again (v1).
+  const voted = new Set(list.map((v) => String(v.voter_id)));
+  const notYetVoted = members.filter((m) => !voted.has(String(m.builder_id))).length;
+  return !hasMajority(yes.length + notYetVoted, memberCount);
 }
 
 // Should a just-cast vote close the item now, under the SNAPSHOTTED rule?
-function shouldCloseAfterVote({ constitution, votes, members } = {}) {
+//
+// EVERY RULE NEEDS A NON-AUTHOR VOTE FIRST (task 1003273): an author's cast is
+// recorded but never ends the sitting. Without this an author could close their
+// own item under first_ratifier — the very self-decision the rule forbids.
+function shouldCloseAfterVote({ constitution, votes, members, authorId = null } = {}) {
   const rule = (constitution || {}).pass_rule;
-  if (rule === 'first_ratifier') return (votes || []).length >= 1;
+  const deciding = decidingVotes(votes, authorId);
+  if (rule === 'first_ratifier') return deciding.length >= 1;
+  if (rule === 'majority') {
+    if (!deciding.length) return false; // nobody but the author has spoken
+    if (majorityDecided({ votes, members, authorId })) return true;
+    // Full turnout closes it too, when the constitution says so — the same
+    // courtesy consent gets, and by then every position is on the record.
+    if (!(constitution || {}).close_early_on_full_turnout) return false;
+    if (!members || !members.length) return false;
+    const voters = new Set((votes || []).map((v) => String(v.voter_id)));
+    return members.every((m) => voters.has(String(m.builder_id)));
+  }
   if (rule === 'consent') {
     if (!(constitution || {}).close_early_on_full_turnout) return false;
     if (!members || !members.length) return false; // an empty board has no turnout to complete
+    if (!deciding.length) return false;
     const voters = new Set((votes || []).map((v) => String(v.voter_id)));
     return members.every((m) => voters.has(String(m.builder_id)));
   }
@@ -357,15 +486,46 @@ function passPayload(closed, { authorId, completenessScore, passedAt }) {
 async function closeItem(item, { cause = 'vote' } = {}) {
   if (!item || item.closed_at) return { closed: false, reason: 'already_closed' };
   const votes = await db.getVotesForItem(item.id);
-  const outcome = tallyOutcome(votes);
+  const constitution = item.constitution || {};
+
+  // THE TALLY'S INPUTS ARE READ HERE, NOT PASSED IN, so the two callers — a
+  // racing vote and the expiry sweep — cannot disagree about what a close means
+  // (the invariant R10 already held for the outcome now has to hold for the
+  // majority denominator too). Both are resolved against the item's SNAPSHOT and
+  // the live rows, uncached, the same ADR 0016 posture as every other read here.
+  //
+  // authorId moved AHEAD of the tally (task 1003273): it used to be fetched only
+  // on a pass, for the payload, but the author rule makes it an INPUT to the
+  // outcome — an author's vote must not return their own idea, and a majority
+  // made only of the author must not carry it.
+  // Read ONLY when a decision actually depends on it. For a full idea the author
+  // is an INPUT to the outcome (their 'no' cannot return their own idea, and a
+  // majority with no other voice cannot carry it), so it must be known before the
+  // tally. For an amendment the carve-out makes it irrelevant to the outcome, so
+  // the read stays where it always was — after the tally, only on a pass, for the
+  // payload and the ratification karma. Same query count as before this task on
+  // the amendment path, one extra on an idea close.
+  let authorId = authorRuleApplies(item.subject_type)
+    ? await db.getBoardItemAuthor(item)
+    : null;
+  // Only `majority` needs the membership denominator; the absence-passes rules
+  // read nothing but the cast votes, so we do not spend the query on them.
+  const members = constitution.pass_rule === 'majority'
+    ? await resolveBoardMembers(constitution)
+    : null;
+  const outcome = tallyOutcome(votes, {
+    constitution, members,
+    // Subject-typed: an amendment's proposer is not held to the author rule (§7).
+    authorId: decidingAuthorId(item.subject_type, authorId),
+  });
 
-  // The payload's reads, ahead of the transaction (reads never ride a tx they
-  // don't need). Only a pass needs them, and only a full_idea can pay.
-  let authorId = null;
+  // The payload's remaining reads (reads never ride a tx they don't need). Only a
+  // pass needs them, and only a full_idea can pay.
   let completenessScore = null;
   let credit = null;
   if (outcome === 'passed') {
-    authorId = await db.getBoardItemAuthor(item);
+    // The amendment path's author, deferred to here — see the note above.
+    if (authorId == null) authorId = await db.getBoardItemAuthor(item);
     if (item.subject_type === 'full_idea') {
       completenessScore = await db.getIdeaCompleteness(item.subject_id);
     }
@@ -444,7 +604,12 @@ async function maybeCloseAfterVote(itemId) {
   const constitution = item.constitution || {};
   const votes = await db.getVotesForItem(item.id);
   const members = await resolveBoardMembers(constitution);
-  if (!shouldCloseAfterVote({ constitution, votes, members })) {
+  // task 1003273: the author is an input to the trigger, not just the tally — an
+  // author's cast must never be the vote that ends the sitting.
+  const authorId = authorRuleApplies(item.subject_type)
+    ? await db.getBoardItemAuthor(item)
+    : null;
+  if (!shouldCloseAfterVote({ constitution, votes, members, authorId })) {
     return { closed: false, reason: 'window_still_open' };
   }
   return closeItem(item, { cause: 'vote' });
@@ -719,7 +884,77 @@ async function latestRejectionForIdea(ideaId) {
   });
 }
 
+// ── the summons: what is waiting on THIS member's vote (task 1003271) ───────
+//
+// THE PROBLEM THIS EXISTS TO FIX. Nine items sat open for two days with zero
+// votes. The board was not deadlocked — three of the four archons could each
+// have carried any of them with one click — they simply never learned a vote was
+// wanted. The Discord announcer (R21) is the only summons there has ever been,
+// and it is BEST-EFFORT BY CONSTRUCTION: an unconfigured webhook, an unlinked
+// member, or a failed POST all end in a swallowed log line. A nudge that can
+// silently not happen cannot be the only nudge.
+//
+// So the durable summons is the one surface every session and every hall visit
+// already reads: the builder-needs roster on /me (ADR 0073). This function is
+// its counter. Discord stays exactly what §8 says it is — a notification, not a
+// ballot — and voting stays hall-only (ADR 0175 §8, owner decision 2026-08-25).
+//
+// WHY MEMBERSHIP IS RESOLVED HERE AND NOT IN SQL. Each item snapshots the
+// constitution it opened under, so "may this builder vote on THIS item" is a
+// per-item predicate over the LIVE rank rows — the ADR 0016 posture the rest of
+// this module keeps (per request, uncached). Resolved once per DISTINCT
+// predicate rather than once per item, so nine items under one constitution cost
+// one membership resolve, not nine.
+//
+// It counts what the vote route would ACCEPT, so the roster can never promise a
+// ballot the route then refuses:
+//   - open, not past its deadline        (the SQL's WHERE)
+//   - this builder has not already cast  (UNIQUE(item_id, voter_id) — one vote each)
+//   - this builder is a board member under the item's OWN snapshot
+//   - this builder is not the subject's author (the anti-self-vote line, §3)
+// Fail-closed on an unreadable constitution: parseMembershipPredicate yields
+// nobody, so a malformed snapshot summons no one rather than everyone.
+async function pendingVotesFor(builderId) {
+  const empty = Object.freeze({ count: 0, first_item_id: null });
+  if (builderId === null || builderId === undefined || builderId === '') return empty;
+  let rows;
+  try {
+    rows = await db.openBoardItemsAwaitingVoter(builderId);
+  } catch (_) {
+    // A summons that cannot be counted is a quiet session, never a failed /me.
+    return empty;
+  }
+  if (!rows || !rows.length) return empty;
+
+  // One membership answer per distinct predicate. The predicate string IS the
+  // cache key: two items under the same membership have the same answer, and the
+  // resolve is a DB read we should not repeat nine times on the session hot path.
+  const membershipCache = new Map();
+  const votable = [];
+  for (const row of rows) {
+    if (row.already_voted) continue;
+    // The author does not vote on their own item (§3). Null author = nobody to
+    // disqualify, so the item stays votable.
+    if (row.author_id != null && String(row.author_id) === String(builderId)) continue;
+    const constitution = row.constitution || {};
+    const key = String(constitution.membership || '');
+    if (!membershipCache.has(key)) {
+      membershipCache.set(key, await isBoardMember(builderId, constitution).catch(() => false));
+    }
+    if (!membershipCache.get(key)) continue;
+    votable.push(row);
+  }
+  if (!votable.length) return empty;
+  // Oldest first (the SQL's ORDER BY), so the deep link lands on the sitting
+  // that has been waiting longest rather than an arbitrary one.
+  return Object.freeze({ count: votable.length, first_item_id: String(votable[0].id) });
+}
+
 module.exports = {
+  pendingVotesFor,
+  hasMajority,
+  majorityDecided,
+  decidingVotes,
   FULL_IDEA_PASS_BAR,
   ideaPassesBar,
   openWindowForFullIdea,

package/modules/government/config.js

@@ -141,6 +141,13 @@ function sanitizeRole(key, raw) {
 // predicate says which RANK governs; who actually holds that rank stays a DB row,
 // resolved per request by R06's membership resolver. Nothing here names a builder,
 // and a config edit cannot make anyone a board member.
+// WHY window_minutes STAYS null HERE (task 1003273). A clock is only safe under
+// a rule where expiry means RETURN. Under first_ratifier and consent the tally
+// passes on absence, so giving a sitting a deadline would make the expiry sweep
+// ratify items NOBODY READ — paying author karma and the idea credit on them.
+// A project that wants a clock wants `majority` first, and sets both together in
+// its own instance pack; the neutral default must not hand every instance an
+// auto-ratifier.
 const BOARD_DEFAULTS = Object.freeze({
   membership: 'rank:archon',
   pass_rule: 'first_ratifier',
@@ -148,11 +155,25 @@ const BOARD_DEFAULTS = Object.freeze({
   close_early_on_full_turnout: true,
 });
 
-// The pass rules that EXIST, not the ones a project should pick. `consent` is the
-// documented recommendation once a project has a board worth sitting (all Archons,
-// one vote each, consent, a 90-minute window); `first_ratifier` is the day-one
-// default and what an unreadable value falls back to.
-const PASS_RULES = Object.freeze(['first_ratifier', 'consent']);
+// The pass rules that EXIST, not the ones a project should pick. `first_ratifier`
+// is the day-one default and what an unreadable value falls back to.
+//
+// THE THREE ARE NOT A LADDER OF STRICTNESS — they differ in what SILENCE means,
+// which is the axis that actually matters (task 1003273):
+//   • first_ratifier — one affirmative act decides. Silence passes (the tally
+//     only returns on a reasoned objection), so an unvoted item ratifies.
+//   • consent        — the same tally over a sitting; an empty window passes
+//     UNOPPOSED. Silence is assent, deliberately (owner decision 6).
+//   • majority       — strictly more than half of the RESOLVED MEMBERSHIP must
+//     vote yes. Silence is NOT assent: an item that never reaches a majority
+//     RETURNS at expiry. This is the only rule under which not voting is a
+//     meaningful act, and the only one where a clock is safe — see the note on
+//     window_minutes below.
+// Adding `majority` cannot widen the fail-closed fallback: sanitizeBoard still
+// falls back to first_ratifier, and majority is the STRICTER end of this axis
+// anyway (it demands affirmative votes from a majority, where the other two
+// pass on absence).
+const PASS_RULES = Object.freeze(['first_ratifier', 'consent', 'majority']);
 
 // A membership predicate names WHO SITS. The grammar and its parser live in
 // ./membership-predicate — ONE implementation, shared with R06's resolver

package/modules/government/db.js

@@ -618,6 +618,52 @@ async function getExpiredOpenBoardItems(limit = 100) {
   return rows;
 }
 
+// The summons read (task 1003271): every OPEN item this builder could still
+// vote on, with the two facts that decide it — who authored the subject, and
+// whether this builder has already cast. Membership is NOT decided here: it
+// depends on the item's SNAPSHOTTED constitution predicate, which board.js
+// resolves against the live rank rows (the ADR 0016 posture — per request,
+// uncached). This query's job is to make that resolution cheap by handing back
+// everything else in ONE round trip instead of three per item.
+//
+// Expired items are excluded: a sitting past its deadline is the expiry sweep's
+// to close, and nagging someone to vote on it would be asking for a vote the
+// close will not count.
+//
+// The author join mirrors getBoardItemAuthor exactly — full_idea authorship is
+// idea_inbox.captured_by, and anything else is opened_by. Kept as a LEFT JOIN so
+// an item whose idea row is gone still appears with a null author (it has no
+// author to disqualify, so it stays votable) rather than vanishing from the count.
+//
+// INDEXES THIS RELIES ON — all three already exist (government_003), which is why
+// this adds no migration:
+//   - government_board_items_open_by_deadline ON (closes_at) WHERE closed_at IS NULL
+//     — a PARTIAL index whose predicate is exactly this query's `closed_at IS NULL`,
+//       and whose key is the `closes_at` it then filters on.
+//   - government_board_votes_one_per_voter UNIQUE (item_id, voter_id) — the votes
+//     LEFT JOIN's two columns, in that order, so "did this voter cast on this item"
+//     is one index probe rather than a scan of the item's ballot.
+//   - idea_inbox's primary key, for the author join.
+// The open set is also intrinsically small (an open item is one awaiting a decision,
+// not history — the closed rows are the unbounded side, per ADR 0175 §4).
+async function openBoardItemsAwaitingVoter(voterId) {
+  const { rows } = await pool.query(
+    `SELECT i.id, i.subject_type, i.subject_id, i.constitution, i.opened_at, i.closes_at,
+            CASE WHEN i.subject_type = 'full_idea' THEN idea.captured_by ELSE i.opened_by END AS author_id,
+            (v.id IS NOT NULL) AS already_voted
+       FROM government_board_items i
+       LEFT JOIN idea_inbox idea
+              ON i.subject_type = 'full_idea' AND idea.id = i.subject_id
+       LEFT JOIN government_board_votes v
+              ON v.item_id = i.id AND v.voter_id = $1
+      WHERE i.closed_at IS NULL
+        AND (i.closes_at IS NULL OR i.closes_at >= now())
+      ORDER BY i.opened_at`,
+    [voterId],
+  );
+  return rows;
+}
+
 // Author-ratification karma (+3, board.js AUTHOR_RATIFY_KARMA_DELTA) — fired by
 // the R10 close on a passed item. IDEMPOTENT: the reason key is unique per item
 // and the INSERT is one atomic WHERE-NOT-EXISTS statement (the economy
@@ -645,6 +691,7 @@ async function insertVoteKarma({ voterId, itemId, delta }) {
 }
 
 module.exports = {
+  openBoardItemsAwaitingVoter,
   getPermissionKeysForBuilder,
   getRankKeysForBuilder,
   getSeededRanks,

package/modules/government/routes/government.js

@@ -93,6 +93,12 @@ const governmentPort = {
   // bar gate lives INSIDE board.js (a sub-bar idea never reaches the board, and
   // no caller is trusted to pre-filter). Returns, never throws into capture.
   openBoardWindowForIdea: board.openWindowForFullIdea,
+  // task 1003271: how many open sittings are waiting on THIS builder's vote
+  // (member under the item's own snapshot, not the author, has not yet cast).
+  // On the port because the summons is rendered by the kernel's builder-needs
+  // roster on /me — the one surface every session already reads — and core
+  // imports no module (ADR 0093).
+  pendingBoardVotesFor: board.pendingVotesFor,
   // R13: the feedback a board-returned idea carries back to its author — the
   // resubmit path in modules/ideas resolves this to show what was objected to
   // and to check whether the flagged section actually changed.
@@ -534,7 +540,12 @@ module.exports = function buildGovernmentRouter() {
         const status =
           out.reason === 'item_not_found' ? 404 :
           out.reason === 'not_board_member' ? 403 :
-          out.reason === 'anti_self_vote' ? 403 :
+          // 'anti_self_vote' was retired by task 1003273 — an author may cast;
+          // what they cannot do is decide alone, which the close trigger and the
+          // tally enforce rather than the route. The mapping is left OUT rather
+          // than kept "just in case": a reason castVote can no longer return
+          // would be dead code pretending to be a wall.
+
           out.reason === 'item_closed' ? 409 :
           out.reason === 'vote_window_expired' ? 409 :
           400; // bad_direction / yes_carries_nothing / objection_needs_reason / objection_needs_section

package/modules/hall-ui/public/government.js

@@ -89,7 +89,6 @@
     validation_failed: 'Missing or invalid fields.',
     // the vote refusals (R17 over R08's route)
     not_board_member: 'Only members of this item\u2019s board may vote on it \u2014 membership follows the rules that were in force when the window opened.',
-    anti_self_vote: 'You can\u2019t vote on your own idea \u2014 that\u2019s the line that keeps ratification honest.',
     item_closed: 'This sitting has closed \u2014 refreshing.',
     vote_window_expired: 'This sitting\u2019s clock has run out \u2014 the sweep is closing it.',
     objection_needs_reason: 'An objection must say why \u2014 write the reason.',
@@ -519,6 +518,14 @@
     if (board.pass_rule === 'consent') {
       return 'Items pass by <strong>consent</strong>: silence is consent, a single reasoned objection returns the item to its author, and a sitting that ends with no votes at all passes.';
     }
+    // task 1003273. The sentence leads with what silence means, because that is
+    // the axis these three rules actually differ on and the one that surprises
+    // people: under the other two an unvoted item passes, under this one it does not.
+    if (board.pass_rule === 'majority') {
+      return 'Items pass by <strong>majority</strong>: more than half of the board must vote yes \u2014 not just more yes than no. '
+        + 'Silence is <em>not</em> agreement here, so an item that never reaches a majority is returned to its author. '
+        + 'An author may vote on their own idea, but it can never be carried by their vote alone.';
+    }
     return `Pass rule: <code>${escapeHtml(String(board.pass_rule || 'unset'))}</code>.`;
   }
 
@@ -694,9 +701,12 @@
       return rem || 'timed sitting';
     }
     const rule = item.constitution && item.constitution.pass_rule;
-    return rule === 'first_ratifier'
-      ? 'no clock — closes on the first vote'
-      : 'no clock';
+    if (rule === 'first_ratifier') return 'no clock — closes on the first vote';
+    // A clockless majority sitting is worth naming honestly: without a deadline
+    // it waits indefinitely for a majority, which is a real state a project can
+    // configure itself into (task 1003273).
+    if (rule === 'majority') return 'no clock — waits for a majority';
+    return 'no clock';
   }
 
   function ballotHtml(item, viewerId) {
@@ -750,12 +760,22 @@
     if (item.closed_at) return '';
     const mine = item.votes.find((v) => String(v.voter_id) === String(viewerId));
     if (mine) return '';
-    if (item.subject_type === 'full_idea' && item.subject && String(item.subject.author_id) === String(viewerId)) {
-      return `<p class="gov-grid-note">This is your idea \u2014 its author does not vote on it. The board decides; a return comes back to you with its reason.</p>`;
-    }
+    // TASK 1003273: the author gets a REAL ballot. The old branch returned a note
+    // and no form, which is what made the Board Room show nine sittings and no
+    // way to vote on any of them — every one of them was the reader's own. They
+    // may now cast; what they cannot do is decide alone (the close trigger needs
+    // a voice that is not theirs, and a majority made only of them cannot carry).
+    // The note says so instead of refusing, so the limit is visible rather than
+    // discovered by clicking.
+    const isOwnIdea = item.subject_type === 'full_idea'
+      && item.subject && String(item.subject.author_id) === String(viewerId);
     const sections = Object.keys(SECTION_LABELS).map((key) => `
       <label class="gov-perm" style="cursor:pointer"><input type="radio" name="vote-section-${escapeHtml(item.id)}" value="${escapeHtml(key)}"> <span>${escapeHtml(SECTION_LABELS[key])}</span></label>`).join('');
+    const ownNote = isOwnIdea
+      ? `<p class="gov-grid-note">This is your idea. You can vote on it \u2014 your position belongs on the record \u2014 but it can\u2019t be decided by your vote alone, and a vote on your own idea earns no karma.</p>`
+      : '';
     return `<div class="gov-vote" data-item="${escapeHtml(item.id)}">
+      ${ownNote}
       <button type="button" class="gov-btn" data-vote="yes">Vote yes</button>
       <details class="gov-vote__no">
         <summary class="gov-btn gov-btn--ghost">Object\u2026</summary>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.363",
+  "version": "1.19.365",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.363",
+      "version": "1.19.365",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.363",
+  "version": "1.19.365",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",