@bongos/core 1.19.364 → 1.19.366

package/modules/government/board.js

@@ -214,10 +214,13 @@ function validateVote({ direction, reasonMd, sectionKey } = {}) {
 
 // Cast a vote on an open item. Returns a typed result, never throws for a
 // policy refusal — the route maps each to its status:
-//   { ok: true,  vote, fresh: true, karma_delta }   — recorded now
-//   { ok: true,  vote, fresh: false }               — idempotent re-cast
+//   { ok: true,  vote, fresh: true, karma_delta, self_cast }  — recorded now
+//   { ok: true,  vote, fresh: false, self_cast }               — idempotent re-cast
 //   { ok: false, reason: 'item_not_found' | 'item_closed' | 'vote_window_expired'
-//               | 'not_board_member' | 'anti_self_vote' | <validateVote reason> }
+//               | 'not_board_member' | <validateVote reason> }
+// 'anti_self_vote' is GONE as of task 1003273 — an author may cast; what they
+// cannot do is decide alone, which shouldCloseAfterVote and tallyOutcome enforce.
+// A self-cast is recorded and visible but earns no karma (karma_delta: 0).
 async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKey = null } = {}) {
   const id = Number(itemId);
   if (!Number.isFinite(id) || id <= 0) return { ok: false, reason: 'item_not_found' };
@@ -237,20 +240,34 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
   const constitution = item.constitution || {};
   if (!(await isBoardMember(voterId, constitution))) return { ok: false, reason: 'not_board_member' };
 
-  // ANTI-SELF IS A FULL-IDEA RULE, NOT AN AMENDMENT RULE (R14, ADR 0175 §§7/11).
-  // The bright line exists because an idea's author GAINS from ratification
-  // (credits, legitimacy) — ceremonial self-ratification is what it prevents.
-  // An amendment pays nothing, and §7 explicitly blesses the monarchy act:
-  // under a one-Archon board with no clock, the proposer must be able to
-  // ratify their own amendment or the subject is dead on arrival — and adding
-  // a special escape for that case is the bootstrap exception §7 forbids.
-  // Skipping anti-self FOR AMENDMENTS is the rule that needs no exceptions.
-  if (item.subject_type === 'full_idea') {
-    const authorId = await db.getBoardItemAuthor(item);
-    if (authorId != null && String(authorId) === String(voterId)) {
-      return { ok: false, reason: 'anti_self_vote' };
-    }
-  }
+  // THE AUTHOR MAY NOW VOTE (task 1003273, owner decision 2026-08-25). The old
+  // rule refused an author's cast outright, which is defensible on a board of
+  // strangers and dead-ended here: every open item was authored by the one member
+  // reading them, so the room offered nine sittings and no ballot.
+  //
+  // WHAT REPLACES IT IS NOT A WEAKER RULE, IT IS A RULE IN A DIFFERENT PLACE.
+  // "An author never decides alone" is enforced where deciding actually happens —
+  // shouldCloseAfterVote (an author's cast never ends the sitting) and
+  // tallyOutcome (a majority with no non-author yes cannot carry, and an author's
+  // 'no' cannot return their own idea). Refusing the CAST was only ever a proxy
+  // for those, and it was the proxy that produced the deadlock.
+  //
+  // So there is no anti-self branch here any more, for either subject type. The
+  // amendment carve-out ADR 0175 §§7/11 blessed is subsumed rather than removed:
+  // a sole Archon proposing an amendment could always ratify it, and still can —
+  // that path never had a non-author to wait for, and an amendment pays nothing,
+  // which is why it was carved out in the first place.
+  //
+  // NO KARMA FOR VOTING ON YOUR OWN ITEM. The +1 exists to reward the work of
+  // reading someone else's idea and taking a position on it; paying it for a
+  // self-cast would make an author's own ballot a tiny income stream, and the
+  // owner's rule is that a self-vote confers no advantage.
+  // Not even asked for an amendment — the carve-out means there is nothing to
+  // learn, and the read is a query on the vote path.
+  const subjectAuthorId = authorRuleApplies(item.subject_type)
+    ? await db.getBoardItemAuthor(item)
+    : null;
+  const isSelfCast = subjectAuthorId != null && String(subjectAuthorId) === String(voterId);
 
   const inserted = await db.insertBoardVote({
     itemId: id, voterId, direction: v.direction, reasonMd: v.reasonMd, sectionKey: v.sectionKey,
@@ -258,12 +275,15 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
   if (!inserted) {
     // UNIQUE(item_id, voter_id) — the idempotent path. Return what stands.
     const existing = await db.getBoardVote(id, voterId);
-    return { ok: true, vote: existing, fresh: false };
+    return { ok: true, vote: existing, fresh: false, self_cast: isSelfCast };
   }
   // Karma rides the FRESH insert only, and the whole route refused a closed or
   // expired item above, so every paid vote is by construction in-window.
+  if (isSelfCast) {
+    return { ok: true, vote: inserted, fresh: true, karma_delta: 0, self_cast: true };
+  }
   await db.insertVoteKarma({ voterId, itemId: id, delta: VOTE_KARMA_DELTA });
-  return { ok: true, vote: inserted, fresh: true, karma_delta: VOTE_KARMA_DELTA };
+  return { ok: true, vote: inserted, fresh: true, karma_delta: VOTE_KARMA_DELTA, self_cast: false };
 }
 
 // ── close + tally (BV1.R10 of goal 1000069, ADR 0175 §3) ────────────────────
@@ -299,19 +319,128 @@ async function castVote({ itemId, voterId, direction, reasonMd = null, sectionKe
 // `WHERE outcome = 'passed'` shape survives precisely because closing and
 // emitting are separate acts.
 
-// The whole counting rule. Absence is nulled by what this function DOESN'T
-// read: only cast votes exist here.
-function tallyOutcome(votes) {
-  return (votes || []).some((v) => v.direction === 'no') ? 'returned' : 'passed';
+// ── the author's own vote (task 1003273) ────────────────────────────────────
+//
+// THE RULE THE OWNER CHOSE, and the deadlock it replaces. The old line was flat:
+// an author could not vote on their own idea at all. That is defensible on a
+// board of strangers and produced a dead end here — every open item was authored
+// by the one person looking at them, so the Board Room showed nine sittings and
+// no ballot. The rule now: AN AUTHOR MAY VOTE, AND MAY NEVER DECIDE ALONE.
+//
+// "Never decide alone" is enforced in two places, because there are two ways to
+// decide something:
+//   1. by CLOSING it     — shouldCloseAfterVote requires a NON-AUTHOR vote, so
+//      an author's cast never trips the trigger that ends the sitting;
+//   2. by CARRYING it    — the majority tally requires at least one non-author
+//      YES, so a majority made only of the author cannot ratify.
+// An author's vote still counts toward the majority NUMERATOR (it is a real
+// vote — they sit on the board), it just can never be the whole of it.
+//
+// AND AN AUTHOR CAN NEVER MAKE THEIR OWN IDEA WORSE. Their 'no' is excluded from
+// the objection test, so voting on your own idea cannot return it — otherwise the
+// safest thing an author could do would be to stay silent, which is a strange
+// incentive to build into a board.
+// THE AUTHOR RULE IS A FULL_IDEA RULE, and that subject-typing is load-bearing
+// rather than tidy (ADR 0175 §§7/11). An idea's author GAINS from ratification
+// (credits, karma, legitimacy), which is what "never decide alone" guards. An
+// amendment pays nothing, and §7 explicitly blesses the monarchy act: on a
+// one-Archon board the proposer must be able to ratify their own amendment or
+// the whole subject type is dead on arrival — and a special escape for that case
+// is precisely the bootstrap exception §7 forbids. So the carve-out is not an
+// exception to the author rule, it is the author rule's scope.
+//
+// Everything downstream reads the author through this: for an amendment the
+// deciding author is NULL, so the trigger and the tally behave exactly as they
+// did before task 1003273.
+const authorRuleApplies = (subjectType) => subjectType === 'full_idea';
+
+// The author id that the DECIDING rules should see: the real one for a full
+// idea, nobody for an amendment.
+const decidingAuthorId = (subjectType, authorId) =>
+  (authorRuleApplies(subjectType) ? authorId : null);
+
+const isAuthorVote = (v, authorId) =>
+  authorId != null && String(v.voter_id) === String(authorId);
+
+// Votes that can DECIDE: everyone but the subject's author.
+const decidingVotes = (votes, authorId) =>
+  (votes || []).filter((v) => !isAuthorVote(v, authorId));
+
+// Strictly more than half — never >=. On an even board of 4 that is 3, not 2:
+// "more than half" is the honest reading of majority, and a tie is not a
+// majority. Of the resolved MEMBERSHIP, not of the votes cast, so low turnout
+// cannot quietly pass something on two voices out of nine.
+function hasMajority(yesCount, memberCount) {
+  if (!Number.isFinite(memberCount) || memberCount <= 0) return false;
+  return yesCount * 2 > memberCount;
+}
+
+// The whole counting rule. Under the two absence-passes rules, absence is nulled
+// by what this function DOESN'T read: only cast votes exist here. Under
+// `majority` absence is the opposite — it is counted, via the membership
+// denominator — which is exactly what makes silence not assent.
+function tallyOutcome(votes, { constitution = {}, members = null, authorId = null } = {}) {
+  const list = votes || [];
+  if (constitution.pass_rule === 'majority') {
+    const yes = list.filter((v) => v.direction === 'yes');
+    const memberCount = Array.isArray(members) ? members.length : 0;
+    // Both conditions, or it returns: a majority of the membership said yes, AND
+    // at least one voice that was not the author's is among them.
+    const carried = hasMajority(yes.length, memberCount)
+      && yes.some((v) => !isAuthorVote(v, authorId));
+    return carried ? 'passed' : 'returned';
+  }
+  // first_ratifier / consent / anything unknown: one reasoned objection returns
+  // the idea, anything else — including ZERO votes — passes. The author's own
+  // vote is excluded so they cannot return their own idea.
+  return decidingVotes(list, authorId).some((v) => v.direction === 'no') ? 'returned' : 'passed';
+}
+
+// Is this majority sitting already DECIDED, whatever the absent members do? Once
+// the yes votes clear the bar the outcome cannot change (there is no
+// vote-changing in v1), and once enough members have voted the OTHER way that the
+// remaining ones cannot reach the bar, it cannot change either. Closing then is
+// not impatience — it is refusing to hold a sitting whose answer is already
+// fixed, which is the same reason consent closes on full turnout.
+function majorityDecided({ votes, members, authorId }) {
+  const list = votes || [];
+  const memberCount = Array.isArray(members) ? members.length : 0;
+  if (!memberCount) return false; // an empty board decides nothing
+  const yes = list.filter((v) => v.direction === 'yes');
+  // Already carried — but only if a non-author yes is among them, since a
+  // majority that is only the author can still be joined by someone who makes
+  // it legitimate. Closing early there would deny the item its one real voice.
+  if (hasMajority(yes.length, memberCount) && yes.some((v) => !isAuthorVote(v, authorId))) return true;
+  // Already unreachable: even if every member who has not voted votes yes, the
+  // bar cannot be met. A member who voted 'no' cannot vote again (v1).
+  const voted = new Set(list.map((v) => String(v.voter_id)));
+  const notYetVoted = members.filter((m) => !voted.has(String(m.builder_id))).length;
+  return !hasMajority(yes.length + notYetVoted, memberCount);
 }
 
 // Should a just-cast vote close the item now, under the SNAPSHOTTED rule?
-function shouldCloseAfterVote({ constitution, votes, members } = {}) {
+//
+// EVERY RULE NEEDS A NON-AUTHOR VOTE FIRST (task 1003273): an author's cast is
+// recorded but never ends the sitting. Without this an author could close their
+// own item under first_ratifier — the very self-decision the rule forbids.
+function shouldCloseAfterVote({ constitution, votes, members, authorId = null } = {}) {
   const rule = (constitution || {}).pass_rule;
-  if (rule === 'first_ratifier') return (votes || []).length >= 1;
+  const deciding = decidingVotes(votes, authorId);
+  if (rule === 'first_ratifier') return deciding.length >= 1;
+  if (rule === 'majority') {
+    if (!deciding.length) return false; // nobody but the author has spoken
+    if (majorityDecided({ votes, members, authorId })) return true;
+    // Full turnout closes it too, when the constitution says so — the same
+    // courtesy consent gets, and by then every position is on the record.
+    if (!(constitution || {}).close_early_on_full_turnout) return false;
+    if (!members || !members.length) return false;
+    const voters = new Set((votes || []).map((v) => String(v.voter_id)));
+    return members.every((m) => voters.has(String(m.builder_id)));
+  }
   if (rule === 'consent') {
     if (!(constitution || {}).close_early_on_full_turnout) return false;
     if (!members || !members.length) return false; // an empty board has no turnout to complete
+    if (!deciding.length) return false;
     const voters = new Set((votes || []).map((v) => String(v.voter_id)));
     return members.every((m) => voters.has(String(m.builder_id)));
   }
@@ -357,15 +486,46 @@ function passPayload(closed, { authorId, completenessScore, passedAt }) {
 async function closeItem(item, { cause = 'vote' } = {}) {
   if (!item || item.closed_at) return { closed: false, reason: 'already_closed' };
   const votes = await db.getVotesForItem(item.id);
-  const outcome = tallyOutcome(votes);
+  const constitution = item.constitution || {};
 
-  // The payload's reads, ahead of the transaction (reads never ride a tx they
-  // don't need). Only a pass needs them, and only a full_idea can pay.
-  let authorId = null;
+  // THE TALLY'S INPUTS ARE READ HERE, NOT PASSED IN, so the two callers — a
+  // racing vote and the expiry sweep — cannot disagree about what a close means
+  // (the invariant R10 already held for the outcome now has to hold for the
+  // majority denominator too). Both are resolved against the item's SNAPSHOT and
+  // the live rows, uncached, the same ADR 0016 posture as every other read here.
+  //
+  // authorId moved AHEAD of the tally (task 1003273): it used to be fetched only
+  // on a pass, for the payload, but the author rule makes it an INPUT to the
+  // outcome — an author's vote must not return their own idea, and a majority
+  // made only of the author must not carry it.
+  // Read ONLY when a decision actually depends on it. For a full idea the author
+  // is an INPUT to the outcome (their 'no' cannot return their own idea, and a
+  // majority with no other voice cannot carry it), so it must be known before the
+  // tally. For an amendment the carve-out makes it irrelevant to the outcome, so
+  // the read stays where it always was — after the tally, only on a pass, for the
+  // payload and the ratification karma. Same query count as before this task on
+  // the amendment path, one extra on an idea close.
+  let authorId = authorRuleApplies(item.subject_type)
+    ? await db.getBoardItemAuthor(item)
+    : null;
+  // Only `majority` needs the membership denominator; the absence-passes rules
+  // read nothing but the cast votes, so we do not spend the query on them.
+  const members = constitution.pass_rule === 'majority'
+    ? await resolveBoardMembers(constitution)
+    : null;
+  const outcome = tallyOutcome(votes, {
+    constitution, members,
+    // Subject-typed: an amendment's proposer is not held to the author rule (§7).
+    authorId: decidingAuthorId(item.subject_type, authorId),
+  });
+
+  // The payload's remaining reads (reads never ride a tx they don't need). Only a
+  // pass needs them, and only a full_idea can pay.
   let completenessScore = null;
   let credit = null;
   if (outcome === 'passed') {
-    authorId = await db.getBoardItemAuthor(item);
+    // The amendment path's author, deferred to here — see the note above.
+    if (authorId == null) authorId = await db.getBoardItemAuthor(item);
     if (item.subject_type === 'full_idea') {
       completenessScore = await db.getIdeaCompleteness(item.subject_id);
     }
@@ -444,7 +604,12 @@ async function maybeCloseAfterVote(itemId) {
   const constitution = item.constitution || {};
   const votes = await db.getVotesForItem(item.id);
   const members = await resolveBoardMembers(constitution);
-  if (!shouldCloseAfterVote({ constitution, votes, members })) {
+  // task 1003273: the author is an input to the trigger, not just the tally — an
+  // author's cast must never be the vote that ends the sitting.
+  const authorId = authorRuleApplies(item.subject_type)
+    ? await db.getBoardItemAuthor(item)
+    : null;
+  if (!shouldCloseAfterVote({ constitution, votes, members, authorId })) {
     return { closed: false, reason: 'window_still_open' };
   }
   return closeItem(item, { cause: 'vote' });
@@ -787,6 +952,9 @@ async function pendingVotesFor(builderId) {
 
 module.exports = {
   pendingVotesFor,
+  hasMajority,
+  majorityDecided,
+  decidingVotes,
   FULL_IDEA_PASS_BAR,
   ideaPassesBar,
   openWindowForFullIdea,

package/modules/government/config.js

@@ -141,6 +141,13 @@ function sanitizeRole(key, raw) {
 // predicate says which RANK governs; who actually holds that rank stays a DB row,
 // resolved per request by R06's membership resolver. Nothing here names a builder,
 // and a config edit cannot make anyone a board member.
+// WHY window_minutes STAYS null HERE (task 1003273). A clock is only safe under
+// a rule where expiry means RETURN. Under first_ratifier and consent the tally
+// passes on absence, so giving a sitting a deadline would make the expiry sweep
+// ratify items NOBODY READ — paying author karma and the idea credit on them.
+// A project that wants a clock wants `majority` first, and sets both together in
+// its own instance pack; the neutral default must not hand every instance an
+// auto-ratifier.
 const BOARD_DEFAULTS = Object.freeze({
   membership: 'rank:archon',
   pass_rule: 'first_ratifier',
@@ -148,11 +155,25 @@ const BOARD_DEFAULTS = Object.freeze({
   close_early_on_full_turnout: true,
 });
 
-// The pass rules that EXIST, not the ones a project should pick. `consent` is the
-// documented recommendation once a project has a board worth sitting (all Archons,
-// one vote each, consent, a 90-minute window); `first_ratifier` is the day-one
-// default and what an unreadable value falls back to.
-const PASS_RULES = Object.freeze(['first_ratifier', 'consent']);
+// The pass rules that EXIST, not the ones a project should pick. `first_ratifier`
+// is the day-one default and what an unreadable value falls back to.
+//
+// THE THREE ARE NOT A LADDER OF STRICTNESS — they differ in what SILENCE means,
+// which is the axis that actually matters (task 1003273):
+//   • first_ratifier — one affirmative act decides. Silence passes (the tally
+//     only returns on a reasoned objection), so an unvoted item ratifies.
+//   • consent        — the same tally over a sitting; an empty window passes
+//     UNOPPOSED. Silence is assent, deliberately (owner decision 6).
+//   • majority       — strictly more than half of the RESOLVED MEMBERSHIP must
+//     vote yes. Silence is NOT assent: an item that never reaches a majority
+//     RETURNS at expiry. This is the only rule under which not voting is a
+//     meaningful act, and the only one where a clock is safe — see the note on
+//     window_minutes below.
+// Adding `majority` cannot widen the fail-closed fallback: sanitizeBoard still
+// falls back to first_ratifier, and majority is the STRICTER end of this axis
+// anyway (it demands affirmative votes from a majority, where the other two
+// pass on absence).
+const PASS_RULES = Object.freeze(['first_ratifier', 'consent', 'majority']);
 
 // A membership predicate names WHO SITS. The grammar and its parser live in
 // ./membership-predicate — ONE implementation, shared with R06's resolver

package/modules/government/routes/government.js

@@ -540,7 +540,12 @@ module.exports = function buildGovernmentRouter() {
         const status =
           out.reason === 'item_not_found' ? 404 :
           out.reason === 'not_board_member' ? 403 :
-          out.reason === 'anti_self_vote' ? 403 :
+          // 'anti_self_vote' was retired by task 1003273 — an author may cast;
+          // what they cannot do is decide alone, which the close trigger and the
+          // tally enforce rather than the route. The mapping is left OUT rather
+          // than kept "just in case": a reason castVote can no longer return
+          // would be dead code pretending to be a wall.
+
           out.reason === 'item_closed' ? 409 :
           out.reason === 'vote_window_expired' ? 409 :
           400; // bad_direction / yes_carries_nothing / objection_needs_reason / objection_needs_section

package/modules/hall-ui/public/government.js

@@ -89,7 +89,6 @@
     validation_failed: 'Missing or invalid fields.',
     // the vote refusals (R17 over R08's route)
     not_board_member: 'Only members of this item\u2019s board may vote on it \u2014 membership follows the rules that were in force when the window opened.',
-    anti_self_vote: 'You can\u2019t vote on your own idea \u2014 that\u2019s the line that keeps ratification honest.',
     item_closed: 'This sitting has closed \u2014 refreshing.',
     vote_window_expired: 'This sitting\u2019s clock has run out \u2014 the sweep is closing it.',
     objection_needs_reason: 'An objection must say why \u2014 write the reason.',
@@ -519,6 +518,14 @@
     if (board.pass_rule === 'consent') {
       return 'Items pass by <strong>consent</strong>: silence is consent, a single reasoned objection returns the item to its author, and a sitting that ends with no votes at all passes.';
     }
+    // task 1003273. The sentence leads with what silence means, because that is
+    // the axis these three rules actually differ on and the one that surprises
+    // people: under the other two an unvoted item passes, under this one it does not.
+    if (board.pass_rule === 'majority') {
+      return 'Items pass by <strong>majority</strong>: more than half of the board must vote yes \u2014 not just more yes than no. '
+        + 'Silence is <em>not</em> agreement here, so an item that never reaches a majority is returned to its author. '
+        + 'An author may vote on their own idea, but it can never be carried by their vote alone.';
+    }
     return `Pass rule: <code>${escapeHtml(String(board.pass_rule || 'unset'))}</code>.`;
   }
 
@@ -694,9 +701,12 @@
       return rem || 'timed sitting';
     }
     const rule = item.constitution && item.constitution.pass_rule;
-    return rule === 'first_ratifier'
-      ? 'no clock — closes on the first vote'
-      : 'no clock';
+    if (rule === 'first_ratifier') return 'no clock — closes on the first vote';
+    // A clockless majority sitting is worth naming honestly: without a deadline
+    // it waits indefinitely for a majority, which is a real state a project can
+    // configure itself into (task 1003273).
+    if (rule === 'majority') return 'no clock — waits for a majority';
+    return 'no clock';
   }
 
   function ballotHtml(item, viewerId) {
@@ -750,12 +760,22 @@
     if (item.closed_at) return '';
     const mine = item.votes.find((v) => String(v.voter_id) === String(viewerId));
     if (mine) return '';
-    if (item.subject_type === 'full_idea' && item.subject && String(item.subject.author_id) === String(viewerId)) {
-      return `<p class="gov-grid-note">This is your idea \u2014 its author does not vote on it. The board decides; a return comes back to you with its reason.</p>`;
-    }
+    // TASK 1003273: the author gets a REAL ballot. The old branch returned a note
+    // and no form, which is what made the Board Room show nine sittings and no
+    // way to vote on any of them — every one of them was the reader's own. They
+    // may now cast; what they cannot do is decide alone (the close trigger needs
+    // a voice that is not theirs, and a majority made only of them cannot carry).
+    // The note says so instead of refusing, so the limit is visible rather than
+    // discovered by clicking.
+    const isOwnIdea = item.subject_type === 'full_idea'
+      && item.subject && String(item.subject.author_id) === String(viewerId);
     const sections = Object.keys(SECTION_LABELS).map((key) => `
       <label class="gov-perm" style="cursor:pointer"><input type="radio" name="vote-section-${escapeHtml(item.id)}" value="${escapeHtml(key)}"> <span>${escapeHtml(SECTION_LABELS[key])}</span></label>`).join('');
+    const ownNote = isOwnIdea
+      ? `<p class="gov-grid-note">This is your idea. You can vote on it \u2014 your position belongs on the record \u2014 but it can\u2019t be decided by your vote alone, and a vote on your own idea earns no karma.</p>`
+      : '';
     return `<div class="gov-vote" data-item="${escapeHtml(item.id)}">
+      ${ownNote}
       <button type="button" class="gov-btn" data-vote="yes">Vote yes</button>
       <details class="gov-vote__no">
         <summary class="gov-btn gov-btn--ghost">Object\u2026</summary>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.364",
+  "version": "1.19.366",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.364",
+      "version": "1.19.366",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.364",
+  "version": "1.19.366",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gen-sounds.js

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+// scripts/gds/gen-sounds.js — synthesize the notification WAVs (task 1003272).
+//
+// WHY A GENERATOR RATHER THAN FOUR COMMITTED BINARIES. The 5-event sound system
+// (V3.R90, task 1000781) shipped its configuration — the prefs, the toggles, the
+// master volume, the per-event variant picker — and never shipped the audio. Only
+// chime.wav has ever existed in this repo, so four of the five events resolved to
+// a 404 and played nothing. Two prior attempts to fix "sound is broken" (tasks
+// 1001252 and 1000796) were abandoned without reaching that.
+//
+// An opaque binary nobody can regenerate is how a repo loses assets in the first
+// place (the local player itself vanished in the 1.18.0 re-seed and no commit
+// records it). These are simple synthesized tones, so the honest artifact is the
+// recipe: a few dozen lines of additive synthesis anyone can read, adjust, and
+// re-run. `node scripts/gds/gen-sounds.js` is idempotent — same bytes every time,
+// no timestamps, no randomness — so it can be a CI freshness check like the other
+// generators if that is ever wanted.
+//
+// chime.wav IS NOT TOUCHED. It predates this task and is the one asset the system
+// always had; regenerating it would replace a sound builders already know with a
+// different one for no reason. This writes only the four that were missing.
+//
+// WHERE THEY GO, and why one copy. modules/hall-ui/public/ is served at
+// /builders/<name>.wav, which is exactly what settings.js previews
+// (`new Audio('/builders/' + wavName + '.wav')`). The local player
+// (.claude/sounds/play.js) reads the SAME files from that directory rather than
+// keeping a second copy — two copies of an asset are two things to drift.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const RATE = 44100;
+const OUT_DIR = path.resolve(__dirname, '..', '..', 'modules', 'hall-ui', 'public');
+
+// Equal-temperament note table, only the notes these sounds use. Named rather
+// than numeric so the voicings below read as music instead of magic numbers.
+const HZ = {
+  A5: 880.00, D6: 1174.66,
+  C5: 523.25, E5: 659.25, G5: 783.99,
+  C6: 1046.50, E6: 1318.51, G6: 1567.98,
+};
+
+// One struck note: a fundamental plus a little second and third harmonic (a bell
+// is not a sine wave), under an exponential decay with a short fade-in. The
+// fade-in matters — starting a waveform at full amplitude is an audible click.
+function note({ freq, start, dur, gain = 0.5, decay = 4.5 }) {
+  const voices = [
+    { mult: 1, amp: 1.0 },
+    { mult: 2, amp: 0.28 },
+    { mult: 3, amp: 0.10 },
+  ];
+  const attack = Math.min(0.006, dur / 8); // seconds
+  return { freq, start, dur, gain, decay, voices, attack };
+}
+
+// Render a list of notes into one mono float buffer, summed (notes may overlap).
+function render(notes) {
+  const end = notes.reduce((m, n) => Math.max(m, n.start + n.dur), 0);
+  const total = Math.ceil((end + 0.03) * RATE); // a little tail so nothing cuts
+  const buf = new Float64Array(total);
+  for (const n of notes) {
+    const from = Math.floor(n.start * RATE);
+    const len = Math.floor(n.dur * RATE);
+    for (let i = 0; i < len; i++) {
+      const t = i / RATE;
+      const env = Math.exp(-n.decay * t) * Math.min(1, t / n.attack);
+      let s = 0;
+      for (const v of n.voices) s += v.amp * Math.sin(2 * Math.PI * n.freq * v.mult * t);
+      buf[from + i] += s * env * n.gain;
+    }
+  }
+  // Normalize to a consistent peak so no sound is jarringly louder than another,
+  // then a short linear fade-out so the file never ends mid-cycle (another click).
+  let peak = 0;
+  for (let i = 0; i < total; i++) peak = Math.max(peak, Math.abs(buf[i]));
+  const scale = peak > 0 ? 0.82 / peak : 0;
+  const fade = Math.min(total, Math.floor(0.02 * RATE));
+  for (let i = 0; i < total; i++) {
+    let s = buf[i] * scale;
+    const fromEnd = total - 1 - i;
+    if (fromEnd < fade) s *= fromEnd / fade;
+    buf[i] = s;
+  }
+  return buf;
+}
+
+// 16-bit mono PCM, 44100 Hz — byte-for-byte the format of the existing chime.wav,
+// so nothing downstream has to care which file it got.
+function toWav(samples) {
+  const dataBytes = samples.length * 2;
+  const out = Buffer.alloc(44 + dataBytes);
+  out.write('RIFF', 0);
+  out.writeUInt32LE(36 + dataBytes, 4);
+  out.write('WAVE', 8);
+  out.write('fmt ', 12);
+  out.writeUInt32LE(16, 16);      // fmt chunk size
+  out.writeUInt16LE(1, 20);       // PCM
+  out.writeUInt16LE(1, 22);       // mono
+  out.writeUInt32LE(RATE, 24);
+  out.writeUInt32LE(RATE * 2, 28); // byte rate
+  out.writeUInt16LE(2, 32);        // block align
+  out.writeUInt16LE(16, 34);       // bits
+  out.write('data', 36);
+  out.writeUInt32LE(dataBytes, 40);
+  for (let i = 0; i < samples.length; i++) {
+    const clamped = Math.max(-1, Math.min(1, samples[i]));
+    out.writeInt16LE(Math.round(clamped * 32767), 44 + i * 2);
+  }
+  return out;
+}
+
+// The four voicings. Each is written to match what the event MEANS — the labels
+// come from modules/builder-settings/sound-prefs.js.
+const SOUNDS = {
+  // "When Claude needs your input" — a two-tone ask, rising so it reads as a
+  // question. Short and unhurried: this one can fire while someone is thinking.
+  alert: [
+    note({ freq: HZ.A5, start: 0.00, dur: 0.26, gain: 0.5, decay: 7 }),
+    note({ freq: HZ.D6, start: 0.15, dur: 0.40, gain: 0.5, decay: 6 }),
+  ],
+  // "When a task ships" — a settled two-note rise, C5 to G5. A fifth, because it
+  // should sound finished rather than expectant.
+  ship: [
+    note({ freq: HZ.C5, start: 0.00, dur: 0.30, gain: 0.5, decay: 6 }),
+    note({ freq: HZ.G5, start: 0.14, dur: 0.55, gain: 0.5, decay: 4.5 }),
+  ],
+  // "When a big task ships" — the same idea carried further: a major triad
+  // arpeggio landing on the octave.
+  triumph: [
+    note({ freq: HZ.C5, start: 0.00, dur: 0.26, gain: 0.42, decay: 7 }),
+    note({ freq: HZ.E5, start: 0.11, dur: 0.26, gain: 0.42, decay: 7 }),
+    note({ freq: HZ.G5, start: 0.22, dur: 0.30, gain: 0.46, decay: 6 }),
+    note({ freq: HZ.C6, start: 0.34, dur: 0.75, gain: 0.55, decay: 3.4 }),
+  ],
+  // "When you earn a rank promotion" — the brightest of the four, a four-note
+  // fanfare that overlaps into a held top note.
+  fanfare: [
+    note({ freq: HZ.G5, start: 0.00, dur: 0.22, gain: 0.40, decay: 8 }),
+    note({ freq: HZ.C6, start: 0.10, dur: 0.22, gain: 0.44, decay: 8 }),
+    note({ freq: HZ.E6, start: 0.20, dur: 0.26, gain: 0.46, decay: 7 }),
+    note({ freq: HZ.G6, start: 0.31, dur: 0.90, gain: 0.55, decay: 3.0 }),
+  ],
+};
+
+function main() {
+  const check = process.argv.includes('--check');
+  const written = [];
+  const stale = [];
+  for (const [name, notes] of Object.entries(SOUNDS)) {
+    const file = path.join(OUT_DIR, `${name}.wav`);
+    const wav = toWav(render(notes));
+    let current = null;
+    try { current = fs.readFileSync(file); } catch { /* absent */ }
+    if (current && current.equals(wav)) continue;
+    if (check) { stale.push(path.relative(path.resolve(__dirname, '..', '..'), file)); continue; }
+    fs.writeFileSync(file, wav);
+    written.push(`${name}.wav (${wav.length} bytes)`);
+  }
+  if (check) {
+    if (stale.length) {
+      console.error(`gen-sounds --check: STALE — would rewrite ${stale.join(', ')}`);
+      console.error('  run: node scripts/gds/gen-sounds.js  (and commit the result)');
+      process.exit(1);
+    }
+    console.log('gen-sounds --check: up to date.');
+    return;
+  }
+  console.log(written.length
+    ? `gen-sounds: wrote ${written.join(', ')}`
+    : 'gen-sounds: all sounds already current — no changes.');
+}
+
+if (require.main === module) main();
+module.exports = { render, toWav, SOUNDS, RATE };