@bongos/core 1.19.613 → 1.19.615

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.613",
+  "version": "1.19.615",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.613",
+      "version": "1.19.615",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.613",
+  "version": "1.19.615",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-net.js

@@ -244,6 +244,34 @@ function healthzCmd(inst) {
   return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/healthz`;
 }
 
+// The instance manifest, read over loopback — the identity companion to healthzCmd (task 1003740).
+function identityCmd(inst) {
+  return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/api/gds/instance`;
+}
+
+// Does a freshly provisioned instance report ITSELF, or the platform it is hosted on?
+//
+// WHY THIS EXISTS. Provisioning used to pin every instance's branding pack to the shared neutral
+// starter (see provision-units.js), a leftover from the co-tenant model that shared one checkout. Under
+// ADR 0108 each instance has its own, and src/branding.js's ENV_OVERRIDES carry domains but never
+// identity.productName — so every hosted instance served "Cloud Bongos" as its own name for
+// months, greeting newcomers with the wrong project at sign-in. Nothing looked.
+//
+// PURE so it is testable without a box: takes the parsed manifest and returns a verdict.
+// Deliberately a WARNING, not a failure — an owner may legitimately name a project after the
+// platform, and provisioning must not refuse a working instance over a name.
+function identityVerdict({ manifest, slug, neutralName }) {
+  const name = manifest && (manifest.name || (manifest.brand && manifest.brand.identity && manifest.brand.identity.productName));
+  if (!name) return { ok: null, reason: 'no name in manifest' };
+  // The bug's exact shape: the instance answers with the neutral pack's name while its slug says
+  // it is somebody else. A project genuinely called that keeps its name and only trips when the
+  // slug matches too — in which case it is not the bug.
+  if (neutralName && name === neutralName && slug && slug !== neutralName) {
+    return { ok: false, name, reason: `serves the platform default name "${name}" instead of its own` };
+  }
+  return { ok: true, name };
+}
+
 // ---------------------------------------------------------------------------
 // The injectable executor. dry-run → log-only; --apply → child_process.
 // ---------------------------------------------------------------------------
@@ -260,6 +288,8 @@ module.exports = {
   federateInstance,
   federationHubOrigin,
   healthzCmd,
+  identityCmd,
+  identityVerdict,
   shouldFederate,
   zoneForDomain,
 };

package/scripts/gds/provision-units.js

@@ -121,16 +121,30 @@ WantedBy=timers.target
 `;
 }
 
-// The branding pack a provisioned CO-TENANT instance loads: the shared, committed
-// neutral starter (the co-tenant model shares ONE checkout, differentiated only by
-// env — src/branding.js's GDS_BRANDING_FILE knob). Per-instance identity/domains
-// therefore ride ENV OVERRIDES, not a divergent pack. Kept as a constant so the
-// GDS_BRANDING_FILE line below and the env-var PREFIX (which must equal this pack's
-// envPrefix, or src/branding.js's ENV_OVERRIDES never fire) can't drift apart.
-const PROVISIONED_BRANDING_FILE = 'config/branding.neutral.json';
+// The pack the provisioner reads to learn an instance's env-var PREFIX floor.
+//
+// It is NOT the pack the instance loads, and that distinction is the whole of task 1003740.
+// The original co-tenant model shared ONE checkout across every instance, differentiated only by
+// env, so provisioning pinned the pack to `config/branding.neutral.json` and let identity
+// ride ENV OVERRIDES. That model is gone: under ADR 0108 each co-tenant has its own checkout
+// (`WorkingDirectory=/srv/<base>/<slug>`, running `node_modules/@bongos/core`) and its own
+// `config/branding.json` written at init.
+//
+// The pin outlived it, and src/branding.js's ENV_OVERRIDES cover domains, auth.idp and landing —
+// never `identity.productName`. So every hosted instance kept serving the NEUTRAL pack's name:
+// GET /api/gds/instance on hermeslines-marketing, mercury and demo all answered "Cloud Bongos"
+// while each instance's own pack on disk said otherwise, and `bongos login <instance>` greeted a
+// newcomer with the platform's name at the moment they were deciding whether to trust it.
+//
+// The instance now loads its own pack by src/branding.js's DEFAULT (INSTANCE_PATH =
+// <instanceRoot>/config/branding.json), which falls back to neutral when absent — so no
+// branding-file env line is written at all. Reading the neutral pack HERE is still correct: it is
+// the prefix floor an instance inherits unless its own pack overrides envPrefix, and every live
+// co-tenant pack pins `envPrefix: "CLOUDBONGOS"` explicitly.
+const ENV_PREFIX_PACK = 'config/branding.neutral.json';
 
 // The env-var prefix a provisioned instance actually RESOLVES — i.e. the envPrefix
-// of the pack it loads (PROVISIONED_BRANDING_FILE). src/instance-config.resolveEnv
+// of the pack it loads (ENV_PREFIX_PACK). src/instance-config.resolveEnv
 // reads <envPrefix>_<SUFFIX>, and src/branding.resolveBranding applies
 // <envPrefix>_{PUBLIC,BUILDERS,…}_ORIGIN overrides — so a web.env var only takes
 // effect under THIS prefix. Read from the pack (fail-soft to the vanilla default)
@@ -139,7 +153,7 @@ const PROVISIONED_BRANDING_FILE = 'config/branding.neutral.json';
 // the OAuth creds were silently unreadable — task 1972.)
 function provisionedEnvPrefix() {
   try {
-    const pack = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, PROVISIONED_BRANDING_FILE), 'utf8'));
+    const pack = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, ENV_PREFIX_PACK), 'utf8'));
     return pack.envPrefix || 'CLOUDBONGOS';
   } catch { return 'CLOUDBONGOS'; }
 }
@@ -228,8 +242,7 @@ GITHUB_APP_PRIVATE_KEY=${String(appPem).replace(/\r?\n/g, '\\n')}
 ${credComment}
 ${prefix}_GITHUB_CLIENT_ID=${clientId || ''}
 ${prefix}_GITHUB_CLIENT_SECRET=${clientSecret || ''}
-${firstAdminLine}GDS_BRANDING_FILE=${PROVISIONED_BRANDING_FILE}
-${originLines}${appLines}PORT=${inst.port}
+${firstAdminLine}${originLines}${appLines}PORT=${inst.port}
 PGDATABASE=${dbName(inst)}
 ${fedLines}${settingsEnvLines(inst, prefix)}`;
 }
@@ -318,7 +331,7 @@ function upsertEnvVars(body, vars) {
 // env the hub already runs under). Null → not hub-configured → shouldFederate is false.
 
 module.exports = {
-  PROVISIONED_BRANDING_FILE,
+  ENV_PREFIX_PACK,
   backupScriptPath,
   backupService,
   backupServicePath,

package/scripts/gds/provision.js

@@ -52,7 +52,7 @@ const crypto = require('node:crypto');
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
 const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, instanceManifestCmd, originEnvVarsFor, serviceUnit, serviceUnitPath, settingsConsumed, settingsEnvVarsFor, upsertEnvVars, webEnvBody, webEnvPath } = require('./provision-units.js');
-const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
+const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsReleaseEnv, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, identityCmd, identityVerdict, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
 function makeExec({ apply, log = console.log, remoteHost = null, remoteCwd = null, sshOpts = '' }) {
   // `shown` (task 1003140): what to LOG in place of the command text — for a command
@@ -503,6 +503,32 @@ async function provisionInstance(inst, deps) {
     }
   } else log('    (verified post-boot)');
 
+  // ── step 7b: identity ─────────────────────────────────────────────────────
+  // Does it answer as ITSELF? A live instance that serves the platform's name instead of its own
+  // is invisible to healthz — it is perfectly healthy and telling every newcomer the wrong project
+  // (task 1003740, which went unnoticed across every hosted instance for months). A WARNING, never
+  // a failure: an owner may legitimately name a project after the platform, and a name must not
+  // fail a working standup.
+  if (local && apply && healthy !== false) {
+    const res = boxExec(identityCmd(inst), { allowFail: true });
+    const raw = res && !res.softFailed ? (res.stdout || '') : '';
+    let manifest = null;
+    try { manifest = raw ? JSON.parse(raw) : null; } catch (_) { manifest = null; }
+    if (manifest) {
+      let neutralName = null;
+      try {
+        neutralName = (JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'config/branding.neutral.json'), 'utf8'))
+          .identity || {}).productName || null;
+      } catch (_) { /* no neutral pack readable → the check simply cannot fire */ }
+      const verdict = identityVerdict({ manifest, slug: inst.slug, neutralName });
+      if (verdict.ok === false) {
+        log(`  ⚠ ${inst.slug} ${verdict.reason} — check its config/branding.json and that no env var pins its branding pack`);
+      } else if (verdict.ok) {
+        log(`  [identity] answers as "${verdict.name}"`);
+      }
+    }
+  }
+
   // Mark active. error_note: null — a stale note from an earlier failed run
   // must not ride into the active state (F15's second half; the co-tenant +
   // standalone paths never cleared it). The runner hands its own observation

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.613'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.615'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_amendment.mjs

@@ -56,7 +56,7 @@ test('every field is required and every refusal is named — no silent correctio
     [{ ...CONSENT_90, extra: true }, 'unknown_field'],
     [{ ...CONSENT_90, membership: 'everyone' }, 'bad_membership'],
     [{ ...CONSENT_90, membership: undefined }, 'bad_membership'],
-    [{ ...CONSENT_90, pass_rule: 'unanimous' }, 'bad_pass_rule'],
+    [{ ...CONSENT_90, pass_rule: 'by_acclamation' }, 'bad_pass_rule'],
     [{ ...CONSENT_90, window_minutes: 0 }, 'bad_window_minutes'],
     [{ ...CONSENT_90, window_minutes: 1.5 }, 'bad_window_minutes'],
     [{ ...CONSENT_90, close_early_on_full_turnout: 'yes' }, 'bad_close_early'],
@@ -68,8 +68,8 @@ test('every field is required and every refusal is named — no silent correctio
   }
   // THE CONTRAST WITH THE SANITIZER, stated as an assertion: the sanitizer
   // silently corrects a bad pass_rule; the proposal validator refuses it.
-  assert.equal(config.sanitizeBoard({ ...CONSENT_90, pass_rule: 'unanimous' }).pass_rule, 'first_ratifier');
-  assert.equal(validateProposedConstitution({ ...CONSENT_90, pass_rule: 'unanimous' }).ok, false);
+  assert.equal(config.sanitizeBoard({ ...CONSENT_90, pass_rule: 'by_acclamation' }).pass_rule, 'first_ratifier');
+  assert.equal(validateProposedConstitution({ ...CONSENT_90, pass_rule: 'by_acclamation' }).ok, false);
   // THE PERMISSIVE HALF, asserted on purpose (task 1003273): `majority` is a
   // REAL rule now, so a proposal naming it must be ACCEPTED. This used to be
   // this file's canonical invalid value — a later change that quietly dropped
@@ -107,7 +107,7 @@ test('an invalid proposal files NOTHING — refused before any write', async ()
     openBoardItem: async () => { throw new Error('must not be reached'); },
     builderHoldsRankActive: async () => true,
   }, async () => {
-    assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'unanimous' }, proposedBy: '42' })).ok, false);
+    assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'by_acclamation' }, proposedBy: '42' })).ok, false);
     assert.equal((await proposeAmendment({ proposal: CONSENT_90, proposedBy: null })).reason, 'missing_proposer');
   });
 });

package/tests/government_board_close.mjs

@@ -82,7 +82,7 @@ test('consent closes early only on FULL TURNOUT of the live members', () => {
 test('close-early OFF, an empty board, and an unknown rule all refuse to close after a vote', () => {
   assert.equal(shouldCloseAfterVote({ constitution: { ...CONSENT, close_early_on_full_turnout: false }, votes: [yes('1')], members: [member(1)] }), false);
   assert.equal(shouldCloseAfterVote({ constitution: CONSENT, votes: [yes('1')], members: [] }), false, 'an empty board has no turnout to complete');
-  assert.equal(shouldCloseAfterVote({ constitution: { ...CONSENT, pass_rule: 'unanimous' }, votes: [yes('1')], members: [member(1)] }), false,
+  assert.equal(shouldCloseAfterVote({ constitution: { ...CONSENT, pass_rule: 'by_acclamation' }, votes: [yes('1')], members: [member(1)] }), false,
     'unknown rule: fail-closed — only the clock closes it');
 });
 

package/tests/government_config.mjs

@@ -264,8 +264,8 @@ test('a malformed constitution can never widen the franchise or lower the bar',
     { membership: 'RANK:ARCHON' },          // grammar is lowercase
     { membership: '' },
     { membership: { rank: 'archon' } },
-    { pass_rule: 'unanimous' },
-    { pass_rule: 'unanimous' },
+    { pass_rule: 'by_acclamation' },
+    { pass_rule: 'UNANIMOUS' },          // a real rule, wrong case — still unreadable
     { pass_rule: null },
     { membership: 'rank:xenos; DROP TABLE government_ranks' },
   ];
@@ -325,11 +325,12 @@ test('the resolved constitution is frozen, like the rest of the config contract'
 });
 
 test('PASS_RULES is the closed set the rest of the goal codes against', () => {
-  // `majority` joined the set in task 1003273 (owner decision 2026-08-25). The
+  // `majority` joined the set in task 1003273 (owner decision 2026-08-25) and
+  // `unanimous` in task 1003733 (owner decision 2026-09-08, ADR 0267). The
   // set stays CLOSED and asserted whole on purpose: board.js branches on these
   // strings, so a rule added to config without a tally to match would be a
   // constitution a project could adopt and then never resolve.
-  assert.deepEqual([...PASS_RULES].sort(), ['consent', 'first_ratifier', 'majority']);
+  assert.deepEqual([...PASS_RULES].sort(), ['consent', 'first_ratifier', 'majority', 'unanimous']);
   assert.ok(Object.isFrozen(PASS_RULES));
   assert.ok(PASS_RULES.includes(BOARD_DEFAULTS.pass_rule), 'the default must be a member of the set');
   // The fail-closed default is UNCHANGED by the addition — adding a stricter rule

package/tests/government_unanimous.mjs

@@ -0,0 +1,319 @@
+// tests/government_unanimous.mjs — the `unanimous` pass rule and the
+// revise-and-re-sit loop it exists to drive (task 1003733, ADR 0267).
+//
+// THE OWNER DECISION OF 2026-09-08, pinned here: a Full Idea is ratified by
+// UNANIMOUS agreement from round one. A sitting that does not carry RETURNS to
+// its author, who revises and puts it back to the board — and that loop repeats
+// until the board is unanimous. Two sub-decisions the owner made explicitly:
+//
+//   A. SILENCE DOES NOT BLOCK. A member who never votes is not a veto; they drop
+//      out of the reckoning entirely. There is deliberately NO membership
+//      denominator here — that is what separates `unanimous` from `majority`,
+//      and it is why the owner asked for the clock in the same breath: with
+//      absence nulled, the deadline is what ends a sitting nobody finished.
+//   B. AND SILENCE CANNOT CARRY EITHER. An empty room agrees to nothing, so a
+//      sitting that ends with no affirmative voice RETURNS rather than passing.
+//      That second half is what makes a clock SAFE under this rule (ADR 0191 §4:
+//      a deadline may only be given to a rule whose expiry means return) — and
+//      it is the whole difference from `consent`, where an empty window passes.
+//
+// THE PERMISSIVE ANSWERS ARE ASSERTED AS DELIBERATELY AS THE RESTRICTIVE ONES
+// (modules/government/CLAUDE.md): "an absent member does not block" is exactly
+// the property a later well-meaning tightening would quietly undo, so it fails a
+// test by design.
+//
+// DB-free (db monkeypatched — the sibling board tests' idiom).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+const config = require(path.join(GOV, 'config.js'));
+
+const { tallyOutcome, shouldCloseAfterVote, closeItem } = board;
+
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); }
+  finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+const UNANIMOUS = {
+  membership: 'rank:archon', pass_rule: 'unanimous',
+  window_minutes: 1440, close_early_on_full_turnout: true,
+};
+const CONSENT = { ...UNANIMOUS, pass_rule: 'consent' };
+
+const yes = (v) => ({ voter_id: String(v), direction: 'yes' });
+const no = (v, section = 'fit') => ({ voter_id: String(v), direction: 'no', reason_md: 'too thin', section_key: section });
+const member = (id) => ({ builder_id: String(id), github_login: `m${id}`, display_name: `M${id}` });
+const FOUR = [member(1), member(2), member(3), member(4)];
+const AUTHOR = '1';
+
+const ideaItem = (over = {}) => ({
+  id: '11', subject_type: 'full_idea', subject_id: '7', opened_by: null,
+  constitution: UNANIMOUS, closed_at: null, outcome: null, expired: false, ...over,
+});
+
+// ── A. the tally: everyone who spoke said yes, and somebody spoke ────────────
+
+test('unanimous carries when every cast vote is yes and one of them is not the author', () => {
+  assert.equal(tallyOutcome([yes(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+  assert.equal(tallyOutcome([yes(1), yes(2), yes(3), yes(4)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+});
+
+test('ONE objection returns it, however many yes votes stand beside it', () => {
+  assert.equal(tallyOutcome([yes(2), yes(3), no(4)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'returned');
+  assert.equal(tallyOutcome([no(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'returned');
+});
+
+test('a sitting nobody voted in RETURNS — an empty room agrees to nothing', () => {
+  // The half that makes a clock safe here (ADR 0191 §4). Under `consent` the
+  // very same sitting PASSES, which is the difference stated as an assertion
+  // rather than as prose.
+  assert.equal(tallyOutcome([], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'returned');
+  assert.equal(tallyOutcome([], { constitution: CONSENT, members: FOUR, authorId: AUTHOR }), 'passed');
+});
+
+test('SILENCE DOES NOT BLOCK: one yes out of four carries, three absences and all', () => {
+  // Owner decision A, and the property a later "tighten it up" change would
+  // quietly undo. There is no membership denominator: `members` is passed and
+  // deliberately does not matter.
+  assert.equal(tallyOutcome([yes(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+  assert.equal(tallyOutcome([yes(2)], { constitution: UNANIMOUS, members: null, authorId: AUTHOR }), 'passed');
+  // Contrast with `majority`, where the same ballot fails on the denominator.
+  assert.equal(tallyOutcome([yes(2)], { constitution: { ...UNANIMOUS, pass_rule: 'majority' }, members: FOUR, authorId: AUTHOR }), 'returned');
+});
+
+// ── B. the ADR 0191 author rule, unchanged under the new tally ───────────────
+
+test('an author cannot carry their own idea alone, and cannot return it either', () => {
+  // Alone: their yes is the only affirmative voice, so nothing carries.
+  assert.equal(tallyOutcome([yes(AUTHOR)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'returned');
+  // Joined: their yes is a real vote, it simply may not be the whole of it.
+  assert.equal(tallyOutcome([yes(AUTHOR), yes(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+  // And an author's 'no' cannot return their own idea — otherwise silence would
+  // be the safest act available to an author.
+  assert.equal(tallyOutcome([no(AUTHOR), yes(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+});
+
+test('the amendment carve-out survives: no author means no author rule', () => {
+  // ADR 0175 §7 — an amendment pays nothing and has no author to wait for, so a
+  // sole Archon proposing one must be able to ratify it. authorId is null there.
+  assert.equal(tallyOutcome([yes(1)], { constitution: UNANIMOUS, members: FOUR, authorId: null }), 'passed');
+});
+
+// ── C. the trigger: a yes waits, an objection does not ───────────────────────
+
+test('a single yes does NOT end the sitting — a later member must still be able to object', () => {
+  // The whole difference from first_ratifier, and the reason the clock matters.
+  assert.equal(shouldCloseAfterVote({ constitution: UNANIMOUS, votes: [yes(2)], members: FOUR, authorId: AUTHOR }), false);
+  assert.equal(shouldCloseAfterVote({ constitution: { ...UNANIMOUS, pass_rule: 'first_ratifier' }, votes: [yes(2)], members: FOUR, authorId: AUTHOR }), true);
+});
+
+test('a reasoned objection ends it at once — the outcome is already fixed', () => {
+  // There is no vote-changing in v1, so once a non-author 'no' is on the record
+  // nothing the absent members do can carry it. Closing now is what gets the
+  // author their feedback in time to revise, which is the point of the rule.
+  assert.equal(shouldCloseAfterVote({ constitution: UNANIMOUS, votes: [yes(2), no(3)], members: FOUR, authorId: AUTHOR }), true);
+});
+
+test('full turnout closes it early, and an author-only ballot never does', () => {
+  const all = [yes(1), yes(2), yes(3), yes(4)];
+  assert.equal(shouldCloseAfterVote({ constitution: UNANIMOUS, votes: all, members: FOUR, authorId: AUTHOR }), true);
+  assert.equal(shouldCloseAfterVote({ constitution: { ...UNANIMOUS, close_early_on_full_turnout: false }, votes: all, members: FOUR, authorId: AUTHOR }), false,
+    'close-early OFF means only the clock ends it');
+  assert.equal(shouldCloseAfterVote({ constitution: UNANIMOUS, votes: [yes(AUTHOR)], members: FOUR, authorId: AUTHOR }), false,
+    "an author's own cast never ends their sitting (ADR 0191 §3)");
+});
+
+// ── D. the loop: a returned sitting hands the idea back, and pays nothing ────
+
+test('the clock returns an unvoted sitting, and the author is free to re-sit it', async () => {
+  // What the expiry sweep does with a sitting nobody attended. closeItem is the
+  // same path the R11 poller calls, so this IS the expiry behaviour.
+  let written = null;
+  await withDb({
+    getVotesForItem: async () => [],
+    getBoardItemAuthor: async () => AUTHOR,
+    getIdeaCompleteness: async () => 88,
+    closeBoardItem: async ({ itemId, outcome }) => {
+      written = outcome;
+      return { id: itemId, subject_type: 'full_idea', subject_id: '7', outcome, closed_at: new Date().toISOString() };
+    },
+  }, async () => {
+    const out = await closeItem(ideaItem(), { cause: 'expiry' });
+    assert.equal(out.closed, true);
+    assert.equal(out.outcome, 'returned', 'expiry with nothing cast RETURNS — never a silent ratification');
+  });
+  assert.equal(written, 'returned');
+});
+
+test('a returned sitting is not a dead end: the item closes, and nothing is paid', async () => {
+  // The revise-and-re-sit loop lives in the ideas module (POST /inbox/:id/resubmit
+  // re-grades and re-fires the window hook). What the BOARD owes that loop is
+  // exactly this: a return that CLOSES the item — so government_003's partial
+  // unique index admits the next window — and that pays nothing, so a round trip
+  // through revision can never earn the author credits or ratification karma.
+  const paid = [];
+  await withDb({
+    getVotesForItem: async () => [no(2, 'fit')],
+    getBoardItemAuthor: async () => AUTHOR,
+    getIdeaCompleteness: async () => { paid.push('completeness'); return 88; },
+    closeBoardItem: async ({ itemId, outcome, afterClose }) => {
+      if (afterClose) paid.push('credit');
+      return { id: itemId, subject_type: 'full_idea', subject_id: '7', outcome, closed_at: new Date().toISOString() };
+    },
+  }, async () => {
+    const out = await closeItem(ideaItem(), { cause: 'vote' });
+    assert.equal(out.outcome, 'returned');
+    assert.ok(out.item.closed_at, 'the item is CLOSED, so the next window may open');
+    assert.equal(out.author_karma, null, 'a return pays no ratification karma');
+    assert.equal(out.credit, undefined, 'a return books no idea credit');
+  });
+  assert.deepEqual(paid, [], 'nothing on the paying path was even reached');
+});
+
+// ── E. the config contract ──────────────────────────────────────────────────
+
+test('unanimous is a legal, adoptable pass rule — and the fail-closed default is untouched', () => {
+  assert.ok(config.PASS_RULES.includes('unanimous'));
+  assert.equal(config.sanitizeBoard({ membership: 'rank:metic+', pass_rule: 'unanimous', window_minutes: 1440, close_early_on_full_turnout: true }).pass_rule, 'unanimous');
+  // Adding a STRICTER rule must not move what a malformed constitution falls
+  // back to — a fresh instance is still the day-one monarchy, which is what lets
+  // a solo founder ratify anything at all (ADR 0191 §5).
+  assert.equal(config.BOARD_DEFAULTS.pass_rule, 'first_ratifier');
+  assert.equal(config.sanitizeBoard({ pass_rule: 'unanimious' }).pass_rule, 'first_ratifier');
+});
+
+test('a unanimous constitution may carry a clock, which the older two may not safely', () => {
+  // Not a code rule — a REVIEW rule, stated as an assertion so the pairing is
+  // visible: window_minutes is only safe where expiry means return.
+  const withClock = config.sanitizeBoard({ membership: 'rank:archon', pass_rule: 'unanimous', window_minutes: 1440, close_early_on_full_turnout: true });
+  assert.equal(withClock.window_minutes, 1440);
+  assert.equal(tallyOutcome([], { constitution: withClock, members: FOUR, authorId: AUTHOR }), 'returned',
+    'the clock is safe here precisely because an empty sitting returns');
+});
+
+// ── F. the loop's other half: what the board hands back, and the next window ─
+
+test('a returned idea carries its objection back — reason and flagged section', async () => {
+  // The feedback that makes revision possible. The ideas resubmit path reads
+  // this through the `government` port and renders it as the rejection notice
+  // (tests/idea_resubmit.mjs pins that end: a board objection OUTRANKS the
+  // mechanical weakest-section flag).
+  await withDb({
+    getLatestReturnedItemWithObjection: async (type, id) => {
+      assert.equal(type, 'full_idea');
+      assert.equal(id, 7);
+      return { item_id: '11', section_key: 'fit', reason_md: 'the fit section names no user', closed_at: '2026-09-08T00:00:00Z' };
+    },
+  }, async () => {
+    const r = await board.latestRejectionForIdea(7);
+    assert.equal(r.source, 'board');
+    assert.equal(r.section_key, 'fit');
+    assert.equal(r.reason_md, 'the fit section names no user');
+  });
+});
+
+test('a ZERO-VOTE return carries no objection — and says so rather than inventing one', async () => {
+  // The honest gap this rule creates (ADR 0267 §5). Nobody voted, so there is no
+  // reason and no flagged section; the read returns null and the resubmit path
+  // falls back to the deterministic weakest-section flag. Returning a fabricated
+  // "the board did not read it" would put words in a member's mouth.
+  await withDb({
+    getLatestReturnedItemWithObjection: async () => null,
+  }, async () => {
+    assert.equal(await board.latestRejectionForIdea(7), null);
+  });
+});
+
+test('the next round can open: a CLOSED prior sitting no longer holds the subject', async () => {
+  // The precondition the whole loop rests on. government_003's partial unique
+  // index admits one OPEN window per subject, so a returned (closed) sitting
+  // must not stand in the way of the revised idea's next one — that is why the
+  // return path closes the item rather than parking it.
+  let opened = 0;
+  await withDb({
+    openBoardItem: async ({ subjectType, subjectId }) => {
+      opened += 1;
+      return { id: String(30 + opened), subject_type: subjectType, subject_id: String(subjectId), closes_at: null, constitution: UNANIMOUS };
+    },
+    getOpenBoardItem: async () => null,
+  }, async () => {
+    const first = await board.openWindowForFullIdea({ ideaId: 7, completenessScore: 88 });
+    assert.equal(first.opened, true);
+    // Round two, after a revision that re-cleared the bar. Nothing in the module
+    // remembers that this subject has sat before — by design, the loop is unbounded.
+    const second = await board.openWindowForFullIdea({ ideaId: 7, completenessScore: 91 });
+    assert.equal(second.opened, true);
+    assert.notEqual(second.item.id, first.item.id, 'a NEW sitting, not the old one reopened');
+  });
+  assert.equal(opened, 2);
+});
+
+test('a revision that falls back BELOW the completeness bar never reaches the board', async () => {
+  // The grade is the floor and the vote is the merit (ADR 0175 §5): a revision
+  // can make an idea worse, and board time is never spent on what a free
+  // deterministic check can bounce. The author gets the weakest-section flag
+  // instead — which is exactly the zero-vote fallback above.
+  await withDb({
+    openBoardItem: async () => { throw new Error('must not be reached'); },
+  }, async () => {
+    const out = await board.openWindowForFullIdea({ ideaId: 7, completenessScore: 41 });
+    assert.equal(out.opened, false);
+    assert.equal(out.reason, 'below_bar');
+  });
+});
+
+test('a subject that ALREADY sits does not open a second window', async () => {
+  // The other side of the partial unique index: a double-fired hook, a re-grade
+  // or a resubmission race must not put one idea in front of the board twice.
+  await withDb({
+    openBoardItem: async () => null, // ON CONFLICT DO NOTHING
+    getOpenBoardItem: async () => ({ id: '31', subject_type: 'full_idea', subject_id: '7' }),
+  }, async () => {
+    const out = await board.openWindowForFullIdea({ ideaId: 7, completenessScore: 88 });
+    assert.equal(out.opened, false);
+    assert.equal(out.reason, 'already_open');
+    assert.equal(out.item.id, '31');
+  });
+});
+
+// ── G. the clock advice the amendment form reads ────────────────────────────
+
+test('the constitution view states which rules a clock is honest under, and what to put in the box', async () => {
+  // A proposer chooses a pass rule and a window in the same breath (a
+  // constitution is ratified whole, never by diff) and the two are NOT
+  // independent — ADR 0191 §4. So the server states the pairing rather than the
+  // hall hardcoding a number it could drift from.
+  const originals = { listAmendmentHistory: db.listAmendmentHistory, countActiveBuilders: db.countActiveBuilders };
+  Object.assign(db, { listAmendmentHistory: async () => [], countActiveBuilders: async () => 4 });
+  try {
+    const view = await board.constitutionView();
+    assert.equal(view.clock.recommended_window_minutes, config.RECOMMENDED_WINDOW_MINUTES);
+    assert.deepEqual([...view.clock.clock_safe_pass_rules].sort(), ['majority', 'unanimous']);
+    // This checkout resolves to the neutral monarchy, under which expiry PASSES
+    // — so the view must say a clock is NOT safe here rather than recommending
+    // one. That is the auto-ratifier guard, visible in the API.
+    assert.equal(view.board.pass_rule, 'first_ratifier');
+    assert.equal(view.clock.live_rule_is_clock_safe, false);
+  } finally { Object.assign(db, originals); }
+});
+
+test('clock safety is a property of the RULE, and the two absence-passes rules never get one', () => {
+  assert.equal(config.isClockSafe('unanimous'), true);
+  assert.equal(config.isClockSafe('majority'), true);
+  assert.equal(config.isClockSafe('first_ratifier'), false, 'expiry PASSES here — a deadline would ratify the unread');
+  assert.equal(config.isClockSafe('consent'), false, 'silence is assent here — same trap');
+  assert.equal(config.isClockSafe('nonsense'), false, 'an unknown rule is never clock-safe');
+  // The two lists cannot drift apart: every clock-safe rule is a real rule.
+  for (const r of config.CLOCK_SAFE_PASS_RULES) assert.ok(config.PASS_RULES.includes(r), `${r} must be a real pass rule`);
+});