@bongos/core 1.19.614 → 1.19.615

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.614",
+  "version": "1.19.615",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.614'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.615'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_amendment.mjs

@@ -56,7 +56,7 @@ test('every field is required and every refusal is named — no silent correctio
     [{ ...CONSENT_90, extra: true }, 'unknown_field'],
     [{ ...CONSENT_90, membership: 'everyone' }, 'bad_membership'],
     [{ ...CONSENT_90, membership: undefined }, 'bad_membership'],
-    [{ ...CONSENT_90, pass_rule: 'unanimous' }, 'bad_pass_rule'],
+    [{ ...CONSENT_90, pass_rule: 'by_acclamation' }, 'bad_pass_rule'],
     [{ ...CONSENT_90, window_minutes: 0 }, 'bad_window_minutes'],
     [{ ...CONSENT_90, window_minutes: 1.5 }, 'bad_window_minutes'],
     [{ ...CONSENT_90, close_early_on_full_turnout: 'yes' }, 'bad_close_early'],
@@ -68,8 +68,8 @@ test('every field is required and every refusal is named — no silent correctio
   }
   // THE CONTRAST WITH THE SANITIZER, stated as an assertion: the sanitizer
   // silently corrects a bad pass_rule; the proposal validator refuses it.
-  assert.equal(config.sanitizeBoard({ ...CONSENT_90, pass_rule: 'unanimous' }).pass_rule, 'first_ratifier');
-  assert.equal(validateProposedConstitution({ ...CONSENT_90, pass_rule: 'unanimous' }).ok, false);
+  assert.equal(config.sanitizeBoard({ ...CONSENT_90, pass_rule: 'by_acclamation' }).pass_rule, 'first_ratifier');
+  assert.equal(validateProposedConstitution({ ...CONSENT_90, pass_rule: 'by_acclamation' }).ok, false);
   // THE PERMISSIVE HALF, asserted on purpose (task 1003273): `majority` is a
   // REAL rule now, so a proposal naming it must be ACCEPTED. This used to be
   // this file's canonical invalid value — a later change that quietly dropped
@@ -107,7 +107,7 @@ test('an invalid proposal files NOTHING — refused before any write', async ()
     openBoardItem: async () => { throw new Error('must not be reached'); },
     builderHoldsRankActive: async () => true,
   }, async () => {
-    assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'unanimous' }, proposedBy: '42' })).ok, false);
+    assert.equal((await proposeAmendment({ proposal: { ...CONSENT_90, pass_rule: 'by_acclamation' }, proposedBy: '42' })).ok, false);
     assert.equal((await proposeAmendment({ proposal: CONSENT_90, proposedBy: null })).reason, 'missing_proposer');
   });
 });

package/tests/government_board_close.mjs

@@ -82,7 +82,7 @@ test('consent closes early only on FULL TURNOUT of the live members', () => {
 test('close-early OFF, an empty board, and an unknown rule all refuse to close after a vote', () => {
   assert.equal(shouldCloseAfterVote({ constitution: { ...CONSENT, close_early_on_full_turnout: false }, votes: [yes('1')], members: [member(1)] }), false);
   assert.equal(shouldCloseAfterVote({ constitution: CONSENT, votes: [yes('1')], members: [] }), false, 'an empty board has no turnout to complete');
-  assert.equal(shouldCloseAfterVote({ constitution: { ...CONSENT, pass_rule: 'unanimous' }, votes: [yes('1')], members: [member(1)] }), false,
+  assert.equal(shouldCloseAfterVote({ constitution: { ...CONSENT, pass_rule: 'by_acclamation' }, votes: [yes('1')], members: [member(1)] }), false,
     'unknown rule: fail-closed — only the clock closes it');
 });
 

package/tests/government_config.mjs

@@ -264,8 +264,8 @@ test('a malformed constitution can never widen the franchise or lower the bar',
     { membership: 'RANK:ARCHON' },          // grammar is lowercase
     { membership: '' },
     { membership: { rank: 'archon' } },
-    { pass_rule: 'unanimous' },
-    { pass_rule: 'unanimous' },
+    { pass_rule: 'by_acclamation' },
+    { pass_rule: 'UNANIMOUS' },          // a real rule, wrong case — still unreadable
     { pass_rule: null },
     { membership: 'rank:xenos; DROP TABLE government_ranks' },
   ];
@@ -325,11 +325,12 @@ test('the resolved constitution is frozen, like the rest of the config contract'
 });
 
 test('PASS_RULES is the closed set the rest of the goal codes against', () => {
-  // `majority` joined the set in task 1003273 (owner decision 2026-08-25). The
+  // `majority` joined the set in task 1003273 (owner decision 2026-08-25) and
+  // `unanimous` in task 1003733 (owner decision 2026-09-08, ADR 0267). The
   // set stays CLOSED and asserted whole on purpose: board.js branches on these
   // strings, so a rule added to config without a tally to match would be a
   // constitution a project could adopt and then never resolve.
-  assert.deepEqual([...PASS_RULES].sort(), ['consent', 'first_ratifier', 'majority']);
+  assert.deepEqual([...PASS_RULES].sort(), ['consent', 'first_ratifier', 'majority', 'unanimous']);
   assert.ok(Object.isFrozen(PASS_RULES));
   assert.ok(PASS_RULES.includes(BOARD_DEFAULTS.pass_rule), 'the default must be a member of the set');
   // The fail-closed default is UNCHANGED by the addition — adding a stricter rule

package/tests/government_unanimous.mjs

@@ -0,0 +1,319 @@
+// tests/government_unanimous.mjs — the `unanimous` pass rule and the
+// revise-and-re-sit loop it exists to drive (task 1003733, ADR 0267).
+//
+// THE OWNER DECISION OF 2026-09-08, pinned here: a Full Idea is ratified by
+// UNANIMOUS agreement from round one. A sitting that does not carry RETURNS to
+// its author, who revises and puts it back to the board — and that loop repeats
+// until the board is unanimous. Two sub-decisions the owner made explicitly:
+//
+//   A. SILENCE DOES NOT BLOCK. A member who never votes is not a veto; they drop
+//      out of the reckoning entirely. There is deliberately NO membership
+//      denominator here — that is what separates `unanimous` from `majority`,
+//      and it is why the owner asked for the clock in the same breath: with
+//      absence nulled, the deadline is what ends a sitting nobody finished.
+//   B. AND SILENCE CANNOT CARRY EITHER. An empty room agrees to nothing, so a
+//      sitting that ends with no affirmative voice RETURNS rather than passing.
+//      That second half is what makes a clock SAFE under this rule (ADR 0191 §4:
+//      a deadline may only be given to a rule whose expiry means return) — and
+//      it is the whole difference from `consent`, where an empty window passes.
+//
+// THE PERMISSIVE ANSWERS ARE ASSERTED AS DELIBERATELY AS THE RESTRICTIVE ONES
+// (modules/government/CLAUDE.md): "an absent member does not block" is exactly
+// the property a later well-meaning tightening would quietly undo, so it fails a
+// test by design.
+//
+// DB-free (db monkeypatched — the sibling board tests' idiom).
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const board = require(path.join(GOV, 'board.js'));
+const db = require(path.join(GOV, 'db.js'));
+const config = require(path.join(GOV, 'config.js'));
+
+const { tallyOutcome, shouldCloseAfterVote, closeItem } = board;
+
+async function withDb(stubs, fn) {
+  const originals = {};
+  for (const [k, v] of Object.entries(stubs)) { originals[k] = db[k]; db[k] = v; }
+  try { return await fn(); }
+  finally { for (const [k, v] of Object.entries(originals)) db[k] = v; }
+}
+
+const UNANIMOUS = {
+  membership: 'rank:archon', pass_rule: 'unanimous',
+  window_minutes: 1440, close_early_on_full_turnout: true,
+};
+const CONSENT = { ...UNANIMOUS, pass_rule: 'consent' };
+
+const yes = (v) => ({ voter_id: String(v), direction: 'yes' });
+const no = (v, section = 'fit') => ({ voter_id: String(v), direction: 'no', reason_md: 'too thin', section_key: section });
+const member = (id) => ({ builder_id: String(id), github_login: `m${id}`, display_name: `M${id}` });
+const FOUR = [member(1), member(2), member(3), member(4)];
+const AUTHOR = '1';
+
+const ideaItem = (over = {}) => ({
+  id: '11', subject_type: 'full_idea', subject_id: '7', opened_by: null,
+  constitution: UNANIMOUS, closed_at: null, outcome: null, expired: false, ...over,
+});
+
+// ── A. the tally: everyone who spoke said yes, and somebody spoke ────────────
+
+test('unanimous carries when every cast vote is yes and one of them is not the author', () => {
+  assert.equal(tallyOutcome([yes(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+  assert.equal(tallyOutcome([yes(1), yes(2), yes(3), yes(4)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+});
+
+test('ONE objection returns it, however many yes votes stand beside it', () => {
+  assert.equal(tallyOutcome([yes(2), yes(3), no(4)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'returned');
+  assert.equal(tallyOutcome([no(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'returned');
+});
+
+test('a sitting nobody voted in RETURNS — an empty room agrees to nothing', () => {
+  // The half that makes a clock safe here (ADR 0191 §4). Under `consent` the
+  // very same sitting PASSES, which is the difference stated as an assertion
+  // rather than as prose.
+  assert.equal(tallyOutcome([], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'returned');
+  assert.equal(tallyOutcome([], { constitution: CONSENT, members: FOUR, authorId: AUTHOR }), 'passed');
+});
+
+test('SILENCE DOES NOT BLOCK: one yes out of four carries, three absences and all', () => {
+  // Owner decision A, and the property a later "tighten it up" change would
+  // quietly undo. There is no membership denominator: `members` is passed and
+  // deliberately does not matter.
+  assert.equal(tallyOutcome([yes(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+  assert.equal(tallyOutcome([yes(2)], { constitution: UNANIMOUS, members: null, authorId: AUTHOR }), 'passed');
+  // Contrast with `majority`, where the same ballot fails on the denominator.
+  assert.equal(tallyOutcome([yes(2)], { constitution: { ...UNANIMOUS, pass_rule: 'majority' }, members: FOUR, authorId: AUTHOR }), 'returned');
+});
+
+// ── B. the ADR 0191 author rule, unchanged under the new tally ───────────────
+
+test('an author cannot carry their own idea alone, and cannot return it either', () => {
+  // Alone: their yes is the only affirmative voice, so nothing carries.
+  assert.equal(tallyOutcome([yes(AUTHOR)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'returned');
+  // Joined: their yes is a real vote, it simply may not be the whole of it.
+  assert.equal(tallyOutcome([yes(AUTHOR), yes(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+  // And an author's 'no' cannot return their own idea — otherwise silence would
+  // be the safest act available to an author.
+  assert.equal(tallyOutcome([no(AUTHOR), yes(2)], { constitution: UNANIMOUS, members: FOUR, authorId: AUTHOR }), 'passed');
+});
+
+test('the amendment carve-out survives: no author means no author rule', () => {
+  // ADR 0175 §7 — an amendment pays nothing and has no author to wait for, so a
+  // sole Archon proposing one must be able to ratify it. authorId is null there.
+  assert.equal(tallyOutcome([yes(1)], { constitution: UNANIMOUS, members: FOUR, authorId: null }), 'passed');
+});
+
+// ── C. the trigger: a yes waits, an objection does not ───────────────────────
+
+test('a single yes does NOT end the sitting — a later member must still be able to object', () => {
+  // The whole difference from first_ratifier, and the reason the clock matters.
+  assert.equal(shouldCloseAfterVote({ constitution: UNANIMOUS, votes: [yes(2)], members: FOUR, authorId: AUTHOR }), false);
+  assert.equal(shouldCloseAfterVote({ constitution: { ...UNANIMOUS, pass_rule: 'first_ratifier' }, votes: [yes(2)], members: FOUR, authorId: AUTHOR }), true);
+});
+
+test('a reasoned objection ends it at once — the outcome is already fixed', () => {
+  // There is no vote-changing in v1, so once a non-author 'no' is on the record
+  // nothing the absent members do can carry it. Closing now is what gets the
+  // author their feedback in time to revise, which is the point of the rule.
+  assert.equal(shouldCloseAfterVote({ constitution: UNANIMOUS, votes: [yes(2), no(3)], members: FOUR, authorId: AUTHOR }), true);
+});
+
+test('full turnout closes it early, and an author-only ballot never does', () => {
+  const all = [yes(1), yes(2), yes(3), yes(4)];
+  assert.equal(shouldCloseAfterVote({ constitution: UNANIMOUS, votes: all, members: FOUR, authorId: AUTHOR }), true);
+  assert.equal(shouldCloseAfterVote({ constitution: { ...UNANIMOUS, close_early_on_full_turnout: false }, votes: all, members: FOUR, authorId: AUTHOR }), false,
+    'close-early OFF means only the clock ends it');
+  assert.equal(shouldCloseAfterVote({ constitution: UNANIMOUS, votes: [yes(AUTHOR)], members: FOUR, authorId: AUTHOR }), false,
+    "an author's own cast never ends their sitting (ADR 0191 §3)");
+});
+
+// ── D. the loop: a returned sitting hands the idea back, and pays nothing ────
+
+test('the clock returns an unvoted sitting, and the author is free to re-sit it', async () => {
+  // What the expiry sweep does with a sitting nobody attended. closeItem is the
+  // same path the R11 poller calls, so this IS the expiry behaviour.
+  let written = null;
+  await withDb({
+    getVotesForItem: async () => [],
+    getBoardItemAuthor: async () => AUTHOR,
+    getIdeaCompleteness: async () => 88,
+    closeBoardItem: async ({ itemId, outcome }) => {
+      written = outcome;
+      return { id: itemId, subject_type: 'full_idea', subject_id: '7', outcome, closed_at: new Date().toISOString() };
+    },
+  }, async () => {
+    const out = await closeItem(ideaItem(), { cause: 'expiry' });
+    assert.equal(out.closed, true);
+    assert.equal(out.outcome, 'returned', 'expiry with nothing cast RETURNS — never a silent ratification');
+  });
+  assert.equal(written, 'returned');
+});
+
+test('a returned sitting is not a dead end: the item closes, and nothing is paid', async () => {
+  // The revise-and-re-sit loop lives in the ideas module (POST /inbox/:id/resubmit
+  // re-grades and re-fires the window hook). What the BOARD owes that loop is
+  // exactly this: a return that CLOSES the item — so government_003's partial
+  // unique index admits the next window — and that pays nothing, so a round trip
+  // through revision can never earn the author credits or ratification karma.
+  const paid = [];
+  await withDb({
+    getVotesForItem: async () => [no(2, 'fit')],
+    getBoardItemAuthor: async () => AUTHOR,
+    getIdeaCompleteness: async () => { paid.push('completeness'); return 88; },
+    closeBoardItem: async ({ itemId, outcome, afterClose }) => {
+      if (afterClose) paid.push('credit');
+      return { id: itemId, subject_type: 'full_idea', subject_id: '7', outcome, closed_at: new Date().toISOString() };
+    },
+  }, async () => {
+    const out = await closeItem(ideaItem(), { cause: 'vote' });
+    assert.equal(out.outcome, 'returned');
+    assert.ok(out.item.closed_at, 'the item is CLOSED, so the next window may open');
+    assert.equal(out.author_karma, null, 'a return pays no ratification karma');
+    assert.equal(out.credit, undefined, 'a return books no idea credit');
+  });
+  assert.deepEqual(paid, [], 'nothing on the paying path was even reached');
+});
+
+// ── E. the config contract ──────────────────────────────────────────────────
+
+test('unanimous is a legal, adoptable pass rule — and the fail-closed default is untouched', () => {
+  assert.ok(config.PASS_RULES.includes('unanimous'));
+  assert.equal(config.sanitizeBoard({ membership: 'rank:metic+', pass_rule: 'unanimous', window_minutes: 1440, close_early_on_full_turnout: true }).pass_rule, 'unanimous');
+  // Adding a STRICTER rule must not move what a malformed constitution falls
+  // back to — a fresh instance is still the day-one monarchy, which is what lets
+  // a solo founder ratify anything at all (ADR 0191 §5).
+  assert.equal(config.BOARD_DEFAULTS.pass_rule, 'first_ratifier');
+  assert.equal(config.sanitizeBoard({ pass_rule: 'unanimious' }).pass_rule, 'first_ratifier');
+});
+
+test('a unanimous constitution may carry a clock, which the older two may not safely', () => {
+  // Not a code rule — a REVIEW rule, stated as an assertion so the pairing is
+  // visible: window_minutes is only safe where expiry means return.
+  const withClock = config.sanitizeBoard({ membership: 'rank:archon', pass_rule: 'unanimous', window_minutes: 1440, close_early_on_full_turnout: true });
+  assert.equal(withClock.window_minutes, 1440);
+  assert.equal(tallyOutcome([], { constitution: withClock, members: FOUR, authorId: AUTHOR }), 'returned',
+    'the clock is safe here precisely because an empty sitting returns');
+});
+
+// ── F. the loop's other half: what the board hands back, and the next window ─
+
+test('a returned idea carries its objection back — reason and flagged section', async () => {
+  // The feedback that makes revision possible. The ideas resubmit path reads
+  // this through the `government` port and renders it as the rejection notice
+  // (tests/idea_resubmit.mjs pins that end: a board objection OUTRANKS the
+  // mechanical weakest-section flag).
+  await withDb({
+    getLatestReturnedItemWithObjection: async (type, id) => {
+      assert.equal(type, 'full_idea');
+      assert.equal(id, 7);
+      return { item_id: '11', section_key: 'fit', reason_md: 'the fit section names no user', closed_at: '2026-09-08T00:00:00Z' };
+    },
+  }, async () => {
+    const r = await board.latestRejectionForIdea(7);
+    assert.equal(r.source, 'board');
+    assert.equal(r.section_key, 'fit');
+    assert.equal(r.reason_md, 'the fit section names no user');
+  });
+});
+
+test('a ZERO-VOTE return carries no objection — and says so rather than inventing one', async () => {
+  // The honest gap this rule creates (ADR 0267 §5). Nobody voted, so there is no
+  // reason and no flagged section; the read returns null and the resubmit path
+  // falls back to the deterministic weakest-section flag. Returning a fabricated
+  // "the board did not read it" would put words in a member's mouth.
+  await withDb({
+    getLatestReturnedItemWithObjection: async () => null,
+  }, async () => {
+    assert.equal(await board.latestRejectionForIdea(7), null);
+  });
+});
+
+test('the next round can open: a CLOSED prior sitting no longer holds the subject', async () => {
+  // The precondition the whole loop rests on. government_003's partial unique
+  // index admits one OPEN window per subject, so a returned (closed) sitting
+  // must not stand in the way of the revised idea's next one — that is why the
+  // return path closes the item rather than parking it.
+  let opened = 0;
+  await withDb({
+    openBoardItem: async ({ subjectType, subjectId }) => {
+      opened += 1;
+      return { id: String(30 + opened), subject_type: subjectType, subject_id: String(subjectId), closes_at: null, constitution: UNANIMOUS };
+    },
+    getOpenBoardItem: async () => null,
+  }, async () => {
+    const first = await board.openWindowForFullIdea({ ideaId: 7, completenessScore: 88 });
+    assert.equal(first.opened, true);
+    // Round two, after a revision that re-cleared the bar. Nothing in the module
+    // remembers that this subject has sat before — by design, the loop is unbounded.
+    const second = await board.openWindowForFullIdea({ ideaId: 7, completenessScore: 91 });
+    assert.equal(second.opened, true);
+    assert.notEqual(second.item.id, first.item.id, 'a NEW sitting, not the old one reopened');
+  });
+  assert.equal(opened, 2);
+});
+
+test('a revision that falls back BELOW the completeness bar never reaches the board', async () => {
+  // The grade is the floor and the vote is the merit (ADR 0175 §5): a revision
+  // can make an idea worse, and board time is never spent on what a free
+  // deterministic check can bounce. The author gets the weakest-section flag
+  // instead — which is exactly the zero-vote fallback above.
+  await withDb({
+    openBoardItem: async () => { throw new Error('must not be reached'); },
+  }, async () => {
+    const out = await board.openWindowForFullIdea({ ideaId: 7, completenessScore: 41 });
+    assert.equal(out.opened, false);
+    assert.equal(out.reason, 'below_bar');
+  });
+});
+
+test('a subject that ALREADY sits does not open a second window', async () => {
+  // The other side of the partial unique index: a double-fired hook, a re-grade
+  // or a resubmission race must not put one idea in front of the board twice.
+  await withDb({
+    openBoardItem: async () => null, // ON CONFLICT DO NOTHING
+    getOpenBoardItem: async () => ({ id: '31', subject_type: 'full_idea', subject_id: '7' }),
+  }, async () => {
+    const out = await board.openWindowForFullIdea({ ideaId: 7, completenessScore: 88 });
+    assert.equal(out.opened, false);
+    assert.equal(out.reason, 'already_open');
+    assert.equal(out.item.id, '31');
+  });
+});
+
+// ── G. the clock advice the amendment form reads ────────────────────────────
+
+test('the constitution view states which rules a clock is honest under, and what to put in the box', async () => {
+  // A proposer chooses a pass rule and a window in the same breath (a
+  // constitution is ratified whole, never by diff) and the two are NOT
+  // independent — ADR 0191 §4. So the server states the pairing rather than the
+  // hall hardcoding a number it could drift from.
+  const originals = { listAmendmentHistory: db.listAmendmentHistory, countActiveBuilders: db.countActiveBuilders };
+  Object.assign(db, { listAmendmentHistory: async () => [], countActiveBuilders: async () => 4 });
+  try {
+    const view = await board.constitutionView();
+    assert.equal(view.clock.recommended_window_minutes, config.RECOMMENDED_WINDOW_MINUTES);
+    assert.deepEqual([...view.clock.clock_safe_pass_rules].sort(), ['majority', 'unanimous']);
+    // This checkout resolves to the neutral monarchy, under which expiry PASSES
+    // — so the view must say a clock is NOT safe here rather than recommending
+    // one. That is the auto-ratifier guard, visible in the API.
+    assert.equal(view.board.pass_rule, 'first_ratifier');
+    assert.equal(view.clock.live_rule_is_clock_safe, false);
+  } finally { Object.assign(db, originals); }
+});
+
+test('clock safety is a property of the RULE, and the two absence-passes rules never get one', () => {
+  assert.equal(config.isClockSafe('unanimous'), true);
+  assert.equal(config.isClockSafe('majority'), true);
+  assert.equal(config.isClockSafe('first_ratifier'), false, 'expiry PASSES here — a deadline would ratify the unread');
+  assert.equal(config.isClockSafe('consent'), false, 'silence is assent here — same trap');
+  assert.equal(config.isClockSafe('nonsense'), false, 'an unknown rule is never clock-safe');
+  // The two lists cannot drift apart: every clock-safe rule is a real rule.
+  for (const r of config.CLOCK_SAFE_PASS_RULES) assert.ok(config.PASS_RULES.includes(r), `${r} must be a real pass rule`);
+});