@bongos/core 1.19.614 → 1.19.616

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.614",
-  "core_contract": "1.19.614",
-  "source_commit": "abed8329cedd284ae48ca75f74b991eed0bb00aa",
+  "core_version": "1.19.616",
+  "core_contract": "1.19.616",
+  "source_commit": "2113152645fd3966e0a77a4da6b68d6ea73848aa",
   "source_ref": "HEAD",
-  "built_at": "2026-09-09T05:18:42.201Z",
+  "built_at": "2026-09-09T05:39:43.695Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 459,
+    "docs_redacted": 460,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2080,
+    "functional_verbatim": 2081,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2563,
-  "tree_sha256": "6eaf4625f3f277d948abd11748dcf8e2f7f24062b460a58dd7ea3c7033156dea",
+  "file_count": 2565,
+  "tree_sha256": "f508d8a28fac2d7f0653d1b5663e850247311a8a9187a112387cd1658b4830cc",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -1849,10 +1849,15 @@
       "mode": "0000644",
       "sha256": "ac348289412efce1b3d67d74fccb5ff81347d196715ff53fd77e79e22228fad3"
     },
+    {
+      "path": "docs/adr/0267-unanimity-and-the-revise-and-re-sit-loop.md",
+      "mode": "0000644",
+      "sha256": "32a1e0c4fe9423008caf491e5d3594aa4a07874a46a047a86e5eb321baef773a"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "6cdaf9ffd4b14ae27231158fc040d59f084b86a93e6ecc43fb16bdea54e32fb6"
+      "sha256": "c836e90436fea9c5a1f1a38e3640643602e8a639120c33770ab525c432655799"
     },
     {
       "path": "docs/api-reference.md",
@@ -1887,12 +1892,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "8b804ce68d2c06220133ad408d97683211859389d73612c15a0c1818bd2333d4"
+      "sha256": "00e8dd0db1a70a4f9fec1f1622688f78308f560485bfb8a0df24d50ceb4a8c66"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "ecaec2aa40662c54a136bcf8c41b95b45a497d02265ca2f229f9cfa440a39f44"
+      "sha256": "4dcbb030236a1267b336e0ecb1c13623794cba823b61304ab4cb7b4db06c55b1"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2737,7 +2742,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "df3d7a5da1b66f12598a82a180eb3b3373938ef7a95e17977229adf999b02195"
+      "sha256": "b94b3264ad1cdcdcb427201228f87e7b5d6362210338ac13e1b4382cde0081b6"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4392,7 +4397,7 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "c3fb035f37f2a8fa8f0c8f3e06ecef037a2d46937e6f3958cdd259573b426d9c"
+      "sha256": "e79c0a72c27c3773308ad3e21040a6e22c4ba63af46aec8ab4d26e5d588a1b2e"
     },
     {
       "path": "modules/government/catalog.js",
@@ -4402,7 +4407,7 @@
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
-      "sha256": "a6ed17999e34222a7c8622699c33c5302afbf2fff9024fefb20177d029dbf8a5"
+      "sha256": "3e66902145db7a64e7932b8a071bbbe496dd63f450abe629168813349cf92211"
     },
     {
       "path": "modules/government/db.js",
@@ -4917,7 +4922,7 @@
     {
       "path": "modules/hall-ui/public/government.js",
       "mode": "0000644",
-      "sha256": "2db7825c2f0066753bb18565d50fc5a08761158502e9882353d72ce877b1518f"
+      "sha256": "dea97ea504d81b69b97679db8dda2180f156b3fead18bc18a4d7c95e83d4fe9e"
     },
     {
       "path": "modules/hall-ui/public/government.states.json",
@@ -7637,12 +7642,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "abc3e3e3456a393e7a2113807d07adcc257b8e8af6369e6c05fc0bdf32340d49"
+      "sha256": "51bfd3e50f43955dc06201b291f9dbba29c3439724aab443c5d177ef30776557"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "7301d49faecbce2fb275d06852d671f82f97df62ff7c94a0451e719a2457e257"
+      "sha256": "a9ddee44e32208948907ee0f79e1927f9e09cf3a6e71975f11c43fc61fe916fa"
     },
     {
       "path": "public-docs/index.html",
@@ -9367,7 +9372,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "05f2b36b4f1ebb20ba4a425d9669d0ac29326557c67d3deb61a63e3e5a06a261"
+      "sha256": "fdf7c35d60a47a1850c524f9bfa233ac52cd1727dc7ceff35c2653895724675f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10607,12 +10612,12 @@
     {
       "path": "tests/government_board_amendment.mjs",
       "mode": "0000644",
-      "sha256": "eec3a845e513cc8cf1faf6cde195581943c52b249508091db7d141209add4874"
+      "sha256": "c119e3095fd3c260fdea47ff79d2135a77d2a55cc089842667e0b4167a41b91a"
     },
     {
       "path": "tests/government_board_close.mjs",
       "mode": "0000644",
-      "sha256": "86c129ee24f084fcd5574a827de0ed4ada7a00a92721b1038204f5474ee2e18d"
+      "sha256": "beb4e3bb9c220512f7c08c4b2642266c883b5304cd8eb47b20eebf0205d83aa4"
     },
     {
       "path": "tests/government_board_expiry.mjs",
@@ -10682,7 +10687,7 @@
     {
       "path": "tests/government_config.mjs",
       "mode": "0000644",
-      "sha256": "2e6f51648c858cf33cf6eb712a20e048be3fa92d2ec6d7e747601569b3f19109"
+      "sha256": "a8e575d151aca92789ffa9d3a49f77aa2579fa285374b2c1f5a65b12ac82163d"
     },
     {
       "path": "tests/government_constitution_view.mjs",
@@ -10764,6 +10769,11 @@
       "mode": "0000644",
       "sha256": "7aea1db75ada98b9e3756695c743516a3aac5f12a71d654adc383ae886c2568c"
     },
+    {
+      "path": "tests/government_unanimous.mjs",
+      "mode": "0000644",
+      "sha256": "fb35e842dfdba0569da6fc798ccc6699159a942a0ac2024897d2de7dfc059fb4"
+    },
     {
       "path": "tests/government_vanilla_boot.mjs",
       "mode": "0000644",

package/docs/adr/0267-unanimity-and-the-revise-and-re-sit-loop.md

@@ -0,0 +1,124 @@
+# 0267 — Unanimity, and the revise-and-re-sit loop
+
+- **Status:** Accepted
+- **Date:** 2026-09-08
+- **Tasks:** [#1003733](https://cloudbongos.com/builders#/task/1003733) (goal [#1000111](https://cloudbongos.com/builders#/goal/1000111) — Government).
+- **Amends:** [ADR 0175](<redacted>.md) §3 (the pass-rule set) and [ADR 0191](<redacted>.md) §2 (the same set, and the clock argument in §4). Everything else in both stands — in particular 0191 §3, the author who may vote and may never decide alone, which this decision leans on rather than touches, and 0175 §8, Discord is outbound-only and never a ballot.
+
+## 1. The decision
+
+The owner, 2026-09-08: *"first vote does not pass. A Full idea requires majority,
+or unanimous decision making, with revisions until there is unanimous decision
+making."* Asked which of the two readings that was, they chose **unanimous from
+round one**, and — asked whether a member who never votes should block an idea —
+answered **no**, *"this is why we want that timer rule from before implemented."*
+
+So the rule is:
+
+> **A Full Idea is ratified by unanimous agreement.** Everyone who votes must
+> vote yes, and at least one member must. One reasoned objection returns it to
+> its author, who revises it and puts it back to the board — as many rounds as it
+> takes. Being away blocks nothing; the clock is what ends a sitting nobody
+> finished.
+
+## 2. Unanimity is two conditions, and the second is the one people forget
+
+`unanimous` joins `first_ratifier`, `consent` and `majority` in `PASS_RULES`. The
+four rules are still not a ladder of strictness — they differ on **what silence
+means**, which stays the axis that matters (0191 §2):
+
+| Rule | What carries it | **What silence means** |
+|---|---|---|
+| `first_ratifier` | the first vote cast | an unvoted item **passes** |
+| `consent` | anything but a reasoned objection | an empty window **passes unopposed** |
+| `majority` | more than half of the **membership** votes yes | absence counts against; an item that never reaches a majority **returns** |
+| `unanimous` (new) | nobody who spoke objected, **and somebody spoke** | absence is nulled — it neither blocks nor carries; an unvoted item **returns** |
+
+Unanimity is not "nobody objected". **An empty room agrees to nothing**, so a
+sitting that ends with no affirmative voice returns rather than passing. Without
+that second condition `unanimous` would collapse into `consent` at expiry, and
+the clock the owner asked for would become an auto-ratifier — precisely the trap
+0191 §4 identified when it refused to give a deadline to `first_ratifier`.
+
+**There is deliberately no membership denominator.** That is the whole difference
+from `majority`, and it is the owner's "silence does not block" written as code:
+a member who never votes is not in the reckoning at all. One yes out of four
+carries. The cost of that permissiveness is real and is stated here rather than
+hidden — an idea can be ratified by one attentive reader on a distracted board —
+and it is the price of the deadlock the alternative produces. A unanimity rule
+with absence in the denominator is a rule where one person on holiday stops the
+pipeline.
+
+## 3. The clock is now safe, and it is not armed by default
+
+0191 §4 established the condition: **a deadline may only be given to a rule whose
+expiry means return.** `unanimous` satisfies it, so a project adopting this rule
+may set `window_minutes` — and should, because a returned idea is only useful if
+the return actually arrives.
+
+The R11 expiry sweep (`modules/government/pollers/board-expiry.js`) already
+closes due items through the same `closeItem` a vote uses, so the timed half
+needed no new machinery — only a rule it is safe under.
+
+**`BOARD_DEFAULTS` is unchanged: a fresh instance is still the day-one monarchy**
+(`rank:archon` · `first_ratifier` · no clock). This is not timidity, it is 0191
+§5's finding applied: under any rule carrying the non-author-yes requirement, a
+**solo instance cannot ratify its own ideas** — there is no non-author yes
+available. Shipping unanimity as the neutral default would hand every new Cloud
+Bongos instance an idea pipeline that returns everything its founder writes. The
+fail-closed fallback also stays `first_ratifier`, so a malformed constitution
+still cannot resolve to a wider or easier board.
+
+**A project adopts this rule the constitutional way — by amendment**, in the
+Board Room, which is what 0175 §7 and its owner decision 11 reserve constitution
+changes to. Config-by-deploy-flag is still refused: `resolveGovernmentConfig`
+keeps its "no env var can change the constitution" property, pinned by test.
+
+## 4. What ends a sitting, and what does not
+
+Two changes to the trigger, both following from the rule rather than added to it:
+
+- **A single yes does not close it.** Unlike `first_ratifier`, a later member
+  must still be able to object, so the sitting runs its clock. Full turnout
+  closes it early, as under `consent` — by then every position is recorded.
+- **A reasoned objection closes it at once.** There is no vote-changing in v1, so
+  a non-author `no` fixes the outcome at *returned* whatever the absent members
+  do. Holding the sitting open past that point would only delay the feedback the
+  author needs in order to revise — and revising is the point of this rule. Same
+  reasoning as `majorityDecided`'s unreachable branch.
+
+The ADR 0191 author rule rides both unchanged: an author's cast never ends their
+own sitting, their `no` cannot return their own idea, and the affirmative voice
+that carries it must not be their own.
+
+## 5. The loop already existed; what was missing was a rule that used it
+
+`POST /api/gds/inbox/:id/resubmit` has re-graded a returned Full Idea and
+re-fired the window hook since goal 1000069 — and `latestRejectionForIdea` hands
+the author the objection's reason and flagged section on the way back. The board
+owes that loop two things, and now pins both by test: a return **closes** the
+item (so `government_003`'s partial unique index admits the next window), and a
+return **pays nothing** (so a round trip through revision can never earn credits
+or ratification karma).
+
+The loop is unbounded on purpose. "Revisions until there is unanimous decision
+making" has no round limit in it, and a cap would just be a different way of
+killing an idea than the board deciding to.
+
+One honest gap: a **zero-vote** return carries no objection, so the author gets
+the mechanical weakest-section flag instead of a human reason. That is the
+correct fallback — it is what the sub-bar path already uses — but it means a
+generous window and a working summons stay load-bearing, exactly as 0191 §5 said
+of majority.
+
+## 6. What this does not do
+
+**It does not change what cloudbongos.com is running today.** The live
+constitution resolves to `first_ratifier` / `rank:archon` / no clock, *despite* a
+consent amendment that passed on 2026-08-25 — `applyBoardAmendment` wrote the
+instance pack and the live resolution never moved. That is a separate defect
+(a ratified amendment that does not survive to the next read is a governance
+system lying about its own constitution), filed on its own task rather than
+absorbed into this one. Until it is fixed, adopting unanimity on this instance is
+blocked behind it — which is the same trap 0191 fell into, and worth naming
+loudly rather than discovering twice.

package/docs/adr/README.md

@@ -358,3 +358,4 @@ This keeps the decision history honest and traceable.
 | 0264 | [**The ten working areas: one goal per area, held until 5,000 builders** ([task 1003696](https://cloudbongos.com/builders#/task/1003696) · goal 1000086 — *Strict versioning*, criterion `sv-cutover-proven-live`). The owner and the full team ran a manual goal review on 2026-09-07 and cut **38 open goals down to 10**, one per working area, each with a named owner and a described 5,000-builder end state: project creation (Rini), account/community (Rini), human project management (Scott), core distribution (Lars/Will), module distribution & economy (Will), the four-role experience incl. agents (Masterqua/Rini), government (Will/Masterqua), the credit economy (Scott), platform analytics (Lars), security (everyone bar Nils and Scott). **Why the rules were not enough on their own:** [ADR 0250](<redacted>.md) D1 closes the goal set of a BUILDING version — which freezes 38 goals exactly as effectively as it would freeze 10. Enforcement cannot shrink a scope that is already too large, so the rules and the cut are two halves of one move; the horizon is a SCALE (5,000 builders), not a date, because that is the question that decides when this set stops being the right set. **The finding that reorders the goal:** none of the cut can be executed today. R10 ([task 1003597](https://cloudbongos.com/builders#/task/1003597)) made `POST /goals/:id/archive` refuse a goal holding unfinished tasks and demand a disposition — correct, and exactly D3 — but the vector that SUPPLIES a disposition is R14 ([task 1003601](https://cloudbongos.com/builders#/task/1003601)), unshipped. Every one of the 12 deletes and every fold goes through that door, so **R14 is the keystone of the whole cut**, not one feature among thirteen, and is built before the rest of the version-close chain rather than in rank order. It looks like a bug and is not: the refusal is the design, landed one task ahead of its own remedy. "Delete" means `archived`, never a row removal (`goals.status` is open|achieved|archived, migration 160; reversible via `/reopen`) — preserving the rows keeps shipped-task attribution and credit history a delete would strand. Three open goals were NOT covered by the review and are surfaced as open questions rather than guessed: 1000003 (the catch-all — already R25's target), 1000065 (assumed to be area 2's community half), and 1000088 (repo cleanup — maps to no area, needs an owner decision). Deliberately does not decide: the areas' priority order, criteria for the six goals R29 must create (inventing criteria for someone else's area is how a goal acquires scope its owner never agreed to), or any task rehoming (R25/R26).](<redacted>.md) | scope / goal set / owner decision |
 | 0265 | [**Work with no goal survives a version close, and the order the ten-area cut actually needs** ([task 1003713](https://cloudbongos.com/builders#/task/1003713) · goal 1000086 — *Strict versioning*, criteria `sv-every-task-has-a-goal` + `sv-cutover-proven-live`). `closeVersion`'s post-apply invariant counts GOALS, and every task write inside the close is scoped `WHERE goal_id = $1` — so a task belonging to no goal is reached by no disposition, counted by no re-count, and ships stranded on a version that is over. Not hypothetical: six such tasks already sat on shipped GDS-V3/GDS-V4, and 47 rows on BONGOS-V1 carried a null `goal_id` (R11 required the column going forward but never backfilled, because every catch-all lookup matches the exact title `<VERSION> — general` and BONGOS-V1's is titled 'Work with no goal yet'). Decision: a second invariant in the same transaction refuses a close leaving ANY non-terminal task on the version, failing `CLOSE_LEAVES_STRANDED_TASKS` with the ids; exempting only the maintenance goal (its carry-forward runs in the later `onClosed` hook) — through the SAME `maintenanceGoalExemptSql` the goal count uses, never a second copy — and `__smoke__` fixtures. Consequence recorded here too: because `PATCH /tasks/:id {goal_id}` refuses a cross-version move (409 `goal_version_mismatch`) and `roll_forward` CREATES a successor rather than merging into one, [ADR 0264](<redacted>.md)'s cut must run home-then-close-then-**fold on the planning version**, where task and destination finally share a version. Rejected: a `fold_into` disposition (puts scope decisions inside a shipping transaction), creating the six new areas on the building version via R07 admissions (spends ten overrides to route around the rule they price), and a backfill instead of a gate (fixes today's rows, not the forty-eighth).](<redacted>.md) | lifecycle / version boundary |
 | 0266 | [**The Board Room is its own surface, reachable by whoever may vote** ([task 1003734](https://cloudbongos.com/builders#/task/1003734) · goal 1000111 — *Working area 7, Government*, criterion `wa7-government`; owner decision 2026-09-08). The hall's only **upward-pointing** gate ([ADR 0175](<redacted>.md)) shipped as a hash tab inside `/government`, and two things about that did not survive inspection. **The nav never followed the page:** R16 correctly widened the PAGE gate from `government.manage` (archon) to `page.view.government` (metic+) when the page became three rooms — its own comment says *"the shell follows the widest legitimate audience"* — but `shell.js` still declares that item as label Permissions with gate archon, so a Metic who SITS on the board has no nav link at all and the only word in the nav is Permissions. Watch, Harbor, Gate and Sessions each own a nav item; the voting room was reachable only by knowing a URL fragment. **The surface was narrower than the franchise:** `board.vote.cast` floors at XENOS deliberately (`board.js:149` — the floor is low *so that widening the board works*) while the shell demands metic+, so the moment a constitution widens membership below Metic — the exact act [ADR 0175](<redacted>.md) §6 exists to make a CONFIG change — those members may vote by API and cannot load the page they would vote on, reintroducing the code-path change §6 removed. Decision: **its own page at `/board-room`, gated on the same atom the vote route checks.** The floor stays coarse — membership is still checked in-handler per item against that item's own snapshotted constitution — so a builder who clears the floor but sits on no board sees the room and no ballot, which is honest (§9 made the ballot open on purpose). **The migration is client-side because a fragment never reaches the server:** `#board-room` cannot be caught by any server route, so `government.js` redirects on load, preserving `?item=N` — recorded as a decision because adding a regex to `serve-internal.js` looks like the obvious fix and silently never fires. Three writers move (Discord `board-broadcast.js`, the `board_votes` need href, docs), and the redirect stays a release regardless because announcements already in channel history carry the old link forever. A **waiting-vote count** goes on the nav item: the data already exists (`boardVotesNeed` carries a live count pre-filtered to what the vote route would accept, served on `GET /me`), but `shell.js` has NO badge/bell/dot mechanism at all, so one is built once, generically, zero-is-silent, visible to exactly whoever the item is. Found while scoping and filed separately ([task 1003738](https://cloudbongos.com/builders#/task/1003738)): the hall renders needs as a SINGLE slot and `computeNeeds` sorts only by state with a stable sort, so registry order decides inside the `action_needed` bucket and `boardVotesNeed` sits fourth behind `artKeyNeed` — any builder with an unresolved image key never sees the board notice, which was live for this decision's own owner at the moment they asked for the bell. Rejected: a nav item merely deep-linking to the existing tab (cheaper, keeps the hash links free, but leaves the voting room inside a page whose gate answers a different question); a bell in the global header (a second inbox, needing its own read/unread and dismissal semantics); and a SOUND (`alert.wav`/`chime.wav` already ship, so it would be easy — it was not asked for).](<redacted>.md) | government / the board / hall nav |
+| 0267 | [**Unanimity, and the revise-and-re-sit loop** ([task 1003733](https://cloudbongos.com/builders#/task/1003733) · goal 1000111 — *Government*, owner decision 2026-09-08). A Full Idea is ratified by **unanimous** agreement from round one; a sitting that does not carry RETURNS to its author, who revises and re-sits it, unbounded, until the board is unanimous. `unanimous` joins `PASS_RULES` as a fourth answer on the axis these rules actually differ on — **what silence means**: it is two conditions, not one, because "nobody objected" is true of an empty room. Everyone who spoke must have said yes AND somebody must have spoken, so an unvoted sitting RETURNS, which is exactly what makes the clock the owner asked for safe under it ([ADR 0191](<redacted>.md) §4: a deadline may only be given to a rule whose expiry means return). **There is deliberately no membership denominator** — that is the whole difference from `majority`, and it is the owner's "silence does not block" as code: an absent member is not in the reckoning, so one yes out of four carries. The stated cost is that an attentive minority can ratify on a distracted board; the alternative is one person on holiday stopping the pipeline. Trigger changes follow from the rule: a single yes does NOT close it (a later member must still be able to object — the sitting runs its clock, full turnout closes early), while a reasoned objection closes it AT ONCE (no vote-changing in v1 fixes the outcome, and the author needs the feedback to revise). ADR 0191 §3's author rule rides both unchanged. **`BOARD_DEFAULTS` is NOT moved**: a fresh instance stays the day-one monarchy, because under any non-author-yes rule a solo founder can never ratify their own ideas (0191 §5) — adoption is a board amendment, and no env var can change a constitution. The revise-and-re-sit loop already existed (`POST /inbox/:id/resubmit` re-grades and re-fires the window hook); what the board owes it is now pinned by test — a return CLOSES the item so the next window may open, and pays nothing. Named limits: a zero-vote return carries no human objection (the author gets the mechanical weakest-section flag), and this changes nothing live until the separate defect where a ratified amendment does not survive to the next read is fixed.](<redacted>.md) | government / board room |