@bongos/core 1.19.616 → 1.19.618

package/.bongos-core.json

@@ -2,23 +2,28 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.616",
-  "core_contract": "1.19.616",
-  "source_commit": "2113152645fd3966e0a77a4da6b68d6ea73848aa",
+  "core_version": "1.19.618",
+  "core_contract": "1.19.618",
+  "source_commit": "1e344743e60d4921a3e5d73b32817388928e62a0",
   "source_ref": "HEAD",
-  "built_at": "2026-09-09T05:39:43.695Z",
+  "built_at": "2026-09-09T06:20:10.684Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 460,
+    "docs_redacted": 462,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2081,
+    "functional_verbatim": 2085,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2565,
-  "tree_sha256": "f508d8a28fac2d7f0653d1b5663e850247311a8a9187a112387cd1658b4830cc",
+  "file_count": 2571,
+  "tree_sha256": "725579642848cf49184292a5271ac418e2ea288cac2beaaa80b49468625abc14",
   "files": [
+    {
+      "path": ".claude/skills/backlog-review/SKILL.md",
+      "mode": "0000644",
+      "sha256": "ce45a242487fa6d10794280958fea47f8a23e2618551f629abe38054d467a59c"
+    },
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
       "mode": "0000644",
@@ -1854,10 +1859,15 @@
       "mode": "0000644",
       "sha256": "32a1e0c4fe9423008caf491e5d3594aa4a07874a46a047a86e5eb321baef773a"
     },
+    {
+      "path": "docs/adr/0268-the-constitution-comes-from-two-roots.md",
+      "mode": "0000644",
+      "sha256": "cec61252a02d5da416c77088dbf2adf99c138cb10b654fa9fef949a0848a7964"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "c836e90436fea9c5a1f1a38e3640643602e8a639120c33770ab525c432655799"
+      "sha256": "7ab74c04d47b89328aedfe3fca3f2fd18c049c2fe5aa6c98bc1072d26bc12c68"
     },
     {
       "path": "docs/api-reference.md",
@@ -1892,12 +1902,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "00e8dd0db1a70a4f9fec1f1622688f78308f560485bfb8a0df24d50ceb4a8c66"
+      "sha256": "0e4c54e6bd6d76fdd7853b19c343b747fabfc2f59ee8baab74cbaebc6064aa1e"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "4dcbb030236a1267b336e0ecb1c13623794cba823b61304ab4cb7b4db06c55b1"
+      "sha256": "4357446e8f95c430791743a43f893140d862ab7dd5453f6a42791b194956d61c"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2732,7 +2742,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "8b9c303b7cb35b420ff13c0a265fe2e505769c6d1625977eb85c0d077ff1ddf2"
+      "sha256": "0cec3b144d8cca893b49c1d08bdacf37220dc1b670fd771656dda659bae16edc"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2742,7 +2752,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b94b3264ad1cdcdcb427201228f87e7b5d6362210338ac13e1b4382cde0081b6"
+      "sha256": "ec11a2ed9d50d4558aee3aca03f217dc0dde1f717859eb7a77c706535324fd32"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4397,7 +4407,7 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "e79c0a72c27c3773308ad3e21040a6e22c4ba63af46aec8ab4d26e5d588a1b2e"
+      "sha256": "68bf53ab31ec3f21359665eea42127f1691b8dc17b59100c65cc1f56a04ad6a7"
     },
     {
       "path": "modules/government/catalog.js",
@@ -4407,7 +4417,7 @@
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
-      "sha256": "3e66902145db7a64e7932b8a071bbbe496dd63f450abe629168813349cf92211"
+      "sha256": "8edccad7dc69a95503d9e0d1de7795fd6082c8122e0695d1f018f49b37051fed"
     },
     {
       "path": "modules/government/db.js",
@@ -4922,7 +4932,7 @@
     {
       "path": "modules/hall-ui/public/government.js",
       "mode": "0000644",
-      "sha256": "dea97ea504d81b69b97679db8dda2180f156b3fead18bc18a4d7c95e83d4fe9e"
+      "sha256": "6333b05761e5bf3215fe3c19ae98b25ebdac8cf0761df28fbc4933a5317ce5fa"
     },
     {
       "path": "modules/hall-ui/public/government.states.json",
@@ -5052,7 +5062,7 @@
     {
       "path": "modules/hall-ui/public/oversight.css",
       "mode": "0000644",
-      "sha256": "13d46f29e77ba9ca30ab52de2e0413f2fcb68bfec44de032730d4d135530e4ba"
+      "sha256": "a199baf1c11bdbe6d30931253956e0c9a9709ae3f880af77b2a6737212fe0984"
     },
     {
       "path": "modules/hall-ui/public/pair.css",
@@ -7642,12 +7652,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "51bfd3e50f43955dc06201b291f9dbba29c3439724aab443c5d177ef30776557"
+      "sha256": "44a869111a69105fd5f1778cb749ad2c40a067db90fee6e6bbd19fcd76acd2ab"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a9ddee44e32208948907ee0f79e1927f9e09cf3a6e71975f11c43fc61fe916fa"
+      "sha256": "b974dffa8dcde89358258e710e0f0b2c9fbd560ff5ba4c505cc57ced1809ab0e"
     },
     {
       "path": "public-docs/index.html",
@@ -7794,6 +7804,11 @@
       "mode": "0000644",
       "sha256": "a9f1064fbb683297e775c455ef65249cf809018a38a5aa2f975a62cbba16cd9c"
     },
+    {
+      "path": "scripts/gds/backlog-review.js",
+      "mode": "0000644",
+      "sha256": "4646bd6da8be2d2c40c1063bba47f5fdce0f2f63143e26fc16e36ea941adbc88"
+    },
     {
       "path": "scripts/gds/backup.js",
       "mode": "0000644",
@@ -9372,7 +9387,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fdf7c35d60a47a1850c524f9bfa233ac52cd1727dc7ceff35c2653895724675f"
+      "sha256": "8d4f44cdde9eecac4f1d8294dcd8d1f1283d536c2adab2d9e49b74c8891a40e8"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9679,6 +9694,11 @@
       "mode": "0000644",
       "sha256": "25f45e6a0f79e6e6299b062dd89306f898fc1ed8cefbf4fa16b76c9c511f0548"
     },
+    {
+      "path": "tests/backlog_review.mjs",
+      "mode": "0000644",
+      "sha256": "788f3b3faba5f0568a251d3551c8776e2f383d59c8c2ed0728ef4c9af9a208c7"
+    },
     {
       "path": "tests/backup_cli.mjs",
       "mode": "0000644",
@@ -10689,6 +10709,16 @@
       "mode": "0000644",
       "sha256": "a8e575d151aca92789ffa9d3a49f77aa2579fa285374b2c1f5a65b12ac82163d"
     },
+    {
+      "path": "tests/government_config_roots.mjs",
+      "mode": "0000644",
+      "sha256": "d3060b7302f17a1478588ee333ba9e2f4deea23d5896363b9bd42e30edb12c88"
+    },
+    {
+      "path": "tests/government_constitution_divergence.mjs",
+      "mode": "0000644",
+      "sha256": "280bc5906ac8075495cd3b1fe10e4082291cf4497b166f6acbdec291a8fd6698"
+    },
     {
       "path": "tests/government_constitution_view.mjs",
       "mode": "0000644",
@@ -11442,7 +11472,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "157d551b9a99320198f22d32ce335fa4166414dc1818d11ef23a0ea05ac80a76"
+      "sha256": "cc6fb31e06f0b2accf46f1595f9548492698c88ff56c4d9f4f43c86fce6816a3"
     },
     {
       "path": "tests/module_api_lazy.mjs",

package/.claude/skills/backlog-review/SKILL.md

@@ -0,0 +1,175 @@
+---
+name: backlog-review
+description: >-
+  Daily walk of status='backlog' — the pre-workable state a human must say go on.
+  Separates rows waiting on a PERSON (walked: promote, kill, water) from rows
+  waiting on a TRIGGER, and surfaces rows stranded behind an abandoned dependency.
+  Triggers on "/backlog-review", "review the backlog", "what needs a nod", "walk
+  the backlog", "what's waiting on me to approve". Metic+ only.
+---
+
+You are running the backlog-review session. Tasks at `status='backlog'` get
+walked and verdicted, so work nobody has said go on doesn't sit un-nodded
+forever.
+
+## Why this exists (task 1003746)
+
+`backlog` is the **pre-workable** state: a task lands there when the system will
+not put it in the claimable queue without a human saying go. `routing.js` says it
+plainly — *"'backlog' means a human still says go"* — and [ADR 0234](../../../docs/adr/<redacted>.md) §2
+records why: a feature/cleanup/refactor filing *"reshape[s] what gets built and a
+filer should not be able to set the queue's agenda alone."*
+
+Every **other** queue in the methodology already has a walkable cadence:
+`/idea-triage` for `idea_inbox`, `/blocker-review` for blockers, `/bug-triage`
+for `kind=bug`, `/goal-review` for criteria. The backlog had none. Its only pull
+surfaces were:
+
+- the **nod queue** (`GET /inbox/awaiting-nod`), scoped `WHERE origin='route'` —
+  so it sees only filings that arrived through the idea inbox, and
+- the **30-day rot timer** (`GET /inbox/rotting`, [ADR 0232](../../../docs/adr/<redacted>.md)).
+
+Neither is a review of the backlog. This skill is that missing walk.
+
+## Rank gate — Metic+ only
+
+**Gated to Metic and above (Metic, Archon); not Xenos or Thetes.** Promoting a
+backlog task puts it in the claimable queue for the whole team and, if its reward
+is unset, prices it — `task.promote` and `task.abandon` are both floor-`metic`
+permissions (`modules/government/catalog.js`). A sub-Metic can still **file**
+work (`POST /tasks`, `capture.js`, Discord `#bugs`) — that path stays open; they
+just can't say go on it.
+
+**Enforce the gate at the top of the session, before reading the queue:**
+
+1. Call `GET /api/gds/me` and read `builder.rank`. Compare case-insensitively.
+2. **If `rank` lowercases to `xenos` or `thetes`** → stop immediately. Tell the
+   builder: *"Backlog review is a Metic+ operation — promoting a task puts it in
+   the claimable queue for everyone and sets its price. You can still file work;
+   ask an Archon to promote you if you need to nod it through."* Do not list the
+   queue, do not propose verdicts.
+3. **If `rank` lowercases to `metic` or `archon`** → proceed below.
+4. **If `rank` is absent** (pre-rank deployment) → treat the session as
+   available, the same pre-rank passthrough `/idea-triage` uses.
+
+> Belt-and-braces: the server already rejects `POST /tasks/:id/promote` and
+> `/abandon` with `403 permission_forbidden` for a sub-Metic caller. This check
+> stops one early instead of after a wall of 403s. Markdown never grants
+> authority ([`docs/canonical-permissions.md`](../../../docs/canonical-permissions.md), ADR 0016).
+
+## The four buckets — and why only two get walked
+
+**This is the whole point of the skill.** One read partitions the backlog into
+four populations, and conflating them is the trap: *a row waiting on a TRIGGER is
+not a row waiting on a PERSON.* Asking a human to verdict the former burns the
+cadence on rows it cannot move.
+
+| Bucket | What it is | Walked? |
+|---|---|---|
+| **stranded** | dep-gated, but a dependency is `abandoned` — that edge can never satisfy, so the auto-promote trigger will **never** fire | **first** — it only gets worse if left |
+| **awaiting a nod** | no unsatisfied dependency; nothing gates it but a human | **yes — the review subject** |
+| **waiting on a dependency** | an unsatisfied but still-live dep; shipping it auto-promotes the row (migration 163) | no — counted only |
+| **spikes** | `kind='spike'` lives at backlog **by convention** (migration 020: *"Spikes stay in backlog by convention"*) | no — counted only |
+
+A promote on a healthy dep-gated row would race the trigger and put work in the
+queue whose prerequisites aren't done. Don't.
+
+## The verbs are status-derived — do NOT offer prune
+
+The rot card publishes four task verbs (prioritise / prune / kill / water), but
+two are **status-conditional at the route**:
+
+- `POST /tasks/:id/promote` accepts only `backlog | blocked | abandoned`
+- `POST /tasks/:id/demote` accepts only `ready` (`routes/tasks.js`: `if (task.status !== 'ready') return res.fail('cannot_demote', 409)`)
+
+So on a **backlog** row, "prune" is a guaranteed `409 cannot_demote` — it is
+already at the bottom. This walk offers:
+
+| Verb | Route | Meaning |
+|---|---|---|
+| **promote** | `POST /tasks/:id/promote` | the nod — backlog → ready, claimable now |
+| **kill** | `POST /tasks/:id/abandon` | it is not going to happen (restorable — ADR 0152) |
+| **water** | `POST /tasks/:id/water` | leave it; reset the rot clock. Changes no status, destroys nothing — its route is `requireBuilder` plus an ownership-or-atom check (creator, or the see-all-rot atom), which every Metic+ caller here holds per ADR 0157 |
+| **skip** | — | no write; it surfaces again next review |
+
+Every one is an **existing** route, so this skill adds no new authority — the
+[ADR 0232](../../../docs/adr/<redacted>.md)
+precedent (*"a verb that reuses a route also reuses its permission"*).
+
+## How to use
+
+**Step 1 — run the walk.**
+
+```bash
+node scripts/gds/backlog-review.js
+```
+
+It reads `GET /tasks?status=backlog&include=deps&limit=1000`, prints the four
+bucket counts, then walks stranded rows first and the nod queue after — each
+**grouped goal-by-goal** under a header naming the goal. Flags: `--limit N`
+(default 20 per sitting), `--all`, `--goal ID`.
+
+**Why goal-by-goal matters to how you prompt.** The nod is mostly a *scope*
+judgment — "does this goal want this work next" — and that is one decision per
+goal, not per row. So read the goal header, then offer its rows together; you
+will often give the same verdict to three in a row. Within a goal the order is
+oldest-first, and goals themselves are ordered by their own oldest waiting row,
+so the longest-ignored goal comes up first and nothing hides behind a busy one.
+`--goal ID` narrows to a single goal; grouping is what organises the *whole*
+queue.
+
+> The `include=deps` parameter is load-bearing — it is what returns `blocked_by[]`
+> with a per-edge `satisfied` flag, and without it every row looks like it's
+> waiting on a person. `limit` is capped at 1000 by the route.
+
+**Step 2 — verdict each row.** For each, the walk shows title, description, goal,
+kind, estimate, reward, and filing date, then asks:
+
+```
+[p]romote (make claimable) / [k]ill / [w]ater (leave it, reset the clock) / [s]kip / [q]uit
+```
+
+Frame the question around the **outcome**, not the mechanics — the prompter is
+often the owner, who is not a software engineer:
+
+> #1003678 "Goals have no intentionality record" — filed 2026-09-07, ~2h,
+> goal 1000089. Say go, drop it, or leave it for now?
+
+**Step 3 — watch the price on a promote.** If `credits_reward` is 0/NULL, promote
+**auto-assigns** a capped suggestion rather than refusing (ADR 0096 + the task
+1673 amendment). The walk echoes `assigned_credits_reward` — read it out, because
+that number is what the task now pays.
+
+**Step 4 — handle a stranded row deliberately.** A stranded row prints its dead
+edges and the two ways out:
+
+- **drop the dead edge** — `DELETE /api/bongos/dependencies` with
+  `{"from_kind":"task","from_id":<this>,"to_kind":"task","to_id":<dead>}`, then
+  the row becomes a normal nod decision; or
+- **restore the dependency** — `POST /api/bongos/tasks/<dead>/promote` returns an
+  abandoned task to backlog (ADR 0152).
+
+Never just promote a stranded row past its dead edge without one of those — the
+dependency was declared for a reason, and dropping it silently is the decision
+being made by accident.
+
+**Step 5 — close out.** The walk prints a summary and how many rows still await a
+human. Note the counts in the session log. If the same rows get skipped three
+reviews running, they are telling you something: either kill them, or the goal
+they sit in has gone quiet and belongs in `/goal-review`.
+
+## Cadence
+
+Run it **once a day**, like `/idea-triage` and `/blocker-review` — it is a manual
+slash command, not a scheduled routine. Deferring a row is fine; the cadence is
+the discipline. If a day passes without it, the queue quietly grows.
+
+## Non-goals
+
+- **Not a re-prioritiser.** Reordering what's already `ready` is
+  `/priority-session`. This skill only decides whether a row becomes claimable.
+- **Not dependency surgery.** Editing the dep graph beyond dropping one dead edge
+  belongs in its own task — the graph is load-bearing (ADR 0015).
+- **Not a duplicate-folder.** Merging near-duplicate reports is `/bug-triage`.
+- **Not a promote-everything button.** A backlog that empties every day means the
+  nod has stopped being a decision, which is the gate ADR 0234 §2 exists to keep.

package/docs/adr/0268-the-constitution-comes-from-two-roots.md

@@ -0,0 +1,132 @@
+# 0268 — The constitution comes from two roots, and a decision that did not take must say so
+
+- **Status:** Accepted
+- **Date:** 2026-09-09
+- **Tasks:** [#1003739](https://cloudbongos.com/builders#/task/1003739) (goal [#1000111](https://cloudbongos.com/builders#/goal/1000111) — Government). Found while shipping [#1003733](https://cloudbongos.com/builders#/task/1003733) ([ADR 0267](<redacted>.md)).
+- **Builds on:** [ADR 0108](<redacted>.md) §1 (the two configurable roots), [ADR 0175](<redacted>.md) §7 (a passed amendment becomes the live constitution), [ADR 0083](<redacted>.md) (a module reaches core only through the doorway).
+
+## 1. What happened
+
+On 2026-08-25 cloudbongos.com's board ratified a constitutional amendment:
+`rank:metic+` · `consent` · a 1440-minute sitting. It passed, it was recorded,
+the proposer was paid the ratification karma — and **the constitution never
+changed.** Two weeks later `GET /government/constitution` still answered the
+day-one monarchy, with the passed amendment sitting in its own `history` array
+directly beneath the `board` block that contradicted it.
+
+Every Board Room sitting in those two weeks was decided under a rule the board
+had voted to replace. It also quietly un-shipped [ADR 0191](<redacted>.md)
+(majority) and would have un-shipped ADR 0267 (unanimity) the same way: both
+shipped as code, and neither could reach anybody.
+
+Nobody noticed, because nothing was broken enough to notice. No error, no failed
+write, no missing row.
+
+## 2. The cause: one root where there are two
+
+`modules/government/config.js` resolved both of its files from one place:
+
+```js
+const ROOT = path.resolve(__dirname, '..', '..');
+const NEUTRAL_PATH  = path.join(ROOT, 'config', 'government.neutral.json');
+const INSTANCE_PATH = path.join(ROOT, 'config', 'government.json');
+```
+
+The comment above it said the two roots coincided *today* and that the instance
+path would route through `resolveInstanceRoot()` when ADR 0108's split landed.
+**The split had landed.** cloudbongos.com is a standalone instance: its systemd
+unit runs `node_modules/@cloudbongos/core`'s server with
+`WorkingDirectory=<instance repo>`, so at runtime `__dirname` is *inside the core
+package*. Which makes:
+
+| file | resolved to | correct? |
+|---|---|---|
+| `government.neutral.json` | `…/node_modules/@cloudbongos/core/config/` | ✅ — it really is core content |
+| `government.json` | `…/node_modules/@cloudbongos/core/config/` | ❌ — the host's is at `<instance>/config/` |
+
+So two things were true at once, and each hid the other:
+
+1. **The host's own constitution was never read.** An instance authoring
+   `config/government.json` — the documented way to set one — was ignored.
+2. **`applyBoardAmendment` wrote the ratified amendment into `node_modules`,**
+   where it worked until the next core upgrade deleted it. The nightly upgrade
+   sweep (ADR 0161 cuts a release per merge) did exactly that, within a day.
+
+**Nothing threw, and nothing could have.** Both paths exist, both are writable,
+and an absent instance pack is a legal state — a vanilla instance has none — so
+the read fell through to the neutral monarchy precisely as designed. This class
+of bug has no error to catch. `src/branding.js` had it right the whole time and
+was three files away: neutral from `resolveCoreRoot()`, instance from
+`resolveInstanceRoot()`.
+
+## 3. The fix, and the doorway it needed
+
+`NEUTRAL_PATH` now resolves from the core root and `INSTANCE_PATH` from the
+instance root, reached through `src/module-api` — because ADR 0083 forbids a
+module requiring a core internal, and until now the doorway exposed neither
+resolver. That absence is *why* the module re-derived a root from `__dirname`:
+the only tool it had was the wrong one. Both are now exported, with the failure
+above written into the export comment.
+
+Two smaller decisions travel with it:
+
+- **Resolved at load, not per call.** `resolveInstanceRoot()` falls back to
+  `process.cwd()`, so resolving lazily would let a `chdir` mid-process move the
+  constitution — a worse failure than the one being fixed.
+- **`applyBoardAmendment` creates the directory.** The write now targets a
+  directory the core does not own, and an instance that has never been branded
+  has no `config/` of its own. A ratified amendment lost to `ENOENT` is the same
+  failure in a different coat.
+
+The single-checkout case is byte-identical, and a test asserts that rather than
+the prose claiming it.
+
+## 4. The detector, because the fix alone is not the lesson
+
+Fixing the path fixes *this* cause. The thing worth keeping is that **the API
+held both facts in one payload for two weeks and never compared them.**
+
+`constitutionView` now carries a `divergence` block: the newest **passed**
+amendment's proposal, sanitized the way an apply would have written it, compared
+field by field against the constitution actually in force. Null when they agree.
+The hall renders it above the dials — in words, not config keys — as *"the board
+ratified a change that is not in force."*
+
+Three properties, each chosen against a plausible alternative:
+
+- **It reports; it never heals.** Re-applying automatically was refused: the
+  instance pack is *also* the file a human editing the constitution touches (ADR
+  0175 §7), so a silent re-apply would revert a legitimate hand edit with no way
+  to tell the two apart — trading a visible wrong constitution for an unstoppable
+  one. Naming the divergence is what those two weeks actually lacked.
+- **A returned amendment is never compared.** That is the whole meaning of
+  *returned*; comparing against it would fire on every rejected proposal, i.e. on
+  the system working.
+- **It compares the SANITIZED proposal.** Comparing the raw one would report a
+  phantom divergence on any field the sanitizer legitimately normalises — and a
+  warning that can never be cleared is a warning people learn to scroll past.
+
+## 5. What this does not do
+
+**It does not put the 2026-08-25 amendment back in force.** That is a board act,
+not a deploy: once this ships, cloudbongos.com's Constitution tab will *say* the
+amendment is not in force, and the remedy is to put it back to the board (now
+that a pass will stick) or for an operator to author the instance's own
+`config/government.json`. Choosing between those is the owner's, not this task's.
+
+**It fixes one module, and the sweep for siblings was run rather than promised.**
+Every other module deriving a root from `__dirname` was checked, and all but one
+are reading genuine CORE content — `scripts/`, `infra/`, the UI kit — which the
+core root is the *right* answer for. The exception is
+`modules/security/artifact-scan/quarantine.js`, whose "a quarantine site must not
+be inside the repository" refusal resolves to the core package on a standalone
+instance and so does not refuse a site inside the instance repo itself. That is a
+real, narrow weakening of a security guard; it is filed as
+[#1003745](https://cloudbongos.com/builders#/task/1003745) on the Security area
+rather than absorbed here, and the doorway exports this ADR adds are what its fix
+will use.
+
+**The rule to carry forward:** a `__dirname`-derived root is correct for reading
+what the core ships and wrong for reading what the host owns, and on a
+single-checkout instance the two are indistinguishable — which is why this kind
+of bug is always found in production and never in a test that runs at home.

package/docs/adr/README.md

@@ -359,3 +359,4 @@ This keeps the decision history honest and traceable.
 | 0265 | [**Work with no goal survives a version close, and the order the ten-area cut actually needs** ([task 1003713](https://cloudbongos.com/builders#/task/1003713) · goal 1000086 — *Strict versioning*, criteria `sv-every-task-has-a-goal` + `sv-cutover-proven-live`). `closeVersion`'s post-apply invariant counts GOALS, and every task write inside the close is scoped `WHERE goal_id = $1` — so a task belonging to no goal is reached by no disposition, counted by no re-count, and ships stranded on a version that is over. Not hypothetical: six such tasks already sat on shipped GDS-V3/GDS-V4, and 47 rows on BONGOS-V1 carried a null `goal_id` (R11 required the column going forward but never backfilled, because every catch-all lookup matches the exact title `<VERSION> — general` and BONGOS-V1's is titled 'Work with no goal yet'). Decision: a second invariant in the same transaction refuses a close leaving ANY non-terminal task on the version, failing `CLOSE_LEAVES_STRANDED_TASKS` with the ids; exempting only the maintenance goal (its carry-forward runs in the later `onClosed` hook) — through the SAME `maintenanceGoalExemptSql` the goal count uses, never a second copy — and `__smoke__` fixtures. Consequence recorded here too: because `PATCH /tasks/:id {goal_id}` refuses a cross-version move (409 `goal_version_mismatch`) and `roll_forward` CREATES a successor rather than merging into one, [ADR 0264](<redacted>.md)'s cut must run home-then-close-then-**fold on the planning version**, where task and destination finally share a version. Rejected: a `fold_into` disposition (puts scope decisions inside a shipping transaction), creating the six new areas on the building version via R07 admissions (spends ten overrides to route around the rule they price), and a backfill instead of a gate (fixes today's rows, not the forty-eighth).](<redacted>.md) | lifecycle / version boundary |
 | 0266 | [**The Board Room is its own surface, reachable by whoever may vote** ([task 1003734](https://cloudbongos.com/builders#/task/1003734) · goal 1000111 — *Working area 7, Government*, criterion `wa7-government`; owner decision 2026-09-08). The hall's only **upward-pointing** gate ([ADR 0175](<redacted>.md)) shipped as a hash tab inside `/government`, and two things about that did not survive inspection. **The nav never followed the page:** R16 correctly widened the PAGE gate from `government.manage` (archon) to `page.view.government` (metic+) when the page became three rooms — its own comment says *"the shell follows the widest legitimate audience"* — but `shell.js` still declares that item as label Permissions with gate archon, so a Metic who SITS on the board has no nav link at all and the only word in the nav is Permissions. Watch, Harbor, Gate and Sessions each own a nav item; the voting room was reachable only by knowing a URL fragment. **The surface was narrower than the franchise:** `board.vote.cast` floors at XENOS deliberately (`board.js:149` — the floor is low *so that widening the board works*) while the shell demands metic+, so the moment a constitution widens membership below Metic — the exact act [ADR 0175](<redacted>.md) §6 exists to make a CONFIG change — those members may vote by API and cannot load the page they would vote on, reintroducing the code-path change §6 removed. Decision: **its own page at `/board-room`, gated on the same atom the vote route checks.** The floor stays coarse — membership is still checked in-handler per item against that item's own snapshotted constitution — so a builder who clears the floor but sits on no board sees the room and no ballot, which is honest (§9 made the ballot open on purpose). **The migration is client-side because a fragment never reaches the server:** `#board-room` cannot be caught by any server route, so `government.js` redirects on load, preserving `?item=N` — recorded as a decision because adding a regex to `serve-internal.js` looks like the obvious fix and silently never fires. Three writers move (Discord `board-broadcast.js`, the `board_votes` need href, docs), and the redirect stays a release regardless because announcements already in channel history carry the old link forever. A **waiting-vote count** goes on the nav item: the data already exists (`boardVotesNeed` carries a live count pre-filtered to what the vote route would accept, served on `GET /me`), but `shell.js` has NO badge/bell/dot mechanism at all, so one is built once, generically, zero-is-silent, visible to exactly whoever the item is. Found while scoping and filed separately ([task 1003738](https://cloudbongos.com/builders#/task/1003738)): the hall renders needs as a SINGLE slot and `computeNeeds` sorts only by state with a stable sort, so registry order decides inside the `action_needed` bucket and `boardVotesNeed` sits fourth behind `artKeyNeed` — any builder with an unresolved image key never sees the board notice, which was live for this decision's own owner at the moment they asked for the bell. Rejected: a nav item merely deep-linking to the existing tab (cheaper, keeps the hash links free, but leaves the voting room inside a page whose gate answers a different question); a bell in the global header (a second inbox, needing its own read/unread and dismissal semantics); and a SOUND (`alert.wav`/`chime.wav` already ship, so it would be easy — it was not asked for).](<redacted>.md) | government / the board / hall nav |
 | 0267 | [**Unanimity, and the revise-and-re-sit loop** ([task 1003733](https://cloudbongos.com/builders#/task/1003733) · goal 1000111 — *Government*, owner decision 2026-09-08). A Full Idea is ratified by **unanimous** agreement from round one; a sitting that does not carry RETURNS to its author, who revises and re-sits it, unbounded, until the board is unanimous. `unanimous` joins `PASS_RULES` as a fourth answer on the axis these rules actually differ on — **what silence means**: it is two conditions, not one, because "nobody objected" is true of an empty room. Everyone who spoke must have said yes AND somebody must have spoken, so an unvoted sitting RETURNS, which is exactly what makes the clock the owner asked for safe under it ([ADR 0191](<redacted>.md) §4: a deadline may only be given to a rule whose expiry means return). **There is deliberately no membership denominator** — that is the whole difference from `majority`, and it is the owner's "silence does not block" as code: an absent member is not in the reckoning, so one yes out of four carries. The stated cost is that an attentive minority can ratify on a distracted board; the alternative is one person on holiday stopping the pipeline. Trigger changes follow from the rule: a single yes does NOT close it (a later member must still be able to object — the sitting runs its clock, full turnout closes early), while a reasoned objection closes it AT ONCE (no vote-changing in v1 fixes the outcome, and the author needs the feedback to revise). ADR 0191 §3's author rule rides both unchanged. **`BOARD_DEFAULTS` is NOT moved**: a fresh instance stays the day-one monarchy, because under any non-author-yes rule a solo founder can never ratify their own ideas (0191 §5) — adoption is a board amendment, and no env var can change a constitution. The revise-and-re-sit loop already existed (`POST /inbox/:id/resubmit` re-grades and re-fires the window hook); what the board owes it is now pinned by test — a return CLOSES the item so the next window may open, and pays nothing. Named limits: a zero-vote return carries no human objection (the author gets the mechanical weakest-section flag), and this changes nothing live until the separate defect where a ratified amendment does not survive to the next read is fixed.](<redacted>.md) | government / board room |
+| 0268 | [**The constitution comes from two roots, and a decision that did not take must say so** ([task 1003739](https://cloudbongos.com/builders#/task/1003739) · goal 1000111 — *Government*). On 2026-08-25 cloudbongos.com's board RATIFIED an amendment (rank:metic+ · consent · a 1440-minute sitting) and the constitution never changed — for two weeks `GET /government/constitution` answered the day-one monarchy with the passed amendment sitting in its own `history` array directly beneath the contradicting `board` block. Every sitting since was decided under a rule the board had voted to replace, and it silently un-shipped [ADR 0191](<redacted>.md) (majority) and would have un-shipped [ADR 0267](<redacted>.md) the same way. **Cause:** `modules/government/config.js` resolved BOTH its neutral starter and its instance pack from one `path.resolve(__dirname, '..', '..')`, under a comment saying the roots coincided *today* — true in a single checkout, false on a STANDALONE instance ([ADR 0108](<redacted>.md) §1), where the server runs `node_modules/@cloudbongos/core` with `WorkingDirectory=<instance repo>`. The neutral path stayed right (it really is core content); the INSTANCE path resolved inside the core package, so the host's own `config/government.json` was never read and `applyBoardAmendment` wrote the ratified amendment into `node_modules`, where the nightly core upgrade ([ADR 0161](<redacted>.md) cuts a release per merge) erased it within a day. **Nothing threw and nothing could have** — both paths exist, both are writable, and an absent instance pack is a legal state, so the read fell through to the neutral monarchy exactly as designed. `src/branding.js` had the pattern right three files away. **Fix:** neutral from `resolveCoreRoot()`, instance from `resolveInstanceRoot()`, reached through `src/module-api` — which had exposed NEITHER resolver, and that absence is precisely why the module re-derived the wrong one ([ADR 0083](<redacted>.md) forbids requiring a core internal). Resolved at load, not per call, because `resolveInstanceRoot()` falls back to `process.cwd()` and a lazy resolve would let a `chdir` move the constitution; `applyBoardAmendment` now mkdirs, since the write targets a directory the core does not own. Single-checkout behaviour is byte-identical, asserted rather than claimed. **The detector, which is the durable half:** `constitutionView` carries a `divergence` block comparing the newest PASSED amendment (sanitized as an apply would write it) field-by-field against what is in force, rendered above the hall's dials in words rather than config keys. It REPORTS and never HEALS — the instance pack is also the file a human editing the constitution touches, so a silent re-apply would revert a legitimate hand edit with no way to tell the two apart. A RETURNED amendment is never compared (that is what *returned* means). Does NOT put the 2026-08-25 amendment back in force — that is a board act. Sibling sweep RUN, not promised: one real hit filed as [task 1003745](https://cloudbongos.com/builders#/task/1003745) (quarantine.js's repo-containment refusal is blind to the instance repo).](<redacted>.md) | government / instance roots |