@bongos/core 1.19.617 → 1.19.619

package/.bongos-core.json

@@ -2,23 +2,28 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.617",
-  "core_contract": "1.19.617",
-  "source_commit": "203592afd9cb34d665552529bb6dd17c36bb5c1e",
+  "core_version": "1.19.619",
+  "core_contract": "1.19.619",
+  "source_commit": "b3a494e84958a264492cf55b3525d70680f7bbda",
   "source_ref": "HEAD",
-  "built_at": "2026-09-09T05:58:55.608Z",
+  "built_at": "2026-09-09T06:39:30.103Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 460,
+    "docs_redacted": 463,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 2081,
+    "functional_verbatim": 2086,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2565,
-  "tree_sha256": "9832dfdbe8796c1219f41418c67e707f0b30103bcbc3b7950cacd7a90758f646",
+  "file_count": 2573,
+  "tree_sha256": "f0ad9c8d1e70405ab669163d2d2153cd7f6ae97a699036bb8e4278f1e3a435d5",
   "files": [
+    {
+      "path": ".claude/skills/backlog-review/SKILL.md",
+      "mode": "0000644",
+      "sha256": "ce45a242487fa6d10794280958fea47f8a23e2618551f629abe38054d467a59c"
+    },
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
       "mode": "0000644",
@@ -1854,10 +1859,20 @@
       "mode": "0000644",
       "sha256": "32a1e0c4fe9423008caf491e5d3594aa4a07874a46a047a86e5eb321baef773a"
     },
+    {
+      "path": "docs/adr/0268-the-constitution-comes-from-two-roots.md",
+      "mode": "0000644",
+      "sha256": "cec61252a02d5da416c77088dbf2adf99c138cb10b654fa9fef949a0848a7964"
+    },
+    {
+      "path": "docs/adr/0269-the-cli-session-store-is-host-keyed-at-a-fixed-anchor.md",
+      "mode": "0000644",
+      "sha256": "cc44045ea59f76dabc62fe43993ffab6004add88c7f6142bfe9215f7f2c33c99"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "c836e90436fea9c5a1f1a38e3640643602e8a639120c33770ab525c432655799"
+      "sha256": "d660b4bc0bc3306f5fcf583118ca9149ba3deafe82dfe3894fe0b1c11b60cc2f"
     },
     {
       "path": "docs/api-reference.md",
@@ -1892,12 +1907,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "00e8dd0db1a70a4f9fec1f1622688f78308f560485bfb8a0df24d50ceb4a8c66"
+      "sha256": "0e4c54e6bd6d76fdd7853b19c343b747fabfc2f59ee8baab74cbaebc6064aa1e"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "4dcbb030236a1267b336e0ecb1c13623794cba823b61304ab4cb7b4db06c55b1"
+      "sha256": "4357446e8f95c430791743a43f893140d862ab7dd5453f6a42791b194956d61c"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2732,7 +2747,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "8b9c303b7cb35b420ff13c0a265fe2e505769c6d1625977eb85c0d077ff1ddf2"
+      "sha256": "0cec3b144d8cca893b49c1d08bdacf37220dc1b670fd771656dda659bae16edc"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2742,7 +2757,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "86545cc0ed7296d979d78e5a6bf3a6259e358f1673c00db4d9c9c0906aaa5a2f"
+      "sha256": "1fe02fc79e2952efb61450bbd45e6b09e41e8cf73453c6e0a2fbbf2944c1cdab"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4397,7 +4412,7 @@
     {
       "path": "modules/government/board.js",
       "mode": "0000644",
-      "sha256": "e79c0a72c27c3773308ad3e21040a6e22c4ba63af46aec8ab4d26e5d588a1b2e"
+      "sha256": "68bf53ab31ec3f21359665eea42127f1691b8dc17b59100c65cc1f56a04ad6a7"
     },
     {
       "path": "modules/government/catalog.js",
@@ -4407,7 +4422,7 @@
     {
       "path": "modules/government/config.js",
       "mode": "0000644",
-      "sha256": "3e66902145db7a64e7932b8a071bbbe496dd63f450abe629168813349cf92211"
+      "sha256": "8edccad7dc69a95503d9e0d1de7795fd6082c8122e0695d1f018f49b37051fed"
     },
     {
       "path": "modules/government/db.js",
@@ -4922,7 +4937,7 @@
     {
       "path": "modules/hall-ui/public/government.js",
       "mode": "0000644",
-      "sha256": "dea97ea504d81b69b97679db8dda2180f156b3fead18bc18a4d7c95e83d4fe9e"
+      "sha256": "6333b05761e5bf3215fe3c19ae98b25ebdac8cf0761df28fbc4933a5317ce5fa"
     },
     {
       "path": "modules/hall-ui/public/government.states.json",
@@ -5052,7 +5067,7 @@
     {
       "path": "modules/hall-ui/public/oversight.css",
       "mode": "0000644",
-      "sha256": "13d46f29e77ba9ca30ab52de2e0413f2fcb68bfec44de032730d4d135530e4ba"
+      "sha256": "a199baf1c11bdbe6d30931253956e0c9a9709ae3f880af77b2a6737212fe0984"
     },
     {
       "path": "modules/hall-ui/public/pair.css",
@@ -7642,12 +7657,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "3885cce1d32ce4a6a9c0ca430b7f03250a0cdb520f41aeae05cf69e32463fa93"
+      "sha256": "41aca5e97b1cb72e389656c14ddd1bb35a3d5fdce8145f05e294c3fa3f52dc15"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a810ca7406dc6408d628d4b6fafd83268bf994bb407e8a19acf91e35e3348192"
+      "sha256": "2084b4c59fd9b3857bb83b5a4198d43c308f0180edc0e21a698e4285809323fd"
     },
     {
       "path": "public-docs/index.html",
@@ -7794,6 +7809,11 @@
       "mode": "0000644",
       "sha256": "a9f1064fbb683297e775c455ef65249cf809018a38a5aa2f975a62cbba16cd9c"
     },
+    {
+      "path": "scripts/gds/backlog-review.js",
+      "mode": "0000644",
+      "sha256": "4646bd6da8be2d2c40c1063bba47f5fdce0f2f63143e26fc16e36ea941adbc88"
+    },
     {
       "path": "scripts/gds/backup.js",
       "mode": "0000644",
@@ -7847,7 +7867,7 @@
     {
       "path": "scripts/gds/build-cli-package.js",
       "mode": "0000644",
-      "sha256": "81ad7fbc99f5c85219f1385cdd6e6954d27a0e2943f285676f060611a4878f4e"
+      "sha256": "de1cdede17761775722509b1e1edb4bb43fbbf336450556f22119b18b93e43d3"
     },
     {
       "path": "scripts/gds/bump-version.js",
@@ -7907,7 +7927,7 @@
     {
       "path": "scripts/gds/cli-lib.js",
       "mode": "0000644",
-      "sha256": "44b8c997a25d9fcc68ba573d33391546ff98a871c7d99e9aa6d982c69a703824"
+      "sha256": "eaa4c3a172009d5ce825e528f5077a480e034658501a7d0c532a7807886beb9e"
     },
     {
       "path": "scripts/gds/client-baseurl-guard.js",
@@ -8287,7 +8307,7 @@
     {
       "path": "scripts/gds/login.js",
       "mode": "0000644",
-      "sha256": "f16497d7eae23657e83f631b420f82a55ed8216480f3cd5488609d3b93274dee"
+      "sha256": "bdc7fcc0876a1185fb15339740793944c755d716d998bb68533ab3a721d39ab2"
     },
     {
       "path": "scripts/gds/main-audit.js",
@@ -9372,7 +9392,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1607f76a96146a4b3bfdda5b3206097dbee812115f47d57fe545513490fb350f"
+      "sha256": "983d456cff4042137990a5baacb002919c3d213a33f663d6e8fcc7e9f5945ae6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9679,6 +9699,11 @@
       "mode": "0000644",
       "sha256": "25f45e6a0f79e6e6299b062dd89306f898fc1ed8cefbf4fa16b76c9c511f0548"
     },
+    {
+      "path": "tests/backlog_review.mjs",
+      "mode": "0000644",
+      "sha256": "788f3b3faba5f0568a251d3551c8776e2f383d59c8c2ed0728ef4c9af9a208c7"
+    },
     {
       "path": "tests/backup_cli.mjs",
       "mode": "0000644",
@@ -9974,6 +9999,11 @@
       "mode": "0000644",
       "sha256": "a57516ed9e904cf1c86fe99688415f834dcae1a19f01b22e986f199fa5473258"
     },
+    {
+      "path": "tests/cli_sessions.mjs",
+      "mode": "0000644",
+      "sha256": "6ec406bf2bcbae261ab37ecaf820cfbe196c11007b0d8d3ee47cf21b6a3919ca"
+    },
     {
       "path": "tests/cli_surface.mjs",
       "mode": "0000644",
@@ -10689,6 +10719,16 @@
       "mode": "0000644",
       "sha256": "a8e575d151aca92789ffa9d3a49f77aa2579fa285374b2c1f5a65b12ac82163d"
     },
+    {
+      "path": "tests/government_config_roots.mjs",
+      "mode": "0000644",
+      "sha256": "d3060b7302f17a1478588ee333ba9e2f4deea23d5896363b9bd42e30edb12c88"
+    },
+    {
+      "path": "tests/government_constitution_divergence.mjs",
+      "mode": "0000644",
+      "sha256": "280bc5906ac8075495cd3b1fe10e4082291cf4497b166f6acbdec291a8fd6698"
+    },
     {
       "path": "tests/government_constitution_view.mjs",
       "mode": "0000644",
@@ -11442,7 +11482,7 @@
     {
       "path": "tests/module_api.mjs",
       "mode": "0000644",
-      "sha256": "157d551b9a99320198f22d32ce335fa4166414dc1818d11ef23a0ea05ac80a76"
+      "sha256": "cc6fb31e06f0b2accf46f1595f9548492698c88ff56c4d9f4f43c86fce6816a3"
     },
     {
       "path": "tests/module_api_lazy.mjs",

package/.claude/skills/backlog-review/SKILL.md

@@ -0,0 +1,175 @@
+---
+name: backlog-review
+description: >-
+  Daily walk of status='backlog' — the pre-workable state a human must say go on.
+  Separates rows waiting on a PERSON (walked: promote, kill, water) from rows
+  waiting on a TRIGGER, and surfaces rows stranded behind an abandoned dependency.
+  Triggers on "/backlog-review", "review the backlog", "what needs a nod", "walk
+  the backlog", "what's waiting on me to approve". Metic+ only.
+---
+
+You are running the backlog-review session. Tasks at `status='backlog'` get
+walked and verdicted, so work nobody has said go on doesn't sit un-nodded
+forever.
+
+## Why this exists (task 1003746)
+
+`backlog` is the **pre-workable** state: a task lands there when the system will
+not put it in the claimable queue without a human saying go. `routing.js` says it
+plainly — *"'backlog' means a human still says go"* — and [ADR 0234](../../../docs/adr/<redacted>.md) §2
+records why: a feature/cleanup/refactor filing *"reshape[s] what gets built and a
+filer should not be able to set the queue's agenda alone."*
+
+Every **other** queue in the methodology already has a walkable cadence:
+`/idea-triage` for `idea_inbox`, `/blocker-review` for blockers, `/bug-triage`
+for `kind=bug`, `/goal-review` for criteria. The backlog had none. Its only pull
+surfaces were:
+
+- the **nod queue** (`GET /inbox/awaiting-nod`), scoped `WHERE origin='route'` —
+  so it sees only filings that arrived through the idea inbox, and
+- the **30-day rot timer** (`GET /inbox/rotting`, [ADR 0232](../../../docs/adr/<redacted>.md)).
+
+Neither is a review of the backlog. This skill is that missing walk.
+
+## Rank gate — Metic+ only
+
+**Gated to Metic and above (Metic, Archon); not Xenos or Thetes.** Promoting a
+backlog task puts it in the claimable queue for the whole team and, if its reward
+is unset, prices it — `task.promote` and `task.abandon` are both floor-`metic`
+permissions (`modules/government/catalog.js`). A sub-Metic can still **file**
+work (`POST /tasks`, `capture.js`, Discord `#bugs`) — that path stays open; they
+just can't say go on it.
+
+**Enforce the gate at the top of the session, before reading the queue:**
+
+1. Call `GET /api/gds/me` and read `builder.rank`. Compare case-insensitively.
+2. **If `rank` lowercases to `xenos` or `thetes`** → stop immediately. Tell the
+   builder: *"Backlog review is a Metic+ operation — promoting a task puts it in
+   the claimable queue for everyone and sets its price. You can still file work;
+   ask an Archon to promote you if you need to nod it through."* Do not list the
+   queue, do not propose verdicts.
+3. **If `rank` lowercases to `metic` or `archon`** → proceed below.
+4. **If `rank` is absent** (pre-rank deployment) → treat the session as
+   available, the same pre-rank passthrough `/idea-triage` uses.
+
+> Belt-and-braces: the server already rejects `POST /tasks/:id/promote` and
+> `/abandon` with `403 permission_forbidden` for a sub-Metic caller. This check
+> stops one early instead of after a wall of 403s. Markdown never grants
+> authority ([`docs/canonical-permissions.md`](../../../docs/canonical-permissions.md), ADR 0016).
+
+## The four buckets — and why only two get walked
+
+**This is the whole point of the skill.** One read partitions the backlog into
+four populations, and conflating them is the trap: *a row waiting on a TRIGGER is
+not a row waiting on a PERSON.* Asking a human to verdict the former burns the
+cadence on rows it cannot move.
+
+| Bucket | What it is | Walked? |
+|---|---|---|
+| **stranded** | dep-gated, but a dependency is `abandoned` — that edge can never satisfy, so the auto-promote trigger will **never** fire | **first** — it only gets worse if left |
+| **awaiting a nod** | no unsatisfied dependency; nothing gates it but a human | **yes — the review subject** |
+| **waiting on a dependency** | an unsatisfied but still-live dep; shipping it auto-promotes the row (migration 163) | no — counted only |
+| **spikes** | `kind='spike'` lives at backlog **by convention** (migration 020: *"Spikes stay in backlog by convention"*) | no — counted only |
+
+A promote on a healthy dep-gated row would race the trigger and put work in the
+queue whose prerequisites aren't done. Don't.
+
+## The verbs are status-derived — do NOT offer prune
+
+The rot card publishes four task verbs (prioritise / prune / kill / water), but
+two are **status-conditional at the route**:
+
+- `POST /tasks/:id/promote` accepts only `backlog | blocked | abandoned`
+- `POST /tasks/:id/demote` accepts only `ready` (`routes/tasks.js`: `if (task.status !== 'ready') return res.fail('cannot_demote', 409)`)
+
+So on a **backlog** row, "prune" is a guaranteed `409 cannot_demote` — it is
+already at the bottom. This walk offers:
+
+| Verb | Route | Meaning |
+|---|---|---|
+| **promote** | `POST /tasks/:id/promote` | the nod — backlog → ready, claimable now |
+| **kill** | `POST /tasks/:id/abandon` | it is not going to happen (restorable — ADR 0152) |
+| **water** | `POST /tasks/:id/water` | leave it; reset the rot clock. Changes no status, destroys nothing — its route is `requireBuilder` plus an ownership-or-atom check (creator, or the see-all-rot atom), which every Metic+ caller here holds per ADR 0157 |
+| **skip** | — | no write; it surfaces again next review |
+
+Every one is an **existing** route, so this skill adds no new authority — the
+[ADR 0232](../../../docs/adr/<redacted>.md)
+precedent (*"a verb that reuses a route also reuses its permission"*).
+
+## How to use
+
+**Step 1 — run the walk.**
+
+```bash
+node scripts/gds/backlog-review.js
+```
+
+It reads `GET /tasks?status=backlog&include=deps&limit=1000`, prints the four
+bucket counts, then walks stranded rows first and the nod queue after — each
+**grouped goal-by-goal** under a header naming the goal. Flags: `--limit N`
+(default 20 per sitting), `--all`, `--goal ID`.
+
+**Why goal-by-goal matters to how you prompt.** The nod is mostly a *scope*
+judgment — "does this goal want this work next" — and that is one decision per
+goal, not per row. So read the goal header, then offer its rows together; you
+will often give the same verdict to three in a row. Within a goal the order is
+oldest-first, and goals themselves are ordered by their own oldest waiting row,
+so the longest-ignored goal comes up first and nothing hides behind a busy one.
+`--goal ID` narrows to a single goal; grouping is what organises the *whole*
+queue.
+
+> The `include=deps` parameter is load-bearing — it is what returns `blocked_by[]`
+> with a per-edge `satisfied` flag, and without it every row looks like it's
+> waiting on a person. `limit` is capped at 1000 by the route.
+
+**Step 2 — verdict each row.** For each, the walk shows title, description, goal,
+kind, estimate, reward, and filing date, then asks:
+
+```
+[p]romote (make claimable) / [k]ill / [w]ater (leave it, reset the clock) / [s]kip / [q]uit
+```
+
+Frame the question around the **outcome**, not the mechanics — the prompter is
+often the owner, who is not a software engineer:
+
+> #1003678 "Goals have no intentionality record" — filed 2026-09-07, ~2h,
+> goal 1000089. Say go, drop it, or leave it for now?
+
+**Step 3 — watch the price on a promote.** If `credits_reward` is 0/NULL, promote
+**auto-assigns** a capped suggestion rather than refusing (ADR 0096 + the task
+1673 amendment). The walk echoes `assigned_credits_reward` — read it out, because
+that number is what the task now pays.
+
+**Step 4 — handle a stranded row deliberately.** A stranded row prints its dead
+edges and the two ways out:
+
+- **drop the dead edge** — `DELETE /api/bongos/dependencies` with
+  `{"from_kind":"task","from_id":<this>,"to_kind":"task","to_id":<dead>}`, then
+  the row becomes a normal nod decision; or
+- **restore the dependency** — `POST /api/bongos/tasks/<dead>/promote` returns an
+  abandoned task to backlog (ADR 0152).
+
+Never just promote a stranded row past its dead edge without one of those — the
+dependency was declared for a reason, and dropping it silently is the decision
+being made by accident.
+
+**Step 5 — close out.** The walk prints a summary and how many rows still await a
+human. Note the counts in the session log. If the same rows get skipped three
+reviews running, they are telling you something: either kill them, or the goal
+they sit in has gone quiet and belongs in `/goal-review`.
+
+## Cadence
+
+Run it **once a day**, like `/idea-triage` and `/blocker-review` — it is a manual
+slash command, not a scheduled routine. Deferring a row is fine; the cadence is
+the discipline. If a day passes without it, the queue quietly grows.
+
+## Non-goals
+
+- **Not a re-prioritiser.** Reordering what's already `ready` is
+  `/priority-session`. This skill only decides whether a row becomes claimable.
+- **Not dependency surgery.** Editing the dep graph beyond dropping one dead edge
+  belongs in its own task — the graph is load-bearing (ADR 0015).
+- **Not a duplicate-folder.** Merging near-duplicate reports is `/bug-triage`.
+- **Not a promote-everything button.** A backlog that empties every day means the
+  nod has stopped being a decision, which is the gate ADR 0234 §2 exists to keep.

package/docs/adr/0268-the-constitution-comes-from-two-roots.md

@@ -0,0 +1,132 @@
+# 0268 — The constitution comes from two roots, and a decision that did not take must say so
+
+- **Status:** Accepted
+- **Date:** 2026-09-09
+- **Tasks:** [#1003739](https://cloudbongos.com/builders#/task/1003739) (goal [#1000111](https://cloudbongos.com/builders#/goal/1000111) — Government). Found while shipping [#1003733](https://cloudbongos.com/builders#/task/1003733) ([ADR 0267](<redacted>.md)).
+- **Builds on:** [ADR 0108](<redacted>.md) §1 (the two configurable roots), [ADR 0175](<redacted>.md) §7 (a passed amendment becomes the live constitution), [ADR 0083](<redacted>.md) (a module reaches core only through the doorway).
+
+## 1. What happened
+
+On 2026-08-25 cloudbongos.com's board ratified a constitutional amendment:
+`rank:metic+` · `consent` · a 1440-minute sitting. It passed, it was recorded,
+the proposer was paid the ratification karma — and **the constitution never
+changed.** Two weeks later `GET /government/constitution` still answered the
+day-one monarchy, with the passed amendment sitting in its own `history` array
+directly beneath the `board` block that contradicted it.
+
+Every Board Room sitting in those two weeks was decided under a rule the board
+had voted to replace. It also quietly un-shipped [ADR 0191](<redacted>.md)
+(majority) and would have un-shipped ADR 0267 (unanimity) the same way: both
+shipped as code, and neither could reach anybody.
+
+Nobody noticed, because nothing was broken enough to notice. No error, no failed
+write, no missing row.
+
+## 2. The cause: one root where there are two
+
+`modules/government/config.js` resolved both of its files from one place:
+
+```js
+const ROOT = path.resolve(__dirname, '..', '..');
+const NEUTRAL_PATH  = path.join(ROOT, 'config', 'government.neutral.json');
+const INSTANCE_PATH = path.join(ROOT, 'config', 'government.json');
+```
+
+The comment above it said the two roots coincided *today* and that the instance
+path would route through `resolveInstanceRoot()` when ADR 0108's split landed.
+**The split had landed.** cloudbongos.com is a standalone instance: its systemd
+unit runs `node_modules/@cloudbongos/core`'s server with
+`WorkingDirectory=<instance repo>`, so at runtime `__dirname` is *inside the core
+package*. Which makes:
+
+| file | resolved to | correct? |
+|---|---|---|
+| `government.neutral.json` | `…/node_modules/@cloudbongos/core/config/` | ✅ — it really is core content |
+| `government.json` | `…/node_modules/@cloudbongos/core/config/` | ❌ — the host's is at `<instance>/config/` |
+
+So two things were true at once, and each hid the other:
+
+1. **The host's own constitution was never read.** An instance authoring
+   `config/government.json` — the documented way to set one — was ignored.
+2. **`applyBoardAmendment` wrote the ratified amendment into `node_modules`,**
+   where it worked until the next core upgrade deleted it. The nightly upgrade
+   sweep (ADR 0161 cuts a release per merge) did exactly that, within a day.
+
+**Nothing threw, and nothing could have.** Both paths exist, both are writable,
+and an absent instance pack is a legal state — a vanilla instance has none — so
+the read fell through to the neutral monarchy precisely as designed. This class
+of bug has no error to catch. `src/branding.js` had it right the whole time and
+was three files away: neutral from `resolveCoreRoot()`, instance from
+`resolveInstanceRoot()`.
+
+## 3. The fix, and the doorway it needed
+
+`NEUTRAL_PATH` now resolves from the core root and `INSTANCE_PATH` from the
+instance root, reached through `src/module-api` — because ADR 0083 forbids a
+module requiring a core internal, and until now the doorway exposed neither
+resolver. That absence is *why* the module re-derived a root from `__dirname`:
+the only tool it had was the wrong one. Both are now exported, with the failure
+above written into the export comment.
+
+Two smaller decisions travel with it:
+
+- **Resolved at load, not per call.** `resolveInstanceRoot()` falls back to
+  `process.cwd()`, so resolving lazily would let a `chdir` mid-process move the
+  constitution — a worse failure than the one being fixed.
+- **`applyBoardAmendment` creates the directory.** The write now targets a
+  directory the core does not own, and an instance that has never been branded
+  has no `config/` of its own. A ratified amendment lost to `ENOENT` is the same
+  failure in a different coat.
+
+The single-checkout case is byte-identical, and a test asserts that rather than
+the prose claiming it.
+
+## 4. The detector, because the fix alone is not the lesson
+
+Fixing the path fixes *this* cause. The thing worth keeping is that **the API
+held both facts in one payload for two weeks and never compared them.**
+
+`constitutionView` now carries a `divergence` block: the newest **passed**
+amendment's proposal, sanitized the way an apply would have written it, compared
+field by field against the constitution actually in force. Null when they agree.
+The hall renders it above the dials — in words, not config keys — as *"the board
+ratified a change that is not in force."*
+
+Three properties, each chosen against a plausible alternative:
+
+- **It reports; it never heals.** Re-applying automatically was refused: the
+  instance pack is *also* the file a human editing the constitution touches (ADR
+  0175 §7), so a silent re-apply would revert a legitimate hand edit with no way
+  to tell the two apart — trading a visible wrong constitution for an unstoppable
+  one. Naming the divergence is what those two weeks actually lacked.
+- **A returned amendment is never compared.** That is the whole meaning of
+  *returned*; comparing against it would fire on every rejected proposal, i.e. on
+  the system working.
+- **It compares the SANITIZED proposal.** Comparing the raw one would report a
+  phantom divergence on any field the sanitizer legitimately normalises — and a
+  warning that can never be cleared is a warning people learn to scroll past.
+
+## 5. What this does not do
+
+**It does not put the 2026-08-25 amendment back in force.** That is a board act,
+not a deploy: once this ships, cloudbongos.com's Constitution tab will *say* the
+amendment is not in force, and the remedy is to put it back to the board (now
+that a pass will stick) or for an operator to author the instance's own
+`config/government.json`. Choosing between those is the owner's, not this task's.
+
+**It fixes one module, and the sweep for siblings was run rather than promised.**
+Every other module deriving a root from `__dirname` was checked, and all but one
+are reading genuine CORE content — `scripts/`, `infra/`, the UI kit — which the
+core root is the *right* answer for. The exception is
+`modules/security/artifact-scan/quarantine.js`, whose "a quarantine site must not
+be inside the repository" refusal resolves to the core package on a standalone
+instance and so does not refuse a site inside the instance repo itself. That is a
+real, narrow weakening of a security guard; it is filed as
+[#1003745](https://cloudbongos.com/builders#/task/1003745) on the Security area
+rather than absorbed here, and the doorway exports this ADR adds are what its fix
+will use.
+
+**The rule to carry forward:** a `__dirname`-derived root is correct for reading
+what the core ships and wrong for reading what the host owns, and on a
+single-checkout instance the two are indistinguishable — which is why this kind
+of bug is always found in production and never in a test that runs at home.

package/docs/adr/0269-the-cli-session-store-is-host-keyed-at-a-fixed-anchor.md

@@ -0,0 +1,104 @@
+# ADR 0269 — The CLI's session store is host-keyed at a fixed anchor; the per-brand file stays the active pointer
+
+- **Status:** accepted
+- **Date:** 2026-09-09
+- **Task:** [task 1003741](https://cloudbongos.com/builders#/task/1003741) (BONGOS-V2, goal 1000090 — *Working area 4, Bongos Core distribution*)
+- **Deciders:** Claude, under the Archon's standing scope
+- **Related:** [ADR 0258](<redacted>.md) (the public CLI, which is where this bites) · [ADR 0108](<redacted>.md) (each instance its own checkout) · [ADR 0083](<redacted>.md) (why the store directory may not be called `sessions`)
+
+---
+
+## Context
+
+The CLI resolved its session path from the **branding pack**, which is read out of whatever
+checkout the process happens to be standing in. That gave it exactly **one session slot**, and the
+slot moved depending on where you ran from:
+
+- **Standalone** — the public `@cloudbongos/cli`'s entire situation — no checkout means no brand,
+  so every instance shared `~/.config/cloudbongos/gds-session.json`. Signing into a second
+  instance **destroyed** the first. Measured on the published 0.1.1: `configHome()` resolved to
+  `<HOME>/.config/cloudbongos` whichever instance was named.
+- **In-repo** the brand resolved and the session landed in `~/.config/<slug>/`, where the
+  standalone CLI could never find it. `npx @cloudbongos/cli api GET /api/gds/me` from a bare
+  directory returned the cloudbongos.com builder while a valid hermeslines session sat on the same
+  machine.
+
+This was not theoretical. The owner's own config dir carries a hand-made
+`gds-session.<redacted>.bak.json`, alongside four more rescues of the same
+shape. For a newcomer with one project it is invisible; it bites precisely the people running more
+than one, which is the direction the platform is going.
+
+## Decision
+
+**Keep one session file per instance, keyed by the instance's host, under a FIXED anchor —
+`~/.config/<FALLBACK_DIR>/instances/<host>.json` — and leave the per-brand `gds-session.json`
+exactly where it is, as the ACTIVE pointer.**
+
+Four parts are load-bearing.
+
+### 1. The anchor is fixed, never brand-derived
+
+A brand-derived anchor is the bug. `sessionStoreDir()` is built from `FALLBACK_DIR` and must not
+read `configHome()`, `configDirName()` or the pack — so the same instance resolves to the same file
+whether you run from a checkout or from `npx`. A test asserts the function body names none of them,
+because "helpfully" routing it back through the brand would silently reinstate the split.
+
+It lives in `scripts/gds/cli-lib.js`, **not** `src/instance-config.js`. That module is generic
+config-path machinery shared with the server, and a CLI session store is not its concern; cli-lib
+already owns `SESSION_PATH` and `SESSION_READ_PATHS`, so one file now describes where a session
+lives. (The first cut put it in instance-config and the knip dead-code ratchet caught it: knip
+cannot trace that module's `require()` consumers, so every export it gains counts as dead — three
+new ones broke the gate. The right answer was better placement, not a bigger baseline.)
+
+### 2. The active pointer does not move
+
+Every existing reader — in-repo skills, the card hook, the dev box, `readSessionToken` — looks at
+`gds-session.json` in the configured dir. The store is **additive**: `saveSession` still writes that
+file last and unchanged. Moving it would have been the tidier design and would have broken every one
+of those readers at once, for no gain a builder can see.
+
+### 3. The OUTGOING session is archived before the incoming one lands
+
+Order matters, and this step is the one that is easy to omit. A session written *before* the store
+existed is not in it; without archiving the session being replaced, the very first login after
+upgrading would still lose it — the exact bug, surviving its own fix. Archiving is best-effort and
+never blocks a real sign-in.
+
+### 4. A stored token is verified before it is trusted
+
+`bongos login <url>` now switches back to an instance you are already signed into with no browser
+flow — but it calls `/api/gds/me` with the stored token first. Reinstating an expired or revoked
+token unchecked would leave a builder "signed in" to a session every later command then fails on.
+An unverified token falls straight through to the real device flow; `--force` signs in as somebody
+else.
+
+Because sessions are now kept rather than overwritten, `login` also names the other instances this
+machine knows and how to move between them — silence would leave them unfindable.
+
+## Consequences
+
+- Signing into a second instance is non-destructive, and moving between two projects costs no
+  browser round-trip.
+- Session files are `0600` in a `0700` directory: they hold bearer tokens.
+- An `api_base` that names no host is **not stored** rather than stored under a guessed name, so a
+  malformed or hostile base cannot write outside the store directory.
+- **The directory is `instances/`, not `sessions/`.** `sessions` is a live module key, and
+  ADR 0083 §Decision #4 forbids kernel machinery from naming one — `src/instance-config.js` is a
+  kernel file and the fitness gate caught it. `instances/` is also the truer name: one file per
+  instance is exactly what it holds.
+- A corrupt entry in the store is skipped, never fatal.
+- Still open: the store is per-machine and holds no notion of which instance a *directory* belongs
+  to, so running in an instance repo does not automatically select that instance — the active
+  pointer is whatever you last signed into. That is a smaller, separable question.
+
+## Rejected
+
+- **Moving the active pointer into the store** — breaks every existing reader at once for no
+  visible gain.
+- **One file holding a map of instances** — changes the on-disk format that in-repo readers,
+  hooks and the dev box all parse today.
+- **Keying the store under `configHome()`** — brand-derived, which is the bug being fixed.
+- **Restoring a stored session without verifying it** — hands the builder a dead session that
+  looks live.
+- **A new `bongos switch` verb** — `login <url>` is the command a builder already reaches for, and
+  the public CLI's verb surface is deliberately small (ADR 0258).