@bongos/core 1.19.621 → 1.19.623

package/modules/lifecycle/db-tasks.js

@@ -855,11 +855,22 @@ function taskTouchesProtectedPath(task) {
 // and rank them.
 //
 // Ranking key (most relevant first):
-//   1. priority DESC          — a P5 in another lane still beats a P1
+//   1. priority ASC, unset last — 1 is the MOST urgent. This is the DB's own
+//      convention: CHECK (priority BETWEEN 1 AND 5), and every version-progress
+//      view weights work as 6 - COALESCE(priority, 5), so a lower number earns
+//      more weight. It is the same order the SQL feeds use — `priority ASC
+//      NULLS LAST` in the optimizer, `priority NULLS LAST` in listTasks and the
+//      goal rollup. A task with no priority set ranks after an explicit P5,
+//      never ahead of a P1.
 //   2. credits-per-minute DESC — best bang-for-effort among equal priority
 //   3. est_minutes ASC         — shorter wins the tiebreak (easier to try)
 //   4. id ASC                  — stable final tiebreak
 //
+// scripts/gds/start.js keeps a hand-copied mirror of this function (it is a
+// pure HTTP client and cannot import this module). The two are a documented
+// mirror pair: tests/cross_discipline_priority_direction.mjs executes BOTH and
+// fails if either drifts. Change one, change the other.
+//
 // 'unclassified' tasks are excluded: they're un-triaged, not a real lane to
 // recommend exploring. If preferred_disciplines is empty (no preference), the
 // builder already sees everything in the main list, so there is nothing
@@ -876,13 +887,22 @@ function rankCrossDisciplineRecommendations(claimable, preferredDisciplines, lim
     const mins = Number(t.est_minutes_calibrated ?? t.est_minutes) || 0;
     return mins > 0 ? credits / mins : 0;
   };
+  // `ASC NULLS LAST` expressed in JS: an absent, blank or non-numeric priority
+  // sorts AFTER every explicit 1..5. Deliberately not `Number(t.priority) || 0`
+  // — that maps NULL to 0, which under an ascending sort is more urgent than a
+  // P1. Infinity is the only value that keeps unset work at the back.
+  const prio = (t) => {
+    if (t.priority === null || t.priority === undefined || t.priority === '') return Infinity;
+    const n = Number(t.priority);
+    return Number.isFinite(n) ? n : Infinity;
+  };
   const outside = rows.filter(
     (t) => t.discipline && t.discipline !== 'unclassified' && !prefSet.has(t.discipline)
   );
   outside.sort((a, b) => {
-    const pa = Number(a.priority) || 0;
-    const pb = Number(b.priority) || 0;
-    if (pb !== pa) return pb - pa; // higher priority first
+    const pa = prio(a);
+    const pb = prio(b);
+    if (pa !== pb) return pa - pb; // lower number = more urgent; unset last
     const ca = cpm(a);
     const cb = cpm(b);
     if (cb !== ca) return cb - ca; // higher credits/min first

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.621",
+  "version": "1.19.623",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.621",
+      "version": "1.19.623",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.621",
+  "version": "1.19.623",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-vocabulary.js

@@ -59,6 +59,13 @@ const VOCAB_SURFACE = [
   'modules/hall-ui/public/government.js',
   'modules/hall-ui/public/government.html',
   'modules/hall-ui/public/government.css',
+  // ADR 0266 carved the Board Room out of government.js onto its own page. The
+  // wall follows the SURFACE, not the filename — without these two rows the
+  // room's own files would have left the wall's scope, which is how a renamed
+  // file quietly drops an enforcement it used to be held to.
+  'modules/hall-ui/public/board-room.js',
+  'modules/hall-ui/public/board-room.html',
+  'modules/hall-ui/public/board-room.css',
 ];
 const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css']);
 const VOCAB_BANNED = [

package/scripts/gds/start.js

@@ -45,9 +45,9 @@
 //
 // Below the main list, a "You might enjoy" section surfaces up to 3 claimable
 // tasks OUTSIDE the builder's disciplines, ranked by relevance. The ranking
-// mirrors db.rankCrossDisciplineRecommendations (the canonical server-side
-// home for this logic — kept in sync deliberately; start.js is a pure HTTP
-// client and cannot import the server db module).
+// mirrors rankCrossDisciplineRecommendations in modules/lifecycle/db-tasks.js
+// (the canonical server-side home for this logic — kept in sync deliberately;
+// start.js is a pure HTTP client and cannot import the server db module).
 //
 //
 // Returns JSON if --json is passed (for the slash command to parse cleanly).
@@ -470,12 +470,19 @@ function renderWidget({ builder, claims, claimable, total, streak, recommendatio
 }
 
 // Cross-discipline recommendations — mirror of
-// db.rankCrossDisciplineRecommendations (src/bongos/db.js). Given the full
-// claimable list and the builder's preferred_disciplines, return up to `limit`
-// tasks whose discipline is OUTSIDE the builder's preferences, ranked:
-//   priority DESC, credits/min DESC, est_minutes ASC, id ASC.
+// rankCrossDisciplineRecommendations in modules/lifecycle/db-tasks.js (the
+// canonical copy; it moved there from src/bongos/db.js in the twelve-unit
+// carve). Given the full claimable list and the builder's
+// preferred_disciplines, return up to `limit` tasks whose discipline is OUTSIDE
+// the builder's preferences, ranked:
+//   priority ASC (unset last), credits/min DESC, est_minutes ASC, id ASC.
+// Priority 1 is the MOST urgent — the DB's own convention (CHECK (priority
+// BETWEEN 1 AND 5), weighted 6 - COALESCE(priority, 5)); an unset priority
+// sorts after an explicit P5, never ahead of a P1.
 // 'unclassified' tasks are excluded (un-triaged, not a real lane). Empty
 // preferences → [] (everything is already in the main list; nothing outside).
+// This copy and the canonical one are pinned together by
+// tests/cross_discipline_priority_direction.mjs — change one, change the other.
 function rankCrossDisciplineRecommendations(claimable, preferredDisciplines, limit = 3) {
   const rows = Array.isArray(claimable) ? claimable : [];
   const prefs = Array.isArray(preferredDisciplines) ? preferredDisciplines : [];
@@ -486,13 +493,21 @@ function rankCrossDisciplineRecommendations(claimable, preferredDisciplines, lim
     const mins = Number(t.est_minutes_calibrated ?? t.est_minutes) || 0;
     return mins > 0 ? credits / mins : 0;
   };
+  // `ASC NULLS LAST` in JS — an absent/blank/non-numeric priority sorts after
+  // every explicit 1..5. Not `Number(t.priority) || 0`: that maps NULL to 0,
+  // which under an ascending sort outranks a P1.
+  const prio = (t) => {
+    if (t.priority === null || t.priority === undefined || t.priority === '') return Infinity;
+    const n = Number(t.priority);
+    return Number.isFinite(n) ? n : Infinity;
+  };
   const outside = rows.filter(
     (t) => t.discipline && t.discipline !== 'unclassified' && !prefSet.has(t.discipline)
   );
   outside.sort((a, b) => {
-    const pa = Number(a.priority) || 0;
-    const pb = Number(b.priority) || 0;
-    if (pb !== pa) return pb - pa;
+    const pa = prio(a);
+    const pb = prio(b);
+    if (pa !== pb) return pa - pb;
     const ca = cpm(a);
     const cb = cpm(b);
     if (cb !== ca) return cb - ca;
@@ -973,7 +988,9 @@ async function main() {
 // Only auto-run when invoked directly (`node start.js …`); a `require()` (the
 // unit test) imports the pure render helpers without executing the fetch flow —
 // the claim.js precedent. The owed-rebase warning helpers (ADR 0120 part 5) are
-// exported so they can be unit-tested without a live server.
+// exported so they can be unit-tested without a live server, and so is
+// rankCrossDisciplineRecommendations — the mirror test executes THIS copy
+// alongside the canonical one rather than pattern-matching the source.
 if (require.main === module) {
   main().catch((err) => {
     console.error('fatal:', err);
@@ -982,6 +999,7 @@ if (require.main === module) {
 }
 
 module.exports = {
+  rankCrossDisciplineRecommendations,
   rebaseWarningModel,
   rebaseWarningMarkdown,
   rebaseWarningWidget,

package/src/bongos/auth.js

@@ -401,6 +401,21 @@ const PAGE_GATES = Object.freeze({
   requireProjectCuratePage: Object.freeze({
     permission: 'project.curate', deniedTo: '/builders', alsoAdmits: 'isProjectOwner',
   }),
+  // The /board-room page (ADR 0266) — gated on `board.vote.cast`, the SAME atom
+  // the vote route checks, so the surface's reach equals the right to vote.
+  //
+  // That atom floors at XENOS on purpose (modules/government/board.js — low so
+  // that WIDENING the board works), which makes this the widest page gate in the
+  // table. It is deliberate and it is not a hole: the floor is the coarse gate,
+  // and MEMBERSHIP is still checked in-handler per item against that item's own
+  // snapshotted constitution. A holder who sits on no board sees the room and no
+  // ballot — the honest state, since ADR 0175 §9 made the ballot open on purpose.
+  //
+  // Reaching for `page.view.government` (metic+) instead would look tighter and
+  // be wrong: an instance that widens membership below Metic would then have
+  // members who can cast a vote through the API and cannot load the page they
+  // would cast it on. That is the code-path change ADR 0175 §6 exists to remove.
+  requireBoardVotePage: Object.freeze({ permission: 'board.vote.cast', deniedTo: '/builders' }),
 });
 
 // The `alsoAdmits` door — "is this visitor the page's OTHER audience?", asked of
@@ -550,6 +565,17 @@ async function requireProjectCuratePage(req, res, next) {
   return runPageGate('requireProjectCuratePage', req, res, next);
 }
 
+// The /board-room page (ADR 0266) — gated on the `board.vote.cast` ATOM, the
+// same key the vote route checks, so the page layer can never drift NARROWER
+// than the API it fronts. That is the direction that matters here: the Board
+// Room used to live inside /government behind `page.view.government` (metic+)
+// while the vote atom floors at xenos, so a widened board produced members who
+// could vote by API and not load the page. See PAGE_GATES above for why the
+// wide floor is correct rather than a hole (membership is the in-handler check).
+async function requireBoardVotePage(req, res, next) {
+  return runPageGate('requireBoardVotePage', req, res, next);
+}
+
 // The orientation reading rooms (the citizen's primer, the system-maps/diagrams)
 // that #766 closed to newcomers and #770 enforces at the URL. A Xenos's path is
 // action-only — find work, claim, ship three — so these pages are reserved for
@@ -821,6 +847,7 @@ module.exports = {
   requireGovernmentManagePage,
   requireNonXenosPage,
   requireProjectCuratePage,
+  requireBoardVotePage,
   requireRank,
   rankMeetsThreshold,
   requirePermission,

package/src/bongos/serve-internal.js

@@ -844,6 +844,21 @@ function mountInternalSurfaces(app) {
   // the `government.manage` atom itself (archon), the same key its data routes
   // check — requireGovernmentManagePage, not the metic-floored gate above.
   const GOVERNMENT_PAGE_RE = /^\/builders\/government(?:\.html)?\/?$/;
+  // /board-room — the Board Room, carved out of the /government tab strip onto
+  // its own page (ADR 0266). It does NOT take the gate above. Its atom is
+  // `board.vote.cast`, the same key the vote route checks, so the page's reach
+  // equals the right to vote: that atom floors at xenos on purpose, so that a
+  // constitution widening membership below Metic gets members who can actually
+  // reach the room rather than members who can only vote by curl. Membership is
+  // still the in-handler check, per item, against that item's own snapshotted
+  // constitution.
+  //
+  // NB as at PROJECT_SETTINGS_PAGE_RE: this assignment must stay
+  // `const NAME_RE = /…/;` with nothing between the `=` and the literal —
+  // tests/hall_page_gate_map.mjs rebuilds the URL→gate map by parsing this file
+  // statically, and a comment in that gap drops the regex out of the map, which
+  // makes the page test as UNGATED while looking gated here. Prose goes above.
+  const BOARD_ROOM_PAGE_RE = /^\/builders\/board-room(?:\.html)?\/?$/;
   // The /people builder directory (task 1002577): gated on `project.curate`, the
   // exact permission its data route (GET /scouting) checks — same posture as the
   // /government tab above (the page can never drift wider than the API it fronts).
@@ -885,6 +900,12 @@ function mountInternalSurfaces(app) {
     if (GOVERNMENT_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernmentPage(req, res, next);
     }
+    // ADR 0266: the Board Room's own page, on the vote atom rather than the
+    // government page floor. Ordered after the branch above only for reading
+    // order — the regexes are disjoint, so the sequence carries no meaning.
+    if (BOARD_ROOM_PAGE_RE.test(norm)) {
+      return gdsAuth.requireBoardVotePage(req, res, next);
+    }
     if (PEOPLE_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);
     }

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.621'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.623'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_resolve_failure.mjs

@@ -94,16 +94,17 @@ test('AUDIT: every async middleware mounted directly on a router owns its reject
   //   requireBuilder            — the API gate. Guarded here (BV1.R109-follow-up).
   //   requireBuilderPage         \
   //   requireGovernmentPage       \
-  //   requireGovernmentManagePage  > all five delegate to runPageGate, guarded by BV1.R107.
-  //   requireNonXenosPage         /  (the R113 roles-tab gate; the /people curate gate)
-  //   requireProjectCuratePage   /
+  //   requireGovernmentManagePage  \ all SIX delegate to runPageGate, guarded by BV1.R107.
+  //   requireNonXenosPage          /  (the R113 roles-tab gate; the /people curate
+  //   requireProjectCuratePage    /    gate; the ADR 0266 /board-room vote gate)
+  //   requireBoardVotePage       /
   // Anything else async and router-mounted must be added with its own try/catch.
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
   const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
-  assert.deepEqual(asyncMw.sort(), ['requireBuilder', 'requireBuilderPage', 'requireGovernmentManagePage', 'requireGovernmentPage', 'requireNonXenosPage', 'requireProjectCuratePage'],
+  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireGovernmentManagePage', 'requireGovernmentPage', 'requireNonXenosPage', 'requireProjectCuratePage'],
     'a new async router middleware appeared — give it a try/catch and add it here');
   // The page gates must actually delegate (that is WHY they are safe).
-  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireGovernmentManagePage', 'requireNonXenosPage', 'requireProjectCuratePage']) {
+  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireGovernmentManagePage', 'requireNonXenosPage', 'requireProjectCuratePage', 'requireBoardVotePage']) {
     const fn = src.slice(src.indexOf(`async function ${name}`));
     assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
   }

package/tests/cross_discipline_priority_direction.mjs

@@ -0,0 +1,196 @@
+// tests/cross_discipline_priority_direction.mjs — priority sorts ONE way
+// (task 1003756).
+//
+// tasks.priority is 1..5 with 1 the MOST urgent. The DB says so in two places
+// that cannot drift (the CHECK constraint and the 6 - COALESCE(priority, 5)
+// weighting every version-progress view uses), and every SQL feed orders
+// `priority ASC NULLS LAST`. rankCrossDisciplineRecommendations used to sort
+// the other way and its header comment asserted the inverse as the global rule,
+// so re-ranking a task moved it the wrong direction in /builder-start's
+// "You might enjoy" section.
+//
+// The function has TWO hand-copied implementations — the canonical one in
+// modules/lifecycle/db-tasks.js and a mirror in scripts/gds/start.js, which is
+// a pure HTTP client and cannot import the server module. This test EXECUTES
+// both against the same fixtures and asserts they agree, so the pair cannot
+// drift apart again.
+//
+// Run:  node tests/cross_discipline_priority_direction.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+const CANONICAL = require(path.join(ROOT, 'modules/lifecycle/db-tasks.js'))
+  .rankCrossDisciplineRecommendations;
+const MIRROR = require(path.join(ROOT, 'scripts/gds/start.js'))
+  .rankCrossDisciplineRecommendations;
+
+// Both copies, run over the same input. Every behavioural assertion below goes
+// through this so a fix applied to only one file fails the suite.
+const IMPLS = [['db-tasks.js (canonical)', CANONICAL], ['start.js (mirror)', MIRROR]];
+const bothRank = (rows, prefs, limit) => IMPLS.map(([name, fn]) => [name, fn(rows, prefs, limit)]);
+const eachImpl = (rows, prefs, limit, check) => {
+  for (const [name, out] of bothRank(rows, prefs, limit)) check(out, name);
+};
+
+// A claimable row. discipline defaults OUTSIDE the caller's prefs (['engineer'])
+// so the partition step never eats the fixture; credits/minutes are equal by
+// default so priority is the only live sort key unless a test says otherwise.
+const row = (id, priority, extra = {}) => ({
+  id, priority, discipline: 'design', credits_reward: 10, est_minutes: 10, ...extra,
+});
+const PREFS = ['engineer'];
+const ids = (out) => out.map((t) => t.id);
+
+const { test, summary } = makeRunner();
+
+// ---- the direction itself ---------------------------------------------------
+
+await test('P1 outranks P5 — 1 is the most urgent, in BOTH copies', () => {
+  // Input deliberately in the wrong order so a no-op sort cannot pass.
+  const rows = [row('p5', 5), row('p3', 3), row('p1', 1)];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['p1', 'p3', 'p5'],
+      `${name}: ascending — the DB weights work 6 - COALESCE(priority, 5), so P1 earns the most`);
+  });
+});
+
+await test('the limit keeps the MOST urgent, not the least', () => {
+  const rows = [row('p5', 5), row('p4', 4), row('p1', 1), row('p2', 2)];
+  eachImpl(rows, PREFS, 2, (out, name) => {
+    assert.deepEqual(ids(out), ['p1', 'p2'],
+      `${name}: slicing after a backwards sort would surface the two LEAST urgent tasks`);
+  });
+});
+
+// ---- the NULL mapping -------------------------------------------------------
+// The old code read priority as `Number(t.priority) || 0`. Under the old DESC
+// sort that put unset work last by accident; under the corrected ASC sort the
+// same expression would rank it 0 — ahead of every P1. These pin the explicit
+// handling that replaced it.
+
+await test('an unset priority sorts LAST, not first (the || 0 trap)', () => {
+  for (const blank of [null, undefined, '']) {
+    const rows = [row('blank', blank), row('p1', 1), row('p5', 5)];
+    eachImpl(rows, PREFS, 10, (out, name) => {
+      assert.deepEqual(ids(out), ['p1', 'p5', 'blank'],
+        `${name}: priority=${JSON.stringify(blank)} must rank after an explicit P5`);
+    });
+  }
+});
+
+await test('a non-numeric priority is treated as unset, not as 0', () => {
+  const rows = [row('junk', 'urgent'), row('p5', 5)];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['p5', 'junk'], `${name}: NaN must not outrank a real priority`);
+  });
+});
+
+await test('a numeric string priority still sorts as its number', () => {
+  const rows = [row('five', '5'), row('one', '1')];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['one', 'five'], `${name}: the API can hand back stringified integers`);
+  });
+});
+
+// ---- the rest of the ranking key, so fixing direction did not disturb it ----
+
+await test('credits-per-minute DESC breaks a priority tie', () => {
+  const rows = [
+    row('cheap', 2, { credits_reward: 10, est_minutes: 100 }),
+    row('rich', 2, { credits_reward: 100, est_minutes: 10 }),
+  ];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['rich', 'cheap'], `${name}: best bang-for-effort first`);
+  });
+});
+
+await test('shorter est_minutes, then id, break the remaining ties', () => {
+  const rows = [
+    row('long', 2, { credits_reward: 10, est_minutes: 10 }),
+    row('short', 2, { credits_reward: 5, est_minutes: 5 }),
+  ];
+  // Equal credits/min (1.0), so est_minutes decides.
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['short', 'long'], `${name}: shorter is easier to try`);
+  });
+  const tied = [row(9, 2), row(3, 2)];
+  eachImpl(tied, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), [3, 9], `${name}: id ASC is the stable final tiebreak`);
+  });
+});
+
+await test('partitioning is unchanged: outside-prefs only, no unclassified, empty prefs → []', () => {
+  const rows = [
+    row('mine', 1, { discipline: 'engineer' }),
+    row('untriaged', 1, { discipline: 'unclassified' }),
+    row('theirs', 4, { discipline: 'design' }),
+  ];
+  eachImpl(rows, PREFS, 10, (out, name) => {
+    assert.deepEqual(ids(out), ['theirs'], `${name}: only lanes outside the builder's prefs`);
+  });
+  eachImpl(rows, [], 10, (out, name) => {
+    assert.deepEqual(out, [], `${name}: no stated preference → nothing is "outside"`);
+  });
+});
+
+await test('the two copies agree row-for-row on a mixed corpus', () => {
+  const disciplines = ['design', 'ops', 'research', 'engineer', 'unclassified'];
+  const priorities = [1, 2, 3, 4, 5, null, undefined, '', '2', 'junk'];
+  const rows = [];
+  for (let i = 0; i < 60; i++) {
+    rows.push(row(i, priorities[i % priorities.length], {
+      discipline: disciplines[i % disciplines.length],
+      credits_reward: (i % 7) * 5,
+      est_minutes: (i % 4) * 15,
+    }));
+  }
+  const [[, fromCanonical], [, fromMirror]] = bothRank(rows, ['engineer'], 25);
+  assert.ok(fromCanonical.length > 5, 'fixture must actually exercise the ranking');
+  assert.deepEqual(ids(fromMirror), ids(fromCanonical),
+    'start.js is a hand-copied mirror — it must produce the identical order');
+});
+
+// ---- the convention this direction is anchored to ---------------------------
+// If someone ever inverts the DB's meaning of priority, these fail and force the
+// behavioural assertions above to be reconsidered rather than silently re-flipped.
+
+await test('the DB still says 1 is most urgent (CHECK + the 6 - COALESCE weighting)', () => {
+  const schema = read('migrations/003_pms.sql');
+  assert.match(schema, /priority\s+integer\s+CHECK \(priority BETWEEN 1 AND 5\)/,
+    'priority is a 1..5 integer');
+  assert.match(schema, /6 - COALESCE\(t\.priority, 5\)/,
+    'progress weighting subtracts from 6, so a LOWER priority number earns MORE weight');
+  assert.match(read('src/bongos/optimizer.js'), /priority ASC NULLS LAST/,
+    'the optimizer — the closest analogue to this recommender — orders ascending');
+});
+
+await test('neither copy claims priority DESC, and the mirror pointer resolves', () => {
+  const canonicalSrc = read('modules/lifecycle/db-tasks.js');
+  const mirrorSrc = read('scripts/gds/start.js');
+  for (const [name, src] of [['db-tasks.js', canonicalSrc], ['start.js', mirrorSrc]]) {
+    assert.ok(!/priority DESC/.test(src), `${name}: no comment may assert priority DESC`);
+  }
+  // The canonical home moved out of src/bongos/db.js in the twelve-unit carve;
+  // start.js pointed at the old address long after the function had left it.
+  assert.ok(
+    !/rankCrossDisciplineRecommendations \(src\/bongos\/db\.js\)/.test(mirrorSrc)
+      && !/db\.rankCrossDisciplineRecommendations/.test(mirrorSrc),
+    'start.js must name modules/lifecycle/db-tasks.js as the canonical home'
+  );
+  assert.match(mirrorSrc, /modules\/lifecycle\/db-tasks\.js/,
+    'the mirror names where the canonical copy actually lives');
+  assert.ok(
+    !/rankCrossDisciplineRecommendations/.test(read('src/bongos/db.js')),
+    'src/bongos/db.js really does not define it — the old pointer was dangling'
+  );
+});
+
+summary();

package/tests/government_board_hash_redirect.mjs

@@ -0,0 +1,129 @@
+// tests/government_board_hash_redirect.mjs — the `#board-room` compatibility
+// redirect (ADR 0266, task 1003735).
+//
+// WHY THIS FILE EXISTS. ADR 0266 carved the Board Room out of the /government
+// tab strip onto its own page, and named this redirect load-bearing for a reason
+// that does not expire: Discord's window-open announcement deep-links
+// `?item=<id>#board-room` (ADR 0175 §8 makes that mention the "vote within X"
+// notice), and every one of those messages already sitting in channel history
+// carries the old form forever. If the redirect breaks, a member clicking the
+// notification lands on the Permissions page with no way to the sitting.
+//
+// AND WHY IT CANNOT BE A SERVER TEST. A URL fragment is never sent to the
+// server, so `#board-room` cannot be caught by a route in serve-internal.js —
+// adding a regex there looks like the obvious fix and silently never fires. That
+// makes this browser function the ONLY thing standing between an old link and a
+// dead end, which is exactly the shape that deserves a pin.
+//
+// It is extracted and RUN, not grepped: the interesting behaviour is the
+// branch (which hashes trigger) and the query-preservation (encodeURIComponent
+// on a value that came off the URL), and a source match would pass on a
+// function that returns the wrong string.
+//
+// Pure file-read + vm (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const GOV_SRC = fs.readFileSync(path.join(HALL, 'government.js'), 'utf8');
+
+// Lift the function out of the page's IIFE and run it against a fake location.
+// `sliceFn` counts braces rather than matching a closing line, so a nested block
+// inside the body cannot end the slice early.
+function sliceFn(src, name) {
+  const start = src.indexOf(`function ${name}`);
+  assert.notEqual(start, -1, `${name} not found in government.js`);
+  const open = src.indexOf('{', start);
+  let depth = 0;
+  for (let i = open; i < src.length; i += 1) {
+    if (src[i] === '{') depth += 1;
+    else if (src[i] === '}') {
+      depth -= 1;
+      if (depth === 0) return src.slice(start, i + 1);
+    }
+  }
+  throw new Error(`${name} is unbalanced`);
+}
+
+// Returns { result, replaced } — `replaced` is the URL location.replace was
+// called with, or null if it was never called.
+function runRedirect({ hash, search = '' }) {
+  let replaced = null;
+  const sandbox = {
+    URLSearchParams,
+    window: {
+      location: {
+        hash,
+        search,
+        replace(url) { replaced = url; },
+      },
+    },
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(`${sliceFn(GOV_SRC, 'redirectLegacyBoardHash')}
+    globalThis.__out = redirectLegacyBoardHash();`, sandbox, { filename: 'government.js' });
+  return { result: sandbox.__out, replaced };
+}
+
+test('the old hash lands on the room, and says it navigated', () => {
+  const { result, replaced } = runRedirect({ hash: '#board-room' });
+  assert.equal(replaced, '/board-room');
+  assert.equal(result, true,
+    'init() returns early on true — a falsy answer would let the government page paint over the navigation');
+});
+
+test('?item=N is carried across — that is the whole point of the Discord link', () => {
+  const { replaced } = runRedirect({ hash: '#board-room', search: '?item=12' });
+  assert.equal(replaced, '/board-room?item=12');
+});
+
+test('the item is re-encoded, never pasted through raw', () => {
+  // The value arrives off a URL a stranger can author, and goes straight back
+  // into one. Board item ids are numeric, so this is defence rather than a live
+  // case — which is why it is pinned instead of assumed.
+  const { replaced } = runRedirect({ hash: '#board-room', search: '?item=1%202%263' });
+  assert.equal(replaced, '/board-room?item=1%202%263',
+    'a space and an ampersand survive as escapes rather than splitting the query');
+});
+
+test('an item that is absent or empty produces a bare URL, not a dangling ?item=', () => {
+  assert.equal(runRedirect({ hash: '#board-room', search: '?other=1' }).replaced, '/board-room');
+  assert.equal(runRedirect({ hash: '#board-room', search: '?item=' }).replaced, '/board-room',
+    'an empty value is falsy, so no query is appended');
+});
+
+test('every OTHER hash is left alone — the two surviving tabs still work', () => {
+  // The government page kept #constitution and #ranks. A redirect that fired on
+  // those would make the page unreachable, which is a worse failure than the one
+  // this function exists to prevent.
+  for (const hash of ['#constitution', '#ranks', '', '#board-room-extra', '#Board-Room']) {
+    const { result, replaced } = runRedirect({ hash, search: '?item=12' });
+    assert.equal(replaced, null, `${hash || '(no hash)'} must not navigate`);
+    assert.equal(result, false, `${hash || '(no hash)'} must let init() continue`);
+  }
+});
+
+test('init() consults it FIRST and returns on true', () => {
+  // The order is the behaviour: called after the /me fetch, the reader would see
+  // the government page paint and then jump. Asserted on the source because it is
+  // a statement about sequence, not a value.
+  const init = sliceFn(GOV_SRC, 'init');
+  const guard = init.indexOf('redirectLegacyBoardHash()');
+  assert.notEqual(guard, -1, 'init() must consult the redirect');
+  assert.match(init.slice(guard - 30, guard + 60), /if \(redirectLegacyBoardHash\(\)\) return;/,
+    'it must be an early return, not a fire-and-continue');
+  const meFetch = init.indexOf("fetchJson('/me')");
+  assert.ok(guard < meFetch, 'the redirect must run BEFORE the /me read and any paint');
+});
+
+test('the government page no longer declares a board-room tab to redirect INTO', () => {
+  // If #board-room came back as a tab id, this redirect would fight makeTabs for
+  // the same hash and the room would exist in two places.
+  const ids = [...GOV_SRC.matchAll(/\{ id: '([a-z-]+)', label: '[^']*', panel:/g)].map((m) => m[1]);
+  assert.ok(!ids.includes('board-room'), `board-room is a page, not a tab (found ${ids})`);
+});