@bongos/core 1.19.622 → 1.19.623

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.622",
+  "version": "1.19.623",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-vocabulary.js

@@ -59,6 +59,13 @@ const VOCAB_SURFACE = [
   'modules/hall-ui/public/government.js',
   'modules/hall-ui/public/government.html',
   'modules/hall-ui/public/government.css',
+  // ADR 0266 carved the Board Room out of government.js onto its own page. The
+  // wall follows the SURFACE, not the filename — without these two rows the
+  // room's own files would have left the wall's scope, which is how a renamed
+  // file quietly drops an enforcement it used to be held to.
+  'modules/hall-ui/public/board-room.js',
+  'modules/hall-ui/public/board-room.html',
+  'modules/hall-ui/public/board-room.css',
 ];
 const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css']);
 const VOCAB_BANNED = [

package/src/bongos/auth.js

@@ -401,6 +401,21 @@ const PAGE_GATES = Object.freeze({
   requireProjectCuratePage: Object.freeze({
     permission: 'project.curate', deniedTo: '/builders', alsoAdmits: 'isProjectOwner',
   }),
+  // The /board-room page (ADR 0266) — gated on `board.vote.cast`, the SAME atom
+  // the vote route checks, so the surface's reach equals the right to vote.
+  //
+  // That atom floors at XENOS on purpose (modules/government/board.js — low so
+  // that WIDENING the board works), which makes this the widest page gate in the
+  // table. It is deliberate and it is not a hole: the floor is the coarse gate,
+  // and MEMBERSHIP is still checked in-handler per item against that item's own
+  // snapshotted constitution. A holder who sits on no board sees the room and no
+  // ballot — the honest state, since ADR 0175 §9 made the ballot open on purpose.
+  //
+  // Reaching for `page.view.government` (metic+) instead would look tighter and
+  // be wrong: an instance that widens membership below Metic would then have
+  // members who can cast a vote through the API and cannot load the page they
+  // would cast it on. That is the code-path change ADR 0175 §6 exists to remove.
+  requireBoardVotePage: Object.freeze({ permission: 'board.vote.cast', deniedTo: '/builders' }),
 });
 
 // The `alsoAdmits` door — "is this visitor the page's OTHER audience?", asked of
@@ -550,6 +565,17 @@ async function requireProjectCuratePage(req, res, next) {
   return runPageGate('requireProjectCuratePage', req, res, next);
 }
 
+// The /board-room page (ADR 0266) — gated on the `board.vote.cast` ATOM, the
+// same key the vote route checks, so the page layer can never drift NARROWER
+// than the API it fronts. That is the direction that matters here: the Board
+// Room used to live inside /government behind `page.view.government` (metic+)
+// while the vote atom floors at xenos, so a widened board produced members who
+// could vote by API and not load the page. See PAGE_GATES above for why the
+// wide floor is correct rather than a hole (membership is the in-handler check).
+async function requireBoardVotePage(req, res, next) {
+  return runPageGate('requireBoardVotePage', req, res, next);
+}
+
 // The orientation reading rooms (the citizen's primer, the system-maps/diagrams)
 // that #766 closed to newcomers and #770 enforces at the URL. A Xenos's path is
 // action-only — find work, claim, ship three — so these pages are reserved for
@@ -821,6 +847,7 @@ module.exports = {
   requireGovernmentManagePage,
   requireNonXenosPage,
   requireProjectCuratePage,
+  requireBoardVotePage,
   requireRank,
   rankMeetsThreshold,
   requirePermission,

package/src/bongos/serve-internal.js

@@ -844,6 +844,21 @@ function mountInternalSurfaces(app) {
   // the `government.manage` atom itself (archon), the same key its data routes
   // check — requireGovernmentManagePage, not the metic-floored gate above.
   const GOVERNMENT_PAGE_RE = /^\/builders\/government(?:\.html)?\/?$/;
+  // /board-room — the Board Room, carved out of the /government tab strip onto
+  // its own page (ADR 0266). It does NOT take the gate above. Its atom is
+  // `board.vote.cast`, the same key the vote route checks, so the page's reach
+  // equals the right to vote: that atom floors at xenos on purpose, so that a
+  // constitution widening membership below Metic gets members who can actually
+  // reach the room rather than members who can only vote by curl. Membership is
+  // still the in-handler check, per item, against that item's own snapshotted
+  // constitution.
+  //
+  // NB as at PROJECT_SETTINGS_PAGE_RE: this assignment must stay
+  // `const NAME_RE = /…/;` with nothing between the `=` and the literal —
+  // tests/hall_page_gate_map.mjs rebuilds the URL→gate map by parsing this file
+  // statically, and a comment in that gap drops the regex out of the map, which
+  // makes the page test as UNGATED while looking gated here. Prose goes above.
+  const BOARD_ROOM_PAGE_RE = /^\/builders\/board-room(?:\.html)?\/?$/;
   // The /people builder directory (task 1002577): gated on `project.curate`, the
   // exact permission its data route (GET /scouting) checks — same posture as the
   // /government tab above (the page can never drift wider than the API it fronts).
@@ -885,6 +900,12 @@ function mountInternalSurfaces(app) {
     if (GOVERNMENT_PAGE_RE.test(norm)) {
       return gdsAuth.requireGovernmentPage(req, res, next);
     }
+    // ADR 0266: the Board Room's own page, on the vote atom rather than the
+    // government page floor. Ordered after the branch above only for reading
+    // order — the regexes are disjoint, so the sequence carries no meaning.
+    if (BOARD_ROOM_PAGE_RE.test(norm)) {
+      return gdsAuth.requireBoardVotePage(req, res, next);
+    }
     if (PEOPLE_PAGE_RE.test(norm)) {
       return gdsAuth.requireProjectCuratePage(req, res, next);
     }

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.622'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.623'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/auth_resolve_failure.mjs

@@ -94,16 +94,17 @@ test('AUDIT: every async middleware mounted directly on a router owns its reject
   //   requireBuilder            — the API gate. Guarded here (BV1.R109-follow-up).
   //   requireBuilderPage         \
   //   requireGovernmentPage       \
-  //   requireGovernmentManagePage  > all five delegate to runPageGate, guarded by BV1.R107.
-  //   requireNonXenosPage         /  (the R113 roles-tab gate; the /people curate gate)
-  //   requireProjectCuratePage   /
+  //   requireGovernmentManagePage  \ all SIX delegate to runPageGate, guarded by BV1.R107.
+  //   requireNonXenosPage          /  (the R113 roles-tab gate; the /people curate
+  //   requireProjectCuratePage    /    gate; the ADR 0266 /board-room vote gate)
+  //   requireBoardVotePage       /
   // Anything else async and router-mounted must be added with its own try/catch.
   const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth.js'), 'utf8');
   const asyncMw = [...src.matchAll(/^async function (require\w+|allow\w+)\s*\(req, res, next\)/gm)].map((m) => m[1]);
-  assert.deepEqual(asyncMw.sort(), ['requireBuilder', 'requireBuilderPage', 'requireGovernmentManagePage', 'requireGovernmentPage', 'requireNonXenosPage', 'requireProjectCuratePage'],
+  assert.deepEqual(asyncMw.sort(), ['requireBoardVotePage', 'requireBuilder', 'requireBuilderPage', 'requireGovernmentManagePage', 'requireGovernmentPage', 'requireNonXenosPage', 'requireProjectCuratePage'],
     'a new async router middleware appeared — give it a try/catch and add it here');
   // The page gates must actually delegate (that is WHY they are safe).
-  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireGovernmentManagePage', 'requireNonXenosPage', 'requireProjectCuratePage']) {
+  for (const name of ['requireBuilderPage', 'requireGovernmentPage', 'requireGovernmentManagePage', 'requireNonXenosPage', 'requireProjectCuratePage', 'requireBoardVotePage']) {
     const fn = src.slice(src.indexOf(`async function ${name}`));
     assert.match(sliceFn(fn), /runPageGate\(/, `${name} must delegate to the guarded runPageGate`);
   }

package/tests/government_board_hash_redirect.mjs

@@ -0,0 +1,129 @@
+// tests/government_board_hash_redirect.mjs — the `#board-room` compatibility
+// redirect (ADR 0266, task 1003735).
+//
+// WHY THIS FILE EXISTS. ADR 0266 carved the Board Room out of the /government
+// tab strip onto its own page, and named this redirect load-bearing for a reason
+// that does not expire: Discord's window-open announcement deep-links
+// `?item=<id>#board-room` (ADR 0175 §8 makes that mention the "vote within X"
+// notice), and every one of those messages already sitting in channel history
+// carries the old form forever. If the redirect breaks, a member clicking the
+// notification lands on the Permissions page with no way to the sitting.
+//
+// AND WHY IT CANNOT BE A SERVER TEST. A URL fragment is never sent to the
+// server, so `#board-room` cannot be caught by a route in serve-internal.js —
+// adding a regex there looks like the obvious fix and silently never fires. That
+// makes this browser function the ONLY thing standing between an old link and a
+// dead end, which is exactly the shape that deserves a pin.
+//
+// It is extracted and RUN, not grepped: the interesting behaviour is the
+// branch (which hashes trigger) and the query-preservation (encodeURIComponent
+// on a value that came off the URL), and a source match would pass on a
+// function that returns the wrong string.
+//
+// Pure file-read + vm (no DB/network) — runs in the DB-free unit gate.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const GOV_SRC = fs.readFileSync(path.join(HALL, 'government.js'), 'utf8');
+
+// Lift the function out of the page's IIFE and run it against a fake location.
+// `sliceFn` counts braces rather than matching a closing line, so a nested block
+// inside the body cannot end the slice early.
+function sliceFn(src, name) {
+  const start = src.indexOf(`function ${name}`);
+  assert.notEqual(start, -1, `${name} not found in government.js`);
+  const open = src.indexOf('{', start);
+  let depth = 0;
+  for (let i = open; i < src.length; i += 1) {
+    if (src[i] === '{') depth += 1;
+    else if (src[i] === '}') {
+      depth -= 1;
+      if (depth === 0) return src.slice(start, i + 1);
+    }
+  }
+  throw new Error(`${name} is unbalanced`);
+}
+
+// Returns { result, replaced } — `replaced` is the URL location.replace was
+// called with, or null if it was never called.
+function runRedirect({ hash, search = '' }) {
+  let replaced = null;
+  const sandbox = {
+    URLSearchParams,
+    window: {
+      location: {
+        hash,
+        search,
+        replace(url) { replaced = url; },
+      },
+    },
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(`${sliceFn(GOV_SRC, 'redirectLegacyBoardHash')}
+    globalThis.__out = redirectLegacyBoardHash();`, sandbox, { filename: 'government.js' });
+  return { result: sandbox.__out, replaced };
+}
+
+test('the old hash lands on the room, and says it navigated', () => {
+  const { result, replaced } = runRedirect({ hash: '#board-room' });
+  assert.equal(replaced, '/board-room');
+  assert.equal(result, true,
+    'init() returns early on true — a falsy answer would let the government page paint over the navigation');
+});
+
+test('?item=N is carried across — that is the whole point of the Discord link', () => {
+  const { replaced } = runRedirect({ hash: '#board-room', search: '?item=12' });
+  assert.equal(replaced, '/board-room?item=12');
+});
+
+test('the item is re-encoded, never pasted through raw', () => {
+  // The value arrives off a URL a stranger can author, and goes straight back
+  // into one. Board item ids are numeric, so this is defence rather than a live
+  // case — which is why it is pinned instead of assumed.
+  const { replaced } = runRedirect({ hash: '#board-room', search: '?item=1%202%263' });
+  assert.equal(replaced, '/board-room?item=1%202%263',
+    'a space and an ampersand survive as escapes rather than splitting the query');
+});
+
+test('an item that is absent or empty produces a bare URL, not a dangling ?item=', () => {
+  assert.equal(runRedirect({ hash: '#board-room', search: '?other=1' }).replaced, '/board-room');
+  assert.equal(runRedirect({ hash: '#board-room', search: '?item=' }).replaced, '/board-room',
+    'an empty value is falsy, so no query is appended');
+});
+
+test('every OTHER hash is left alone — the two surviving tabs still work', () => {
+  // The government page kept #constitution and #ranks. A redirect that fired on
+  // those would make the page unreachable, which is a worse failure than the one
+  // this function exists to prevent.
+  for (const hash of ['#constitution', '#ranks', '', '#board-room-extra', '#Board-Room']) {
+    const { result, replaced } = runRedirect({ hash, search: '?item=12' });
+    assert.equal(replaced, null, `${hash || '(no hash)'} must not navigate`);
+    assert.equal(result, false, `${hash || '(no hash)'} must let init() continue`);
+  }
+});
+
+test('init() consults it FIRST and returns on true', () => {
+  // The order is the behaviour: called after the /me fetch, the reader would see
+  // the government page paint and then jump. Asserted on the source because it is
+  // a statement about sequence, not a value.
+  const init = sliceFn(GOV_SRC, 'init');
+  const guard = init.indexOf('redirectLegacyBoardHash()');
+  assert.notEqual(guard, -1, 'init() must consult the redirect');
+  assert.match(init.slice(guard - 30, guard + 60), /if \(redirectLegacyBoardHash\(\)\) return;/,
+    'it must be an early return, not a fire-and-continue');
+  const meFetch = init.indexOf("fetchJson('/me')");
+  assert.ok(guard < meFetch, 'the redirect must run BEFORE the /me read and any paint');
+});
+
+test('the government page no longer declares a board-room tab to redirect INTO', () => {
+  // If #board-room came back as a tab id, this redirect would fight makeTabs for
+  // the same hash and the room would exist in two places.
+  const ids = [...GOV_SRC.matchAll(/\{ id: '([a-z-]+)', label: '[^']*', panel:/g)].map((m) => m[1]);
+  assert.ok(!ids.includes('board-room'), `board-room is a page, not a tab (found ${ids})`);
+});

package/tests/government_board_room_copy.mjs

@@ -26,20 +26,28 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+// TWO SOURCES SINCE ADR 0266. The Board Room was the `#board-room` tab of the
+// government page and is now its own page, so the sitting card, its copy and the
+// vote form live in board-room.js / board-room.html. `CLIENT` and `HTML` stay
+// pointed at the government page for the two assertions that are genuinely about
+// what STAYED there — the Constitution's own membership sentence, and the short
+// pass-rule name its change-history line reads.
 const CLIENT = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.js'), 'utf8');
 const HTML = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.html'), 'utf8');
+const BOARD = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.js'), 'utf8');
+const BOARD_HTML = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.html'), 'utf8');
 const { PASS_RULES } = require(path.join(ROOT, 'modules', 'government', 'config.js'));
 
-const card = () => CLIENT.slice(CLIENT.indexOf('function itemCard'), CLIENT.indexOf('async function loadBoard'));
+const card = () => BOARD.slice(BOARD.indexOf('function itemCard'), BOARD.indexOf('async function loadBoard'));
 
 // Deleted copy is asserted against the RENDERING source only. The comments in
-// government.js deliberately quote what was removed and why — that history is
+// board-room.js deliberately quote what was removed and why — that history is
 // the point of them, and a test that forbade it would push the record out of
 // the file it explains.
-const CODE = CLIENT.split(/\r?\n/).filter((l) => !/^\s*\/\//.test(l)).join('\n');
+const CODE = BOARD.split(/\r?\n/).filter((l) => !/^\s*\/\//.test(l)).join('\n');
 
 test('every pass rule the server can hold has a plain-language sentence', () => {
-  const block = CLIENT.slice(CLIENT.indexOf('const PASS_RULE_PLAIN'), CLIENT.indexOf('function decidedByHtml'));
+  const block = BOARD.slice(BOARD.indexOf('const PASS_RULE_PLAIN'), BOARD.indexOf('function decidedByHtml'));
   assert.ok(PASS_RULES.length >= 3, `sanity: found the real rule set (${PASS_RULES})`);
   for (const rule of PASS_RULES) {
     assert.ok(block.includes(`${rule}:`), `PASS_RULE_PLAIN must explain '${rule}' — a rule with no copy renders its enum key`);
@@ -52,14 +60,23 @@ test('every pass rule the server can hold has a plain-language sentence', () =>
 });
 
 test('the short name map covers the same rule set (the history line)', () => {
-  const block = CLIENT.slice(CLIENT.indexOf('const PASS_RULE_NAME'), CLIENT.indexOf('const PASS_RULE_PLAIN'));
+  // Its reader (historyRow, the amendment change-history) stayed on the
+  // government page when ADR 0266 carved the room out, so this map stayed with
+  // it. The slice therefore ends at a landmark that is still IN government.js —
+  // it used to end at `const PASS_RULE_PLAIN`, which has moved to board-room.js,
+  // and an indexOf that misses returns -1: `slice(start, -1)` would have handed
+  // this assertion most of the file and passed for the wrong reason.
+  const start = CLIENT.indexOf('const PASS_RULE_NAME');
+  const end = CLIENT.indexOf('function dialRow');
+  assert.ok(start !== -1 && end > start, 'PASS_RULE_NAME sits above dialRow in government.js');
+  const block = CLIENT.slice(start, end);
   for (const rule of PASS_RULES) {
     assert.ok(block.includes(`${rule}:`), `PASS_RULE_NAME must name '${rule}'`);
   }
 });
 
 test('a rank reaches the reader as a LABEL, never as the enum key', () => {
-  assert.match(CLIENT, /function rankNames\(keys\)[\s\S]*?window\.OTB\.rankLabel\(k\)/,
+  assert.match(BOARD, /function rankNames\(keys\)[\s\S]*?window\.OTB\.rankLabel\(k\)/,
     'the board card resolves rank keys through the branding pack');
   const membership = CLIENT.slice(CLIENT.indexOf('function membershipSentence'), CLIENT.indexOf('function passRuleSentence'));
   assert.match(membership, /window\.OTB\.rankLabel\(k\)/,
@@ -84,7 +101,7 @@ test('the card order is title → action → the idea → the apparatus', () =>
 });
 
 test('the idea renders OPEN — never behind a summary', () => {
-  const sections = CLIENT.slice(CLIENT.indexOf('function ideaSectionsHtml'), CLIENT.indexOf('function rankNames'));
+  const sections = BOARD.slice(BOARD.indexOf('function ideaSectionsHtml'), BOARD.indexOf('function rankNames'));
   assert.ok(!/<details/.test(sections),
     'the substance of the vote is not a disclosure — that was the reported bug');
   assert.match(sections, /gov-idea__body/, 'and it is set as prose, not as a config row');
@@ -99,12 +116,12 @@ test('the tally stays visible without a click (ADR 0175 §9)', () => {
 test('the self-explaining copy is DELETED, not reworded', () => {
   assert.ok(!/Casting arrives with the vote form/.test(CODE),
     'the sentence that explained the UI to itself — and the form it promised has shipped');
-  assert.ok(!/tally: \$\{yes\} yes/.test(CLIENT), 'the raw-config tally line is gone');
+  assert.ok(!/tally: \$\{yes\} yes/.test(BOARD), 'the raw-config tally line is gone');
   assert.ok(!/The idea, in full/.test(CODE), 'so is the summary that hid the idea');
 });
 
 test('the section a voter faults is shown by NAME, in the ballot and the picker', () => {
-  const ballot = CLIENT.slice(CLIENT.indexOf('function ballotHtml'), CLIENT.indexOf('// ---- the vote form'));
+  const ballot = BOARD.slice(BOARD.indexOf('function ballotHtml'), BOARD.indexOf('// ---- the vote form'));
   assert.match(ballot, /SECTION_LABELS\[v\.section_key\]/,
     '`why_matters` is a jsonb key; the objector picked a named section and the reader should see that name');
 });
@@ -112,18 +129,27 @@ test('the section a voter faults is shown by NAME, in the ballot and the picker'
 test('the objection still carries a reason AND one section (ADR 0175 §8)', () => {
   // The requirement simplifying may not weaken: it is why voting lives in the
   // hall instead of on a chat reaction.
-  const form = CLIENT.slice(CLIENT.indexOf('function voteFormHtml'), CLIENT.indexOf('async function castVoteFromRoom'));
+  const form = BOARD.slice(BOARD.indexOf('function voteFormHtml'), BOARD.indexOf('async function castVoteFromRoom'));
   assert.match(form, /data-vote-reason/, 'the reason box survives');
   assert.match(form, /gov-vote__sections/, 'so does the five-way section picker');
   assert.match(form, /Object\.keys\(SECTION_LABELS\)\.map/, 'with one radio per declared section');
 });
 
-test('the page frames its panels in one line each, not a paragraph', () => {
+test('each room frames itself in one line, not a paragraph', () => {
   // The two intros used to run ~60 and ~50 words before anything actionable.
-  for (const heading of ['Constitution', 'Board Room']) {
-    const i = HTML.indexOf(`<h2 class="gov-h">${heading}</h2>`);
-    assert.notEqual(i, -1, `${heading} panel heading missing`);
-    const note = /<p class="gov-grid-note">([\s\S]*?)<\/p>/.exec(HTML.slice(i));
+  //
+  // They now live on two pages (ADR 0266), and the Board Room's heading is its
+  // page's own <h1> rather than a panel <h2> — a second "Board Room" heading
+  // under the page head would be the copy-that-explains-the-UI-to-itself this
+  // file exists to keep out. So the landmark differs per room; the RULE does not.
+  const rooms = [
+    { heading: 'Constitution', src: HTML, at: '<h2 class="gov-h">Constitution</h2>' },
+    { heading: 'Board Room', src: BOARD_HTML, at: '<h1 class="page-head__h">Board Room</h1>' },
+  ];
+  for (const { heading, src, at } of rooms) {
+    const i = src.indexOf(at);
+    assert.notEqual(i, -1, `${heading} heading missing (${at})`);
+    const note = /<p class="gov-grid-note">([\s\S]*?)<\/p>/.exec(src.slice(i));
     assert.ok(note, `${heading} has no framing line`);
     const words = note[1].replace(/<[^>]+>/g, ' ').trim().split(/\s+/).length;
     assert.ok(words <= 30, `${heading}'s intro is ${words} words — a reader meets it before anything actionable`);

package/tests/government_board_vote_ui.mjs

@@ -16,7 +16,11 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const CLIENT = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.js'), 'utf8');
+// board-room.js since ADR 0266, not government.js: every assertion in this file
+// is about the sitting card, the ballot and the vote form, and all three moved
+// with the room onto its own page. The name stays `CLIENT` because that is what
+// each assertion below reads — this file has exactly one source.
+const CLIENT = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.js'), 'utf8');
 const { BASE_TEMPLATE } = require(path.join(ROOT, 'modules', 'ideas', 'templates.js'));
 const board = require(path.join(ROOT, 'modules', 'government', 'board.js'));
 

package/tests/hall_nav.mjs

@@ -177,7 +177,11 @@ test('sidebar groups read by audience, in order', () => {
   // 'government' (the Permissions tab, BV1.R113) is the group's one archon-gated item.
   // 'project-settings' joins the Government group at the metic floor (task 1003280,
   // goal 1000072) — it sits before 'government', which is the one archon-only item.
-  assert.deepEqual(nav[4].items.map((i) => i.id), ['watch', 'harbor', 'gate', 'sessions', 'project-settings', 'government']);
+  // 'board-room' leads the group since ADR 0266: it is the one page here you ACT
+  // on (a sitting waits on a decision; the rest is monitoring), the same ordering
+  // rule the Community group's first item follows. Before that carve it had no
+  // item at all — it was a tab behind the one labelled "Permissions".
+  assert.deepEqual(nav[4].items.map((i) => i.id), ['board-room', 'watch', 'harbor', 'gate', 'sessions', 'project-settings', 'government']);
 });
 
 test('Economy lives in Docs and points at the reward-schedule page', () => {

package/tests/hall_page_gate_map.mjs

@@ -38,6 +38,7 @@ const SRC = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'ut
 //   requireGovernmentPage       page.view.government  metic+   (ADR 0157)
 //   requireProjectCuratePage    project.curate        metic+
 //   requireGovernmentManagePage government.manage     archon
+//   requireBoardVotePage        board.vote.cast       xenos+   (ADR 0266)
 const ORACLE = {
   // Any signed-in builder — no rank floor.
   '/builders/work': 'requireBuilderPage',
@@ -93,6 +94,16 @@ const ORACLE = {
   // tab seals itself for non-archons.
   '/builders/government': 'requireGovernmentPage',
 
+  // ADR 0266: the Board Room, carved out of the tab strip above onto its own
+  // page. It is the ONE hall page whose gate is deliberately WIDER than the
+  // group it sits in — `board.vote.cast` floors at xenos, on purpose, so that a
+  // constitution widening its board below Metic gets members who can reach the
+  // room rather than members who can only vote by curl. The floor is the coarse
+  // gate; membership is checked in-handler per item against that item's own
+  // snapshotted constitution, so a holder who sits on no board sees the room and
+  // no ballot (ADR 0175 §9 made the ballot open on purpose).
+  '/builders/board-room': 'requireBoardVotePage',
+
   // Deliberately UNGATED — the landing card, the rank ladder, the reward
   // schedule and a builder's public portfolio all render for a stranger.
   //

package/tests/hall_palette.mjs

@@ -113,11 +113,17 @@ test('Tasks tab anchors exist in work.js makeTabs', () => {
   }
 });
 
-test('Government section anchors exist in government.js makeTabs (the R15 three-section IA)', () => {
+// TWO rooms since ADR 0266 (was three): the Board Room became its own page at
+// /board-room, so `#board-room` is no longer a tab id here and the palette must
+// not declare it as a sub-destination — it is read live from the sidebar like
+// every other page. The counts stay exact rather than becoming `>= 2`, because
+// the whole point of this test is that a tab and its jump cannot drift apart.
+test('Government section anchors exist in government.js makeTabs', () => {
   const ids = [...read('government.js').matchAll(/\{ id: '([a-z-]+)', label: '[^']*', panel:/g)].map((m) => m[1]);
-  assert.ok(ids.length === 3, `sanity: found the three government tabs (${ids})`);
+  assert.ok(ids.length === 2, `sanity: found the two government tabs (${ids})`);
+  assert.ok(!ids.includes('board-room'), 'the Board Room is a page, not a tab (ADR 0266)');
   const declared = declaredHrefs((x) => x.startsWith('/government#'));
-  assert.ok(declared.length === 3, 'palette declares the three Government sections');
+  assert.ok(declared.length === 2, 'palette declares the two Government sections');
   for (const h of declared) {
     assert.ok(ids.includes(h.split('#')[1]), `${h} must be a real government.js tab id`);
   }

package/tests/rank_tier_single_source.mjs

@@ -116,6 +116,14 @@ const STATIC_LADDER_FILES = [
   // which holds it against catalog.RANK_ORDER and holds the whole browser parser
   // equal to the server one.
   'modules/hall-ui/public/government.js',
+  // ADR 0266: the Board Room moved off the government page onto its own, and the
+  // sitting card's `decidedByHtml` expands the same `rank:<key>+` membership form
+  // to say who may vote on THAT sitting — so the carve took a copy of the ladder
+  // with it. Same reason as the row above (browser code cannot require the server
+  // module), and the same pinning: `tests/government_board_vote_ui.mjs` reads
+  // board-room.js and holds its predicate parser equal to the server's, and the
+  // pin below in this file holds the array itself against LIVE_RANK_LADDER.
+  'modules/hall-ui/public/board-room.js',
   // task 1002487: the pure agent-definition validator applies the ADR 0043
   // sub-Metic floor to an agent's declared scope, so it needs the ladder to
   // compare against. It is one of the "dependency-free" cases this array exists