@bongos/core 1.19.638 → 1.19.640

package/scripts/gds/gen-role-responsibilities.js

@@ -0,0 +1,134 @@
+// scripts/gds/gen-role-responsibilities.js
+//
+// WHAT. Writes each craft's written responsibility into its role pack under
+// docs/packs/, between markers, from the ONE source at src/role-responsibilities.js.
+//
+// WHY A GENERATOR AND NOT A PARAGRAPH SOMEONE TYPES. Criterion
+// wa6-written-responsibilities (goal 1000095) says there is one source "shown on
+// the profile, injected into the pack, referenced by grading". The profile and the
+// grader read the source at runtime, so they cannot drift. A markdown pack cannot
+// require a JS module, so its copy is the only one that CAN drift — and the drift
+// would be invisible and consequential: the pack is what a session is actually
+// instructed by, so a stale sentence there means the project teaches one standard,
+// shows a second on the profile, and grades against a third. This is the
+// gen-diagrams / gen-session-index pattern (ADR 0062 §8): generate the block, gate
+// its freshness in CI, never hand-edit it.
+//
+// USAGE
+//   node scripts/gds/gen-role-responsibilities.js            # write the blocks
+//   node scripts/gds/gen-role-responsibilities.js --check    # exit 2 if any block drifted (the CI gate)
+//
+// A pack with no markers is a WARNING, not a failure — a host instance may carry a
+// pack this core does not know about. A pack whose marker block is STALE is the
+// hard failure, because that is the drift the whole file exists to prevent.
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { ROLE_RESPONSIBILITIES, RESPONSIBILITIES_SOURCE } = require('../../src/role-responsibilities');
+const { resolveCoreRoot } = require('../../src/instance-config');
+
+// The packs are CORE content (they ship in the package alongside the registry that
+// names them), so resolve them against the core root the same way the role-pack
+// guard does — never the instance root.
+const CORE_ROOT = resolveCoreRoot();
+const REGISTRY_REL = 'scripts/gds/discipline-modes.json';
+
+const BEGIN = '<!-- BEGIN GENERATED ROLE RESPONSIBILITY (scripts/gds/gen-role-responsibilities.js — do not hand-edit) -->';
+const END = '<!-- END GENERATED ROLE RESPONSIBILITY -->';
+
+// The block a pack carries. Deliberately short: the pack teaches the craft, this
+// states the standard, and the provenance line is there so a reader knows the
+// sentence is the owner's and not the platform's opinion.
+function blockFor(discipline) {
+  const text = ROLE_RESPONSIBILITIES[discipline];
+  if (!text) return null;
+  const s = RESPONSIBILITIES_SOURCE;
+  return [
+    BEGIN,
+    '## What this craft is answerable for',
+    '',
+    `> ${text}`,
+    '',
+    `*The ${discipline}'s written responsibility — one source (\`src/role-responsibilities.js\`), shown on the hall profile, taught here, and referenced by the grader. Fixed by ${s.authoredBy} on ${s.authoredOn}, criterion \`${s.criterion}\`. Generated: do not hand-edit, and do not paraphrase it elsewhere.*`,
+    END,
+  ].join('\n');
+}
+
+// Replace the marked region, or report that the pack has no markers. Mirrors
+// gen-session-index.injectBlock: bounded by the two literal markers, so a pack may
+// put the block anywhere and move it later without touching this file.
+//
+// THE BLOCK TAKES THE FILE'S OWN LINE ENDING. These packs are `.md` and check out
+// CRLF on Windows while CI checks out LF. A generator that always wrote '\n' would
+// splice LF lines into a CRLF file, so the committed bytes and the bytes `--check`
+// recomputes would differ by platform — the check would be red on one checkout and
+// green on the other, for a file nobody touched. Detecting the file's ending makes
+// the generator idempotent on both.
+function inject(text, block) {
+  const i = text.indexOf(BEGIN);
+  const j = text.indexOf(END);
+  if (i === -1 || j === -1 || j < i) return null;
+  const eol = text.includes('\r\n') ? '\r\n' : '\n';
+  return text.slice(0, i) + block.replace(/\n/g, eol) + text.slice(j + END.length);
+}
+
+// Every discipline the role registry binds to a pack. Reading the registry rather
+// than hardcoding three filenames means a pack that is renamed, or a fourth craft
+// that is added later (Governor, when the owner decides), is picked up here with no
+// edit — the same single-declaration rule the registry already enforces for claim.js.
+function packTargets() {
+  const abs = path.join(CORE_ROOT, REGISTRY_REL);
+  const modes = (JSON.parse(fs.readFileSync(abs, 'utf8')) || {}).modes || {};
+  const out = [];
+  for (const [discipline, mode] of Object.entries(modes)) {
+    if (!mode || !mode.pack) continue;
+    out.push({ discipline, rel: mode.pack, abs: path.join(CORE_ROOT, mode.pack) });
+  }
+  return out;
+}
+
+function plan() {
+  const writes = [];
+  const warnings = [];
+  for (const t of packTargets()) {
+    const block = blockFor(t.discipline);
+    if (!block) {
+      // A pack whose craft has no statement is legitimate (a module-contributed
+      // craft that grew a pack). Say so; never write an empty quote into it.
+      warnings.push(`${t.rel}: no written responsibility for '${t.discipline}' — leaving the pack alone.`);
+      continue;
+    }
+    let cur;
+    try { cur = fs.readFileSync(t.abs, 'utf8'); } catch {
+      warnings.push(`${t.rel}: named by the role registry but not readable — the role-pack guard is the check that fails on this.`);
+      continue;
+    }
+    const next = inject(cur, block);
+    if (next === null) { warnings.push(`${t.rel}: no marker block — add the BEGIN/END pair to carry the statement.`); continue; }
+    if (next !== cur) writes.push({ abs: t.abs, rel: t.rel, content: next });
+  }
+  return { writes, warnings };
+}
+
+function main() {
+  const check = process.argv.includes('--check');
+  const { writes, warnings } = plan();
+  for (const w of warnings) console.error(`gen-role-responsibilities: WARN ${w}`);
+  if (check) {
+    if (writes.length) {
+      for (const w of writes) console.error(`gen-role-responsibilities: STALE ${w.rel}`);
+      console.error('Run `node scripts/gds/gen-role-responsibilities.js` and commit.');
+      process.exit(2);
+    }
+    console.log('gen-role-responsibilities --check: up to date.');
+    return;
+  }
+  for (const w of writes) fs.writeFileSync(w.abs, w.content);
+  console.log(writes.length ? `gen-role-responsibilities: wrote ${writes.length} pack(s): ${writes.map((w) => w.rel).join(', ')}` : 'gen-role-responsibilities: already up to date.');
+}
+
+if (require.main === module) main();
+
+module.exports = { BEGIN, END, blockFor, inject, packTargets, plan };

package/scripts/gds/role-pack-guard.js

@@ -101,6 +101,27 @@ function checkRolePacks(fsImpl = fs) {
     }
   }
 
+  // Each pack's WRITTEN-RESPONSIBILITY block must match src/role-responsibilities.js
+  // (task 1003732). It lives with the other pack assertions rather than in
+  // checkGeneratedArtifactsFresh so one check owns "the packs are correct" — and the
+  // drift matters for the same reason the missing-pack case does: the profile and
+  // the grader read the source at runtime and cannot drift, but the pack is markdown,
+  // so its copy is the only one that can — and it is the copy a SESSION is instructed
+  // by. A stale block means the project teaches one standard, shows a second on the
+  // profile, and grades against a third. Skipped when the fs is stubbed (the negative
+  // tests inject a registry that names packs this generator would not find).
+  if (fsImpl === fs) {
+    try {
+      const { plan } = require('./gen-role-responsibilities.js');
+      const { writes } = plan();
+      for (const w of writes) {
+        violations.push(`${w.rel}: the written-responsibility block is STALE against src/role-responsibilities.js — run \`node scripts/gds/gen-role-responsibilities.js\` and commit (task 1003732).`);
+      }
+    } catch (e) {
+      violations.push(`could not check the packs' written-responsibility blocks (${e && e.message}) — run \`node scripts/gds/gen-role-responsibilities.js --check\`.`);
+    }
+  }
+
   // The split's own shape, asserted so a later edit cannot quietly drop a craft
   // back into the kernel: three core packs, and Governor deliberately absent
   // (criterion wa6-kernel-and-packs — "three packs, not four, until the owner decides").

package/scripts/gds/sequence.js

@@ -164,13 +164,62 @@ function chainFrom(headId, byId, { limit = DEFAULT_LIMIT } = {}) {
   return picked;
 }
 
+// Does the task's OWN declared file surface rule a schema change out? (task 1003699)
+//
+// tasks.needs_migration is set server-side from a keyword scan of the title and
+// description (migration 081; detectsMigration in
+// modules/lifecycle/routes/task-route-helpers.js), so the flag means "this task
+// SAYS the word migration", not "this task changes the schema". Task 1003697
+// carried it while its description said, in capitals, not to change any
+// migration; the row for THIS task is flagged too, for the same reason. A false
+// halt is not free — it is a task the runner will never offer.
+//
+// So the flag alone no longer halts. It is overridden only by positive evidence
+// pointing the other way: a NON-EMPTY touches[] that names no path under
+// migrations/. That is the author stating the file surface and leaving
+// migrations/ out of it.
+//
+// The asymmetry is deliberate. An absent or empty touches[] tells us nothing, so
+// it keeps halting — and it must, because the rank floor cannot be leaned on
+// here: task 1003697 sat at requires_rank 'xenos' with the flag set, so ADR
+// 0270's needs_migration→floor coupling did not raise it and would not have
+// caught a real schema change either.
+//
+// Note this is NARROWER than what the task proposed. "touches[] hitting
+// migrations/, or a declared migration number" would have re-read the prose, and
+// 1003697's description contains a literal migrations/… path while its touches[]
+// contains none — so the number/path branch would have preserved the very false
+// halt the task was filed to remove, and failed its own acceptance criterion.
+// touches[] is the only signal here that is structural rather than vocabulary.
+// A `migrations` DIRECTORY anywhere in the path, not only at the repo root.
+// This codebase ships MODULE-OWNED schema migrations at
+// modules/<key>/migrations/NNN_*.sql (ADR 0083; docs/modules-contract.md §
+// "Module-owned migrations"), and ten such directories exist today — so an
+// anchored /^migrations\//  test would have called every one of them "not a
+// migration" and suppressed the halt on a real schema change.
+//
+// That mistake would have been worse than the bug this task fixes, because
+// nothing else catches it: permission-path-check's protected-surfaces registry
+// carries a `migrations/` glob that IS a second gate for root migrations, but it
+// is root-anchored too, so a module-owned migration has no other halt at all.
+//
+// Matching a whole path SEGMENT is what keeps docs/migrations-guide.md — a file
+// with the word in its name and no migrations directory — from counting.
+const MIGRATION_DIR_RE = /(?:^|\/)migrations\//i;
+
+function declaredSurfaceExcludesMigrations(task) {
+  const touches = Array.isArray(task.touches) ? task.touches : [];
+  if (!touches.length) return false;
+  return !touches.some((raw) => MIGRATION_DIR_RE.test(String(raw).trim().replace(/\\/g, '/')));
+}
+
 // The halt matrix. Facts only — every entry is something the runner can read
 // off the task row, never a judgement about the work itself.
 function haltReasons(task, { rank, claimableIds = null } = {}) {
   const reasons = [];
   if (!task) return [{ code: 'not_found', detail: 'no such task' }];
 
-  if (task.needs_migration) {
+  if (task.needs_migration && !declaredSurfaceExcludesMigrations(task)) {
     reasons.push({ code: 'needs_migration', detail: HALT_REASONS.needs_migration });
   }
   if (task.security_sensitive) {
@@ -286,9 +335,64 @@ async function fetchChain(api, headId, limit) {
   return byId;
 }
 
+// GOAL_PAGE is deliberately below the route's limit cap (1000): the cap is what
+// made the old single read look complete, and paging in smaller bites means the
+// "did I get everything?" question is answered by a short last page rather than
+// by trusting one number. GOAL_MAX_ROWS is a runaway guard, not a window — it is
+// far above any real goal, and hitting it throws rather than truncating.
+const GOAL_PAGE = 500;
+const GOAL_MAX_ROWS = 20000;
+
+// Every task row in one goal, paged until the server runs out (task 1003699).
+//
+// THE BUG THIS REPLACES. The old body asked for `?limit=1000` with NO goal
+// filter and matched goal_id in JS. Past a thousand rows in that ordering — this
+// instance crossed it long ago — a task in the goal simply fell outside the
+// window, and the planner printed "No open tasks in goal N". That is
+// indistinguishable from a finished chain, which is the dangerous part: the
+// runner concludes the goal is DONE and stops. Raising the limit only moves the
+// cliff, so the fix is to filter server-side (?goal_id=, ADR 0086 §3) and page.
+//
+// ANY unreadable page throws, for the same reason the bug was invisible: "I
+// could not look" and "there is nothing left" must never render as the same
+// sentence — and a dropped middle page would say the second while meaning the
+// first.
+async function fetchGoalTaskRows(api, goalId) {
+  const rows = [];
+  for (let offset = 0; ; offset += GOAL_PAGE) {
+    const query = { goal_id: Number(goalId), limit: GOAL_PAGE };
+    // The route rejects offset=0 as "must be a positive integer", so page one
+    // sends no offset at all.
+    if (offset) query.offset = offset;
+    const r = await api.tasks.getTasks({ query });
+    if (!r.ok) {
+      // ANY failed page throws, not just the first. Returning the rows read so
+      // far would hand back a short list that looks like a complete goal — the
+      // same "silent incompleteness reads as done" mistake this task exists to
+      // remove, just relocated from a fixed window to a transient failure. A
+      // caller that wants partial data can ask again; one that is told nothing
+      // cannot know to.
+      throw new Error(
+        `could not read the tasks in goal ${goalId} at offset ${offset} `
+        + `(HTTP ${r.status || '?'}) — refusing to report a partial goal as a complete one`,
+      );
+    }
+    const page = rowsOf(r.data) || [];
+    rows.push(...page);
+    if (page.length < GOAL_PAGE) break;
+    if (rows.length >= GOAL_MAX_ROWS) {
+      throw new Error(`goal ${goalId} returned ${rows.length}+ rows — refusing to page further`);
+    }
+  }
+  return rows;
+}
+
 async function fetchGoalTasks(api, goalId, limit) {
-  const r = await api.tasks.getTasks({ query: { limit: 1000 } });
-  const rows = (r.ok ? rowsOf(r.data) : null) || [];
+  const rows = await fetchGoalTaskRows(api, goalId);
+  // The goal_id match stays even though the server filtered: a core pinned older
+  // than ADR 0086 §3 ignores an unknown query param instead of rejecting it, so
+  // without this line an un-upgraded instance would silently hand back the whole
+  // table and the planner would plan someone else's goal.
   const mine = rows
     .filter((t) => Number(t.goal_id) === Number(goalId) && !TERMINAL.has(t.status))
     .slice(0, limit);
@@ -472,6 +576,10 @@ module.exports = {
   readArgv,
   edgeIds,
   rowsOf,
+  fetchGoalTasks,
+  fetchGoalTaskRows,
+  declaredSurfaceExcludesMigrations,
+  GOAL_PAGE,
   topoOrder,
   chainFrom,
   haltReasons,

package/src/module-api.js

@@ -41,6 +41,22 @@ const instanceConfig = require('./instance-config');
 const staleTimer = require('./stale-timer');
 const seams = require('./module-seams');
 const { buildInfo } = require('./build-info');
+// Eager and DESTRUCTURED on purpose, and inside the rule above rather than an
+// exception to it: role-responsibilities.js requires NOTHING (80 lines of the
+// owner's text plus three pure lookups), so it costs one file read and drags no
+// server file into a CLI subcommand's require-closure — the same footing as
+// `branding` and `instanceConfig` here.
+//
+// It has to be a NAMED require rather than `require(...).x` read inside a getter,
+// or CI's dead-code ratchet counts these exports as dead and no PR touching them
+// can merge — task 1003732 stranded on exactly that. `responsibilityFor`'s only
+// consumer is modules/grading/grader-prompt.js reaching through this doorway, and
+// modules/ sits outside knip's `project` globs by design, so the import HERE is
+// the only place that use can be seen. knip credits a destructured binding and
+// not a member access on a namespace object, which is why the sibling exports
+// (`responsibilitiesFor` via src/modules.js, `ROLE_RESPONSIBILITIES` via
+// scripts/gds/gen-role-responsibilities.js) were never flagged and this one was.
+const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibilities');
 
 // ---------------------------------------------------------------------------
 // CORE_VERSION — the version of THIS published surface (semver).
@@ -55,7 +71,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.638'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.640'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -405,6 +421,19 @@ module.exports = {
   get pageMeta() { return require('./bongos/routes/_helpers').pageMeta; },
   get PAGINATION() { return require('./bongos/routes/_helpers').PAGINATION; },
 
+  // --- the written role responsibilities (task 1003732, criterion
+  //     wa6-written-responsibilities). ONE source for the sentence each craft is
+  //     answerable for; it reaches modules through the doorway because more than
+  //     one module needs the same text — grading references it when judging
+  //     role-shaped work, and the hall shows it to the person being judged — and
+  //     modules never import each other. `responsibilityFor(discipline)` returns
+  //     null for a craft with no statement (a module-contributed one, or an
+  //     unclassified task); that is a legitimate answer, not an error.
+  //     Plain entries rather than getters: the module is loaded eagerly at the
+  //     top of this file (it costs nothing), so there is nothing left to defer.
+  responsibilityFor,
+  ROLE_RESPONSIBILITIES,
+
   // --- logging
   logger,
 };

package/src/modules.js

@@ -28,6 +28,7 @@ const path = require('node:path');
 // until a module is moved into modules/ — so this is a no-op on the current tree.
 const loader = require('./module-loader/loader');
 const { resolveCoreRoot, resolveInstanceRoot } = require('./instance-config');
+const { responsibilitiesFor } = require('./role-responsibilities');
 
 // ADR 0108 §1: the neutral starter ships WITH the core package; the instance
 // pack is host content. Both resolvers return the repo root today, so this is
@@ -250,10 +251,20 @@ function enabledDisciplines(set = modules()) {
 
 // CLIENT-SAFE projection — module flags are just booleans, all safe to expose.
 // The hall/status front-ends read this to hide UI sections for off modules.
+//
+// `responsibilities` rides here (task 1003732) because this projection is already
+// injected into every served page as a global (serve-internal.injectBrandingGlobal),
+// and it already carries the discipline roster the statements are keyed by — so the
+// profile gets the owner's text with no new route, no fetch, and no second copy to
+// drift. Scoped to the disciplines this instance actually offers: a craft the
+// instance does not have must not appear in its UI, and a module-contributed craft
+// has no statement by design (src/role-responsibilities.js says why).
 function clientModules(set = modules()) {
+  const disciplines = enabledDisciplines(set);
   return {
     enabled: knownModules().reduce((o, k) => { o[k] = set[k] === true; return o; }, {}),
-    disciplines: enabledDisciplines(set),
+    disciplines,
+    responsibilities: responsibilitiesFor(disciplines),
   };
 }
 

package/src/role-responsibilities.js

@@ -0,0 +1,80 @@
+// src/role-responsibilities.js
+//
+// WHAT. The one source of each craft's written responsibility — the sentence that
+// says what a person holding that role is actually answerable for. Three consumers
+// read this file and nothing else: the hall profile shows it to the person, the
+// role pack under docs/packs/ teaches a session from it, and the grader references
+// it when it judges role-shaped work.
+//
+// WHY IT IS ONE FILE. Criterion wa6-written-responsibilities (goal 1000095) is
+// explicit that there is ONE source — "shown on the profile, injected into the
+// pack, referenced by grading" — and the reason is not tidiness. The promise made
+// to a builder on their profile and the text their session is actually held to
+// must be the same text; two copies that drift mean the project judged someone
+// against a standard it never showed them. The pack half is enforced rather than
+// promised: the packs carry a GENERATED block written by
+// scripts/gds/gen-role-responsibilities.js, and fitness.js fails CI when it drifts
+// from this file (the gen-diagrams / gen-session-index pattern, ADR 0062 §8).
+//
+// THE TEXT IS THE OWNER'S, VERBATIM. Fixed by the area owner on 2026-09-08 and
+// recorded in the criterion. Do not paraphrase, tighten, or "improve" these
+// sentences — a role's responsibility is the owner's to write, and the whole point
+// of a single source is that it says what they said. Per-project sub-specialities
+// (idea 1000733) build on this later and are deliberately not modelled here.
+//
+// KERNEL FILE. On the fitness.js KERNEL_FILES roster: three different modules read
+// it (hall-ui, grading) plus the core's own client projection, and modules never
+// import each other, so shared vocabulary has to sit in the kernel. It imports
+// nothing, which is what makes that placement free.
+'use strict';
+
+// discipline key (tasks.discipline / builders.preferred_disciplines) → the owner's
+// sentence. Keys mirror CORE_DISCIPLINES order (engineer | artist | ideator), the
+// migration 176 enum order. A module-contributed discipline (ui-design → 'ui') has
+// no statement here on purpose: a craft a module brings is that module's to
+// describe, and inventing one for it would be exactly the paraphrase this file
+// forbids. Consumers must therefore treat "no statement" as normal, not as an error.
+const ROLE_RESPONSIBILITIES = Object.freeze({
+  engineer: 'Running and optimizing the running of Claude nonstop, and ensuring Ideators and Artists can continue to interface with that system effectively.',
+  artist: 'No slop in the appearance and text of the project; the story, emotion and ideology of the project are communicated effectively; project purpose and gravitas are upheld.',
+  ideator: 'Make good ideas; be a philosopher / thought leader for the project; enable Engineers to scope and Artists to create with maximum efficiency — a baseline for creating scopes of work.',
+});
+
+// Provenance, carried with the text so every rendering can say where it came from
+// rather than looking like a platform opinion someone typed.
+const RESPONSIBILITIES_SOURCE = Object.freeze({
+  criterion: 'wa6-written-responsibilities',
+  goalId: '1000095',
+  authoredOn: '2026-09-08',
+  authoredBy: 'the area owner',
+});
+
+// The statement for one discipline, or null when the craft has none (a
+// module-contributed discipline, an unclassified task, a stray value from an older
+// row). Null is a legitimate answer every consumer must render as absence — never
+// as a blank quote or a placeholder sentence.
+function responsibilityFor(discipline) {
+  if (typeof discipline !== 'string') return null;
+  return ROLE_RESPONSIBILITIES[discipline.toLowerCase()] || null;
+}
+
+// The subset of statements an instance actually offers, so a client projection
+// never ships a craft the instance does not have. Takes the discipline roster the
+// caller already resolved (modules.enabledDisciplines()) rather than reaching for
+// the module registry itself — that would make this file import domain and cost it
+// its place on the kernel roster.
+function responsibilitiesFor(disciplines) {
+  const out = {};
+  for (const d of Array.isArray(disciplines) ? disciplines : []) {
+    const text = responsibilityFor(d);
+    if (text) out[d] = text;
+  }
+  return out;
+}
+
+module.exports = {
+  ROLE_RESPONSIBILITIES,
+  RESPONSIBILITIES_SOURCE,
+  responsibilityFor,
+  responsibilitiesFor,
+};

package/tests/discord_board_broadcast.mjs

@@ -50,7 +50,8 @@ test('linked members are @mentioned on the allowlist; unlinked members are named
   assert.ok(posted.text.includes('<@111222333>'));
   assert.ok(posted.text.includes('unlinked-two'), 'the unlinked member is still named');
   assert.ok(posted.text.includes('within 90 minutes'), 'the mention IS the vote-within-X notice');
-  assert.ok(posted.text.includes('/government?item=11#board-room'), 'deep-links THAT item — the panel scrolls to it');
+  assert.ok(posted.text.includes('/board-room?item=11'), 'deep-links THAT item — the page scrolls to it');
+  assert.ok(!posted.text.includes('#board-room'), 'never emits the retired hash form (ADR 0266)');
 });
 
 test('a clockless sitting says so, and an amendment names its subject honestly', async () => {
@@ -221,7 +222,8 @@ test('the close is EDITED onto the same message, and the edit is stamped', async
   assert.equal(edited.messageId, '555000111');
   assert.ok(edited.text.includes('RATIFIED'), 'the summons now reads as the outcome');
   assert.ok(!edited.text.includes('your vote is wanted'), 'nothing stale survives the edit');
-  assert.ok(edited.text.includes('/government?item=11#board-room'), 'the record is still one click away');
+  assert.ok(edited.text.includes('/board-room?item=11'), 'the record is still one click away');
+  assert.ok(!edited.text.includes('#board-room'), 'never emits the retired hash form (ADR 0266)');
   assert.equal(stamped, '11', 'edited_at answers "is this window still shown as open?" without asking Discord');
 });
 

package/tests/government_board_hash_redirect.mjs

@@ -127,3 +127,63 @@ test('the government page no longer declares a board-room tab to redirect INTO',
   const ids = [...GOV_SRC.matchAll(/\{ id: '([a-z-]+)', label: '[^']*', panel:/g)].map((m) => m[1]);
   assert.ok(!ids.includes('board-room'), `board-room is a page, not a tab (found ${ids})`);
 });
+
+// ── the redirect is the ONLY thing that knows the old shape (task 1003736) ────
+//
+// The carve moved the room; task 1003736 moved the WRITERS. Its done-when clause
+// is a statement about the whole tree — "nothing outside the government.js
+// compatibility redirect emits the hash form" — and a claim of that shape rots
+// the moment someone adds a fourth writer by copying an older one. Grepping once
+// at review time proves it for that afternoon only, so it is pinned here instead.
+//
+// TWO TRAPS THIS ENCODES, both of which make the naive sweep wrong:
+//   1. `#board-room` is ALSO the name of a Discord CHANNEL (channels.json, BV1
+//      R20). modules/government/CLAUDE.md and the BV1 spec name that channel, not
+//      a URL — repointing them would be a straightforward mistake, so the sweep
+//      hunts the URL form specifically and the quoted literal separately.
+//   2. ADRs and session logs RECORD the old form on purpose; they are history and
+//      may not be rewritten to match today's code.
+const SWEEP_DIRS = ['modules', 'src', 'scripts', 'docs/recipes', 'docs/packs', '.claude/skills'];
+const SWEEP_EXTS = new Set(['.js', '.mjs', '.cjs', '.html', '.css', '.json', '.md']);
+
+function sweepFiles() {
+  const out = [];
+  const walk = (rel) => {
+    const abs = path.join(ROOT, rel);
+    if (!fs.existsSync(abs)) return;
+    for (const e of fs.readdirSync(abs, { withFileTypes: true })) {
+      if (e.name === 'node_modules' || e.name.startsWith('.git')) continue;
+      const childRel = `${rel}/${e.name}`;
+      if (e.isDirectory()) walk(childRel);
+      else if (SWEEP_EXTS.has(path.extname(e.name))) out.push(childRel);
+    }
+  };
+  for (const d of SWEEP_DIRS) walk(d);
+  return out;
+}
+
+test('no writer anywhere in the tree still emits the retired hash URL', () => {
+  // The emitted form, not the bare fragment: `/government…#board-room`. This is
+  // what a link WRITER produces, and it is the thing task 1003736 repointed in
+  // builder-needs.js (hall banner + CLI nudge) and board-broadcast.js (Discord).
+  const offenders = sweepFiles().filter((rel) =>
+    /\/government[^\s'"`)\]]*#board-room/.test(fs.readFileSync(path.join(ROOT, rel), 'utf8')));
+  assert.deepEqual(offenders, [],
+    `these still emit the retired deep link — point them at /board-room?item=<id>:\n  ${offenders.join('\n  ')}`);
+});
+
+test('the hash literal survives only in the redirect that consumes it', () => {
+  // The QUOTED literal is the runtime value — the thing a branch compares
+  // against. Comments discussing the retired tab are documentation and are left
+  // alone (they use backticks, not quotes), which is why this looks for quotes.
+  const allowed = 'modules/hall-ui/public/government.js';
+  const offenders = sweepFiles().filter((rel) => rel !== allowed
+    && /['"]#board-room['"]/.test(fs.readFileSync(path.join(ROOT, rel), 'utf8')));
+  assert.deepEqual(offenders, [],
+    `only ${allowed}'s redirect may still know the old shape, found in:\n  ${offenders.join('\n  ')}`);
+
+  // And the allowlisted file must actually still contain it — an allowlist that
+  // guards a string nobody has any more is a rule quietly protecting nothing.
+  assert.match(GOV_SRC, /['"]#board-room['"]/,
+    'the compatibility redirect itself is gone — old Discord links now dead-end');
+});

package/tests/government_board_summons.mjs

@@ -199,14 +199,18 @@ test('pending votes are action_needed and deep-link the oldest sitting', () => {
   const n = needs.boardVotesNeed({ pendingBoardVotes: { count: 9, first_item_id: '1' } });
   assert.equal(n.id, 'board_votes');
   assert.equal(n.state, 'action_needed');
-  assert.equal(n.action.href, '/government?item=1#board-room');
-  // The hash is the TAB (makeTabs owns it); the item is a query param.
-  assert.match(n.action.href, /#board-room$/);
+  assert.equal(n.action.href, '/board-room?item=1');
+  // The item is a query param, because `/board-room` reads `?item=` and a
+  // FRAGMENT would never reach the server (ADR 0266). The old
+  // `/government…#board-room` form survives only as government.js's
+  // compatibility redirect — no writer may emit it.
+  assert.ok(!n.action.href.includes('#board-room'), 'never emits the retired hash form');
 });
 
 test('a count with no item id still links the room', () => {
   const n = needs.boardVotesNeed({ pendingBoardVotes: { count: 2 } });
-  assert.equal(n.action.href, '/government#board-room');
+  assert.equal(n.action.href, '/board-room');
+  assert.ok(!n.action.href.includes('#board-room'), 'never emits the retired hash form');
 });
 
 test('the need reaches computeNeeds as an action_needed item', () => {

package/tests/module_api.mjs

@@ -46,6 +46,7 @@ const PUBLISHED_SURFACE = [
   'contribute', 'contributions', 'collectContributions', 'listContributionPoints',
   'buildInfo', 'validateOrRespond', 'LIMITS', 'parseId', 'asyncHandler', 'corsPublicGet', // parseId added 1.8.0 (BV1.R78); asyncHandler + corsPublicGet added 1.12.0 (BV1.R86; lifecycle routes)
   'parsePagination', 'pageMeta', 'PAGINATION', // R14 (#2001, 1.17.0): shared pagination contract for module list routes (ADR 0119)
+  'responsibilityFor', 'ROLE_RESPONSIBILITIES', // added by task 1003732 (ADR 0275; criterion wa6-written-responsibilities): the ONE source for the sentence each craft is answerable for. It rides the doorway because two modules need the same text — grading judges role-shaped work against it, the hall shows it to the person being judged — and modules never import each other. Declared here deliberately: this list is what makes adding to the doorway a decision rather than a side effect
   'logger',
 ];