@bongos/core 1.19.652 → 1.19.654

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.652",
-  "core_contract": "1.19.652",
-  "source_commit": "addabb3fbae5b20acb74b0d7ee3cf369d6a4e8f5",
+  "core_version": "1.19.654",
+  "core_contract": "1.19.654",
+  "source_commit": "29859bbb518d99362867ba988703fdbf1d4f9472",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T21:00:32.591Z",
+  "built_at": "2026-09-10T23:57:14.296Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 472,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2606,
-  "tree_sha256": "0625f6b55212a6ec7203db50d856c576c15b3eda23ea574a46fb212641dc163c",
+  "tree_sha256": "c678060ed77c22de9946d24d4668466c564defa104b075a8076c1a5964fe937a",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2782,7 +2782,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7b9836503b654f29b308db8418484f1f707bfe6edcd32aaae6aa1c1a17216b5b"
+      "sha256": "d45c6981ad6bd64f4b0fc09e9d28fe87231b8d65da676620246f8eccc803f091"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5567,7 +5567,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "b3df5f0d4273f44af60a7e09a8bef026a0f02085c7823c7912c70d067e55e127"
+      "sha256": "0f5997e58ca3f8ee33e84948136697519f095670387f0ae26cadb325f2389268"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -7742,12 +7742,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9fcb8bfb10f688b6442649f49bd4cc91454e56a44169414ca8839caab3fc05c7"
+      "sha256": "9370d237943d31161eb264dcd700e1fe6caea5f32a234e05cf17f94cdba7db5e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ed0d91d1a9a16e1f8e97ce2b538de568c297bc281cf15ea99f22f9bb92f1b5f0"
+      "sha256": "bc4361fd3c305fcb47bc8769dbad015475a2f7ef4e1e6795c7027953e5b259ec"
     },
     {
       "path": "public-docs/index.html",
@@ -8187,7 +8187,7 @@
     {
       "path": "scripts/gds/fitness-checks-vocabulary.js",
       "mode": "0000644",
-      "sha256": "5ea954ec0bf26e5192a369d0f94dcb3b8bf2e263c9e927c66a01791962a46995"
+      "sha256": "f64905f88718e5617ee97584dada757367497eed350bfb41814d257c9d2ec680"
     },
     {
       "path": "scripts/gds/fitness-checks-write-validation.js",
@@ -8207,7 +8207,7 @@
     {
       "path": "scripts/gds/fitness.js",
       "mode": "0000644",
-      "sha256": "3593c992b397333ee85f11dc2ea6325c3c96a2d1e5b813204da32c34c493b236"
+      "sha256": "b30c5c2b3bf6465a63a7124327ad40f94987088d1d87fcc110fec9281539a0a1"
     },
     {
       "path": "scripts/gds/gate-review.js",
@@ -8412,7 +8412,7 @@
     {
       "path": "scripts/gds/main-audit.js",
       "mode": "0000644",
-      "sha256": "35047f05c6059aee0cb64b13ef1495e4db1f3885b5b9c8cac5c60283069a059d"
+      "sha256": "4b27716f74bd13b0500c14b2607ea9f9e2584c4a27280bd075418772ac4dc644"
     },
     {
       "path": "scripts/gds/me.js",
@@ -9012,7 +9012,7 @@
     {
       "path": "scripts/gds/spark.js",
       "mode": "0000755",
-      "sha256": "dfd5aa72caa26eb2c8cf3063e1b4f51e1f4bcd7fddcdd93d243279c130850628"
+      "sha256": "3cc086defcaf14df25db27646596f2332ac79dff97c95e72d4cff329d8db9189"
     },
     {
       "path": "scripts/gds/spike-task-map.js",
@@ -9502,7 +9502,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d0459d72e42fdd8e712146f10545b27b6f82a310afa7bd0acb1b9290e1ef17b3"
+      "sha256": "175d5a93b971e2da73a24186a0e9ed7288da65aed61aa9f86d5a0c85f30bf53f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10107,7 +10107,7 @@
     {
       "path": "tests/cli_exit_no_abort.mjs",
       "mode": "0000644",
-      "sha256": "7bc4d54d29458c70cd545aecac1ca1f7b8cc13d7b1dacaa90a8c2184ef553304"
+      "sha256": "7b489890ab6e2baa6aefe784b81852eaaac39cdc50af5974de7eee815baee510"
     },
     {
       "path": "tests/cli_lib_formatters.mjs",
@@ -10957,7 +10957,7 @@
     {
       "path": "tests/government_vocabulary.mjs",
       "mode": "0000644",
-      "sha256": "71bd23242e53b1acd15fddedcb093790a847471c8c55485614d379d29e3065f3"
+      "sha256": "444f0638dccebc42e5a371820ed565c665d4373c198e1581389ab222bf267c5e"
     },
     {
       "path": "tests/grade_aggregates_unavailable.mjs",
@@ -11227,7 +11227,7 @@
     {
       "path": "tests/idea_develop_spark.mjs",
       "mode": "0000644",
-      "sha256": "a498e2dfc87dbb5050d414ff04ebf4178900edb771be384fe91247e452a37a02"
+      "sha256": "fe55e01a0be2aa6ca0bc536469eefcee7d44f40dfa0767fedf1709aed3f7d81e"
     },
     {
       "path": "tests/idea_full_capture.mjs",
@@ -11267,7 +11267,7 @@
     {
       "path": "tests/idea_resubmit.mjs",
       "mode": "0000644",
-      "sha256": "51e1286235cbde1b56188f29b0e2bd12ac73a9637dbf1c16b325f10147256f27"
+      "sha256": "56ef1d4405ec63a9c095000411774f533b3e34cdb89184bd4351e58313dc2975"
     },
     {
       "path": "tests/idea_route_attribution.mjs",

package/docs/module-api-changelog.md

@@ -1753,5 +1753,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.650 with no explicit bump. run 34526936330. (task 1002620)
   1.19.652 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.651 with no explicit bump. run 34529655648. (task 1002620)
+  1.19.653 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.652 with no explicit bump. run 34543713846. (task 1002620)
+  1.19.654 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.653 with no explicit bump. run 34544345437. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ideas/routes/inbox.js

@@ -63,6 +63,25 @@ function registerSeams() {
   }
 }
 
+// The author-facing shape of a ratification window this request just opened —
+// spelled once because all three open sites (capture, develop, resubmit) return
+// the same thing to the same readers (task 1003654).
+//
+// `closes_at` is legitimately NULL: it is the no-clock constitution, not a
+// missing value (modules/government/db.js — a NULL deadline never expires).
+// That is exactly why `pass_rule` travels WITH it. A caller holding only the
+// timestamp cannot tell a clockless sitting from a broken one, so it prints the
+// raw null — which is what the R157 proof walk caught spark.js doing ("open
+// until null"). With the rule in hand a renderer can say HOW the sitting closes
+// instead, the way the Board Room's own clockLine() already does.
+function boardWindowPayload(item) {
+  return {
+    item_id: item.id,
+    closes_at: item.closes_at ?? null,
+    pass_rule: (item.constitution && item.constitution.pass_rule) || null,
+  };
+}
+
 module.exports = function buildInboxRouter() {
   registerSeams();
   const router = express.Router();
@@ -227,7 +246,7 @@ module.exports = function buildInboxRouter() {
                 completenessScore: row.completeness_score,
               });
               if (w && w.opened && w.item) {
-                idea.board_window = { item_id: w.item.id, closes_at: w.item.closes_at };
+                idea.board_window = boardWindowPayload(w.item);
               } else if (w && w.reason === 'below_bar') {
                 // R09 (goal 1000069, criterion C2): a sub-bar idea returns to
                 // its author WITH A REASON THEY CAN ACT ON — the weakest section
@@ -673,7 +692,7 @@ module.exports = function buildInboxRouter() {
       try {
         if (government && government.openBoardWindowForIdea) {
           const w = await government.openBoardWindowForIdea({ ideaId: id, completenessScore: row.completeness_score });
-          if (w && w.opened && w.item) board_window = { item_id: w.item.id, closes_at: w.item.closes_at };
+          if (w && w.opened && w.item) board_window = boardWindowPayload(w.item);
           else if (w && w.reason === 'below_bar') {
             const flag = weakestSectionPayload(req.body.field_values, templateKey ? { templateKey } : undefined);
             if (flag) out.rejection = flag; // still short — the NEW weakest section, fresh feedback
@@ -957,7 +976,7 @@ module.exports = function buildInboxRouter() {
       const government = api.resolveOptional && api.resolveOptional('government');
       if (government && government.openBoardWindowForIdea) {
         const w = await government.openBoardWindowForIdea({ ideaId: id, completenessScore: row.completeness_score });
-        if (w && w.opened && w.item) board_window = { item_id: w.item.id, closes_at: w.item.closes_at };
+        if (w && w.opened && w.item) board_window = boardWindowPayload(w.item);
         else if (w && w.reason === 'below_bar') {
           // The same honest feedback the resubmit path gives: which section is
           // thinnest, computed from what was just written. Derived, never stored.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.652",
+  "version": "1.19.654",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.652",
+      "version": "1.19.654",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.652",
+  "version": "1.19.654",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/fitness-checks-vocabulary.js

@@ -48,11 +48,36 @@ const VOCAB_ALLOW = [
   },
 ];
 
-// A line CITING a historical artifact by its real name: an ADR filename, the
-// docs/governance/ evidence folder, or one of the already-applied
-// governance_NNN migrations. These names are permanent (see the header), so a
-// reference to one is a citation, not drift.
-const VOCAB_HISTORICAL_REF = /docs\/adr\/|docs\/governance\/|docs\/session-logs\/|governance_0\d\d/;
+// A line CITING a durable artifact by its real name: an ADR filename, the
+// docs/governance/ evidence folder, one of the already-applied migrations, or
+// the cross-goal pass-event contract. These names are permanent (see the
+// header), so a reference to one is a citation, not drift.
+//
+// The migration family is `govern(ance|ment)_NNN` on purpose. government_001
+// RENAMED the governance_NNN family to government_NNN, so half the applied
+// migrations on disk carry each spelling and BOTH are permanent — and the
+// rename migration's own filename (`government_001_rename_from_governance.sql`)
+// says the banned word while matching neither half of the old regex. That is
+// not drift; it is the one filename that has to name what it renamed.
+//
+// docs/specs/board-room-pass-event-contract.md is here for the same reason a
+// migration filename is: it is the agreed cross-goal name of the economy-side
+// award (awardIdeaGovernancePassCredit) and the credit_log reason family
+// idea.credit.governance_pass:<id>. Those are durable ledger rows and another
+// goal's method signature — a line pointing at the contract is citing a name
+// this surface does not own and cannot rename.
+const VOCAB_HISTORICAL_REF = /docs\/adr\/|docs\/governance\/|docs\/session-logs\/|govern(?:ance|ment)_0\d\d|board-room-pass-event-contract/;
+
+// Naming the RULE stays legal — a line that cites ADR 0174 or the task that
+// built the wall is meta-commentary about the ban, and meta-commentary has to
+// be able to say the banned word. Same principle as check 19b's
+// GOAL_VOCAB_CITATION, and deliberately preferred over a per-file VOCAB_ALLOW
+// entry: the exemption belongs to the CITATION, not to whichever file happens
+// to hold it today. (Adding '.md' to VOCAB_EXTS brought the module's own
+// nested CLAUDE.md into scope — the file that TEACHES this rule, which states
+// it in the same breath. Three allowlist entries would have taken the cap of 5
+// to its limit for lines whose only sin is quoting the rule correctly.)
+const VOCAB_CITATION = /ADR 0174|task 1003008/;
 
 const VOCAB_SURFACE = [
   'modules/government',
@@ -67,7 +92,13 @@ const VOCAB_SURFACE = [
   'modules/hall-ui/public/board-room.html',
   'modules/hall-ui/public/board-room.css',
 ];
-const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css']);
+// '.md' is load-bearing, not tidiness (task 1003120). A nested CLAUDE.md is
+// INSTRUCTION: it loads on demand for every agent working in the module, and
+// the agent that reads the wrong vocabulary there goes on to write it into the
+// code. Leaving markdown unscanned is how modules/government/CLAUDE.md came to
+// assert the INVERSE of ADR 0174 and survive a criterion review (task 1003118).
+// The doc surface is the higher-leverage one to guard, and it was the unguarded one.
+const VOCAB_EXTS = new Set(['.js', '.json', '.html', '.css', '.md']);
 const VOCAB_BANNED = [
   { re: /\brole/i,       label: 'role',       hint: '"role" is reserved for the crafts (Artist / Ideator / Builder). On this surface the noun is RANK.' },
   { re: /governance/i,    label: 'governance', hint: 'the pre-ADR-0174 name of this surface. It is the GOVERNMENT now.' },
@@ -202,6 +233,9 @@ function checkVocabularyWall() {
         // too, or the code could not point at the migration that created its own
         // tables. Same principle, applied to the line rather than the file.
         if (VOCAB_HISTORICAL_REF.test(scanLine)) continue;
+        // A line that CITES the rule is meta-commentary about the ban, not an
+        // instance of it. Costs no allowlist entry and travels with the sentence.
+        if (VOCAB_CITATION.test(scanLine)) continue;
         const excused = VOCAB_ALLOW.some((a) => a.file === rel && scanLine.toLowerCase().includes(a.match));
         if (excused) continue;
         violations.push(`${rel}:${i + 1}: "${b.label}" — ${b.hint}  →  ${line.trim().slice(0, 90)}`);
@@ -214,8 +248,52 @@ function checkVocabularyWall() {
     hardFail: violations.length > 0,
     violations,
     warnings: [],
-    note: `${scanned} government-surface file(s) scanned for "role"/"governance"; `
-        + `${VOCAB_ALLOW.length} documented allowlist entr(y|ies). Historical migrations + docs/adr are excluded by construction, not suppressed.`,
+    note: `${scanned} government-surface file(s) scanned for "role"/"governance" (${[...VOCAB_EXTS].sort().join(' ')}); `
+        + `${VOCAB_ALLOW.length} documented allowlist entr(y|ies), plus the citation rule. `
+        + 'Historical migrations + docs/adr are excluded by construction, not suppressed.',
+  };
+}
+
+// ── Check 19c — a rename sweep that ate its own arrow (task 1003120) ─────────
+//
+// THE HOLE CHECK 19 CANNOT SEE. Checks 19 and 19b grep for a BANNED WORD, so
+// they are structurally blind to the damage that actually happened in task
+// 1003118: a find-and-replace ran over a doc that was DESCRIBING the rename, and
+// swept BOTH sides of every rename pair. `governance` → `government` became
+// `government` → `government`. Not one banned word survives that edit, so the
+// wall passed — while the nested CLAUDE.md now taught the next agent that the
+// old name and the new name were the same word, and asserted the inverse of
+// ADR 0174 through a criterion review.
+//
+// An arrow between two identical names states nothing. It is only ever the
+// fossil of a sweep, so flagging the SHAPE catches the defect on the day it
+// lands, with no vocabulary to enumerate. Measured on the whole tree: the one
+// hit outside this surface is ADR 0194's `open` → `open`, a real mapping
+// sentence — which is why the check is scoped to the government surface (the
+// files the rename actually swept) rather than run repo-wide.
+const RENAME_IDENTITY_RE = /`([\w./-]+)` *(?:→|->) *`\1`/;
+
+function checkGovernmentRenameIdentity() {
+  const violations = [];
+  let scanned = 0;
+  for (const { abs, rel } of vocabFilesToScan()) {
+    scanned += 1;
+    fs.readFileSync(abs, 'utf8').split('\n').forEach((line, i) => {
+      const m = RENAME_IDENTITY_RE.exec(line);
+      if (!m) return;
+      violations.push(`${rel}:${i + 1}: \`${m[1]}\` → \`${m[1]}\` — a rename arrow between two IDENTICAL names states nothing. `
+        + 'A sweep ate one side of the pair (task 1003118); restore the name it renamed FROM.'
+        + `  →  ${line.trim().slice(0, 90)}`);
+    });
+  }
+  return {
+    name: 'a rename arrow names two different things (task 1003120)',
+    ok: violations.length === 0,
+    hardFail: violations.length > 0,
+    violations,
+    warnings: [],
+    note: `${scanned} government-surface file(s) scanned for \`X\` → \`X\` pairs; no allowlist — `
+        + 'an arrow between identical names has no legitimate form to excuse.',
   };
 }
 
@@ -225,12 +303,15 @@ module.exports = {
   GOAL_VOCAB_LINE_SCOPED,
   GOAL_VOCAB_SURFACE,
   LIFECYCLE_DB_FILES,
+  RENAME_IDENTITY_RE,
   VOCAB_ALLOW,
   VOCAB_BANNED,
+  VOCAB_CITATION,
   VOCAB_EXTS,
   VOCAB_HISTORICAL_REF,
   VOCAB_SURFACE,
   checkGoalMembershipVocabulary,
+  checkGovernmentRenameIdentity,
   checkVocabularyWall,
   vocabFilesToScan,
 };

package/scripts/gds/fitness.js

@@ -36,7 +36,7 @@ const { resolveCoreRoot, resolveInstanceRoot } = require('../../src/instance-con
 const { CORE_ROOT, INSTANCE_ROOT, MODULE_ROOTS, REPO_ROOT, rel, walkJs, walkJsAllRoots } = require('./fitness-lib.js');
 const { IDENTITY_SCAN_ALLOWED, IDENTITY_SCAN_EXCLUDE, IDENTITY_SCAN_EXTRA_FILES, IDENTITY_SCAN_EXTS, IDENTITY_SCAN_ROOTS, IDENTITY_SCAN_SKIP_DIRS, PROMPT_IDENTITY_LITERALS, checkDesignContract, checkKernelPromptsNoHardcodedIdentity, checkNeutralConfigsNoHostIdentity, collectIdentityFiles, scanPromptIdentity, stripCommentsForIdentity } = require('./fitness-checks-identity.js');
 const { WRITE_VALIDATION_BASELINE, WRITE_VALIDATION_EXEMPT, checkWriteRoutesValidated, scanUnvalidatedWriteRoutes } = require('./fitness-checks-write-validation.js');
-const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
+const { GOAL_VOCAB_CITATION, GOAL_VOCAB_LINE_SCOPED, GOAL_VOCAB_SURFACE, LIFECYCLE_DB_FILES, RENAME_IDENTITY_RE, VOCAB_ALLOW, VOCAB_BANNED, VOCAB_CITATION, VOCAB_EXTS, VOCAB_HISTORICAL_REF, VOCAB_SURFACE, checkGoalMembershipVocabulary, checkGovernmentRenameIdentity, checkVocabularyWall, vocabFilesToScan } = require('./fitness-checks-vocabulary.js');
 // ============================================================================
 // Check 1 — core ↔ host/game import boundary (ADR 0062 §1 cut-line)
 // ============================================================================
@@ -1374,6 +1374,7 @@ const CHECKS = [
   checkErrorEnvelope, // Check 17 — BV1 R03 / task 1990: no route hand-rolls a flat error (ADR 0116)
   checkVocabularyWall, // Check 19 — ADR 0174 / goal 1000068 R07: "role" is a craft, never a rank
   checkGoalMembershipVocabulary, // Check 19b — ADR 0177 / task 1003013: the FOURTH "role" (goal membership)
+  checkGovernmentRenameIdentity, // Check 19c — task 1003120: `X` → `X`, the rename arrow a sweep ate both sides of (the shape checks 19/19b are blind to)
   checkWriteRoutesValidated, // Check 18 — BV1 R12 / task 1999: every body-reading write route validates (ADR 0118)
   require('./fitness-ratchets.js').checkQualityRatchets, // Check 20 — task 1003129: quality budgets only tighten (mechanics + knip CI step live in fitness-ratchets.js)
   require('./doc-cli-guard.js').checkDocNamesRealCli, // Check 22 — task 1003165 / G01: a doc that names a CLI invocation must match the real CLI
@@ -1434,8 +1435,8 @@ function main() {
 if (require.main === module) main();
 
 module.exports = {
-  checkVocabularyWall, VOCAB_ALLOW,
-  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE,
+  checkVocabularyWall, VOCAB_ALLOW, VOCAB_CITATION, VOCAB_EXTS, vocabFilesToScan,
+  checkGoalMembershipVocabulary, GOAL_VOCAB_SURFACE, checkGovernmentRenameIdentity, RENAME_IDENTITY_RE, // 19c — task 1003120
   runAll,
   resolvesToHostGame,
   checkCoreHostBoundary,

package/scripts/gds/main-audit.js

@@ -35,12 +35,21 @@
 //   node scripts/gds/main-audit.js --strict              # also block on unresolved authors
 //   node scripts/gds/main-audit.js --db                  # resolve ranks from Postgres instead of the API
 //   node scripts/gds/main-audit.js --require-roster      # CI: an empty roster is a loud DID-NOT-RUN, not a vacuous green
+//
+// EXIT CONTRACT — never `process.exit()` here, use `cliExit(code)` + `return`
+// (task 1003772). Every exit in this file lands after the roster request, and a
+// hard exit mid-teardown aborts node natively on Windows (UV_HANDLE_CLOSING),
+// printing the verdict and THEN dying at 127. That is worse here than in any
+// other CLI: --verify-head IS the deploy gate, so the destroyed code makes a
+// clean audit look like a refusal and a real blocker indistinguishable from a
+// crash. Guarded by the static check in tests/cli_exit_no_abort.mjs.
+// Codes: 0 = clean · 1 = blocker found · 2 = DID NOT RUN (never a pass).
 
 'use strict';
 
 const { execSync } = require('node:child_process');
 const ppc = require(require('node:path').join(__dirname, '..', '..', 'src', 'bongos', 'permission-path-check.js'));
-const { cliClient, API_BASE } = require('./cli-lib');
+const { cliClient, cliExit, API_BASE } = require('./cli-lib');
 
 // ---------- pure analyzer (tested in tests/main_audit.mjs) ----------
 
@@ -319,14 +328,16 @@ async function main() {
         + `${Number.isFinite(depth) ? `${depth} commit(s)` : 'unreadable'} deep. `
         + 'Pass --range <A..B> or set OTB_AUDIT_RANGE. This is a check that did not execute, not a clean audit.'
       );
-      process.exit(2);
+      cliExit(2);
+      return;
     }
   }
 
   const parsed = parseCommits(range);
   if (parsed.error) {
     console.error(`main-audit: ${parsed.error}`);
-    process.exit(2);
+    cliExit(2);
+    return;
   }
   const rankMap = await fetchRankMap({ useDb });
   if (Object.keys(rankMap).length === 0) {
@@ -336,7 +347,8 @@ async function main() {
     // clean audit (the same false-green shape parseCommits guards against).
     if (process.argv.includes('--require-roster')) {
       console.error('main-audit: DID NOT RUN — the roster is unavailable (offline / no session / public leaderboard unreachable). An empty rank map can never produce a blocker, so exiting green would be a vacuous pass. Fix connectivity or drop --require-roster for a best-effort local read.');
-      process.exit(2);
+      cliExit(2);
+      return;
     }
     console.error('main-audit: WARNING — could not load the GDS roster (offline / insufficient rank / no DB). Authors will be unresolved; run as a Metic+ builder or with --db (on the droplet) for a definitive audit.');
   }
@@ -346,7 +358,8 @@ async function main() {
   console.log(`\nMain audit (SEC #863) — range ${range}, ${parsed.commits.length} commit(s)`);
   if (result.findings.length === 0) {
     console.log('  ✓ clean — no sub-Metic edits to permission-sensitive paths.\n');
-    process.exit(0);
+    cliExit(0);
+    return;
   }
   for (const f of result.findings) {
     const tag = f.severity === 'blocker' ? '\x1b[31m[BLOCKER]\x1b[0m' : '\x1b[33m[review]\x1b[0m';
@@ -364,16 +377,17 @@ async function main() {
   // verify-head is the deploy gate: any blocker (and, unless allowed, any
   // unresolved author) must stop the deploy.
   if (verifyHead) {
-    process.exit(result.hardFail ? 1 : 0);
+    cliExit(result.hardFail ? 1 : 0);
+    return;
   }
   // report mode: non-zero on a real blocker so CI can fail.
-  process.exit(result.hardFail ? 1 : 0);
+  cliExit(result.hardFail ? 1 : 0);
 }
 
 if (require.main === module) {
   main().catch((e) => {
     console.error(`main-audit: ${e.message}`);
-    process.exit(2);
+    cliExit(2);
   });
 }
 

package/scripts/gds/spark.js

@@ -157,6 +157,31 @@ function templateSkeleton() {
   return lines.join('\n');
 }
 
+// How the freshly-opened ratification window is described to its author.
+//
+// A NULL `closes_at` is the no-clock constitution, not a missing deadline —
+// several pass rules run a sitting with no clock at all, and the window simply
+// never expires. Printing the field raw turned that into "open until null" for
+// every author on a clockless instance (task 1003654, caught five times by the
+// R157 proof walk). So the rule decides the sentence, and the wording tracks
+// the Board Room's own clockLine() (modules/hall-ui/public/board-room.js) —
+// one vocabulary for one fact, whichever surface the author reads it on.
+//
+// ALL FOUR of config.js's PASS_RULES get a branch, `consent` included: it is
+// not clock-safe (CLOCK_SAFE_PASS_RULES is majority + unanimous only), so a
+// consent constitution is one of the likeliest to arrive here with no deadline
+// at all. The default arm is for an unreadable rule, not for a known one.
+function boardWindowLine(w) {
+  if (w.closes_at) return `  A board ratification window is open until ${w.closes_at}.`;
+  switch (w.pass_rule) {
+    case 'first_ratifier': return '  A board ratification window is open — no clock; it closes on the first vote.';
+    case 'consent': return '  A board ratification window is open — no clock; it stands unless someone objects.';
+    case 'majority': return '  A board ratification window is open — no clock; it waits for a majority.';
+    case 'unanimous': return '  A board ratification window is open — no clock; it waits for a unanimous yes.';
+    default: return '  A board ratification window is open — no clock; it stays open until the board decides.';
+  }
+}
+
 // What the developer is told once it lands. The completeness score is the number
 // the R147 credit split and the board bar both read, so it is the headline.
 function renderDeveloped(data) {
@@ -168,7 +193,7 @@ function renderDeveloped(data) {
     ? '  You had the thought and you developed it.'
     : `  The thought stays credited to builder ${author_id}; you are recorded as its developer (${developer_id}).`);
   if (board_window) {
-    lines.push(`  A board ratification window is open until ${board_window.closes_at}.`);
+    lines.push(boardWindowLine(board_window));
   } else if (idea.rejection) {
     lines.push(`  Not yet at the bar — thinnest section: ${idea.rejection.section_key}.`);
     if (idea.rejection.reason_md) lines.push(`    ${idea.rejection.reason_md}`);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.652'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.654'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cli_exit_no_abort.mjs

@@ -1,6 +1,13 @@
 // tests/cli_exit_no_abort.mjs — the GDS CLIs must not abort natively on exit
 // (task 1002734; the pre-push twin of this is tests/pre_push_hook.mjs, task 1002725).
 //
+// Guards api.js AND main-audit.js (task 1003772). main-audit --verify-head IS the
+// deploy gate (infra/deploy.sh calls it so a poisoned main never reaches
+// production), so there the destroyed exit code is not cosmetic: the abort fires
+// AFTER the verdict prints, and a caller reading the code cannot tell a clean
+// audit from a real blocker. It reproduced 1/1 on Windows + Node 24 before the fix
+// and went 5/5 clean after it.
+//
 // THE BUG. On Windows + Node 24, calling process.exit() after the CLI has made a
 // request aborts the process before it can exit cleanly:
 //
@@ -26,13 +33,24 @@ import { test } from 'node:test';
 import { spawnSync, spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const API = path.join(ROOT, 'scripts', 'gds', 'api.js');
+const MAIN_AUDIT = path.join(ROOT, 'scripts', 'gds', 'main-audit.js');
 const CLI_LIB = path.join(ROOT, 'scripts', 'gds', 'cli-lib.js');
 const DEAD_BASE = 'http://127.0.0.1:9'; // discard port — connection refused, instantly
 
+// Point a CLI at a base URL. DERIVED, not hardcoded: instance-config resolves
+// <PREFIX>_API_BASE first and only then the legacy GDS_/OTB_/PMS_ spellings, so a
+// literal here would (a) add to the legacy-GDS ratchet the rename is retiring and
+// (b) silently stop steering the CLI on any instance whose brand pack sets a
+// different prefix — the test would then hit the REAL API instead of the stub.
+const { envPrefix } = createRequire(import.meta.url)(path.join(ROOT, 'src', 'instance-config.js'));
+const API_BASE_ENV = `${envPrefix()}_API_BASE`;
+const atBase = (url) => ({ [API_BASE_ENV]: url });
+
 // The native abort prints this and nothing else can be relied on; it is NOT a
 // JS-level error, so it never appears as a caught exception.
 const ABORT_RE = /Assertion failed|UV_HANDLE_CLOSING/i;
@@ -41,7 +59,7 @@ function runApi(args, env = {}) {
   return spawnSync(process.execPath, [API, ...args], {
     cwd: ROOT,
     encoding: 'utf8',
-    env: { ...process.env, GDS_API_BASE: DEAD_BASE, ...env },
+    env: { ...process.env, ...atBase(DEAD_BASE), ...env },
   });
 }
 
@@ -104,7 +122,7 @@ test('api.js exits 0 after a SUCCESSFUL request — the path that aborted in the
   const { proc, port } = await startStub();
   try {
     for (let i = 0; i < 3; i++) {
-      const r = runApi(['GET', '/api/gds/me', '--quiet'], { GDS_API_BASE: `http://127.0.0.1:${port}` });
+      const r = runApi(['GET', '/api/gds/me', '--quiet'], atBase(`http://127.0.0.1:${port}`));
       assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively after a 200:\n${r.stderr}`);
       assert.equal(r.status, 0, `a successful request must exit 0, got ${r.status} (127 = the abort); stderr: ${r.stderr}`);
       assert.match(r.stdout, /"ok"/, 'the JSON body must still reach stdout');
@@ -133,3 +151,92 @@ test('api.js routes its post-request exits through cliExit, not process.exit', (
   );
   assert.match(afterRequest, /cliExit\(/, 'the post-request paths must set the exit code via cliExit');
 });
+
+// ---- main-audit.js — the deploy gate (task 1003772) ------------------------
+// Ranges are always HEAD..HEAD: it resolves on every checkout including a shallow
+// CI clone, audits zero commits, and still runs the WHOLE pipeline — fetchRankMap
+// is called before the verdict, so the exit is a post-request exit either way.
+//
+// THE STATIC CHECK IS THE REAL NET, and this was measured, not assumed: with the
+// hard exit deliberately put back, the static test failed while all four
+// behavioural tests below still PASSED. The same run against a real range
+// (`--range origin/main~15..origin/main`, 31 commits, a live roster call) aborted
+// at exit 127. So the abort needs the full stack to line up — enough commits and a
+// real request — which a network-free test cannot stage, exactly as the api.js
+// note above says. The behavioural tests are still worth their runtime: they pin
+// the exit CODES (0 / 2) that callers branch on, and their timeouts catch the
+// documented conversion trap where a leaked timer turns the crash into a hang.
+
+function runAudit(args, env = {}) {
+  return spawnSync(process.execPath, [MAIN_AUDIT, ...args], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    timeout: 60_000, // dropping a hard exit trades a crash for a HANG if a timer leaks
+    env: { ...process.env, ...atBase(DEAD_BASE), ...env },
+  });
+}
+
+test('main-audit.js routes every exit through cliExit, not process.exit', () => {
+  const src = fs.readFileSync(MAIN_AUDIT, 'utf8');
+  const stripped = src.replace(/\/\/[^\n]*/g, '');
+  // Unlike api.js, main-audit has no pre-request exits worth keeping separate —
+  // all seven sites were converted, so the guard is simply "none left".
+  assert.ok(
+    !/process\.exit\s*\(/.test(stripped),
+    'no process.exit() may remain in main-audit.js — that is what aborts node on Windows, '
+    + 'and this script IS the deploy gate whose exit code the abort destroys'
+  );
+  assert.match(src, /cliExit\(/, 'the exit paths must set the exit code via cliExit');
+});
+
+test('main-audit.js exits cleanly after a FAILED roster request', () => {
+  const r = runAudit(['--range', 'HEAD..HEAD']);
+  assert.notEqual(r.signal, 'SIGTERM', 'timed out — a leaked timer turned the crash into a hang');
+  assert.doesNotMatch(r.stderr || '', ABORT_RE, `native abort on the audit path:\n${r.stderr}`);
+  assert.equal(r.status, 0, `a clean audit must exit 0, not ${r.status} (127 = the abort)`);
+  assert.match(r.stdout, /✓ clean/, 'the verdict must still reach stdout');
+});
+
+test('main-audit.js --verify-head exits 0 on a clean audit — the deploy gate reads this code', () => {
+  // The gate path specifically: infra/deploy.sh treats non-zero as "do not deploy",
+  // so an abort here blocks a deploy that nothing is actually wrong with.
+  for (let i = 0; i < 3; i++) {
+    const r = runAudit(['--verify-head', '--range', 'HEAD..HEAD']);
+    assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — leaked handle`);
+    assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively:\n${r.stderr}`);
+    assert.equal(r.status, 0, `run ${i + 1} exited ${r.status}; stderr: ${r.stderr}`);
+  }
+});
+
+test('main-audit.js --require-roster still exits 2 when the roster is unreachable', () => {
+  // The post-request DID-NOT-RUN path. Converting it to cliExit must not turn a
+  // refusal into a vacuous green — exit 2 is what stops CI calling this a pass.
+  const r = runAudit(['--require-roster', '--range', 'HEAD..HEAD']);
+  assert.notEqual(r.signal, 'SIGTERM', 'timed out — leaked handle');
+  assert.doesNotMatch(r.stderr || '', ABORT_RE);
+  assert.equal(r.status, 2, `an unavailable roster must exit 2, got ${r.status}`);
+  assert.match(r.stderr, /DID NOT RUN/);
+});
+
+test('main-audit.js reports an unresolvable range as exit 2 (pre-request path)', () => {
+  const r = runAudit(['--range', 'bogusref..HEAD']);
+  assert.doesNotMatch(r.stderr || '', ABORT_RE);
+  assert.equal(r.status, 2, 'an unresolvable range is exit 2, and must not be mistaken for clean');
+  assert.match(r.stderr, /DID NOT RUN/);
+});
+
+test('main-audit.js exits 0 after a SUCCESSFUL roster request — the teardown that aborted in the wild', async () => {
+  // A refused connection tears down far less machinery than a 200. The wild repro
+  // was a successful roster call, so this is the case that actually matters.
+  const { proc, port } = await startStub();
+  try {
+    for (let i = 0; i < 3; i++) {
+      const r = runAudit(['--range', 'HEAD..HEAD'], atBase(`http://127.0.0.1:${port}`));
+      assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — leaked handle`);
+      assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively after a 200:\n${r.stderr}`);
+      assert.equal(r.status, 0, `run ${i + 1} exited ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+    }
+  } finally {
+    proc.kill();
+  }
+});

package/tests/government_vocabulary.mjs

@@ -46,18 +46,113 @@ test('a planted "governance" on the government surface REDS the build', () => {
 // Plant a line into a real government-surface file, run the check, restore.
 // Uses the real file rather than a fixture so the test exercises the same path
 // resolution the CI gate does.
-function withPlantedLine(line) {
+function withPlantedLine(line, relParts = ['modules', 'government', 'resolver.js'], check = 'checkVocabularyWall') {
   const fs = require('node:fs');
-  const target = path.join(ROOT, 'modules', 'government', 'resolver.js');
+  const target = path.join(ROOT, ...relParts);
   const original = fs.readFileSync(target, 'utf8');
   try {
     fs.writeFileSync(target, `${original}\n${line}\n`);
-    return fitness.checkVocabularyWall().violations;
+    return fitness[check]().violations;
   } finally {
     fs.writeFileSync(target, original);
   }
 }
 
+const MD = ['modules', 'government', 'CLAUDE.md'];
+
+// ---------- markdown is inside the wall (task 1003120) ----------
+//
+// The gap this closes: a nested CLAUDE.md is INSTRUCTION — it loads on demand
+// for every agent working in the module, and the agent that reads the wrong
+// vocabulary there writes it into the code next. It sat outside the very rule
+// it describes, which is how it came to teach the INVERSE of ADR 0174 and
+// survive a criterion review (task 1003118).
+
+test('the wall scans markdown — the doc that TEACHES the rule is inside it', () => {
+  assert.ok(fitness.VOCAB_EXTS.has('.md'),
+    'markdown must be scanned: the highest-leverage vocabulary surface is the nested '
+    + 'CLAUDE.md an agent reads before writing code, not the code itself');
+  const scanned = fitness.vocabFilesToScan().map((f) => f.rel);
+  assert.ok(scanned.includes('modules/government/CLAUDE.md'),
+    `the module's own nested doc must be in scope; scanned: ${scanned.join(', ')}`);
+});
+
+test('a planted "role" in a government MARKDOWN file REDS the build', () => {
+  const planted = withPlantedLine('A custom role may hold this permission.', MD);
+  assert.ok(planted.some((v) => /CLAUDE\.md.*"role"/.test(v)),
+    'a doc that teaches the banned vocabulary must be caught — otherwise adding '
+    + '.md to VOCAB_EXTS bought nothing');
+});
+
+// ---------- the citation rule is an exemption, not a hole ----------
+//
+// Preferred over three more VOCAB_ALLOW entries (which would have taken the cap
+// of 5 to its limit) because the exemption belongs to the CITATION, not to
+// whichever file happens to hold it. So it has to be narrow, and both halves of
+// that are load-bearing: it lets the rule be NAMED, and nothing else.
+
+test('a line that CITES the rule may say the banned word', () => {
+  const planted = withPlantedLine('On this surface "role" is banned — see ADR 0174.', MD);
+  assert.ok(!planted.some((v) => /CLAUDE\.md/.test(v)),
+    'meta-commentary about the ban has to be able to name it, or the doc could '
+    + 'not state the rule it enforces');
+});
+
+test('the citation rule does NOT excuse the rest of the line', () => {
+  // Same file, same banned word, no citation: still caught. Without this the
+  // exemption could be silently widened to "this file is fine" and stay green.
+  const planted = withPlantedLine('A custom role may hold this permission.', MD);
+  assert.ok(planted.some((v) => /CLAUDE\.md/.test(v)),
+    'a line with no citation must still red — an exemption that covers the file '
+    + 'rather than the sentence is an allowlist wearing a regex');
+});
+
+test('the allowlist did not grow to absorb the markdown surface', () => {
+  // The whole point of the citation rule: bringing .md into scope surfaced three
+  // legitimate lines, and NONE of them cost an allowlist slot.
+  assert.ok(fitness.VOCAB_ALLOW.length <= 4,
+    `the allowlist grew to ${fitness.VOCAB_ALLOW.length} when .md came into scope. `
+    + 'The citation rule exists so it would not have to.');
+});
+
+// ---------- check 19c: the rename arrow a sweep ate both sides of ----------
+//
+// The defect checks 19 and 19b are structurally blind to. Task 1003118 ran a
+// find-and-replace over a doc DESCRIBING the rename and swept both sides of
+// every pair: `governance` → `government` became `government` → `government`.
+// No banned word survives that edit, so the wall passed while the doc taught
+// the next agent that the old and new names were the same word.
+
+test('the government surface carries no identity rename arrows today', () => {
+  const r = fitness.checkGovernmentRenameIdentity();
+  assert.equal(r.ok, true,
+    `an \`X\` → \`X\` arrow is on the surface:\n${r.violations.join('\n')}`);
+  assert.ok(r.note.includes('file(s) scanned'), 'the check must report what it scanned');
+});
+
+test('a planted `X` → `X` pair REDS the build', () => {
+  const planted = withPlantedLine('The sweep renamed `ranks.js` → `ranks.js` here.', MD, 'checkGovernmentRenameIdentity');
+  assert.ok(planted.some((v) => /ranks\.js/.test(v)),
+    'an arrow between two identical names states nothing and is only ever the '
+    + 'fossil of a sweep — it must be caught');
+});
+
+test('a REAL rename arrow is left alone', () => {
+  // The check must not punish the sentence it exists to protect: a doc
+  // describing the rename correctly names two different things.
+  const planted = withPlantedLine('The sweep renamed `governance_001` → `government_001` here.', MD, 'checkGovernmentRenameIdentity');
+  assert.equal(planted.length, 0,
+    `a legitimate A → B rename must pass, or the rule teaches docs not to describe `
+    + `renames at all:\n${planted.join('\n')}`);
+});
+
+test('the rename-identity check has no allowlist to erode', () => {
+  const r = fitness.checkGovernmentRenameIdentity();
+  assert.ok(/no allowlist/.test(r.note),
+    'an arrow between identical names has no legitimate form, so there is nothing '
+    + 'to excuse — and no slot for a future exemption to grow into');
+});
+
 // ---------- the allowlist is small, reasoned, and real ----------
 
 test('every allowlist entry carries a written reason', () => {

package/tests/idea_develop_spark.mjs

@@ -382,6 +382,49 @@ await test('the CLI names both parties, and never prints "undefined"', () => {
   assert.doesNotMatch(out, /undefined|null/);
 });
 
+// task 1003654 — the R157 proof walk read "A board ratification window is open
+// until null" five times on cloudbongos.com. A NULL closes_at is the no-clock
+// constitution, NOT a broken window, so the copy has to name how the sitting
+// closes. One case per pass rule, plus the unknown-rule fallback, because the
+// whole failure was one branch that assumed a deadline always exists.
+for (const [rule, expected] of [
+  ['first_ratifier', /no clock; it closes on the first vote/],
+  ['consent', /no clock; it stands unless someone objects/],
+  ['majority', /no clock; it waits for a majority/],
+  ['unanimous', /no clock; it waits for a unanimous yes/],
+  [null, /no clock; it stays open until the board decides/],
+]) {
+  await test(`a clockless ${rule || 'unknown-rule'} window says how it closes, never "until null"`, () => {
+    const out = cli.renderDeveloped({
+      idea: { id: '77', completeness_score: 88 },
+      author_id: '9', developer_id: '42', self_developed: false,
+      board_window: { item_id: '3', closes_at: null, pass_rule: rule },
+    });
+    assert.match(out, /ratification window is open/);
+    assert.match(out, expected);
+    assert.doesNotMatch(out, /until null|undefined/);
+  });
+}
+
+// Held equal to government's own rule list, the way board.js's FULL_IDEA_PASS_BAR
+// is held equal to economy's — the CLI cannot require() a sibling module, so the
+// test is where the two lists meet. Without this, adding a fifth pass rule
+// silently drops its authors onto the unreadable-rule fallback.
+await test('EVERY pass rule government declares gets its own sentence, not the fallback', () => {
+  const { PASS_RULES } = require('../modules/government/config.js');
+  const fallback = cli.renderDeveloped({
+    idea: { id: '77', completeness_score: 88 }, author_id: '9', developer_id: '42', self_developed: false,
+    board_window: { item_id: '3', closes_at: null, pass_rule: '__no_such_rule__' },
+  });
+  for (const rule of PASS_RULES) {
+    const out = cli.renderDeveloped({
+      idea: { id: '77', completeness_score: 88 }, author_id: '9', developer_id: '42', self_developed: false,
+      board_window: { item_id: '3', closes_at: null, pass_rule: rule },
+    });
+    assert.notEqual(out, fallback, `pass rule '${rule}' falls through to the unreadable-rule fallback`);
+  }
+});
+
 await test('self-development reads as one person, not a handoff to yourself', () => {
   const out = cli.renderDeveloped({ idea: { id: '1', completeness_score: 70 }, author_id: '9', developer_id: '9', self_developed: true });
   assert.match(out, /You had the thought and you developed it/);

package/tests/idea_resubmit.mjs

@@ -25,7 +25,7 @@ const api = require('../src/module-api.js');
 
 // ---- the government port stub (registered BEFORE the routes load) ----------
 let rejectionAnswer = null;      // what latestRejectionForIdea returns
-let windowAnswer = { opened: true, item: { id: '31', closes_at: null } };
+let windowAnswer = { opened: true, item: { id: '31', closes_at: null, constitution: { pass_rule: 'first_ratifier' } } };
 const portCalls = [];
 if (!api.hasProvider('government')) {
   api.registerProvider('government', {
@@ -84,7 +84,7 @@ const fullIdea = (over = {}) => ({
 let passed = 0, failed = 0;
 async function test(name, fn) {
   queries = []; portCalls.length = 0;
-  rejectionAnswer = null; windowAnswer = { opened: true, item: { id: '31', closes_at: null } };
+  rejectionAnswer = null; windowAnswer = { opened: true, item: { id: '31', closes_at: null, constitution: { pass_rule: 'first_ratifier' } } };
   try { await fn(); passed++; console.log(`  ok  ${name}`); }
   catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
 }
@@ -113,7 +113,11 @@ await test('a board objection outranks the mechanical flag, and an ANSWERED sect
   assert.equal(r.payload.flagged_section, 'purpose', 'the human objection wins over the weakest-section flag');
   assert.equal(r.payload.flagged_section_changed, true);
   assert.equal(r.payload.rejection_source, 'board');
-  assert.deepEqual(r.payload.board_window, { item_id: '31', closes_at: null }, 'a new window opened');
+  // The pass rule rides along with the deadline (task 1003654): a clockless
+  // sitting reports closes_at null, and without the rule a caller cannot tell
+  // that apart from a broken window — which is how "open until null" reached
+  // authors in the first place.
+  assert.deepEqual(r.payload.board_window, { item_id: '31', closes_at: null, pass_rule: 'first_ratifier' }, 'a new window opened, and it says how it closes');
 });
 
 await test('reworking everything EXCEPT the flagged section reads changed:false', async () => {