@bongos/core 1.19.653 → 1.19.654

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.653",
-  "core_contract": "1.19.653",
-  "source_commit": "eff58cdbf33eb107723b56ef2f119c578d628d5e",
+  "core_version": "1.19.654",
+  "core_contract": "1.19.654",
+  "source_commit": "29859bbb518d99362867ba988703fdbf1d4f9472",
   "source_ref": "HEAD",
-  "built_at": "2026-09-10T23:48:13.514Z",
+  "built_at": "2026-09-10T23:57:14.296Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 472,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2606,
-  "tree_sha256": "f2c83acf6434a7c56482adc7efcd782b2577ba4f4d6092d74e2ea143b5c6f90c",
+  "tree_sha256": "c678060ed77c22de9946d24d4668466c564defa104b075a8076c1a5964fe937a",
   "files": [
     {
       "path": ".claude/skills/backlog-review/SKILL.md",
@@ -2782,7 +2782,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "11da08cbbf3f33e0a95df12baddcfc0bddba2b4bb4cf7c77f2a818c7d1dbfba8"
+      "sha256": "d45c6981ad6bd64f4b0fc09e9d28fe87231b8d65da676620246f8eccc803f091"
     },
     {
       "path": "docs/modules-contract.md",
@@ -5567,7 +5567,7 @@
     {
       "path": "modules/ideas/routes/inbox.js",
       "mode": "0000644",
-      "sha256": "b3df5f0d4273f44af60a7e09a8bef026a0f02085c7823c7912c70d067e55e127"
+      "sha256": "0f5997e58ca3f8ee33e84948136697519f095670387f0ae26cadb325f2389268"
     },
     {
       "path": "modules/ideas/routing.js",
@@ -7742,12 +7742,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "42dddf576e9fb7f8d33e39dff4244f6105bd4bf78b150cf700d819f763ab6b8d"
+      "sha256": "9370d237943d31161eb264dcd700e1fe6caea5f32a234e05cf17f94cdba7db5e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "12d491b531085f6ed22cbda1b8f7485401c186fd10b1cb4170e8af6bed174d95"
+      "sha256": "bc4361fd3c305fcb47bc8769dbad015475a2f7ef4e1e6795c7027953e5b259ec"
     },
     {
       "path": "public-docs/index.html",
@@ -8412,7 +8412,7 @@
     {
       "path": "scripts/gds/main-audit.js",
       "mode": "0000644",
-      "sha256": "35047f05c6059aee0cb64b13ef1495e4db1f3885b5b9c8cac5c60283069a059d"
+      "sha256": "4b27716f74bd13b0500c14b2607ea9f9e2584c4a27280bd075418772ac4dc644"
     },
     {
       "path": "scripts/gds/me.js",
@@ -9012,7 +9012,7 @@
     {
       "path": "scripts/gds/spark.js",
       "mode": "0000755",
-      "sha256": "dfd5aa72caa26eb2c8cf3063e1b4f51e1f4bcd7fddcdd93d243279c130850628"
+      "sha256": "3cc086defcaf14df25db27646596f2332ac79dff97c95e72d4cff329d8db9189"
     },
     {
       "path": "scripts/gds/spike-task-map.js",
@@ -9502,7 +9502,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "03201e0e94d7ba4d755c8d0efae051208913faa2a7f654b231d3cb9ded49bd9b"
+      "sha256": "175d5a93b971e2da73a24186a0e9ed7288da65aed61aa9f86d5a0c85f30bf53f"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10107,7 +10107,7 @@
     {
       "path": "tests/cli_exit_no_abort.mjs",
       "mode": "0000644",
-      "sha256": "7bc4d54d29458c70cd545aecac1ca1f7b8cc13d7b1dacaa90a8c2184ef553304"
+      "sha256": "7b489890ab6e2baa6aefe784b81852eaaac39cdc50af5974de7eee815baee510"
     },
     {
       "path": "tests/cli_lib_formatters.mjs",
@@ -11227,7 +11227,7 @@
     {
       "path": "tests/idea_develop_spark.mjs",
       "mode": "0000644",
-      "sha256": "a498e2dfc87dbb5050d414ff04ebf4178900edb771be384fe91247e452a37a02"
+      "sha256": "fe55e01a0be2aa6ca0bc536469eefcee7d44f40dfa0767fedf1709aed3f7d81e"
     },
     {
       "path": "tests/idea_full_capture.mjs",
@@ -11267,7 +11267,7 @@
     {
       "path": "tests/idea_resubmit.mjs",
       "mode": "0000644",
-      "sha256": "51e1286235cbde1b56188f29b0e2bd12ac73a9637dbf1c16b325f10147256f27"
+      "sha256": "56ef1d4405ec63a9c095000411774f533b3e34cdb89184bd4351e58313dc2975"
     },
     {
       "path": "tests/idea_route_attribution.mjs",

package/docs/module-api-changelog.md

@@ -1755,5 +1755,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.651 with no explicit bump. run 34529655648. (task 1002620)
   1.19.653 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.652 with no explicit bump. run 34543713846. (task 1002620)
+  1.19.654 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.653 with no explicit bump. run 34544345437. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/ideas/routes/inbox.js

@@ -63,6 +63,25 @@ function registerSeams() {
   }
 }
 
+// The author-facing shape of a ratification window this request just opened —
+// spelled once because all three open sites (capture, develop, resubmit) return
+// the same thing to the same readers (task 1003654).
+//
+// `closes_at` is legitimately NULL: it is the no-clock constitution, not a
+// missing value (modules/government/db.js — a NULL deadline never expires).
+// That is exactly why `pass_rule` travels WITH it. A caller holding only the
+// timestamp cannot tell a clockless sitting from a broken one, so it prints the
+// raw null — which is what the R157 proof walk caught spark.js doing ("open
+// until null"). With the rule in hand a renderer can say HOW the sitting closes
+// instead, the way the Board Room's own clockLine() already does.
+function boardWindowPayload(item) {
+  return {
+    item_id: item.id,
+    closes_at: item.closes_at ?? null,
+    pass_rule: (item.constitution && item.constitution.pass_rule) || null,
+  };
+}
+
 module.exports = function buildInboxRouter() {
   registerSeams();
   const router = express.Router();
@@ -227,7 +246,7 @@ module.exports = function buildInboxRouter() {
                 completenessScore: row.completeness_score,
               });
               if (w && w.opened && w.item) {
-                idea.board_window = { item_id: w.item.id, closes_at: w.item.closes_at };
+                idea.board_window = boardWindowPayload(w.item);
               } else if (w && w.reason === 'below_bar') {
                 // R09 (goal 1000069, criterion C2): a sub-bar idea returns to
                 // its author WITH A REASON THEY CAN ACT ON — the weakest section
@@ -673,7 +692,7 @@ module.exports = function buildInboxRouter() {
       try {
         if (government && government.openBoardWindowForIdea) {
           const w = await government.openBoardWindowForIdea({ ideaId: id, completenessScore: row.completeness_score });
-          if (w && w.opened && w.item) board_window = { item_id: w.item.id, closes_at: w.item.closes_at };
+          if (w && w.opened && w.item) board_window = boardWindowPayload(w.item);
           else if (w && w.reason === 'below_bar') {
             const flag = weakestSectionPayload(req.body.field_values, templateKey ? { templateKey } : undefined);
             if (flag) out.rejection = flag; // still short — the NEW weakest section, fresh feedback
@@ -957,7 +976,7 @@ module.exports = function buildInboxRouter() {
       const government = api.resolveOptional && api.resolveOptional('government');
       if (government && government.openBoardWindowForIdea) {
         const w = await government.openBoardWindowForIdea({ ideaId: id, completenessScore: row.completeness_score });
-        if (w && w.opened && w.item) board_window = { item_id: w.item.id, closes_at: w.item.closes_at };
+        if (w && w.opened && w.item) board_window = boardWindowPayload(w.item);
         else if (w && w.reason === 'below_bar') {
           // The same honest feedback the resubmit path gives: which section is
           // thinnest, computed from what was just written. Derived, never stored.

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.653",
+  "version": "1.19.654",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.653",
+      "version": "1.19.654",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.653",
+  "version": "1.19.654",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/main-audit.js

@@ -35,12 +35,21 @@
 //   node scripts/gds/main-audit.js --strict              # also block on unresolved authors
 //   node scripts/gds/main-audit.js --db                  # resolve ranks from Postgres instead of the API
 //   node scripts/gds/main-audit.js --require-roster      # CI: an empty roster is a loud DID-NOT-RUN, not a vacuous green
+//
+// EXIT CONTRACT — never `process.exit()` here, use `cliExit(code)` + `return`
+// (task 1003772). Every exit in this file lands after the roster request, and a
+// hard exit mid-teardown aborts node natively on Windows (UV_HANDLE_CLOSING),
+// printing the verdict and THEN dying at 127. That is worse here than in any
+// other CLI: --verify-head IS the deploy gate, so the destroyed code makes a
+// clean audit look like a refusal and a real blocker indistinguishable from a
+// crash. Guarded by the static check in tests/cli_exit_no_abort.mjs.
+// Codes: 0 = clean · 1 = blocker found · 2 = DID NOT RUN (never a pass).
 
 'use strict';
 
 const { execSync } = require('node:child_process');
 const ppc = require(require('node:path').join(__dirname, '..', '..', 'src', 'bongos', 'permission-path-check.js'));
-const { cliClient, API_BASE } = require('./cli-lib');
+const { cliClient, cliExit, API_BASE } = require('./cli-lib');
 
 // ---------- pure analyzer (tested in tests/main_audit.mjs) ----------
 
@@ -319,14 +328,16 @@ async function main() {
         + `${Number.isFinite(depth) ? `${depth} commit(s)` : 'unreadable'} deep. `
         + 'Pass --range <A..B> or set OTB_AUDIT_RANGE. This is a check that did not execute, not a clean audit.'
       );
-      process.exit(2);
+      cliExit(2);
+      return;
     }
   }
 
   const parsed = parseCommits(range);
   if (parsed.error) {
     console.error(`main-audit: ${parsed.error}`);
-    process.exit(2);
+    cliExit(2);
+    return;
   }
   const rankMap = await fetchRankMap({ useDb });
   if (Object.keys(rankMap).length === 0) {
@@ -336,7 +347,8 @@ async function main() {
     // clean audit (the same false-green shape parseCommits guards against).
     if (process.argv.includes('--require-roster')) {
       console.error('main-audit: DID NOT RUN — the roster is unavailable (offline / no session / public leaderboard unreachable). An empty rank map can never produce a blocker, so exiting green would be a vacuous pass. Fix connectivity or drop --require-roster for a best-effort local read.');
-      process.exit(2);
+      cliExit(2);
+      return;
     }
     console.error('main-audit: WARNING — could not load the GDS roster (offline / insufficient rank / no DB). Authors will be unresolved; run as a Metic+ builder or with --db (on the droplet) for a definitive audit.');
   }
@@ -346,7 +358,8 @@ async function main() {
   console.log(`\nMain audit (SEC #863) — range ${range}, ${parsed.commits.length} commit(s)`);
   if (result.findings.length === 0) {
     console.log('  ✓ clean — no sub-Metic edits to permission-sensitive paths.\n');
-    process.exit(0);
+    cliExit(0);
+    return;
   }
   for (const f of result.findings) {
     const tag = f.severity === 'blocker' ? '\x1b[31m[BLOCKER]\x1b[0m' : '\x1b[33m[review]\x1b[0m';
@@ -364,16 +377,17 @@ async function main() {
   // verify-head is the deploy gate: any blocker (and, unless allowed, any
   // unresolved author) must stop the deploy.
   if (verifyHead) {
-    process.exit(result.hardFail ? 1 : 0);
+    cliExit(result.hardFail ? 1 : 0);
+    return;
   }
   // report mode: non-zero on a real blocker so CI can fail.
-  process.exit(result.hardFail ? 1 : 0);
+  cliExit(result.hardFail ? 1 : 0);
 }
 
 if (require.main === module) {
   main().catch((e) => {
     console.error(`main-audit: ${e.message}`);
-    process.exit(2);
+    cliExit(2);
   });
 }
 

package/scripts/gds/spark.js

@@ -157,6 +157,31 @@ function templateSkeleton() {
   return lines.join('\n');
 }
 
+// How the freshly-opened ratification window is described to its author.
+//
+// A NULL `closes_at` is the no-clock constitution, not a missing deadline —
+// several pass rules run a sitting with no clock at all, and the window simply
+// never expires. Printing the field raw turned that into "open until null" for
+// every author on a clockless instance (task 1003654, caught five times by the
+// R157 proof walk). So the rule decides the sentence, and the wording tracks
+// the Board Room's own clockLine() (modules/hall-ui/public/board-room.js) —
+// one vocabulary for one fact, whichever surface the author reads it on.
+//
+// ALL FOUR of config.js's PASS_RULES get a branch, `consent` included: it is
+// not clock-safe (CLOCK_SAFE_PASS_RULES is majority + unanimous only), so a
+// consent constitution is one of the likeliest to arrive here with no deadline
+// at all. The default arm is for an unreadable rule, not for a known one.
+function boardWindowLine(w) {
+  if (w.closes_at) return `  A board ratification window is open until ${w.closes_at}.`;
+  switch (w.pass_rule) {
+    case 'first_ratifier': return '  A board ratification window is open — no clock; it closes on the first vote.';
+    case 'consent': return '  A board ratification window is open — no clock; it stands unless someone objects.';
+    case 'majority': return '  A board ratification window is open — no clock; it waits for a majority.';
+    case 'unanimous': return '  A board ratification window is open — no clock; it waits for a unanimous yes.';
+    default: return '  A board ratification window is open — no clock; it stays open until the board decides.';
+  }
+}
+
 // What the developer is told once it lands. The completeness score is the number
 // the R147 credit split and the board bar both read, so it is the headline.
 function renderDeveloped(data) {
@@ -168,7 +193,7 @@ function renderDeveloped(data) {
     ? '  You had the thought and you developed it.'
     : `  The thought stays credited to builder ${author_id}; you are recorded as its developer (${developer_id}).`);
   if (board_window) {
-    lines.push(`  A board ratification window is open until ${board_window.closes_at}.`);
+    lines.push(boardWindowLine(board_window));
   } else if (idea.rejection) {
     lines.push(`  Not yet at the bar — thinnest section: ${idea.rejection.section_key}.`);
     if (idea.rejection.reason_md) lines.push(`    ${idea.rejection.reason_md}`);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.653'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.654'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cli_exit_no_abort.mjs

@@ -1,6 +1,13 @@
 // tests/cli_exit_no_abort.mjs — the GDS CLIs must not abort natively on exit
 // (task 1002734; the pre-push twin of this is tests/pre_push_hook.mjs, task 1002725).
 //
+// Guards api.js AND main-audit.js (task 1003772). main-audit --verify-head IS the
+// deploy gate (infra/deploy.sh calls it so a poisoned main never reaches
+// production), so there the destroyed exit code is not cosmetic: the abort fires
+// AFTER the verdict prints, and a caller reading the code cannot tell a clean
+// audit from a real blocker. It reproduced 1/1 on Windows + Node 24 before the fix
+// and went 5/5 clean after it.
+//
 // THE BUG. On Windows + Node 24, calling process.exit() after the CLI has made a
 // request aborts the process before it can exit cleanly:
 //
@@ -26,13 +33,24 @@ import { test } from 'node:test';
 import { spawnSync, spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const API = path.join(ROOT, 'scripts', 'gds', 'api.js');
+const MAIN_AUDIT = path.join(ROOT, 'scripts', 'gds', 'main-audit.js');
 const CLI_LIB = path.join(ROOT, 'scripts', 'gds', 'cli-lib.js');
 const DEAD_BASE = 'http://127.0.0.1:9'; // discard port — connection refused, instantly
 
+// Point a CLI at a base URL. DERIVED, not hardcoded: instance-config resolves
+// <PREFIX>_API_BASE first and only then the legacy GDS_/OTB_/PMS_ spellings, so a
+// literal here would (a) add to the legacy-GDS ratchet the rename is retiring and
+// (b) silently stop steering the CLI on any instance whose brand pack sets a
+// different prefix — the test would then hit the REAL API instead of the stub.
+const { envPrefix } = createRequire(import.meta.url)(path.join(ROOT, 'src', 'instance-config.js'));
+const API_BASE_ENV = `${envPrefix()}_API_BASE`;
+const atBase = (url) => ({ [API_BASE_ENV]: url });
+
 // The native abort prints this and nothing else can be relied on; it is NOT a
 // JS-level error, so it never appears as a caught exception.
 const ABORT_RE = /Assertion failed|UV_HANDLE_CLOSING/i;
@@ -41,7 +59,7 @@ function runApi(args, env = {}) {
   return spawnSync(process.execPath, [API, ...args], {
     cwd: ROOT,
     encoding: 'utf8',
-    env: { ...process.env, GDS_API_BASE: DEAD_BASE, ...env },
+    env: { ...process.env, ...atBase(DEAD_BASE), ...env },
   });
 }
 
@@ -104,7 +122,7 @@ test('api.js exits 0 after a SUCCESSFUL request — the path that aborted in the
   const { proc, port } = await startStub();
   try {
     for (let i = 0; i < 3; i++) {
-      const r = runApi(['GET', '/api/gds/me', '--quiet'], { GDS_API_BASE: `http://127.0.0.1:${port}` });
+      const r = runApi(['GET', '/api/gds/me', '--quiet'], atBase(`http://127.0.0.1:${port}`));
       assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively after a 200:\n${r.stderr}`);
       assert.equal(r.status, 0, `a successful request must exit 0, got ${r.status} (127 = the abort); stderr: ${r.stderr}`);
       assert.match(r.stdout, /"ok"/, 'the JSON body must still reach stdout');
@@ -133,3 +151,92 @@ test('api.js routes its post-request exits through cliExit, not process.exit', (
   );
   assert.match(afterRequest, /cliExit\(/, 'the post-request paths must set the exit code via cliExit');
 });
+
+// ---- main-audit.js — the deploy gate (task 1003772) ------------------------
+// Ranges are always HEAD..HEAD: it resolves on every checkout including a shallow
+// CI clone, audits zero commits, and still runs the WHOLE pipeline — fetchRankMap
+// is called before the verdict, so the exit is a post-request exit either way.
+//
+// THE STATIC CHECK IS THE REAL NET, and this was measured, not assumed: with the
+// hard exit deliberately put back, the static test failed while all four
+// behavioural tests below still PASSED. The same run against a real range
+// (`--range origin/main~15..origin/main`, 31 commits, a live roster call) aborted
+// at exit 127. So the abort needs the full stack to line up — enough commits and a
+// real request — which a network-free test cannot stage, exactly as the api.js
+// note above says. The behavioural tests are still worth their runtime: they pin
+// the exit CODES (0 / 2) that callers branch on, and their timeouts catch the
+// documented conversion trap where a leaked timer turns the crash into a hang.
+
+function runAudit(args, env = {}) {
+  return spawnSync(process.execPath, [MAIN_AUDIT, ...args], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    timeout: 60_000, // dropping a hard exit trades a crash for a HANG if a timer leaks
+    env: { ...process.env, ...atBase(DEAD_BASE), ...env },
+  });
+}
+
+test('main-audit.js routes every exit through cliExit, not process.exit', () => {
+  const src = fs.readFileSync(MAIN_AUDIT, 'utf8');
+  const stripped = src.replace(/\/\/[^\n]*/g, '');
+  // Unlike api.js, main-audit has no pre-request exits worth keeping separate —
+  // all seven sites were converted, so the guard is simply "none left".
+  assert.ok(
+    !/process\.exit\s*\(/.test(stripped),
+    'no process.exit() may remain in main-audit.js — that is what aborts node on Windows, '
+    + 'and this script IS the deploy gate whose exit code the abort destroys'
+  );
+  assert.match(src, /cliExit\(/, 'the exit paths must set the exit code via cliExit');
+});
+
+test('main-audit.js exits cleanly after a FAILED roster request', () => {
+  const r = runAudit(['--range', 'HEAD..HEAD']);
+  assert.notEqual(r.signal, 'SIGTERM', 'timed out — a leaked timer turned the crash into a hang');
+  assert.doesNotMatch(r.stderr || '', ABORT_RE, `native abort on the audit path:\n${r.stderr}`);
+  assert.equal(r.status, 0, `a clean audit must exit 0, not ${r.status} (127 = the abort)`);
+  assert.match(r.stdout, /✓ clean/, 'the verdict must still reach stdout');
+});
+
+test('main-audit.js --verify-head exits 0 on a clean audit — the deploy gate reads this code', () => {
+  // The gate path specifically: infra/deploy.sh treats non-zero as "do not deploy",
+  // so an abort here blocks a deploy that nothing is actually wrong with.
+  for (let i = 0; i < 3; i++) {
+    const r = runAudit(['--verify-head', '--range', 'HEAD..HEAD']);
+    assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — leaked handle`);
+    assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively:\n${r.stderr}`);
+    assert.equal(r.status, 0, `run ${i + 1} exited ${r.status}; stderr: ${r.stderr}`);
+  }
+});
+
+test('main-audit.js --require-roster still exits 2 when the roster is unreachable', () => {
+  // The post-request DID-NOT-RUN path. Converting it to cliExit must not turn a
+  // refusal into a vacuous green — exit 2 is what stops CI calling this a pass.
+  const r = runAudit(['--require-roster', '--range', 'HEAD..HEAD']);
+  assert.notEqual(r.signal, 'SIGTERM', 'timed out — leaked handle');
+  assert.doesNotMatch(r.stderr || '', ABORT_RE);
+  assert.equal(r.status, 2, `an unavailable roster must exit 2, got ${r.status}`);
+  assert.match(r.stderr, /DID NOT RUN/);
+});
+
+test('main-audit.js reports an unresolvable range as exit 2 (pre-request path)', () => {
+  const r = runAudit(['--range', 'bogusref..HEAD']);
+  assert.doesNotMatch(r.stderr || '', ABORT_RE);
+  assert.equal(r.status, 2, 'an unresolvable range is exit 2, and must not be mistaken for clean');
+  assert.match(r.stderr, /DID NOT RUN/);
+});
+
+test('main-audit.js exits 0 after a SUCCESSFUL roster request — the teardown that aborted in the wild', async () => {
+  // A refused connection tears down far less machinery than a 200. The wild repro
+  // was a successful roster call, so this is the case that actually matters.
+  const { proc, port } = await startStub();
+  try {
+    for (let i = 0; i < 3; i++) {
+      const r = runAudit(['--range', 'HEAD..HEAD'], atBase(`http://127.0.0.1:${port}`));
+      assert.notEqual(r.signal, 'SIGTERM', `run ${i + 1} timed out — leaked handle`);
+      assert.doesNotMatch(r.stderr || '', ABORT_RE, `run ${i + 1} aborted natively after a 200:\n${r.stderr}`);
+      assert.equal(r.status, 0, `run ${i + 1} exited ${r.status} (127 = the abort); stderr: ${r.stderr}`);
+    }
+  } finally {
+    proc.kill();
+  }
+});

package/tests/idea_develop_spark.mjs

@@ -382,6 +382,49 @@ await test('the CLI names both parties, and never prints "undefined"', () => {
   assert.doesNotMatch(out, /undefined|null/);
 });
 
+// task 1003654 — the R157 proof walk read "A board ratification window is open
+// until null" five times on cloudbongos.com. A NULL closes_at is the no-clock
+// constitution, NOT a broken window, so the copy has to name how the sitting
+// closes. One case per pass rule, plus the unknown-rule fallback, because the
+// whole failure was one branch that assumed a deadline always exists.
+for (const [rule, expected] of [
+  ['first_ratifier', /no clock; it closes on the first vote/],
+  ['consent', /no clock; it stands unless someone objects/],
+  ['majority', /no clock; it waits for a majority/],
+  ['unanimous', /no clock; it waits for a unanimous yes/],
+  [null, /no clock; it stays open until the board decides/],
+]) {
+  await test(`a clockless ${rule || 'unknown-rule'} window says how it closes, never "until null"`, () => {
+    const out = cli.renderDeveloped({
+      idea: { id: '77', completeness_score: 88 },
+      author_id: '9', developer_id: '42', self_developed: false,
+      board_window: { item_id: '3', closes_at: null, pass_rule: rule },
+    });
+    assert.match(out, /ratification window is open/);
+    assert.match(out, expected);
+    assert.doesNotMatch(out, /until null|undefined/);
+  });
+}
+
+// Held equal to government's own rule list, the way board.js's FULL_IDEA_PASS_BAR
+// is held equal to economy's — the CLI cannot require() a sibling module, so the
+// test is where the two lists meet. Without this, adding a fifth pass rule
+// silently drops its authors onto the unreadable-rule fallback.
+await test('EVERY pass rule government declares gets its own sentence, not the fallback', () => {
+  const { PASS_RULES } = require('../modules/government/config.js');
+  const fallback = cli.renderDeveloped({
+    idea: { id: '77', completeness_score: 88 }, author_id: '9', developer_id: '42', self_developed: false,
+    board_window: { item_id: '3', closes_at: null, pass_rule: '__no_such_rule__' },
+  });
+  for (const rule of PASS_RULES) {
+    const out = cli.renderDeveloped({
+      idea: { id: '77', completeness_score: 88 }, author_id: '9', developer_id: '42', self_developed: false,
+      board_window: { item_id: '3', closes_at: null, pass_rule: rule },
+    });
+    assert.notEqual(out, fallback, `pass rule '${rule}' falls through to the unreadable-rule fallback`);
+  }
+});
+
 await test('self-development reads as one person, not a handoff to yourself', () => {
   const out = cli.renderDeveloped({ idea: { id: '1', completeness_score: 70 }, author_id: '9', developer_id: '9', self_developed: true });
   assert.match(out, /You had the thought and you developed it/);

package/tests/idea_resubmit.mjs

@@ -25,7 +25,7 @@ const api = require('../src/module-api.js');
 
 // ---- the government port stub (registered BEFORE the routes load) ----------
 let rejectionAnswer = null;      // what latestRejectionForIdea returns
-let windowAnswer = { opened: true, item: { id: '31', closes_at: null } };
+let windowAnswer = { opened: true, item: { id: '31', closes_at: null, constitution: { pass_rule: 'first_ratifier' } } };
 const portCalls = [];
 if (!api.hasProvider('government')) {
   api.registerProvider('government', {
@@ -84,7 +84,7 @@ const fullIdea = (over = {}) => ({
 let passed = 0, failed = 0;
 async function test(name, fn) {
   queries = []; portCalls.length = 0;
-  rejectionAnswer = null; windowAnswer = { opened: true, item: { id: '31', closes_at: null } };
+  rejectionAnswer = null; windowAnswer = { opened: true, item: { id: '31', closes_at: null, constitution: { pass_rule: 'first_ratifier' } } };
   try { await fn(); passed++; console.log(`  ok  ${name}`); }
   catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
 }
@@ -113,7 +113,11 @@ await test('a board objection outranks the mechanical flag, and an ANSWERED sect
   assert.equal(r.payload.flagged_section, 'purpose', 'the human objection wins over the weakest-section flag');
   assert.equal(r.payload.flagged_section_changed, true);
   assert.equal(r.payload.rejection_source, 'board');
-  assert.deepEqual(r.payload.board_window, { item_id: '31', closes_at: null }, 'a new window opened');
+  // The pass rule rides along with the deadline (task 1003654): a clockless
+  // sitting reports closes_at null, and without the rule a caller cannot tell
+  // that apart from a broken window — which is how "open until null" reached
+  // authors in the first place.
+  assert.deepEqual(r.payload.board_window, { item_id: '31', closes_at: null, pass_rule: 'first_ratifier' }, 'a new window opened, and it says how it closes');
 });
 
 await test('reworking everything EXCEPT the flagged section reads changed:false', async () => {