@bongos/core 1.19.656 → 1.19.658

package/src/bongos/{stealth-gate.js → prelaunch-gate.js}

@@ -1,4 +1,31 @@
-// src/bongos/stealth-gate.js — the pre-launch stealth gate (task 1002775).
+// src/bongos/prelaunch-gate.js — the instance PRE-LAUNCH gate (task 1002775).
+//
+// ── THE NAME (task 1003152, owner decision 2026-09-09; ADR 0182 Decision 7) ──
+//
+// This was `stealth-gate.js` and it collided head-on with the OTHER live meaning
+// of the word. `platform_identity_projects.visibility = 'stealth'` is a project
+// that IS on the public orbs map — rendered as a black hole, anonymous, refusing
+// applications, but published and visible; only its identity is withheld. This
+// gate is close to the opposite: the whole instance is UNREADABLE without the
+// password. Same class of defect as ADR 0174's "role", which is why the rename
+// lives in the government goal.
+//
+// The PRODUCT meaning keeps the word — ADR 0182 locks it to the orb metaphor via
+// goal 1000046's own criterion, and the ~16 files carrying that sense are
+// deliberately untouched. Renaming those would have been the actual mistake.
+//
+// THREE IDENTIFIERS DID NOT MOVE, and each one is a deliberate choice, not a
+// missed occurrence (the vocabulary check below knows them by name):
+//
+//   • the cookie `cb_stealth` and the HMAC label `stealth-v1` — both are keyed
+//     INTO live cookies. Renaming either invalidates every outstanding cookie on
+//     a running instance and forces every holder to re-enter the password, to
+//     buy nothing: neither string is ever read by a human. The cookie name is
+//     wire format and the label is an HMAC message, not vocabulary.
+//   • `/__stealth` — the submit path. `/__prelaunch` is what the form posts to
+//     now; the old path is still accepted and still exempt, so a form already
+//     open in somebody's tab when this deploys still works instead of 401ing
+//     them back to the start.
 //
 // An instance that is built but not announced needs a door that is shut without
 // being broken. The proxy can do that with basic_auth, and task 1002774 did
@@ -11,8 +38,11 @@
 // So the gate lives in the app, where it can set a cookie the browser will send
 // to every subdomain:
 //
-//   - It is INERT unless STEALTH_PASSWORD is set. That is the portable default:
-//     a vanilla instance has no gate and needs no config to not have one.
+//   - It is INERT unless PRELAUNCH_PASSWORD is set. That is the portable
+//     default: a vanilla instance has no gate and needs no config to not have
+//     one. STEALTH_PASSWORD is honoured as a deprecated alias — it is SET ON
+//     LIVE today, and a rename that did not read the old name would be an
+//     instant outage.
 //   - The cookie is a SESSION cookie — no Max-Age, no Expires — because the
 //     owner explicitly did not want it to outlive the browser. That is also the
 //     safer default: nothing is written to disk to be found later.
@@ -35,8 +65,15 @@
 const crypto = require('node:crypto');
 const { branding } = require('../branding');
 
+// Wire format, deliberately unrenamed — see the header. Both are keyed into
+// cookies that are live right now.
 const COOKIE = 'cb_stealth';
-const SUBMIT_PATH = '/__stealth';
+const HMAC_LABEL = 'stealth-v1';
+
+const SUBMIT_PATH = '/__prelaunch';
+// Accepted for as long as a form served before the rename might still be open.
+const LEGACY_SUBMIT_PATH = '/__stealth';
+const SUBMIT_PATHS = [SUBMIT_PATH, LEGACY_SUBMIT_PATH];
 
 // Paths that must answer even to a stranger, each for its own reason:
 //   /api/*    the GitHub OAuth round trip has to complete, and a gated callback
@@ -45,19 +82,37 @@ const SUBMIT_PATH = '/__stealth';
 //   /metrics  Prometheus, already access-gated on its own terms (loopback or
 //             bearer token) — double-gating it would break the scrape
 //   /version  the deploy pin check, a public commit sha
-const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__stealth$/];
+const EXEMPT = [/^\/api\//, /^\/healthz$/, /^\/metrics$/, /^\/version$/, /^\/__prelaunch$/, /^\/__stealth$/];
 
+// PRELAUNCH_PASSWORD is primary; STEALTH_PASSWORD is the deprecated alias. This
+// is the ONE read site for either, which is what makes honouring both a single
+// expression rather than a migration — and why the rename could be taken at all
+// without an outage window on a live instance already running the old name.
 function password() {
-  const p = process.env.STEALTH_PASSWORD;
+  const p = process.env.PRELAUNCH_PASSWORD || process.env.STEALTH_PASSWORD;
   return typeof p === 'string' && p.length ? p : null;
 }
 
+// Named once at mount, never per request: a warning on every gated request would
+// be a log flood on exactly the instance that is hardest to look at. Dropping the
+// alias is a separate, later task — this only makes the deprecation audible.
+function warnIfLegacyEnv(log = console.warn) {
+  const hasNew = typeof process.env.PRELAUNCH_PASSWORD === 'string' && process.env.PRELAUNCH_PASSWORD.length;
+  const hasOld = typeof process.env.STEALTH_PASSWORD === 'string' && process.env.STEALTH_PASSWORD.length;
+  if (hasNew || !hasOld) return false;
+  log('[prelaunch-gate] STEALTH_PASSWORD is DEPRECATED and still the only password set. '
+    + 'Set PRELAUNCH_PASSWORD to the same value (task 1003152); the old name is read for now '
+    + 'and will be dropped in a later task.');
+  return true;
+}
+
 function enabled() { return password() !== null; }
 
 // The token a valid cookie must carry. Keyed by the password, so the password
 // itself never leaves the server and a rotation invalidates every cookie.
+// HMAC_LABEL is deliberately still 'stealth-v1' — see the header.
 function expectedToken() {
-  return crypto.createHmac('sha256', password()).update('stealth-v1').digest('hex');
+  return crypto.createHmac('sha256', password()).update(HMAC_LABEL).digest('hex');
 }
 
 function tokenMatches(raw) {
@@ -118,7 +173,7 @@ function relativeReturn(raw) {
   if (typeof raw !== 'string' || !raw.length || raw.length > 512) return null;
   if (!raw.startsWith('/') || raw.startsWith('//') || raw.includes('\\')) return null;
   if (/[\x00-\x1f\x7f]/.test(raw)) return null;
-  if (raw === '/' || raw.startsWith(SUBMIT_PATH)) return null;
+  if (raw === '/' || SUBMIT_PATHS.some((p) => raw.startsWith(p))) return null;
   return raw;
 }
 
@@ -178,11 +233,12 @@ function productName() {
 
 // Mounted FIRST, ahead of every other surface — a route registered earlier would
 // answer before the gate ever ran.
-function stealthGate() {
-  return function stealth(req, res, next) {
+function prelaunchGate() {
+  warnIfLegacyEnv();
+  return function prelaunch(req, res, next) {
     if (!enabled()) return next();
 
-    if (req.method === 'POST' && req.path === SUBMIT_PATH) {
+    if (req.method === 'POST' && SUBMIT_PATHS.includes(req.path)) {
       // The form is urlencoded; body parsers mount later (and only on some
       // routers), so read it here rather than depending on middleware order.
       let body = '';
@@ -226,4 +282,7 @@ function stealthGate() {
   };
 }
 
-module.exports = { stealthGate, enabled, isExempt, tokenMatches, expectedToken, COOKIE, SUBMIT_PATH };
+module.exports = {
+  prelaunchGate, enabled, isExempt, tokenMatches, expectedToken, warnIfLegacyEnv,
+  COOKIE, HMAC_LABEL, SUBMIT_PATH, LEGACY_SUBMIT_PATH, SUBMIT_PATHS,
+};

package/src/bongos/serve-internal.js

@@ -47,7 +47,7 @@ const { buildInfo } = require('../build-info');
 const { buildDevboxDownloads } = require('../devbox-downloads');
 const { buildBongosDownloads } = require('../bongos-downloads');
 const { clientBranding, branding } = require('../branding');
-const { stealthGate } = require('./stealth-gate');
+const { prelaunchGate } = require('./prelaunch-gate');
 const { platformVisibilityGate } = require('./platform-visibility-gate');
 const { clientModules, isModuleEnabled } = require('../modules');
 const { hallWidgetScripts, moduleWebSurfaces } = require('../module-loader/loader');
@@ -494,15 +494,15 @@ function mountInternalSurfaces(app) {
   // game routes too) — it records on res 'finish' regardless of which handler
   // answers. The /metrics scrape endpoint is access-gated (loopback Prometheus
   // or Bearer METRICS_TOKEN; see metrics.authorizeScrape).
-  // THE STEALTH GATE (task 1002775) mounts before anything it is meant to
+  // THE PRE-LAUNCH GATE (task 1002775) mounts before anything it is meant to
   // cover — a surface registered earlier would answer first and the gate would
-  // never run. Inert unless STEALTH_PASSWORD is set, so a vanilla instance is
+  // never run. Inert unless PRELAUNCH_PASSWORD is set, so a vanilla instance is
   // unaffected and pays only a closure call per request.
   //
   // It sits ABOVE the metrics middleware deliberately: a refused knock is still
   // a request this instance served, and hiding gate 401s would make the traffic
   // graph lie about how much attention an unannounced instance is getting.
-  app.use(stealthGate());
+  app.use(prelaunchGate());
 
   app.use(metrics.httpMiddleware());
   app.get('/metrics', metrics.metricsHandler());

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.656'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.658'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_room_copy.mjs

@@ -36,6 +36,10 @@ const CLIENT = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', '
 const HTML = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'government.html'), 'utf8');
 const BOARD = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.js'), 'utf8');
 const BOARD_HTML = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-room.html'), 'utf8');
+// The vocabulary both pages speak (task 1003761). The pass-rule maps and
+// rankNames were one copy per page until the hoist; the assertions that read
+// them come here now, and there is one place to read rather than two.
+const LIB = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'board-lib.js'), 'utf8');
 const { PASS_RULES } = require(path.join(ROOT, 'modules', 'government', 'config.js'));
 
 const card = () => BOARD.slice(BOARD.indexOf('function itemCard'), BOARD.indexOf('async function loadBoard'));
@@ -47,7 +51,13 @@ const card = () => BOARD.slice(BOARD.indexOf('function itemCard'), BOARD.indexOf
 const CODE = BOARD.split(/\r?\n/).filter((l) => !/^\s*\/\//.test(l)).join('\n');
 
 test('every pass rule the server can hold has a plain-language sentence', () => {
-  const block = BOARD.slice(BOARD.indexOf('const PASS_RULE_PLAIN'), BOARD.indexOf('function decidedByHtml'));
+  // In board-lib.js since task 1003761. Both landmarks are asserted before the
+  // slice for the reason the next test spells out: an indexOf that misses
+  // returns -1, and slice(start, -1) would hand this most of the file.
+  const start = LIB.indexOf('const PASS_RULE_PLAIN');
+  const end = LIB.indexOf('shared row pieces');
+  assert.ok(start !== -1 && end > start, 'PASS_RULE_PLAIN sits above the row pieces in board-lib.js');
+  const block = LIB.slice(start, end);
   assert.ok(PASS_RULES.length >= 3, `sanity: found the real rule set (${PASS_RULES})`);
   for (const rule of PASS_RULES) {
     assert.ok(block.includes(`${rule}:`), `PASS_RULE_PLAIN must explain '${rule}' — a rule with no copy renders its enum key`);
@@ -60,24 +70,24 @@ test('every pass rule the server can hold has a plain-language sentence', () =>
 });
 
 test('the short name map covers the same rule set (the history line)', () => {
-  // Its reader (historyRow, the amendment change-history) stayed on the
-  // government page when ADR 0266 carved the room out, so this map stayed with
-  // it. The slice therefore ends at a landmark that is still IN government.js —
-  // it used to end at `const PASS_RULE_PLAIN`, which has moved to board-room.js,
-  // and an indexOf that misses returns -1: `slice(start, -1)` would have handed
-  // this assertion most of the file and passed for the wrong reason.
-  const start = CLIENT.indexOf('const PASS_RULE_NAME');
-  const end = CLIENT.indexOf('function dialRow');
-  assert.ok(start !== -1 && end > start, 'PASS_RULE_NAME sits above dialRow in government.js');
-  const block = CLIENT.slice(start, end);
+  // Its reader (historyRow, the amendment change-history) is on the government
+  // page; the map itself joined its sentence-length twin in board-lib.js in task
+  // 1003761, so the two renderings of one pass rule sit adjacent and cannot
+  // describe the same rule differently. The landmark check stays and matters:
+  // an indexOf that misses returns -1, and `slice(start, -1)` would hand this
+  // assertion most of the file and pass for the wrong reason.
+  const start = LIB.indexOf('const PASS_RULE_NAME');
+  const end = LIB.indexOf('const PASS_RULE_PLAIN');
+  assert.ok(start !== -1 && end > start, 'PASS_RULE_NAME sits above PASS_RULE_PLAIN in board-lib.js');
+  const block = LIB.slice(start, end);
   for (const rule of PASS_RULES) {
     assert.ok(block.includes(`${rule}:`), `PASS_RULE_NAME must name '${rule}'`);
   }
 });
 
 test('a rank reaches the reader as a LABEL, never as the enum key', () => {
-  assert.match(BOARD, /function rankNames\(keys\)[\s\S]*?window\.OTB\.rankLabel\(k\)/,
-    'the board card resolves rank keys through the branding pack');
+  assert.match(LIB, /function rankNames\(keys\)[\s\S]*?window\.OTB\.rankLabel\(k\)/,
+    'the shared vocabulary resolves rank keys through the branding pack');
   const membership = CLIENT.slice(CLIENT.indexOf('function membershipSentence'), CLIENT.indexOf('function passRuleSentence'));
   assert.match(membership, /window\.OTB\.rankLabel\(k\)/,
     'so does the Constitution sentence — `archon` is an enum, "Owner" is what a person reads');
@@ -101,7 +111,13 @@ test('the card order is title → action → the idea → the apparatus', () =>
 });
 
 test('the idea renders OPEN — never behind a summary', () => {
-  const sections = BOARD.slice(BOARD.indexOf('function ideaSectionsHtml'), BOARD.indexOf('function rankNames'));
+  // Ends at decidedByHtml, the declaration that now follows: rankNames was the
+  // old landmark and moved to board-lib.js in task 1003761. Asserted, not
+  // assumed — a missing landmark is -1 and would silently invert this test.
+  const from = BOARD.indexOf('function ideaSectionsHtml');
+  const to = BOARD.indexOf('function decidedByHtml');
+  assert.ok(from !== -1 && to > from, 'ideaSectionsHtml sits above decidedByHtml in board-room.js');
+  const sections = BOARD.slice(from, to);
   assert.ok(!/<details/.test(sections),
     'the substance of the vote is not a disclosure — that was the reported bug');
   assert.match(sections, /gov-idea__body/, 'and it is set as prose, not as a config row');

package/tests/government_constitution_view.mjs

@@ -95,12 +95,17 @@ test('the read rides the vote atom, and the client renders the SERVER value (sou
 // of a grammar is exactly the drift that produced the bug this task fixes, so
 // they are held equal here over every form.
 //
+// The mirror lives in modules/hall-ui/public/board-lib.js since task 1003761.
+// It was in government.js, and ADR 0266's carve left a SECOND copy in
+// board-room.js — so this test lifted one of two implementations and proved
+// nothing about the other. One copy, one lift.
+//
 // This matters more than a normal mirror: the Constitution panel is where an
 // owner READS who governs before deciding whether to change it. A panel that
 // misdescribes the franchise is the same failure as a resolver that mis-seats
 // it, one layer up.
 test('the hall renders every predicate form the server actually resolves', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/government.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/board-lib.js'), 'utf8');
 
   // Lift the browser mirror out of the IIFE and run it.
   const ladder = /const STANDARD_LADDER = (\[[^\]]*\]);/.exec(src);
@@ -131,7 +136,7 @@ test('the hall renders every predicate form the server actually resolves', () =>
 });
 
 test('the ladder the hall expands against IS the government ladder', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/government.js'), 'utf8');
+  const src = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/board-lib.js'), 'utf8');
   const { RANK_ORDER } = require(path.join(ROOT, 'modules/government/catalog.js'));
   const m = /const STANDARD_LADDER = \[([^\]]*)\]/.exec(src);
   assert.ok(m);

package/tests/{stealth_gate.mjs → prelaunch_gate.mjs}

@@ -1,4 +1,4 @@
-// tests/stealth_gate.mjs — the pre-launch stealth gate (task 1002775).
+// tests/prelaunch_gate.mjs — the instance pre-launch gate (task 1002775).
 //
 // A gate that is wrong in either direction is worse than no gate: too open and
 // the unannounced instance is readable; too closed and it locks out sign-in,
@@ -6,7 +6,7 @@
 // gate's whole job is to sit in front of surfaces registered elsewhere — a unit
 // test of the middleware alone could not prove it was mounted early enough.
 //
-// Run:  node --test tests/stealth_gate.mjs
+// Run:  node --test tests/prelaunch_gate.mjs
 
 import assert from 'node:assert/strict';
 import { test, before, after } from 'node:test';
@@ -16,9 +16,9 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 
 const PASSWORD = 'a-test-password';
-process.env.STEALTH_PASSWORD = PASSWORD;   // set BEFORE the app is built
+process.env.PRELAUNCH_PASSWORD = PASSWORD;   // set BEFORE the app is built
 
-const gate = require('../src/bongos/stealth-gate.js');
+const gate = require('../src/bongos/prelaunch-gate.js');
 const platformMod = require('../src/platform-server.js');
 
 let server, port;
@@ -74,7 +74,7 @@ test('the form leaks nothing about the product it is hiding', async () => {
 
 test('every human surface is gated, not just the front page', async () => {
   // the old proxy lock covered '/' but not '/projects', so the hub leaked for
-  // the whole stealth period — that regression must be impossible here
+  // the whole pre-launch period — that regression must be impossible here
   for (const p of ['/', '/projects', '/create', '/builders', '/docs']) {
     const res = await request(p);
     assert.equal(res.status, 401, `${p} must be gated`);
@@ -209,9 +209,9 @@ test('a forged or stale cookie does not open it', async () => {
 
 test('rotating the password invalidates outstanding cookies', async () => {
   const old = validCookie();
-  process.env.STEALTH_PASSWORD = 'a-different-password';
+  process.env.PRELAUNCH_PASSWORD = 'a-different-password';
   const res = await request('/', { cookie: old });
-  process.env.STEALTH_PASSWORD = PASSWORD;
+  process.env.PRELAUNCH_PASSWORD = PASSWORD;
   assert.equal(res.status, 401, 'the token is keyed by the password, so a rotation revokes');
 });
 
@@ -219,16 +219,145 @@ test('an oversized POST body is dropped rather than buffered', async () => {
   // a password is not a payload — the handler reads the body itself, so it must
   // bound it or it is a trivial memory sink on an unauthenticated endpoint
   const src = require('node:fs').readFileSync(
-    new URL('../src/bongos/stealth-gate.js', import.meta.url), 'utf8');
+    new URL('../src/bongos/prelaunch-gate.js', import.meta.url), 'utf8');
   assert.match(src, /body\.length > \d+/, 'the body read must be bounded');
   assert.match(src, /req\.destroy\(\)/);
 });
 
 test('the gate is inert when no password is configured', () => {
   // the portable default: a vanilla instance has no gate and needs no config
-  // to not have one
+  // to not have one. BOTH names must be clear — an alias that kept the gate up
+  // after the primary was unset would be the same bug in reverse.
+  delete process.env.PRELAUNCH_PASSWORD;
   delete process.env.STEALTH_PASSWORD;
   assert.equal(gate.enabled(), false);
-  process.env.STEALTH_PASSWORD = PASSWORD;
+  process.env.PRELAUNCH_PASSWORD = PASSWORD;
   assert.equal(gate.enabled(), true);
 });
+
+// ── the rename's compatibility surface (task 1003152) ───────────────────────
+//
+// STEALTH_PASSWORD is SET ON LIVE cloudbongos.com right now. A rename that did
+// not read the old name would be an instant, total outage of the instance — so
+// these are the tests that make the rename safe to deploy, not nice-to-haves.
+
+test('the DEPRECATED STEALTH_PASSWORD alone still opens the gate', async () => {
+  delete process.env.PRELAUNCH_PASSWORD;
+  process.env.STEALTH_PASSWORD = PASSWORD;
+  try {
+    assert.equal(gate.enabled(), true, 'an instance running only the old name must not go dark');
+    // and the cookie it mints is the same one, because the HMAC label did not move
+    const res = await request('/', { cookie: `${gate.COOKIE}=${gate.expectedToken()}` });
+    assert.equal(res.status, 200, 'a cookie held across the rename must still be honoured');
+  } finally {
+    delete process.env.STEALTH_PASSWORD;
+    process.env.PRELAUNCH_PASSWORD = PASSWORD;
+  }
+});
+
+test('PRELAUNCH_PASSWORD wins when both are set', () => {
+  const fromNewNameAlone = gate.expectedToken();   // PRELAUNCH_PASSWORD only
+  process.env.STEALTH_PASSWORD = 'the-old-one';
+  try {
+    assert.equal(gate.expectedToken(), fromNewNameAlone,
+      'the primary name is primary — an operator who sets the new one and forgets '
+      + 'to clear the old must get the value they just wrote, not the stale one');
+  } finally {
+    delete process.env.STEALTH_PASSWORD;
+  }
+});
+
+test('running on the old name alone warns once, at mount', () => {
+  const lines = [];
+  const log = (m) => lines.push(String(m));
+  delete process.env.PRELAUNCH_PASSWORD;
+  process.env.STEALTH_PASSWORD = PASSWORD;
+  try {
+    assert.equal(gate.warnIfLegacyEnv(log), true, 'the deprecation must be audible');
+    assert.match(lines.join('\n'), /PRELAUNCH_PASSWORD/, 'the warning must name the replacement');
+  } finally {
+    delete process.env.STEALTH_PASSWORD;
+    process.env.PRELAUNCH_PASSWORD = PASSWORD;
+  }
+  // silent once the new name is set — nobody needs a warning they have acted on
+  assert.equal(gate.warnIfLegacyEnv(log), false);
+});
+
+test('both submit paths are accepted, and both are exempt', async () => {
+  // A form served before the rename may still be open in somebody's tab. The old
+  // path keeps working so their password lands them in, not on a 401.
+  assert.equal(gate.SUBMIT_PATH, '/__prelaunch');
+  assert.equal(gate.LEGACY_SUBMIT_PATH, '/__stealth');
+  for (const p of gate.SUBMIT_PATHS) {
+    assert.equal(gate.isExempt(p), true, `${p} must be exempt or the submit is gated behind itself`);
+    const res = await request(p, { method: 'POST', body: `password=${encodeURIComponent(PASSWORD)}` });
+    assert.equal(res.status, 303, `POST ${p} must accept the password`);
+    assert.match(String(res.headers['set-cookie'] || ''), new RegExp(gate.COOKIE),
+      `POST ${p} must mint the cookie`);
+  }
+});
+
+test('the wire format did NOT move — renaming it would log everyone out', () => {
+  // Deliberate, and the reason it is pinned: the cookie name and the HMAC label
+  // are baked into cookies that are live right now. A later "finish the rename"
+  // pass that changes either forces every holder to re-enter the password, to
+  // buy nothing — neither string is ever read by a human.
+  assert.equal(gate.COOKIE, 'cb_stealth');
+  assert.equal(gate.HMAC_LABEL, 'stealth-v1');
+});
+
+// ── the vocabulary wall around the rename (check 19d, task 1003152) ─────────
+//
+// ADR 0174's lesson, applied: a naming rule is the easiest kind of check to ship
+// broken — allowlist enough and it passes forever while proving nothing. So the
+// load-bearing tests are the MUTATION tests. A rule that cannot be made to fail
+// is not a rule.
+
+const fitness = require('../scripts/gds/fitness.js');
+
+test('the pre-launch surface is clean today', () => {
+  const r = fitness.checkPrelaunchVocabulary();
+  assert.equal(r.ok, true, `check 19d is failing on the real tree:\n${r.violations.join('\n')}`);
+  assert.ok(r.note.includes('file(s) scanned'), 'the check must report what it scanned');
+});
+
+test('a planted "stealth" on the pre-launch surface REDS the build', () => {
+  assert.ok(plantInGate('// the stealth gate mounts here').some((v) => /"stealth"/.test(v)),
+    'the retired word must be caught, or the rename un-does itself one comment at a time');
+});
+
+test('a documented COMPATIBILITY identifier is not a violation', () => {
+  // The four that deliberately stayed. Catching these would force an allowlist,
+  // which is what the citation/compat split exists to avoid.
+  for (const line of ["const c = 'cb_stealth';", "hmac('stealth-v1');",
+    "path === '/__stealth'", 'process.env.STEALTH_PASSWORD']) {
+    assert.equal(plantInGate(line).length, 0, `the compat identifier tripped the wall: ${line}`);
+  }
+});
+
+test('a line CITING the rename or the other meaning may say the word', () => {
+  for (const line of ['// renamed from stealth-gate.js (task 1003152)',
+    "// platform_identity_projects.visibility = 'stealth' is the OTHER meaning"]) {
+    assert.equal(plantInGate(line).length, 0, `a citation tripped the wall: ${line}`);
+  }
+});
+
+test('the citation does NOT excuse the rest of the file', () => {
+  // The header cites task 1003152 on its own line. If the exemption were
+  // file-scoped rather than line-scoped, every later line would ride it.
+  assert.ok(plantInGate('// bring back the stealth wording').length > 0,
+    'an uncited line must still red — a file-wide exemption is an allowlist wearing a regex');
+});
+
+// Plant a line into the real gate file, run the real check, restore.
+function plantInGate(line) {
+  const fs = require('node:fs');
+  const target = new URL('../src/bongos/prelaunch-gate.js', import.meta.url);
+  const original = fs.readFileSync(target, 'utf8');
+  try {
+    fs.writeFileSync(target, `${original}\n${line}\n`);
+    return fitness.checkPrelaunchVocabulary().violations;
+  } finally {
+    fs.writeFileSync(target, original);
+  }
+}

package/tests/rank_tier_single_source.mjs

@@ -107,23 +107,35 @@ const STATIC_LADDER_FILES = [
   'modules/hall-ui/public/ranks.js',
   'modules/hall-ui/public/profile.js',
   'modules/hall-ui/public/watch.js',
-  // task 1003094: the Constitution panel expands the `rank:<key>+` membership
-  // form ("that rank and above") to render who governs in plain language, so it
-  // needs the ladder to expand against. Browser code cannot require the server
-  // module — the established mirror pattern here — and listing it in this array
-  // is what makes the copy provable rather than merely allowed. A second,
-  // government-specific pin lives in tests/government_constitution_view.mjs,
-  // which holds it against catalog.RANK_ORDER and holds the whole browser parser
-  // equal to the server one.
+  // task 1003094: the Constitution panel and the Board Room's sitting card both
+  // expand the `rank:<key>+` membership form ("that rank and above") to render
+  // who governs in plain language, so both need the ladder to expand against.
+  // Browser code cannot require the server module — the established mirror
+  // pattern here — and listing it in this array is what makes the copy provable
+  // rather than merely allowed.
+  //
+  // ONE ROW, not two, since task 1003761. ADR 0266 carved the Board Room onto
+  // its own page and the carve COPIED the ladder and the parser into both page
+  // files, so this array had to allowlist BOTH — which permitted a drift between
+  // them by construction: the exact-literal pin below proved each matched the
+  // canonical ladder, but nothing held the two parsers equal to EACH OTHER, and
+  // government_constitution_view.mjs lifted only one of them. board-lib.js is
+  // the single copy now. A second, government-specific pin lives in
+  // tests/government_constitution_view.mjs, which holds it against
+  // catalog.RANK_ORDER and runs the whole browser parser against the server one.
+  //
+  // This row used to claim tests/government_board_vote_ui.mjs pinned the
+  // board-room copy. It does not — that file asserts the sitting card, the
+  // ballot and the vote form, and has no parser assertion at all, so the second
+  // copy was guarded only by the exact-literal ladder match.
+  'modules/hall-ui/public/board-lib.js',
+  // government.js keeps a ladder literal of its own — the charter library's
+  // `seatsRanks` worked example for `rank:xenos+` (the full ladder, spelled out
+  // so a reader sees what the predicate resolves to). That is documentation of
+  // the grammar rather than a second implementation of it, and it must still
+  // match the canonical order or the example teaches a ladder that does not
+  // exist.
   'modules/hall-ui/public/government.js',
-  // ADR 0266: the Board Room moved off the government page onto its own, and the
-  // sitting card's `decidedByHtml` expands the same `rank:<key>+` membership form
-  // to say who may vote on THAT sitting — so the carve took a copy of the ladder
-  // with it. Same reason as the row above (browser code cannot require the server
-  // module), and the same pinning: `tests/government_board_vote_ui.mjs` reads
-  // board-room.js and holds its predicate parser equal to the server's, and the
-  // pin below in this file holds the array itself against LIVE_RANK_LADDER.
-  'modules/hall-ui/public/board-room.js',
   // task 1002487: the pure agent-definition validator applies the ADR 0043
   // sub-Metic floor to an agent's declared scope, so it needs the ladder to
   // compare against. It is one of the "dependency-free" cases this array exists