@bongos/core 1.19.932 → 1.19.934

package/modules/hall-ui/public/board-room.js

@@ -27,7 +27,7 @@
 // TASK 1003270's two rules came with the card and still govern edits here:
 //   • NO RAW CONFIG KEY REACHES A READER. `first_ratifier` / `rank:archon` /
 //     `why_matters` are grammar for the server; a person gets the sentence
-//     (decidedByHtml, rankNames, SECTION_LABELS). The single exception is a
+//     (decidedByHtml, rankNames, SECTION_LABELS_BY_TEMPLATE). The single exception is a
 //     membership predicate that cannot be PARSED, where the broken string is
 //     the actionable fact.
 //   • COPY THAT EXPLAINS THE UI TO ITSELF IS DELETED, not shortened.
@@ -50,8 +50,8 @@
 // `fetchJson` / `sendJson` stay per-page: a hall page script is a self-contained
 // IIFE over the DOM, and those two carry this page's own error copy.
 //
-// SECTION_LABELS and fmtRemaining stay HERE, not in the lib — this page is their
-// only reader, and the lib is for what the two pages share.
+// SECTION_LABELS_BY_TEMPLATE and fmtRemaining stay HERE, not in the lib — this
+// page is their only reader, and the lib is for what the two pages share.
 //
 // The function ORDER here is deliberate and matches the pre-carve source:
 // tests/government_board_room_copy.mjs slices this file by function-name
@@ -165,7 +165,7 @@
       // wrote under and the objector picked from. `why_matters` is a jsonb key,
       // not something a reader should have to decode.
       const objection = v.direction === 'no'
-        ? `<p class="ov-row__sub">objected to <strong>${escapeHtml(SECTION_LABELS[v.section_key] || v.section_key || 'the idea')}</strong>: ${escapeHtml(v.reason_md || '')}</p>`
+        ? `<p class="ov-row__sub">objected to <strong>${escapeHtml(labelsOf(item)[v.section_key] || ANY_SECTION_LABEL[v.section_key] || v.section_key || 'the idea')}</strong>: ${escapeHtml(v.reason_md || '')}</p>`
         : '';
       return `<li class="ov-row ov-row--dense"><div class="ov-row__main">
         <span class="ov-row__title">${who}${mine}</span>
@@ -178,17 +178,59 @@
 
   // ---- the vote form (R17) -----------------------------------------------------
 
-  // The five section labels, mirrored from the base template declaration
+  // The section labels, mirrored from the template declarations
   // (modules/ideas/templates.js — the words the author saw when writing; a test
   // holds the two equal, since browser code cannot import a server module).
-  const SECTION_LABELS = {
-    purpose: 'Purpose of Idea',
-    big_picture: 'What does the Big Picture look like',
-    why_had: 'Why did you have the Idea',
-    why_matters: 'Why does the Idea Matter',
-    fit: 'How does the Idea Fit into the big picture of the project',
+  //
+  // ⚠ ONE MAP PER VINTAGE, KEYED BY `template_key` (task 1004085 / BV2.R06).
+  // There used to be one flat map, which was right while there was one template.
+  // It cannot be flattened again: `why_had` and `fit` exist in BOTH vintages with
+  // DIFFERENT questions behind them, so a merged map would show one idea's author
+  // the words a different author was asked. The label is a quotation, and the
+  // thing it quotes is the template the subject was actually written against.
+  const SECTION_LABELS_BY_TEMPLATE = {
+    'base-v1': {
+      purpose: 'Purpose of Idea',
+      big_picture: 'What does the Big Picture look like',
+      why_had: 'Why did you have the Idea',
+      why_matters: 'Why does the Idea Matter',
+      fit: 'How does the Idea Fit into the big picture of the project',
+    },
+    'base-v2': {
+      why_had: 'What made you have the idea',
+      scope: 'Scope it as best as you can here',
+      build_context: 'What should an engineer or artist know prior to building',
+      fit: 'How is this long term justified in the project',
+      success: 'What does a successful implementation of the idea look like',
+    },
   };
 
+  // The vintage an item's sections should be read under.
+  //
+  // THE FALLBACK IS `base-v1`, AND IT IS NOT THE SERVER'S DEFAULT. An item with
+  // no template to read is an AMENDMENT (which has no Full Idea behind it at all,
+  // yet still needs a section picker, because the DB requires every objection to
+  // name one) or a full_idea whose subject row was deleted. Falling back to the
+  // current default would silently change what those items have always offered;
+  // falling back to v1 keeps them byte-identical to before this task. A vintage
+  // this shipped page has never heard of falls here too — see sectionsOf.
+  function templateOf(item) {
+    const key = item && item.subject && item.subject.template_key;
+    return SECTION_LABELS_BY_TEMPLATE[key] ? key : 'base-v1';
+  }
+
+  function labelsOf(item) {
+    return SECTION_LABELS_BY_TEMPLATE[templateOf(item)];
+  }
+
+  // DECODE-ONLY, and deliberately not used to render a form. A stored objection
+  // names a section that was legal when it was cast, which on an item whose
+  // vintage this page cannot resolve is a key no per-vintage map holds. Turning
+  // it into SOME readable words beats printing `why_matters` at a reader, and the
+  // ambiguity the per-vintage maps exist to avoid does not arise here: the item's
+  // own map is consulted first, and this is only the fallback behind it.
+  const ANY_SECTION_LABEL = Object.assign({}, ...Object.values(SECTION_LABELS_BY_TEMPLATE));
+
   // The idea's five sections, IN FRONT of the voter — the entire reason voting
   // happens in the hall rather than on a reaction. Rendered in template order.
   //
@@ -202,12 +244,20 @@
   function ideaSectionsHtml(item) {
     const fv = item.subject && item.subject.field_values;
     if (!fv) return '';
-    const rows = Object.keys(SECTION_LABELS).map((key) => {
+    const labels = labelsOf(item);
+    // The item's own vintage first, in its declared order — then anything the
+    // author wrote that this page has no label for. That tail is normally empty
+    // and exists so a vintage shipped after this page cannot make an author's
+    // answers INVISIBLE to the board being asked to ratify them: an unlabelled
+    // section reads as its key, which is ugly and honest, where dropping it is
+    // neither. (The vote FORM deliberately does not do this — see voteFormHtml.)
+    const extra = Object.keys(fv).filter((k) => !(k in labels));
+    const rows = Object.keys(labels).concat(extra).map((key) => {
       // An unanswered section is dropped rather than rendered as a bare heading:
       // a graded Full Idea has all five, and a blank one is only noise.
       const body = String(fv[key] ?? '').trim();
       if (!body) return '';
-      return `<h4 class="ov-prose__l">${escapeHtml(SECTION_LABELS[key])}</h4>
+      return `<h4 class="ov-prose__l">${escapeHtml(labels[key] || key)}</h4>
         <p class="ov-prose__p gov-idea__body">${escapeHtml(body)}</p>`;
     }).join('');
     return rows
@@ -268,8 +318,15 @@
     // discovered by clicking.
     const isOwnIdea = item.subject_type === 'full_idea'
       && item.subject && String(item.subject.author_id) === String(viewerId);
-    const sections = Object.keys(SECTION_LABELS).map((key) => `
-      <label class="gov-vote__section"><input type="radio" name="vote-section-${escapeHtml(item.id)}" value="${escapeHtml(key)}"> <span>${escapeHtml(SECTION_LABELS[key])}</span></label>`).join('');
+    // THE PICKER OFFERS THE ITEM'S OWN VINTAGE, AND ONLY KEYS THE SERVER ACCEPTS.
+    // Unlike the prose above it does NOT fall through to whatever the author
+    // wrote: government_003's CHECK (widened by government_017) is a closed
+    // vocabulary, so offering a section outside it would render a radio whose
+    // only outcome is a refused vote. A vintage this page cannot resolve keeps
+    // base-v1's five — see templateOf.
+    const labels = labelsOf(item);
+    const sections = Object.keys(labels).map((key) => `
+      <label class="gov-vote__section"><input type="radio" name="vote-section-${escapeHtml(item.id)}" value="${escapeHtml(key)}"> <span>${escapeHtml(labels[key])}</span></label>`).join('');
     const ownNote = isOwnIdea
       ? `<p class="gov-grid-note">Your own idea. You may vote, but it can’t be decided by your vote alone, and a vote on your own idea earns no karma.</p>`
       : '';

package/modules/ideas/migrations/ideas_008_template_default_v2.sql

@@ -0,0 +1,37 @@
+-- ideas_008_template_default_v2.sql — a NEW Full Idea is written against
+-- `base-v2` (task 1004085 / BV2.R06, goal 1000095; spec decision 10 in
+-- docs/specs/bongos-v2-ideator-surface.md).
+--
+-- WHAT THIS DOES NOT DO: it does not touch a single stored row. `template_key`
+-- has been NOT NULL with a value on every row since ideas_001, and every writer
+-- passes the key explicitly, so there is nothing to backfill and nothing to
+-- reinterpret. The hundreds of ideas already filed keep saying 'base-v1' and keep
+-- being rendered and scored against the questions they were actually asked —
+-- which is the entire promise of versioning the template rather than editing it.
+-- A backfill here would be the bug, not the missing half: `completeness_score`
+-- feeds the ideator credit lane (R147), so re-scoring old thoughts against new
+-- questions would quietly change what work already paid.
+--
+-- WHY MOVE THE COLUMN DEFAULT AT ALL, then. Belt and braces. The default is
+-- unreachable in normal operation — modules/ideas/grades.js always names the key,
+-- taking it from projection.js's DEFAULT_TEMPLATE_KEY, which this migration
+-- mirrors. But a column default is a STATEMENT about what a row without an
+-- opinion is, and leaving it at 'base-v1' would leave that statement false and
+-- waiting: the first writer that ever omits the column would silently mint a new
+-- idea wearing a retired vintage, validate its answers against the wrong five
+-- questions, and score it against the wrong floors. Two statements of one fact
+-- are only safe while they agree.
+--
+-- ALTER … SET DEFAULT is metadata only: no table rewrite, no lock held on the
+-- rows, safe on a live instance of any size.
+--
+-- Additive and forward-safe. There is no down-migration, and the way back is not
+-- this file run in reverse: 'base-v1' stays registered in modules/ideas/
+-- templates.js forever, so reverting the default is a one-line code change with
+-- no data consequence either way.
+
+BEGIN;
+
+ALTER TABLE ideas_grades ALTER COLUMN template_key SET DEFAULT 'base-v2';
+
+COMMIT;

package/modules/ideas/projection.js

@@ -57,9 +57,22 @@ const VALID_GRADES = ['quick', 'spark', 'full'];
 
 // Which template `field_values` was written against. Stored per row so a project
 // that later defines its own shape (R156) does not retro-reinterpret ideas
-// written against the base one. R141 declares what 'base-v1' actually contains —
-// this module only records which template a row used.
-const DEFAULT_TEMPLATE_KEY = 'base-v1';
+// written against the base one. `templates.js` declares what each key actually
+// contains — this module only records which template a row used.
+//
+// THIS IS THE DEFAULT FOR A NEW FILING ONLY, NEVER A READING OF A STORED ROW.
+// It moved 'base-v1' -> 'base-v2' in task 1004085 (BV2.R06, spec decision 10:
+// the five questions are replaced and versioned), and that move is safe for
+// exactly one reason — every graded row carries its own `template_key`, so the
+// hundreds already stored keep resolving to the v1 declaration and keep being
+// scored against the questions they were put. Anything that reaches for this
+// constant while holding a row is a bug: read `row.template_key`.
+//
+// `ideas_008_template_default_v2.sql` moves the COLUMN default to match. The two
+// are belt and braces — every writer passes the key explicitly — but a column
+// default that still said 'base-v1' would be a false statement about what a new
+// idea is, waiting for the first writer that forgets.
+const DEFAULT_TEMPLATE_KEY = 'base-v2';
 const TEMPLATE_KEY_RE = /^[a-z][a-z0-9-]*$/;
 const TEMPLATE_KEY_MAX = 64;
 

package/modules/ideas/templates.js

@@ -1,11 +1,18 @@
 // modules/ideas/templates.js — the Full Idea template declarations (task 1002917,
 // BV1.R141, goal 1000062).
 //
-// THIS FILE IS WHAT 'base-v1' MEANS. ideas_001_grades.sql stores `field_values`
-// jsonb against a `template_key` and deliberately declares nothing about shape —
-// its header says "R141 declares what 'base-v1' means". This is that declaration:
-// the five base fields, in the owner's own wording from the Holy Workshop Trinity
-// brief, in the order they display.
+// THIS FILE IS WHAT EVERY `template_key` MEANS. ideas_001_grades.sql stores
+// `field_values` jsonb against a `template_key` and deliberately declares nothing
+// about shape — its header says "R141 declares what 'base-v1' means". This is that
+// declaration, and since task 1004085 (BV2.R06) there are TWO of them: `base-v2`,
+// the questions a Full Idea is asked today, and `base-v1` beside it, the questions
+// the ideas already in the table were actually asked. Each is the owner's own
+// wording, in the order they display.
+//
+// A VINTAGE IS ADDITIVE AND FROZEN. A new question set is a new key in the
+// registry and a new default; the old declaration is never edited and never
+// removed, because the scorer walks whichever declaration a stored row names and
+// `completeness_score` feeds credits. Re-asking is free; re-scoring is not.
 //
 // THE TEMPLATE IS DATA, READ BY BOTH VALIDATION AND SCORING. Capture (R143)
 // validates a submitted `field_values` against a template with
@@ -43,7 +50,7 @@ const { DEFAULT_TEMPLATE_KEY, FIELD_VALUES_MAX } = require('./inbox');
 // answered, not padded past" — declared here as data so the scorer stays
 // template-agnostic; validation deliberately does NOT enforce it (a thin answer
 // is a scoring problem, not a capture error — scoring never blocks capture).
-const BASE_TEMPLATE = Object.freeze({
+const BASE_V1_TEMPLATE = Object.freeze({
   key: 'base-v1',
   label: 'Full Idea',
   fields: Object.freeze([
@@ -55,21 +62,81 @@ const BASE_TEMPLATE = Object.freeze({
   ]),
 });
 
-// The built-in registry. One entry today; a second built-in template would be
-// added here. Frozen so a consumer can never mutate the base declaration into
-// a de-facto fork — a different shape is a different registry (the seam above).
+// THE QUESTIONS A FULL IDEA IS ASKED TODAY (task 1004085 / BV2.R06, goal 1000095;
+// spec decision 10, `docs/specs/bongos-v2-ideator-surface.md`). The owner's own
+// set, in the owner's own order.
+//
+// WHY A SECOND TEMPLATE RATHER THAN AN EDIT TO THE FIRST. Every graded row stores
+// the `template_key` it was written against, and the scorer walks the declaration
+// that key resolves to — so editing `base-v1` in place would re-score hundreds of
+// already-filed ideas against questions nobody asked them, and `completeness_score`
+// feeds the ideator credit lane (R147). A thought is scored on the questions it
+// was actually put. `base-v1` above is therefore FROZEN HISTORY: it is never
+// edited again, only read.
+//
+// TWO KEYS ARE REUSED DELIBERATELY. `why_had` survives outright ("what made you
+// have the idea") and `fit` survives roughly (the long-term justification moved
+// from "how does it fit" to "how is it justified long term"). Reusing the key is
+// what makes this a registry entry instead of a data migration; `template_key` is
+// what keeps the two readings apart, so a v1 row's `fit` is still rendered under
+// the v1 label. `purpose`, `big_picture` and `why_matters` are NOT carried over —
+// they belong to v1 and stay there.
+//
+// THE FLOORS ARE FLAT 40, MATCHING v1, AND THAT IS TEMPORARY. The new questions
+// are not interchangeable ("scope it as best as you can" deserves more room than
+// "what made you have the idea"), but the score feeds credits, so choosing the
+// numbers is its own deliberate act — task 1004091 (BV2.R12) owns it. Shipping a
+// guess here would have been an unreviewed change to what a thought pays.
+const BASE_V2_TEMPLATE = Object.freeze({
+  key: 'base-v2',
+  label: 'Full Idea',
+  fields: Object.freeze([
+    Object.freeze({ key: 'why_had',       label: 'What made you have the idea',                                required: true, substanceMin: 40 }),
+    Object.freeze({ key: 'scope',         label: 'Scope it as best as you can here',                           required: true, substanceMin: 40 }),
+    Object.freeze({ key: 'build_context', label: 'What should an engineer or artist know prior to building',    required: true, substanceMin: 40 }),
+    Object.freeze({ key: 'fit',           label: 'How is this long term justified in the project',              required: true, substanceMin: 40 }),
+    Object.freeze({ key: 'success',       label: 'What does a successful implementation of the idea look like', required: true, substanceMin: 40 }),
+  ]),
+});
+
+// The template a NEW Full Idea is written against — an alias, not a sixth
+// declaration. Consumers that mean "the current questions" (scripts/gds/spark.js
+// prints them; the tests build a full payload from them) read this, so the alias
+// is what makes flipping the default a one-line change here rather than a sweep.
+// Anything that means a SPECIFIC vintage names `BASE_V1_TEMPLATE` /
+// `BASE_V2_TEMPLATE` instead.
+const BASE_TEMPLATE = BASE_V2_TEMPLATE;
+
+// The built-in registry. Two entries: what ideas are asked now, and what they
+// were asked before. Frozen so a consumer can never mutate a declaration into a
+// de-facto fork — a different shape is a different registry (the seam above).
+// AN ENTRY IS NEVER REMOVED FROM HERE while rows still name it: `templateFor`
+// returns null for an unknown key, and a null template is how a stored idea
+// loses its questions and its score at once.
 const BUILTIN_TEMPLATES = Object.freeze({
-  [BASE_TEMPLATE.key]: BASE_TEMPLATE,
+  [BASE_V1_TEMPLATE.key]: BASE_V1_TEMPLATE,
+  [BASE_V2_TEMPLATE.key]: BASE_V2_TEMPLATE,
 });
 
 // Sanity pin, not a runtime branch: the store's default key and this file's
-// base declaration are two statements of the same fact, and requiring them to
+// current declaration are two statements of the same fact, and requiring them to
 // agree at load time turns a rename-drift into a boot failure instead of a
 // silent "every new row validates against a template that does not exist".
 if (BASE_TEMPLATE.key !== DEFAULT_TEMPLATE_KEY) {
   throw new Error(`templates: BASE_TEMPLATE.key (${BASE_TEMPLATE.key}) !== inbox DEFAULT_TEMPLATE_KEY (${DEFAULT_TEMPLATE_KEY})`);
 }
 
+// The second half of the same pin, and the one this task exists to hold: every
+// vintage a row can still carry must stay resolvable. The default moving forward
+// is a feature; a retired template silently dropping out of the registry is the
+// failure mode — it would leave already-filed ideas with no questions to render
+// and no floors to score against.
+for (const t of [BASE_V1_TEMPLATE, BASE_V2_TEMPLATE]) {
+  if (!Object.hasOwn(BUILTIN_TEMPLATES, t.key)) {
+    throw new Error(`templates: ${t.key} is declared but not registered — an already-filed idea would lose its questions`);
+  }
+}
+
 // Resolve a template by key. Null for an unknown key — the caller decides
 // whether that is a 400 (capture) or a render-as-raw fallback (display).
 function templateFor(key, registry = BUILTIN_TEMPLATES) {
@@ -144,6 +211,8 @@ function validateFieldValues(fieldValues, { templateKey = DEFAULT_TEMPLATE_KEY,
 
 module.exports = {
   BASE_TEMPLATE,
+  BASE_V1_TEMPLATE,
+  BASE_V2_TEMPLATE,
   BUILTIN_TEMPLATES,
   templateFor,
   fieldOrder,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.932",
+  "version": "1.19.934",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.932",
+      "version": "1.19.934",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.932",
+  "version": "1.19.934",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/claude-materialize.js

@@ -32,7 +32,7 @@ const path = require('node:path');
 const { spawnSync } = require('node:child_process');
 const { VERBS } = require('../../bin/bongos.js'); // side-effect-free require (guarded main)
 const ic = require('../../src/instance-config'); // neutral configDir/envPrefix fallbacks (never a founder literal)
-const { isCorePackageName } = require('../../src/module-loader/catalog'); // one definition of "this checkout IS the core"
+const { isCorePackageName, CORE_PACKAGE_NAMES } = require('../../src/module-loader/catalog'); // one definition of "this checkout IS the core"
 const { renderInstanceClaudeMd } = require('./claude-md-template'); // task 2104 — the starter CLAUDE.md
 
 // script basename (e.g. "ship.js") → dedicated bongos verb, for verbs that map to a bare script with
@@ -630,11 +630,19 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
     summary.notes.push('no .instance-skills.json provenance in .claude/skills/ yet, so nothing was withdrawn — this run records it; a later run can withdraw the skills of a module that has since been disabled.');
   }
   // Record what landed, so the NEXT run can withdraw what this one placed.
-  if (!dryRun && overwrite) {
+  //
+  // REPORTED on a dry run, written only on a real one — the same split the starter CLAUDE.md
+  // below already uses. writtenPaths is a "what this run rewrites" list, and a dry run's job is
+  // to preview exactly that: upgrade.js asks for one to decide which dirty paths its clean-tree
+  // pre-flight may ignore (task 1004122), so a generated file missing from the preview is a file
+  // the pre-flight halts on and the real run then rewrites anyway.
+  if (overwrite) {
     const names = Object.keys(landedNow).sort();
     const manifest = { _doc: 'GENERATED by scripts/gds/claude-materialize.js (task 1003632): the module-declared skills a materialize landed in this instance. It is the provenance record that lets a later run WITHDRAW a skill whose module has since been disabled — a name absent from here is never deleted, so a hand-written skill is safe. Commit it; do not hand-edit.', skills: Object.fromEntries(names.map((n) => [n, landedNow[n]])) };
-    fs.mkdirSync(skillsDest, { recursive: true });
-    fs.writeFileSync(path.join(skillsDest, INSTANCE_SKILLS_MANIFEST), JSON.stringify(manifest, null, 2) + '\n');
+    if (!dryRun) {
+      fs.mkdirSync(skillsDest, { recursive: true });
+      fs.writeFileSync(path.join(skillsDest, INSTANCE_SKILLS_MANIFEST), JSON.stringify(manifest, null, 2) + '\n');
+    }
     addWritten(path.join('.claude/skills', INSTANCE_SKILLS_MANIFEST));
   }
 
@@ -741,6 +749,41 @@ function materializeClaude({ coreRoot, instanceDir, dryRun = false, overwrite =
   return summary;
 }
 
+// materializeWillRewrite — the instance-relative paths a materialize WOULD rewrite here, changing
+// nothing. `bongos upgrade` asks before it starts, to decide which dirty paths its clean-tree
+// pre-flight may waive.
+//
+// THE WEDGE THIS EXISTS FOR (task 1004122). The upgrade's materialize step rewrites `.claude/`
+// from the new core on EVERY bump, so after an upgrade that did not commit it — one from before
+// task 1003957, or any run without --commit-pin — the instance carries ~40 modified
+// `.claude/skills/*` files that nobody edited. upgrade.js's clean-tree pre-flight then read them
+// as a human's uncommitted work and refused, so the instance took exactly one upgrade and stuck:
+// `test4` (instance 11) failed its Deploy-page upgrade this way, and provision-core-upgrade.js
+// passes --commit-pin but NOT --force, so the button stayed dead until someone committed by hand.
+//
+// Asking materializeClaude what it WOULD write is a real provenance answer, not a path
+// allow-list: the set is derived from the core actually installed here, and every path in it
+// is one the materialize step overwrites unconditionally a few seconds later. Whatever those files hold right
+// now is discarded either way, so refusing on them protects nothing and stops every future
+// update. A path materialize would NOT touch — an owner's own skill, a dirty migration, a
+// half-finished edit — is absent from the set and still halts the bump, which is the whole
+// safety property. Under --commit-pin the same paths come back from that step as persistPin's
+// artifactPaths and are committed, so the tree ends clean and the next upgrade needs none of this.
+//
+// Probed against the core on disk NOW, not the target: the target is not installed yet, and the
+// two ship the same `.claude/` surface. Fail-soft — a materialize that throws (no core
+// installed, an unreadable tree) returns nothing and the pre-flight is as strict as it ever was.
+function materializeWillRewrite({ instanceDir, coreRoot, materialize = materializeClaude }, err = console.error) {
+  try {
+    const root = coreRoot || path.join(instanceDir, 'node_modules', CORE_PACKAGE_NAMES[0]);
+    const sum = materialize({ coreRoot: root, instanceDir, dryRun: true, log: () => {} });
+    return (sum && Array.isArray(sum.writtenPaths)) ? sum.writtenPaths : [];
+  } catch (e) {
+    err(`  ! could not preview the .claude/ materialization (${e && e.message ? e.message : e}) — pre-flight will treat every dirty path as a human's work.`);
+    return [];
+  }
+}
+
 // ---- the dev checkout: module-owned skills materialised INTO the core (task 1003330, ADR 0224) ----
 // materializeClaude's self-copy guard is right for init/upgrade (instance == core is a no-op),
 // but Claude Code discovers only .claude/skills/ at the project root, so a builder working IN
@@ -850,4 +893,4 @@ if (require.main === module) {
   process.exit(s.refused.length ? 1 : 0);
 }
 
-module.exports = { scriptToVerb, bongosify, transformSettings, readSettingsTransform, renderStarterSettings, STARTER_ALLOW, copyTreeTransformed, materializeClaude, materializeModuleSkillsIntoCore, isCoreCheckoutRoot, readModuleSkillsManifest, MODULE_SKILLS_MANIFEST, readInstanceSkillsManifest, INSTANCE_SKILLS_MANIFEST, GDS_INVOCATION_RE, buildRebrandRules, rebrandText, disabledModuleSkills, moduleSkillRoster, moduleSkillSources, vendoredSkillGate, SKILL_NAME_RE, VENDOR_DEFAULT_POLICY };
+module.exports = { scriptToVerb, bongosify, transformSettings, readSettingsTransform, renderStarterSettings, STARTER_ALLOW, copyTreeTransformed, materializeClaude, materializeWillRewrite, materializeModuleSkillsIntoCore, isCoreCheckoutRoot, readModuleSkillsManifest, MODULE_SKILLS_MANIFEST, readInstanceSkillsManifest, INSTANCE_SKILLS_MANIFEST, GDS_INVOCATION_RE, buildRebrandRules, rebrandText, disabledModuleSkills, moduleSkillRoster, moduleSkillSources, vendoredSkillGate, SKILL_NAME_RE, VENDOR_DEFAULT_POLICY };

package/scripts/gds/upgrade.js

@@ -129,11 +129,13 @@ function restorePin(instanceDir, depString, fsImpl = fs) {
 
 // ---- steps (each injectable for tests) --------------------------------------
 
-function gitTreeClean(instanceDir, run = spawnSync) {
+// `ignore` is waived (it comes from — and is argued for in — claude-materialize.js materializeWillRewrite, task 1004122); every OTHER dirty path still halts the bump.
+function gitTreeClean(instanceDir, run = spawnSync, ignore = []) {
   const r = run('git', ['status', '--porcelain'], { cwd: instanceDir, encoding: 'utf8' });
   if (!r || r.error || r.status !== 0) return { ok: false, reason: 'git status failed (not a git repo?)' };
-  const dirty = (r.stdout || '').trim();
-  return { ok: dirty === '', dirty };
+  const skip = new Set(ignore), all = (r.stdout || '').split('\n').filter((l) => l.trim());
+  const kept = all.filter((l) => !skip.has(l.slice(3).trim()));
+  return { ok: !kept.length, dirty: kept.join('\n'), ignored: all.length - kept.length };
 }
 
 // ---- persisting the pin (task 1002712) --------------------------------------
@@ -1114,8 +1116,11 @@ async function runUpgrade(opts, deps = {}) {
 
   // 1. pre-flight: clean tree (so the pin change is reviewable + revertable) + module compatibility.
   if (!opts.force) {
-    const tree = gitTreeClean(instanceDir, run);
+    // Step 5's own output is not dirt (task 1004122) — but only when step 5 is going to run.
+    const preview = opts.skipMaterialize ? () => [] : (deps.willRewrite || require('./claude-materialize').materializeWillRewrite);
+    const tree = gitTreeClean(instanceDir, run, preview({ instanceDir, materialize }, err));
     if (!tree.ok) return { ok: false, error: `working tree not clean — commit/stash first, or pass --force.\n${tree.dirty || tree.reason || ''}` };
+    if (tree.ignored) log(`  • pre-flight: ignored ${tree.ignored} dirty path(s) this upgrade rewrites from the core (.claude/ materialization)${opts.commitPin ? ' — they are committed with the pin' : ' — pass --commit-pin to commit them'}.`);
   }
   const mods = preflightModules({ instanceDir, targetVersion }, deps);
   log(`  ✓ pre-flight: ${mods.note}`);

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.932'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.934'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/government_board_room_copy.mjs

@@ -138,8 +138,15 @@ test('the self-explaining copy is DELETED, not reworded', () => {
 
 test('the section a voter faults is shown by NAME, in the ballot and the picker', () => {
   const ballot = BOARD.slice(BOARD.indexOf('function ballotHtml'), BOARD.indexOf('// ---- the vote form'));
-  assert.match(ballot, /SECTION_LABELS\[v\.section_key\]/,
+  // Since task 1004085 the label comes from the item's OWN vintage — `why_had`
+  // and `fit` exist in both templates asking different questions, so a single
+  // flat map would show the reader the wrong sentence. `ANY_SECTION_LABEL` is
+  // the decode-only fallback behind it, for a section whose vintage this page
+  // cannot resolve; the one thing that must never appear is the bare key.
+  assert.match(ballot, /labelsOf\(item\)\[v\.section_key\]/,
     '`why_matters` is a jsonb key; the objector picked a named section and the reader should see that name');
+  assert.match(ballot, /ANY_SECTION_LABEL\[v\.section_key\]/,
+    'and an older vintage still decodes to words rather than to its key');
 });
 
 test('the objection still carries a reason AND one section (ADR 0175 §8)', () => {
@@ -147,8 +154,10 @@ test('the objection still carries a reason AND one section (ADR 0175 §8)', () =
   // hall instead of on a chat reaction.
   const form = BOARD.slice(BOARD.indexOf('function voteFormHtml'), BOARD.indexOf('async function castVoteFromRoom'));
   assert.match(form, /data-vote-reason/, 'the reason box survives');
-  assert.match(form, /gov-vote__sections/, 'so does the five-way section picker');
-  assert.match(form, /Object\.keys\(SECTION_LABELS\)\.map/, 'with one radio per declared section');
+  assert.match(form, /gov-vote__sections/, 'so does the section picker');
+  assert.match(form, /Object\.keys\(labels\)\.map/, 'with one radio per declared section');
+  assert.match(form, /const labels = labelsOf\(item\)/,
+    'and the sections offered are the ones the subject was actually written against');
 });
 
 test('each room frames itself in one line, not a paragraph', () => {

package/tests/government_board_vote.mjs

@@ -29,19 +29,44 @@ const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GOV = path.join(ROOT, 'modules', 'government');
 const board = require(path.join(GOV, 'board.js'));
 const db = require(path.join(GOV, 'db.js'));
-const { fieldOrder, templateFor } = require(path.join(ROOT, 'modules', 'ideas', 'templates.js'));
+const { fieldOrder, templateFor, BUILTIN_TEMPLATES } = require(path.join(ROOT, 'modules', 'ideas', 'templates.js'));
 
 const { FULL_IDEA_SECTION_KEYS, VOTE_KARMA_DELTA, AUTHOR_RATIFY_KARMA_DELTA, awardAuthorRatifyKarma, validateVote, castVote } = board;
 
 // ── invariant 1: one list, three places ─────────────────────────────────────
 
+// THE LIST IS THE UNION OF EVERY VINTAGE, since task 1004085 (BV2.R06) versioned
+// the Full Idea questions. It was `base-v1`'s five, and pinning it to one
+// template again would re-open the defect that task closed: an idea filed under
+// a newer vintage reaches the board, and every section a voter could object to
+// is refused `objection_needs_section` — leaving yes as the only castable vote.
+const ALL_TEMPLATE_FIELD_KEYS = [...new Set(
+  Object.keys(BUILTIN_TEMPLATES).flatMap((key) => fieldOrder(templateFor(key))),
+)];
+
 test('the objection section keys ARE the Full Idea template fields (no second list that drifts)', () => {
-  assert.deepEqual([...FULL_IDEA_SECTION_KEYS], fieldOrder(templateFor('base-v1')),
-    'board.js must flag against the same five sections the template declares');
+  assert.deepEqual([...FULL_IDEA_SECTION_KEYS].sort(), [...ALL_TEMPLATE_FIELD_KEYS].sort(),
+    'board.js must flag against exactly the sections the templates declare — every vintage, no extras');
+
+  // The CHECK that is actually in force is government_003's as widened by
+  // government_017; a key is legal if the LATEST statement of the constraint
+  // carries it, so that is the file this reads.
   const migration = fs.readFileSync(
-    path.join(GOV, 'migrations', 'government_003_board_tables.sql'), 'utf8');
+    path.join(GOV, 'migrations', 'government_017_board_section_keys_v2.sql'), 'utf8');
   for (const key of FULL_IDEA_SECTION_KEYS) {
-    assert.ok(migration.includes(`'${key}'`), `the government_003 CHECK must carry '${key}'`);
+    assert.ok(migration.includes(`'${key}'`), `the in-force CHECK must carry '${key}'`);
+  }
+
+  // NARROWING IS THE FAILURE MODE, so it gets its own assertion rather than
+  // riding on the set equality above: objections already cast name government_003's
+  // keys, and dropping one would orphan them and make the CHECK refuse rows that
+  // are already in the table.
+  const original = fs.readFileSync(
+    path.join(GOV, 'migrations', 'government_003_board_tables.sql'), 'utf8');
+  for (const key of fieldOrder(templateFor('base-v1'))) {
+    assert.ok(original.includes(`'${key}'`), `sanity: government_003 declared '${key}'`);
+    assert.ok(FULL_IDEA_SECTION_KEYS.includes(key), `'${key}' must never leave the list`);
+    assert.ok(migration.includes(`'${key}'`), `'${key}' must never leave the CHECK`);
   }
 });
 
@@ -64,6 +89,29 @@ test('a yes carries nothing; a no carries a reason AND exactly one section', ()
   }
 });
 
+test('an objection can name a section of EITHER vintage — BV2.R06\'s actual defect', () => {
+  // The set-equality test above compares two lists. This one drives the real
+  // validator, one section at a time, because the list being right and the
+  // OBJECTION being accepted are different claims — and it is the second one
+  // that decides whether a new-vintage idea can be returned at all. Before task
+  // 1004085 every key on the base-v2 side of this loop answered
+  // `objection_needs_section`, leaving yes as the only castable vote on any idea
+  // filed after the questions changed.
+  for (const templateKey of Object.keys(BUILTIN_TEMPLATES)) {
+    for (const sectionKey of fieldOrder(templateFor(templateKey))) {
+      const v = validateVote({ direction: 'no', reasonMd: 'this section needs work', sectionKey });
+      assert.equal(v.ok, true, `${templateKey}'s '${sectionKey}' must be objectable`);
+      assert.equal(v.sectionKey, sectionKey);
+    }
+  }
+  // And the list is still CLOSED — widening it is not opening it. A plausible
+  // key that no template declares is refused exactly as 'vibes' is.
+  for (const notASection of ['scope_notes', 'why', 'build', 'purpose_v2']) {
+    assert.equal(validateVote({ direction: 'no', reasonMd: 'x', sectionKey: notASection }).reason,
+      'objection_needs_section', `'${notASection}' is not a declared section`);
+  }
+});
+
 // ── castVote against a stubbed db (membership logic REAL) ───────────────────
 
 const MONARCHY = { membership: 'rank:archon', pass_rule: 'first_ratifier', window_minutes: null, close_early_on_full_turnout: true };