@bongos/core 1.21.39 → 1.21.40

package/modules/hall-ui/public/street.js

@@ -78,7 +78,9 @@
   var $ = function (id) { return document.getElementById(id); };
   var media = window.matchMedia ? window.matchMedia('(prefers-color-scheme: dark)') : null;
   var data = { docket: null, goals: [], rollups: [], earnings: null, loaded: false, tasks: {}, room: null, constitution: null };
-  var card = { cv: null, form: null, error: '', busy: false, fresh: null, answer: null };
+  // ask: the act whose chips stand open; more: the detail is open in place;
+  // pick: which of the review queue the queue's card shows (task 1004566)
+  var card = { cv: null, form: null, ask: null, more: false, pick: null, error: '', busy: false, fresh: null, answer: null };
   var view = { open: null, opener: null, model: null, scale: 1, mode: null, inside: null, insideModel: null };
   // the desk's own state: rows you acted on this visit, what you did per floor,
   // the floors you cleared, the row whose facts or chips are open
@@ -1041,21 +1043,42 @@
 
 
   // ---------- the matter card (task 1004528: it acts) ----------
+  // Its acts are the desk row's for the same item (GovDesk.cardFor, task
+  // 1004566): the same words, chips, routes and permission checks. "more" grows
+  // the card in place; nothing on it opens an older page to decide.
   function fillCard() {
-    var C = window.GovMatterCard;
-    var cv = C ? C.model({ docket: data.docket, key: view.open, room: data.room, constitution: data.constitution, now: Date.now() }) : null;
+    var C = window.GovMatterCard, D = window.GovDesk;
+    var ctx = { room: data.room, constitution: data.constitution, now: Date.now(), goals: (data.goals || []).filter(function (g) { return g && g.status === 'open'; }), pick: card.pick };
+    var cv = D && D.cardFor ? D.cardFor(view.open, data.docket, ctx) : C ? C.model({ docket: data.docket, key: view.open, room: data.room, constitution: data.constitution, now: Date.now() }) : null;
     if (!cv) { closeCard(false); return null; }
     card.cv = cv;
     $('streetCardWhere').textContent = cv.where;
     $('streetCardWhen').textContent = cv.when;
     $('streetCardTitle').textContent = cv.title;
-    C.render(document, $('streetCardBody'), cv, { act: actOn, openForm: openForm }, { form: card.form, error: card.error, busy: card.busy, fresh: card.fresh });
-    var open = $('streetCardOpen');
-    if (cv.href) open.setAttribute('href', cv.href);
-    open.hidden = !cv.href;
+    C.render(document, $('streetCardBody'), cv, { act: actOn, openForm: openForm, ask: askFor, more: toggleMore, pick: pickQueued }, { form: card.form, ask: card.ask, more: card.more, error: card.error, busy: card.busy, fresh: card.fresh });
+    var frame = $('streetCard'); if (frame) frame.setAttribute('data-more', card.more ? 'open' : 'closed');
     placeCard();
     return cv;
   }
+  function askFor(key) {
+    card.ask = card.ask === key ? null : key;
+    card.error = '';
+    fillCard();
+    var body = $('streetCardBody'), first = body && body.querySelector ? body.querySelector('.mcard-chip, .mcard-chips__field') : null;
+    if (card.ask && first && first.focus) first.focus();
+  }
+  function toggleMore() {
+    card.more = !card.more;
+    fillCard();
+    var mb = $('streetCardBody'), t = mb && mb.querySelector ? mb.querySelector('[data-act="more"]') : null;
+    if (t && t.focus) t.focus();
+  }
+  function pickQueued(key) {
+    card.pick = key; card.ask = null; card.more = false; card.form = null; card.error = '';
+    fillCard();
+    var close = $('streetCardClose');
+    if (close && close.focus) close.focus();
+  }
   function placeCard() {
     var card = $('streetCard');
     if (!card || !view.open || !view.model) return;
@@ -1071,7 +1094,7 @@
   function openCard(key, opener) {
     view.open = key;
     view.opener = opener || null;
-    card.form = null; card.error = ''; card.fresh = null;
+    card.form = null; card.ask = null; card.more = false; card.pick = null; card.error = ''; card.fresh = null;
     var el = $('streetCard');
     if (!fillCard()) return;
     el.hidden = false;
@@ -1084,7 +1107,7 @@
     var was = view.opener;
     view.open = null;
     view.opener = null;
-    card.cv = null; card.form = null; card.error = ''; card.busy = false; card.fresh = null;
+    card.cv = null; card.form = null; card.ask = null; card.more = false; card.pick = null; card.error = ''; card.busy = false; card.fresh = null;
     var el = $('streetCard');
     if (el) el.hidden = true;
     draw();
@@ -1123,32 +1146,36 @@
     card.form = name || null;
     card.error = '';
     fillCard();
-    var f = name === 'object' ? $('mcardReason') : name === 'revise' ? $('mcardRevise') : $('streetCardClose');
+    var f = name === 'revise' ? $('mcardRevise') : $('streetCardClose');
     if (f && f.focus) f.focus();
   }
   // One act: checked, sent to its own route (the server's permission checks
   // decide), then answered. An act that records nothing (abstain, hold) is
   // answered without a request.
+  // An act from the card goes with the desk row's own card when a row stands
+  // behind it (its subject: which route, the council's), else the model's.
   function actOn(key, input) {
     var C = window.GovMatterCard, cv = card.cv;
     if (!C || !cv || card.busy) return Promise.resolve(false);
-    var refused = C.check(cv, key, input);
+    var subj = cv.row && cv.row.card ? cv.row.card : cv;
+    var refused = C.check(subj, key, input);
     if (refused) { card.error = refused; fillCard(); return Promise.resolve(false); }
     card.error = '';
-    var req = C.request(cv, key, input);
-    if (!req) return Promise.resolve(answered(cv, key, {}, false));
+    var req = C.request(subj, key, input);
+    if (!req) return Promise.resolve(answered(subj, key, {}, false));
     card.busy = true;
     fillCard();
     return send(req).then(function (out) {
       card.busy = false;
       if (!out.ok) { card.error = C.refusal(out.status, out.body); if (view.open) fillCard(); return false; }
-      return answered(cv, key, out.body, true);
+      return answered(subj, key, out.body, true);
     });
   }
   function answered(cv, key, body, recorded) {
     var a = window.GovMatterCard.answer(cv, key, body);
     say(a.toast);
-    card.form = null;
+    card.form = null; card.ask = null;
+    card.pick = null;
     card.fresh = key === 'for' || key === 'object' ? 'you' : null;
     if (a.building && a.kind) card.answer = { building: a.building, matter: cv.key, kind: a.kind, at: Date.now() };
     if (a.close) closeCard(true);

package/modules/ideas/governor-docket.js

@@ -42,6 +42,8 @@ function blockerDocketMatter(b, mayResolve) {
     tally: null,
     href: `/blockers#blocker-${b.id}`,
     ref: { type: 'blocker', id: b.id },
+    // the card's "more" (task 1004566): the body GET /blockers shows everyone
+    detail: b.body_md || null,
     // the floor desk's one act (task 1004560): decide, by one of its options
     ...(mayResolve ? { acts: [{ key: 'decide', options: blockerOptions(b.body_md) }] } : {}),
   };

package/modules/lifecycle/governor-docket.js

@@ -41,6 +41,8 @@ function overrideMatter(r, mayDecide) {
     tally: null,
     href: `/task/${encodeURIComponent(r.task_id)}`,
     ref: { type: 'override_request', id: r.id },
+    // the card's "more" (task 1004566): the reason GET /override-requests shows
+    detail: r.rationale || null,
   };
 }
 
@@ -58,6 +60,8 @@ function removalMatter(r) {
     tally: null,
     href: `/task/${encodeURIComponent(r.proposal_task_id)}`,
     ref: { type: 'task', id: r.proposal_task_id },
+    // the card's "more" (task 1004566): the proposal's own text, from the same read
+    detail: r.description || null,
     // POST /removal-proposals/:id/decide, the docket source's own atom (task 1004559)
     acts: [{ key: 'remove' }, { key: 'keep' }],
   };

package/modules/onboarding/routes/access-requests.js

@@ -236,6 +236,8 @@ function accessRequestDocketMatter(r) {
     tally: null,
     href: '/watch',
     ref: { type: 'access_request', id: r.id },
+    // the card's "more" (task 1004566): their note, as GET /access-requests shows it
+    detail: r.note || null,
   };
 }
 

package/modules/security/routes/reports.js

@@ -56,6 +56,9 @@ function redteamDocketMatter(r) {
     tally: null,
     href: '/watch',
     ref: { type: 'vulnerability_report', id: r.id },
+    // the card's "more" (task 1004566): what GET /security/reports shows this
+    // same atom — what it targets and the report's description
+    detail: [r.target ? `Target: ${r.target}` : '', r.description || ''].filter(Boolean).join('\n\n') || null,
     // The floor desk's acts (task 1004559): the docket only lists this for a
     // holder of the adjudicate atom, which both routes check.
     acts: [{ key: 'confirm' }, { key: 'dispute' }],

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.39",
+  "version": "1.21.40",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.39",
+      "version": "1.21.40",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.39",
+  "version": "1.21.40",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8998,5 +8998,11 @@
       "id": "1004565",
       "text": "Inside each building on the governor street, the separate \"on the table here\" list is gone. The floor desks already show every matter as a row you can act on, so the list only repeated them. The rest of the building panel look"
     }
+  ],
+  "1.21.40": [
+    {
+      "id": "1004566",
+      "text": "Every card on the governor street now acts where it opens. Pressing a pin gives the same buttons as that item's row at its building desk: confirm or dispute a security report, remove or keep, decide a blocker by tapping an opt"
+    }
   ]
 }

package/src/bongos/module-rechecks.js

@@ -53,6 +53,13 @@ async function listModuleRechecks({ limit = RECHECK_LIMIT, db = null } = {}) {
 
 // One version as a docket matter. Pure. A failed gate needs a governor who may
 // ask for a re-check; a pending part is a re-check already moving.
+// The one-tap reasons a re-check may give (POST /store/modules/:key/versions/
+// :version/reassess requires one; task 1004566).
+const RECHECK_REASONS = Object.freeze([
+  { key: 'fixed', label: 'fixed since' },
+  { key: 'misfired', label: 'check misfired' },
+  { key: 'again', label: 'look again' },
+]);
 function moduleRecheckMatter(r, mayRerun) {
   const failed = r.security_failed === true;
   const pending = Array.isArray(r.pending_parts) ? r.pending_parts.filter(Boolean) : [];
@@ -70,7 +77,11 @@ function moduleRecheckMatter(r, mayRerun) {
     proposer: null,
     tally: null,
     href: '/modules',
-    ref: { type: 'module_version', id: r.version_id },
+    // "<key>@<version>": the reassess route's two path parts (task 1004566)
+    ref: { type: 'module_version', id: `${r.module_key}@${r.version}` },
+    // the one act a governor takes on it, under the reassess route's own atom,
+    // only when its security check failed (a pending check is still running)
+    ...(failed && mayRerun ? { acts: [{ key: 'recheck', options: RECHECK_REASONS }] } : {}),
   };
 }
 

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.39'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.40'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/governor_docket.mjs

@@ -101,6 +101,26 @@ test('normalizeMatter: the one shape, prefixed id, ISO dates', () => {
   assert.deepEqual(Object.keys(m).sort(), ['building', 'deadline', 'href', 'id', 'opened_at', 'proposer', 'ref', 'rule', 'short', 'source', 'state', 'tally', 'title', 'where'].sort());
 });
 
+test('normalizeMatter carries a matter\'s detail for the card\'s "more" only as bounded text (task 1004566)', () => {
+  const base = { id: 1, title: 't' };
+  const at = { source: 'blockers', building: 'planning' };
+  assert.equal(docket.normalizeMatter({ ...base, detail: '  Option A: Render\n\nOption B: Fly  ' }, at).detail, 'Option A: Render\n\nOption B: Fly', 'lines kept, ends trimmed');
+  assert.equal(docket.normalizeMatter({ ...base, detail: 'x'.repeat(5000) }, at).detail.length, 4000);
+  for (const bad of [null, '', '   ', 42, { md: 'x' }, ['x']]) assert.ok(!('detail' in docket.normalizeMatter({ ...base, detail: bad }, at)), JSON.stringify(bad));
+});
+
+test('the sources hand the detail their own list route shows, and a failed module check its one act (task 1004566)', () => {
+  const r = reportsRoute.redteamDocketMatter({ id: 2, title: 'x', status: 'open', target: '/login', description: 'No limit on tries.' });
+  assert.equal(r.detail, 'Target: /login\n\nNo limit on tries.');
+  assert.equal(reportsRoute.redteamDocketMatter({ id: 2, title: 'x', status: 'open' }).detail, null);
+  const failed = moduleRechecks.moduleRecheckMatter({ version_id: 7, module_key: 'image-tools', version: '1.2.0', security_failed: true }, true);
+  assert.deepEqual(failed.ref, { type: 'module_version', id: 'image-tools@1.2.0' }, 'the reassess route\'s two path parts');
+  assert.deepEqual(failed.acts.map((a) => a.key), ['recheck']);
+  assert.ok(failed.acts[0].options.length >= 2 && failed.acts[0].options.every((o) => o.label.length <= 16), 'reasons are one-tap chips');
+  assert.ok(!('acts' in moduleRechecks.moduleRecheckMatter({ version_id: 7, module_key: 'm', version: '1.0.0', security_failed: true }, false)), 'not without the reassess atom');
+  assert.ok(!('acts' in moduleRechecks.moduleRecheckMatter({ version_id: 8, module_key: 'm', version: '1.0.0', security_failed: false, pending_parts: ['tests'] }, true)), 'not while its check is still running');
+});
+
 test('normalizeMatter fails SAFE: unknown state → moving (never a false "needs you"), unknown rule → null', () => {
   const m = docket.normalizeMatter({ id: 1, title: 't', state: 'urgent!!', rule: 'vibes', building: 'castle' }, { source: 's', building: 'review' });
   assert.equal(m.state, 'moving');

package/tests/hall_matter_card.mjs

@@ -31,6 +31,7 @@ const require = createRequire(import.meta.url);
 require(path.join(PUB, 'city-draw.js'));
 require(path.join(PUB, 'street-draw.js'));
 const C = require(path.join(PUB, 'street-card.js'));
+const D = require(path.join(PUB, 'street-desk.js'));
 const read = (f) => fs.readFileSync(path.join(PUB, f), 'utf8');
 const NOW = Date.parse('2026-10-02T12:00:00.000Z');
 const VIEWER = '95';
@@ -77,8 +78,12 @@ test('an open unanimous sitting that waits on you: the proposer\'s words, the ch
   assert.equal(cv.counsel.revise, false);
   assert.deepEqual(cv.actions.map((a) => [a.key, a.label, a.tone]), [['for', 'vote for', 'primary'], ['object', 'object', 'quiet']]);
   assert.deepEqual(cv.textActions.map((a) => a.key), ['abstain']);
-  assert.ok(cv.objectForm.sections.length >= 3);
   assert.equal(cv.readOnly, false);
+  // more (task 1004566): the whole rationale, who and when, and every vote in order
+  assert.equal(cv.more.text[0].words, 'Three pieces of finished work are waiting because no one is allowed to test them.\n\nMore below.');
+  assert.equal(cv.more.who, 'Put up by Ana Ruiz.');
+  assert.equal(cv.more.when, 'opened 2026-10-01 · closes 2026-10-03');
+  assert.deepEqual(cv.more.history, ['2026-10-01 · Ana Ruiz voted for', '2026-10-01 · Theo voted for', '2026-10-01 · Mira voted for']);
 });
 
 test('a majority sitting with an objection, after your yes: voices for and against, what it still needs', () => {
@@ -104,7 +109,7 @@ test('a sitting that came back to you: counsel answers the objection, revise and
   assert.equal(cv.readOnly, false);
 });
 
-test('passed, not yours, a Full Idea, and a ballot not read yet are read-only', () => {
+test('passed, not yours, and a ballot not read yet are read-only; a Full Idea is voted on here with its sections under more', () => {
   const passed = card([matter({ state: 'settled' })], 'board:41', room([], [item({ closed_at: '2026-10-02T09:00:00.000Z', outcome: 'passed', votes: [vote(4, 'Ana', 'yes'), vote(5, 'Theo', 'yes')] })]));
   assert.equal(passed.result, 'Passed 2–0. In force from 2026-10-02.');
   assert.deepEqual([passed.readOnly, passed.actions.length, passed.textActions.length], [true, 0, 0]);
@@ -113,9 +118,11 @@ test('passed, not yours, a Full Idea, and a ballot not read yet are read-only',
   assert.equal(notMine.actions.length, 0);
   assert.ok(!notMine.seats.some((s) => s.pos === 'you'), 'no seat drawn for you when you have none');
   const idea = card([matter({ building: 'planning', state: 'needs' })], 'board:41', room([item({ subject_type: 'full_idea', subject: { title: 'An idea', author_id: '4', field_values: { purpose: 'It does a thing.' } } })]));
-  assert.equal(idea.actions.length, 0, 'a Full Idea is voted on with its sections in front of you');
-  assert.match(idea.result, /Board Room/);
-  assert.equal(idea.href, '/board-room?item=41');
+  assert.deepEqual(idea.actions.map((a) => a.key), ['for', 'object'], 'a Full Idea is voted on from the card (task 1004566)');
+  assert.equal(idea.result, 'Read its sections under more, then vote.');
+  assert.deepEqual(idea.more.text, [{ label: 'what it is for', words: 'It does a thing.' }], 'its sections are in front of the voter');
+  const ownIdea = card([matter({ building: 'planning', state: 'moving' })], 'board:41', room([item({ subject_type: 'full_idea', subject: { title: 'An idea', author_id: VIEWER, field_values: { purpose: 'Mine.' } }, votes: [] })]));
+  assert.deepEqual([ownIdea.readOnly, ownIdea.actions.length, ownIdea.result], [true, 0, 'Yours. It is with the sitting now.'], 'its author never votes on it');
   const loading = card([matter()], 'board:41', null);
   assert.deepEqual([loading.loading, loading.readOnly, loading.result], [true, true, 'Reading the sitting…']);
   const gone = card([matter()], 'board:41', room([]));
@@ -134,8 +141,10 @@ test('a constitution amendment shows each changed setting struck and inserted ag
 
 test('admissions: fine by me or object when it is yours, read-only when it is not', () => {
   const m = { id: 'access_requests:7', source: 'access_requests', building: 'people', rule: 'decide', state: 'needs', title: 'Admit Kai as a builder', short: 'admit kai', where: 'people · waiting to join · vouched', proposer: { login: 'kai', name: 'Kai' }, tally: null, href: '/watch', ref: { type: 'access_request', id: '7' } };
-  const cv = card([m], 'access_requests:7');
-  assert.equal(cv.quote.words, 'Kai asked to join as a builder, and someone vouched for them.');
+  const cv = card([{ ...m, detail: 'I build the docs site.' }], 'access_requests:7');
+  assert.equal(cv.quote, null, 'the compact card is the title, one fact and its acts');
+  assert.deepEqual(cv.more.text.map((t) => t.words), ['Kai asked to join as a builder, and someone vouched for them.', 'I build the docs site.']);
+  assert.equal(cv.more.who, 'Raised by Kai.');
   assert.deepEqual(cv.actions.map((a) => [a.key, a.label]), [['fine', 'fine by me'], ['refuse', 'object']]);
   const other = card([{ ...m, state: 'moving' }], 'access_requests:7');
   assert.deepEqual([other.readOnly, other.actions.length], [true, 0]);
@@ -312,21 +321,20 @@ test('vote for: one POST to the vote route, a toast, the docket re-read, and the
   assert.match(p.byId.get('streetPins').children[0].className, /street-pin--moving street-pin--answer/, 'the pin moved from needs to moving');
 });
 
-test('object: the form asks for the reason and the part, then puts both on the record', async () => {
+test('object: "no" opens the desk row\'s one-tap reasons, and a tap puts the reason and the part on the record', async () => {
   const p = await bootPage({ feeds: BASE(docket([matter()])), posts: { 'POST /api/bongos/government/board/items/41/votes': { ok: true, vote: {}, item_closed: true, outcome: 'returned' } } });
   p.byId.get('streetPins').children[0].fire('click');
   await settle(); await settle();
-  byAct(p.byId.get('streetCardBody'), 'object').fire('click');
-  assert.equal(p.focused.el, p.byId.get('mcardReason'), 'focus goes to the reason');
-  byAct(p.byId.get('streetCardBody'), 'object-send').fire('click');
-  await settle();
-  assert.equal(p.calls.filter((c) => c.method !== 'GET').length, 0, 'an empty objection is refused before it is sent');
-  assert.match(walk(p.byId.get('streetCardBody'), (n) => n.className === 'mcard-error')[0].textContent, /^Say why/);
-  p.byId.get('mcardReason').value = 'Volunteers go quiet.';
-  p.byId.get('mcardSection').value = 'scope';
-  byAct(p.byId.get('streetCardBody'), 'object-send').fire('click');
+  const body = () => p.byId.get('streetCardBody');
+  assert.equal(byAct(body(), 'object').textContent, D.ACT_WORDS.object, 'the desk row\'s word');
+  assert.equal(byAct(body(), 'object').attrs['aria-expanded'], 'false');
+  byAct(body(), 'object').fire('click');
+  assert.equal(p.calls.filter((c) => c.method !== 'GET').length, 0, 'asking sends nothing');
+  assert.equal(byAct(body(), 'object').attrs['aria-expanded'], 'true');
+  assert.deepEqual(walk(body(), (n) => n.className === 'mcard-chip').map((n) => n.textContent), Object.values(D.CHIPS), 'the same chips as the desk row');
+  byAct(body(), 'chip-scope').fire('click');
   await settle(); await settle(); await settle();
-  assert.deepEqual(p.calls.filter((c) => c.method !== 'GET').map((c) => c.body), [{ direction: 'no', reason_md: 'Volunteers go quiet.', section_key: 'scope' }]);
+  assert.deepEqual(p.calls.filter((c) => c.method !== 'GET').map((c) => c.body), [{ direction: 'no', reason_md: 'Objects to what it changes (one tap on the floor desk).', section_key: 'scope' }]);
   assert.equal(p.byId.get('streetToast').textContent, 'Your objection is on the record. It goes back to its author to revise.');
 });
 
@@ -382,6 +390,123 @@ test('the card\'s motion is CSS only and dies under reduced motion; tokens only;
   assert.match(html, /id="streetToast" role="status" aria-live="polite"/);
 });
 
+// ── one action model, and more in place (task 1004566) ──────────────────────
+// Every docket source in the shape its route hands it, with the acts its owning
+// module gives a viewer who may act. The card for each must offer the desk
+// row's acts for the same item and link nowhere.
+const SOURCE_FIXTURES = () => {
+  const ms = [
+    matter(),
+    matter({ id: 'board:43', building: 'planning', short: 'idea to ratify', title: 'Ask before a big change', ref: { type: 'board_item', id: '43' } }),
+    { id: 'blockers:11', source: 'blockers', building: 'planning', rule: 'decide', state: 'needs', title: 'Hosting for the demo', short: 'blocker', where: 'planning · holds 2 tasks', opened_at: '2026-09-30T09:00:00.000Z', proposer: null, tally: null, href: '/blockers#blocker-11', ref: { type: 'blocker', id: '11' }, acts: [{ key: 'decide', options: [{ key: 'go ahead', label: 'go ahead' }, { key: 'not now', label: 'not now' }] }], detail: 'Option A: Render\nOption B: Fly' },
+    { id: 'access_requests:7', source: 'access_requests', building: 'people', rule: 'decide', state: 'needs', title: 'Admit Kai as a builder', where: 'people · waiting to join', proposer: { login: 'kai', name: 'Kai' }, href: '/watch', ref: { type: 'access_request', id: '7' } },
+    { id: 'goal_join_requests:5', source: 'goal_join_requests', building: 'people', rule: 'decide', state: 'needs', title: 'Bo asks to join Sign-up', proposer: { login: 'bo' }, href: '/goals#/goal/1000125', ref: { type: 'goal_membership_request', id: '5' } },
+    { id: 'override_requests:9', source: 'override_requests', building: 'release', rule: 'decide', state: 'needs', title: 'Override: the new sign-up', proposer: { login: 'lu' }, href: '/task/12', ref: { type: 'override_request', id: '9' }, detail: 'The grader timed out twice.' },
+    { id: 'removal_proposals:61', source: 'removal_proposals', building: 'disputes', rule: 'decide', state: 'needs', title: 'Old search page', href: '/task/61', ref: { type: 'task', id: '61' }, acts: [{ key: 'remove' }, { key: 'keep' }] },
+    { id: 'redteam_reports:4', source: 'redteam_reports', building: 'disputes', rule: 'decide', state: 'needs', title: 'Security report: sign-in limit skipped', href: '/watch', ref: { type: 'vulnerability_report', id: '4' }, acts: [{ key: 'confirm' }, { key: 'dispute' }] },
+    { id: 'criteria_uat:3', source: 'criteria_uat', building: 'review', rule: 'signoff', state: 'needs', title: 'The export runs nightly', href: '/goals#/goal/7', ref: { type: 'criterion', id: '3' }, acts: [{ key: 'signoff', options: [{ key: 'live', label: 'tested it live' }] }, { key: 'force', options: [{ key: 'tested_by_hand', label: 'tested by hand' }] }] },
+    { id: 'core_update:1.21.20', source: 'core_update', building: 'release', rule: 'decide', state: 'needs', title: 'Take core 1.21.20 (running 1.21.19)', href: '/settings#software-update', ref: { type: 'core_version', id: '1.21.20' } },
+    { id: 'gate_approvals:88', source: 'gate_approvals', building: 'release', rule: 'decide', state: 'needs', title: 'PR 88 waits at the gate', href: '/gate', ref: { type: 'pull_request', id: '88' } },
+    { id: 'autobongos_fence:project', source: 'autobongos_fence', building: 'automation', rule: 'decide', state: 'needs', title: 'Unattended building is off', href: '/autobongos', ref: { type: 'autonomy_fence', id: 'project' }, acts: [{ key: 'switch_on' }] },
+    { id: 'module_rechecks:7', source: 'module_rechecks', building: 'release', rule: 'rule', state: 'needs', title: 'image-tools 1.2.0 failed its security check', href: '/modules', ref: { type: 'module_version', id: 'image-tools@1.2.0' }, acts: [{ key: 'recheck', options: [{ key: 'fixed', label: 'fixed since' }] }] },
+  ];
+  const d = docket(ms);
+  d.desks = [{ key: 'release.core', building: 'release', status: 'live', rows: [{ id: 'release.core:41', desk: 'release.core', building: 'release', name: 'Core 1.21.20', fact: 'not checked yet', facts: [], over: 'core_update', ref: { type: 'core_pin', id: '41' }, acts: [{ key: 'check', options: [{ key: '1.21.20', label: '1.21.20' }] }] }] }];
+  const idea = item({ id: '43', subject_type: 'full_idea', subject: { title: 'Ask before a big change', author_id: '4', field_values: { purpose: 'Ask first.', success: 'No surprises.' } }, votes: [] });
+  return { d, r: room([item(), idea]) };
+};
+
+test('every docket source kind opens a card with the desk row\'s acts when the viewer may act, and links nowhere', () => {
+  const expected = [...read('../../government/docket.js').split('const EXPECTED_SOURCES')[1].split(']);')[0].matchAll(/source: '([a-z_]+)'/g)].map((x) => x[1]);
+  const { d, r } = SOURCE_FIXTURES();
+  assert.deepEqual([...new Set(d.matters.map((m) => m.source))].sort(), expected.slice().sort(), 'a fixture for every source the docket names');
+  const { document } = fakeDom();
+  const matched = [];
+  for (const m of d.matters) {
+    const cv = D.cardFor(m.id, d, { room: r, now: NOW });
+    assert.ok(cv && cv.row && cv.row.actions.length, `${m.id}: the card acts`);
+    assert.equal(cv.readOnly, false, m.id);
+    // one action model: the card's acts ARE the desk row's for the same item
+    const row = [0, 1, 2, 3, 4, 5, 6, 7].reduce((all, f) => all.concat(D.rowsFor(m.building, f, d, { room: r, now: NOW })), [])
+      .find((x) => x.matter === m.id || (x.desk && m.source === 'core_update' && x.over === 'core_update'));
+    if (row) { matched.push(m.id); assert.deepEqual(cv.row.actions.map((a) => [a.key, a.label]), row.actions.map((a) => [a.key, a.label]), `${m.id}: the same acts as its desk row`); }
+    const host = document.createElement('div');
+    C.render(document, host, cv, { act() {}, openForm() {}, ask() {}, more() {}, pick() {} }, { more: true });
+    const links = walk(host, (n) => n.tagName === 'a' || (n.attrs && 'href' in n.attrs));
+    assert.deepEqual(links.map((n) => n.attrs.href), [], `${m.id}: no link out`);
+    assert.ok(walk(host, (n) => n.attrs && n.attrs['data-act'] === 'more').length === 1, `${m.id}: a more toggle`);
+  }
+  assert.deepEqual(matched.sort(), d.matters.map((m) => m.id).sort(), 'the comparison ran for every kind');
+  // the core keeps check-then-take: its card is the Release desk's core row
+  const core = D.cardFor('core_update:1.21.20', d, { now: NOW });
+  assert.deepEqual(core.row.actions.map((a) => a.key), ['check']);
+  assert.deepEqual(C.request(core.row.card, 'check', { option: '1.21.20' }), { method: 'POST', url: '/api/bongos/provisioning/instances/41/core-upgrade', body: { to: '1.21.20', dry_run: true } });
+  // a module version is checked again through the reassess route, with a one-tap reason
+  const rc = D.cardFor('module_rechecks:7', d, { now: NOW });
+  assert.deepEqual(C.request(rc.row.card, 'recheck', { option: 'fixed', label: 'fixed since' }), { method: 'POST', url: '/api/bongos/store/modules/image-tools/versions/1.2.0/reassess', body: { reason: 'Asked on the street: fixed since.' } });
+  // the review queue's pin opens its first piece of work, with that work's acts
+  const q = D.cardFor('queue', d, { room: r, now: NOW });
+  assert.equal(q.key, 'criteria_uat:3');
+  assert.deepEqual(q.row.actions.map((a) => a.key), ['signoff', 'force']);
+  // the page carries no "open it where it lives" link
+  assert.doesNotMatch(read('street.html'), /streetCardOpen|where it lives/);
+  assert.doesNotMatch(read('street.js'), /streetCardOpen/);
+});
+
+test('a viewer who may not act gets the card without acts and still no link out', () => {
+  const { d, r } = SOURCE_FIXTURES();
+  d.matters = d.matters.map((m) => { const x = { ...m, state: 'moving' }; delete x.acts; return x; });
+  d.desks = []; // a desk row is only handed to a viewer who may act on it
+  const { document } = fakeDom();
+  for (const m of d.matters.filter((x) => x.source !== 'board')) {
+    const cv = D.cardFor(m.id, d, { room: r, now: NOW });
+    assert.equal(cv.row, null, `${m.id}: nothing to act on`);
+    const host = document.createElement('div');
+    C.render(document, host, cv, { act() {}, openForm() {}, ask() {}, more() {}, pick() {} }, { more: true });
+    assert.deepEqual(walk(host, (n) => n.attrs && 'href' in n.attrs).map((n) => n.attrs.href), [], m.id);
+  }
+});
+
+test('more expands the same card in place: the full text, who and when, and the record; less folds it', async () => {
+  const { d } = SOURCE_FIXTURES();
+  d.matters = d.matters.filter((m) => m.source === 'blockers');
+  const p = await bootPage({ feeds: { ...BASE(d) } });
+  p.byId.get('streetPins').children[0].fire('click');
+  await settle(); await settle();
+  const body = () => p.byId.get('streetCardBody');
+  const toggle = () => byAct(body(), 'more');
+  assert.equal(toggle().attrs['aria-expanded'], 'false');
+  assert.equal(walk(body(), (n) => n.className === 'mcard-more').length, 0, 'compact first');
+  // compact: one fact and at most two buttons (the line rule)
+  assert.equal(walk(body(), (n) => n.className === 'street-card__result').length, 1);
+  assert.ok(walk(body(), (n) => /^mcard-btn /.test(n.className)).length <= 2);
+  toggle().fire('click');
+  assert.equal(toggle().attrs['aria-expanded'], 'true');
+  assert.equal(toggle().attrs['aria-controls'], 'mcardMore');
+  assert.equal(p.byId.get('streetCard').attrs['data-more'], 'open');
+  const more = walk(body(), (n) => n.className === 'mcard-more')[0];
+  assert.equal(more.attrs.id, 'mcardMore');
+  assert.deepEqual(walk(more, (n) => n.className === 'mcard-more__text').map((n) => n.textContent), ['Option A: Render\nOption B: Fly']);
+  assert.equal(walk(more, (n) => n.className === 'mcard-more__meta')[0].textContent, 'opened 2026-09-30');
+  assert.deepEqual(walk(more, (n) => n.tagName === 'li').map((n) => n.textContent), ['how it is decided: decides alone'], 'the where line is the card head already');
+  assert.equal(p.calls.filter((c) => c.method !== 'GET').length, 0, 'opening more sends nothing');
+  assert.equal(p.window.location.hash, '', 'and goes nowhere');
+  // the blocker's options stand open, as on the desk: deciding it is picking one
+  byAct(body(), 'chip-go ahead');
+  assert.ok(byAct(body(), 'chip-go ahead'), 'its options stand open');
+  toggle().fire('click');
+  assert.equal(walk(body(), (n) => n.className === 'mcard-more').length, 0, 'less folds it');
+});
+
+test('the docket hands a matter its detail only as text, bounded, and only when there is some', () => {
+  const src = read('../../government/docket.js');
+  assert.match(src, /\.\.\.detailField\(raw\.detail\)/);
+  assert.match(src, /const MAX_DETAIL = 4000;/);
+  for (const [f, re] of [['../../ideas/governor-docket.js', /detail: b\.body_md/], ['../../lifecycle/governor-docket.js', /detail: r\.rationale/], ['../../lifecycle/governor-docket.js', /detail: r\.description/], ['../../security/routes/reports.js', /detail: \[r\.target/], ['../../onboarding/routes/access-requests.js', /detail: r\.note/]]) {
+    assert.match(read(f), re, f);
+  }
+});
+
 // ── the Board Room names the new subjects ───────────────────────────────────
 
 test('the Board Room labels a building\'s matter as that building\'s matter, and a who-decides change as its own amendment', () => {

package/tests/hall_street.mjs

@@ -505,7 +505,7 @@ test('a pin opens its short card, Escape closes it and focus goes back to the pi
   const card = p.byId.get('streetCard');
   assert.equal(card.hidden, false);
   assert.equal(p.byId.get('streetCardTitle').textContent, '<img src=x onerror=alert(1)>', 'docket text lands as text');
-  assert.equal(p.byId.get('streetCardOpen').attrs.href, '/builders/board-room');
+  assert.equal(p.byId.get('streetCardOpen').attrs.href, undefined, 'the card links nowhere: it acts in place (task 1004566)');
   assert.equal(p.focused.el, p.byId.get('streetCardClose'));
   assert.equal(p.byId.get('streetPins').children[0].attrs['aria-expanded'], 'true');
   const e = { key: 'Escape', prevented: false, preventDefault() { this.prevented = true; } };