@bongos/core 1.21.98 → 1.21.99

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.98",
-  "core_contract": "1.21.98",
-  "source_commit": "e830432e8980019fb401fc5aa8adf72bcca01811",
+  "core_version": "1.21.99",
+  "core_contract": "1.21.99",
+  "source_commit": "262e039f7737aee04e24db9559e593544fab5532",
   "source_ref": "HEAD",
-  "built_at": "2026-10-09T11:44:35.365Z",
+  "built_at": "2026-10-09T12:05:36.533Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
-    "docs_redacted": 590,
+    "docs_redacted": 591,
     "agent_docs_stubbed": 28,
-    "functional_verbatim": 3017,
+    "functional_verbatim": 3019,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3636,
-  "tree_sha256": "10aaec2a3eabaf5dd793204d82ecbfcb2fbc61dfde61a60d2a3d318c3f9503c5",
+  "file_count": 3639,
+  "tree_sha256": "6627907aa4a62c0516525dd3273bf188497dd8914388d4fcd5435d4563149bbf",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2309,10 +2309,15 @@
       "mode": "0000644",
       "sha256": "d4963a203bce58f5d5f422bab582e022bf2d2b33eaa854c0ee80b6b76ccff1ee"
     },
+    {
+      "path": "docs/adr/0371-auto-pickup-applies-a-submitted-tweak-on-the-runner.md",
+      "mode": "0000644",
+      "sha256": "c23bc85e0e4e925911e7f7c3b2914b8e8dea8db725bd7c8d7840f4dade1f02a6"
+    },
     {
       "path": "docs/adr/README.md",
       "mode": "0000644",
-      "sha256": "3a58f45b80d4311b5ae5458bc7d564301978b0cf3ba5c72c6244bc1ef6356e89"
+      "sha256": "a010bc0f1d8a26126c5b86c24a4a0e548e038c651909e2b27d5fbdc7cbdd6f94"
     },
     {
       "path": "docs/api-reference.md",
@@ -2862,7 +2867,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7d7a017bb5c1bb3a0af17cd04a2b747a9df2a2fdb26879cb431096eb6d4cf9c0"
+      "sha256": "d43b9ee9d1bae22277b8e9b9d425aafef3d1c2c5298814fd6a1a319e632917b7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -10122,12 +10127,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8430c9bf8e4cfbf413316f9b99f85ddfb2dca688374f65373c3959d3f5d67d1a"
+      "sha256": "743e74b9cb354d11b19bb40b81f9640932ac68730487816569ee5796875392a4"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ff69b26fc946bd74d06693048dd4cb7495107d8ee6fef45b45d5c678bce417a5"
+      "sha256": "e74953a3c03fb015d7f54229580414d430cff7159d5361dca7754eb28d852310"
     },
     {
       "path": "public-docs/index.html",
@@ -10147,7 +10152,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "feedbd41f5e5808a38ee9478e01a5060197e78ea317797cee594931e24aeb8bc"
+      "sha256": "76a1303dec3ba5b72f9a7eb03de1896d6dafc040c8c9260af6c7b8fe2a6e58cf"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -10829,6 +10834,11 @@
       "mode": "0000644",
       "sha256": "320841b1e4df014966ea9b6b70645ecb7915b412f94b8fa0d9835dae5b9446c5"
     },
+    {
+      "path": "scripts/gds/government-walk.js",
+      "mode": "0000644",
+      "sha256": "f7a6091ce0621fdfdf69f667e44e52aaf96f6a1222f52f9e5730ff003e162383"
+    },
     {
       "path": "scripts/gds/grade-correlation-audit.js",
       "mode": "0000644",
@@ -12417,7 +12427,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7a9984b85013e6be20e59eb846c78da89ea7f62b650aa3f3c7bf9d3fda539e53"
+      "sha256": "fe5b5772fd9a33f1aa10b93689e32179c6c81d9dbf9a3a33ee4af2383a3bdb02"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14554,6 +14564,11 @@
       "mode": "0000644",
       "sha256": "444f0638dccebc42e5a371820ed565c665d4373c198e1581389ab222bf267c5e"
     },
+    {
+      "path": "tests/government_walk.mjs",
+      "mode": "0000644",
+      "sha256": "35d39431886fb2faad9508dd8ca481987760432397464b1b702aef0451de2270"
+    },
     {
       "path": "tests/governor_docket.mjs",
       "mode": "0000644",

package/docs/adr/0371-auto-pickup-applies-a-submitted-tweak-on-the-runner.md

@@ -0,0 +1,64 @@
+# ADR 0371 — Auto-pickup applies a submitted tweak on the runner, and the artist still approves
+
+- **Status:** accepted
+- **Date:** 2026-10-09
+- **Task:** [task 1004330](https://cloudbongos.com/builders#/task/1004330) (BV2.TW19, goal 1000095, BONGOS-V2)
+- **Builds on:** [ADR 0341](0341-the-page-is-the-unit-of-tweak-mode.md) (Tweak Mode; D7 nothing ships without the artist's approval), [ADR 0307](0307-autobongos-a-deterministic-supervisor-and-agentic-workers.md) (Autobongos: one supervisor, one headless worker per task, a DB fence), [ADR 0369](0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md) (a live knob in `project_settings` behind one resolver)
+- **Decided with:** the owner, 2026-09-27 ("queue now, auto later") and 2026-10-08 (write the design now, without waiting for the live artist proof, task 1004329)
+
+## Context
+
+In Tweak Mode an artist rewrites a whole page in the studio and presses submit. The round then waits, at `ready` with no claim, until a builder or agent session runs `/tweak` (`modules/copy-desk/skills/tweak/SKILL.md`). That session claims the round, applies the words with `copy-apply.js --batch`, takes before and after renders, commits and runs `ship.js`. A passed grade is then held for the artist (`page-tweak-hold.js`), who approves it in the Approval queue or sends it back.
+
+So an artist with nobody at a terminal waits indefinitely. The task asks for an agent that picks up a submitted page on its own, and names four questions: the trigger, who pays, the loop guard, and the rank it runs at.
+
+Two machines in the core could host it:
+
+- **The agents module** (`modules/agents/`). It fires on events, from the web server, through `claude -p --tools Read`. That spawn lives in grading (`modules/grading/grader-subagent.js`) and is hardcoded read-only, which is why its agents "may only report". Applying a tweak needs file writes, git, a browser for the page reader and renders, and `ship.js`. Widening the grader's spawn is an edit to a protected path, and the web server process has no worktree to write in.
+- **Autobongos** (ADR 0307, `scripts/gds/autobongos-run.js`). A supervisor on a builder's machine claims a task, starts one headless worker in a worktree, and reads the outcome from the ledger. It already writes code, ships through the normal grade, and is bounded by a DB fence (kill switch, goal allowlist, protected paths, a grader-outage stop), a wall clock and a grade cap.
+
+## Decision
+
+**D1 — Auto-pickup is a lane of the Autobongos runner, not an agent.** The runner gains a *tweak lane*. Before it picks ordinary work, it asks for the oldest submitted round and, if the lane is allowed, hands that one page to a worker that runs `/tweak` for it. Everything a person's `/tweak` session does still happens, in the same order, through the same scripts. The worker gains no new power: it runs as the runner's builder, through the claim, grade and land paths every session uses. The agents module stays read-only.
+
+**D2 — The trigger is the runner's own poll, not a new event.** Submit emits nothing today, and nothing needs it to: the runner already wakes on its cadence and reads the ledger. The lane reads the same derived state the studio shows (`open_round.state = 'submitted'` from `modules/copy-desk/page-status.js`), oldest first, so the queue order an artist sees is the order it is worked. A round becomes eligible the moment it is submitted; how soon it is picked up is the runner's cadence, which is stated on the studio rather than promised.
+
+**D3 — It is off until the project turns it on.** A new project setting, `tweak.autopickup` (`off` | `on`, default `off`), in `project_settings` behind one resolver, as ADR 0369 does for `ship.mode`. Any builder can read it, `project.settings.manage` writes it. The lane also needs everything an Autobongos run already needs: the fence's kill switch open, a grader that is up, and a runner some Metic+ builder has chosen to run. The setting replaces only the **goal allowlist** for this lane, because a tweak round lives in whatever goal holds the version's page work and an artist cannot be expected to know which goal to allowlist. It does not replace any other fence rule.
+
+**D4 — It runs at the rank of the builder whose runner it is, and that must be Metic or higher.** There is no new service principal. `/tweak` is Metic+ already (`copy-apply.js` writes a `page-tweak-applied` block, which needs `task.edit`), so a runner below Metic gets the same refusal a person would, and the lane reports it once and stops trying. A bot identity was rejected: `builders.system_role` principals are trusted for identity and never for authorization ([ADR 0033](0033-discord-bot-service-principal.md)), and a new one would be a second way to hold `task.edit` that no person holds.
+
+**D5 — Who pays.** The worker's model time is the runner owner's own capacity, exactly as for any Autobongos task: the gauge keeps the owner's reserve and the wall clock (`DEFAULT_WORKER_TIMEOUT_MS`) bounds one worker. The grade is charged to the project, as every grade is. Because a tweak costs the project a grade without a person choosing to spend it, the lane has its own ceiling: **`tweak.autopickup_monthly_cap`**, a count of rounds the lane may pick up per calendar month (default **20**), counted from the ledger, never from a counter that can drift. The lane claims with an `auto_pickup` mark that the server records on the claim row, and **the server enforces the cap at claim time**: the count and the claim insert run in one transaction under a project-wide advisory lock (`page-tweak/autopickup`), so two runners racing for the last slot cannot both get it. At the cap the claim is refused, the lane stops and the studio says so; rounds wait for a person, as today. The mark is a cost brake on a runner the owner chose to run, not a security boundary: a worker that claimed without it would be claiming as its builder, which that builder may already do by hand. **Why 20:** a grade costs the project a few dollars (the `/tweak` skill's own cost line), so 20 rounds is a bounded, legible monthly spend at about the level of one active artist; the owner can raise it. The cost-plus session reward (ADR 0054) is unchanged: it goes to the builder whose session shipped, as for any worktree claim, and the artist's page credit is untouched (ADR 0341 D10).
+
+**D6 — The loop guard is per round, and the artist is the gate that matters.**
+1. **Nothing lands without the artist.** The held pass (`isHeldForArtist`) is unchanged, so the worst an unattended worker can do is offer the artist a bad render to send back. This is why auto-pickup is safe to have at all.
+2. **Two automatic applies per round, then a person.** A sent-back round returns to `ready` with the artist's note, and the lane may take it again, because the note is the artist's instruction. After the lane has applied a round twice (counted from that round's own claims by the runner), it leaves the round for a person and the studio shows "waiting for a person". The server refuses a third `auto_pickup` claim on the same round, with the same refusal shape as the cap. **Why two:** one apply plus one try at the artist's note; a round sent back twice is a disagreement a person should read, not a third render to approve.
+3. **A failed apply is not retried until the round changes.** `copy-apply.js` exit 2 (nothing applied) or a refused claim releases the round with a note, and the lane skips it until the artist edits or resubmits it (its `updated_at` moves). The runner's existing set-aside and grade cap (one grade plus one re-grade) still apply on top.
+
+**D7 — The fence's other rules are kept, on the page's files.** A round's touches are the page's files from the page inventory. The [ADR 0043](0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md) protected-path matcher and the host-access check run over those exactly as `decideTask` runs them over a task's touches. A page whose files hit a protected path (the shared shell is the likely one) is left for a person, and the studio says why. The lane never edits a file outside the page's own list; a rewrite that needs one is already its own engineer task (`page-tweak-unplaced`).
+
+**D8 — The worker is headless, so `/tweak` gains a non-interactive mode.** Today the skill can stop and ask. The worker cannot. `/tweak --page <page-id> --unattended` takes one named round, never asks, and on any halt (claim refused, nothing applied, ship-check stale, grade unavailable) releases the round with a plain note and exits. It never runs `--skip-grade`, never edits a protected path, and never ships more than the one round it was given.
+
+**Those rules are not left to the worker.** The skill states them; the server holds them, so a worker that ignored its instructions gets refused rather than trusted:
+- **No land without the artist.** A page-tweak round reaches `confirmed` only through the artist's approval (`approveHeldTweak`) or the owner's override request, never through a ship path that skips or bypasses the grade. Task 1004678 pins this with a test over every confirm path, and closes any path that does not hold it.
+- **No file outside the page.** At publish, the server reads the merged change's files itself (`ship-files.js`, not the client's report) and refuses an `auto_pickup` round whose diff touches any file outside that page's inventory list, or a protected path.
+- **One round per claim** is the claim model already: a worktree holds one active claim.
+
+**D9 — The artist can see it happened.** The Approval queue already names who applied a round ("with help from", ADR 0341 / task 1004432). An automatic apply is marked "applied automatically" there and in the studio's queue line, and the project settings page carries the switch and the month's count against the cap.
+
+## Rejected
+
+- **A write-capable agent in `modules/agents/`.** It would need a capability-parametrized spawn in grading (a protected edit) and a worktree, a browser and git inside the web server process. Every guard Autobongos already has would be rebuilt there.
+- **A `page.submitted` event.** Useful only to a host that sleeps between events. The runner polls the ledger, which cannot miss a submit that happened while it was down; an event can.
+- **Landing without the artist when the grade passes.** Contradicts ADR 0341 D7, and it is the artist's approval that makes an unattended apply acceptable.
+- **A per-round dollar cap.** The grade cost is set by the grader, not by the lane. A count of rounds is something the owner can reason about and the ledger can count exactly.
+
+## Consequences
+
+- Built by five tasks in goal 1000095:
+  - [task 1004677](https://cloudbongos.com/builders#/task/1004677) (TW19a): the setting, the claim mark and the server-enforced cap and per-round limit (D3, D5, D6; needs a migration);
+  - [task 1004678](https://cloudbongos.com/builders#/task/1004678) (TW19b): `/tweak --page <id> --unattended` and the server guards under it, after TW19a (D8);
+  - [task 1004679](https://cloudbongos.com/builders#/task/1004679) (TW19c): the runner's tweak lane, after the two above (D1, D2, D4, D6, D7);
+  - [task 1004680](https://cloudbongos.com/builders#/task/1004680) (TW19d): the studio and settings surfaces (D9);
+  - [task 1004681](https://cloudbongos.com/builders#/task/1004681) (TW19e): the live proof, which also waits for the artist proof ([task 1004329](https://cloudbongos.com/builders#/task/1004329)) because it needs a real artist to approve the result.
+- Nothing changes until a project turns `tweak.autopickup` on and a Metic+ builder runs the runner. A project that never does keeps today's queue exactly.
+- An instance with no runner has no auto-pickup. That is deliberate: the core does not run unattended workers in its own server process.

package/docs/adr/README.md

@@ -489,3 +489,4 @@ These 20 numbers are each shared by exactly two files. They are **accepted histo
 | 0368 | [**Red and blue teams practise on a range, never on live** (goal 1000094 — *Working area 10, Security*; proposed). **D2:** the range is its own small server, rebuilt from the candidate the owner marks "stage for attack". **D3:** it shares no identity hub, secret or data with live. **D5:** red is AI plus Metic+, with one side at a time and a 30-day switch. **D6:** attacks run on subscriptions, never the metered API. **D7:** 3 runs on the newest model with 0 high+ breaks, advisory until an outside tenant exists. **D8:** points only, no credits yet. **D9:** three live signals to `#security-alerts`.](0368-red-and-blue-teams-practice-on-a-range-never-on-live.md) | security / red-team / range |
 | 0369 | [**Ship mode decides who starts a ship, not how it lands** ([task 1004628](https://cloudbongos.com/builders#/task/1004628), goal 1000106). **D1:** a `ship.mode` project setting, `auto` (the AI ships and lands a finished task with no commands) or `manual` (a person approves each ship), in `project_settings` with no migration. **D2:** Auto is the default, and the resolver reports whether anyone has chosen. **D3:** it is separate from deploy mode (`config/deploy.json`), which decides how a land happens. **D4:** any builder can read it (the AI must know), and `project.settings.manage` writes it, from the settings page or `bongos ship-mode`.](0369-ship-mode-decides-who-starts-a-ship-not-how-it-lands.md) | lifecycle / shipping / project settings |
 | 0370 | [**A repo we create for a new project is private** ([task 1004645](https://cloudbongos.com/builders#/task/1004645), goal 1000106). Supersedes ADR 0155 Decision 3: `createUserRepo` sends `private: true`, still not a parameter, and the wizard says the new repo is private. Safe because ADR 0176 already gives a private repo its own read-only deploy key before the first pull; the owner can make it public from the manage page.](0370-a-repo-we-create-is-private.md) | onboarding / security / github |
+| 0371 | [**Auto-pickup applies a submitted tweak on the runner, and the artist still approves** ([task 1004330](https://cloudbongos.com/builders#/task/1004330), goal 1000095, BV2.TW19). **D1:** a tweak lane of the Autobongos runner (ADR 0307), not a write-capable agent: the agents spawn is read-only by construction. **D2:** the trigger is the runner's ledger poll of the oldest `submitted` round, no new event. **D3:** off until a `tweak.autopickup` project setting turns it on; it replaces only the fence's goal allowlist. **D4:** runs as the runner's Metic+ builder, no service principal. **D5:** model time is the runner owner's; grades are the project's, under a monthly round cap (default 20) counted from the ledger. **D6:** the held pass still waits for the artist; two automatic applies per round, then a person; a failed apply waits for the round to change. **D7:** protected-path and host checks run on the page's files. **D8:** `/tweak --unattended`. **D9:** "applied automatically" is shown. Build tasks 1004677–1004681.](0371-auto-pickup-applies-a-submitted-tweak-on-the-runner.md) | copy-desk / autonomy / tweak mode |

package/docs/module-api-changelog.md

@@ -3033,5 +3033,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.96 with no explicit bump. run 37920956545. (task 1002620)
   1.21.98 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.97 with no explicit bump. run 37925528587. (task 1002620)
+  1.21.99 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.98 with no explicit bump. run 37927704012. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.98",
+  "version": "1.21.99",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.98",
+      "version": "1.21.99",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.98",
+  "version": "1.21.99",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9422,5 +9422,15 @@
       "id": "1004592",
       "text": "When someone restores a cut task or takes a task back off the board, it now stays put until a person promotes it. Before, the automatic promoter put it straight back on the claimable list within about five minutes."
     }
+  ],
+  "1.21.99": [
+    {
+      "id": "1004330",
+      "text": "The plan for applying an artist's submitted page automatically, with nobody at a terminal, is written and broken into five build tasks. It is off until a project turns it on, it has a monthly limit, and the artist still approv"
+    },
+    {
+      "id": "1004658",
+      "text": "There is now one walk anyone can re-run that tests a project's whole government from start to finish, and a table showing the result. It founds a test project with a chosen government and checks that this government, not the f"
+    }
   ]
 }

package/scripts/gds/government-walk.js

@@ -0,0 +1,842 @@
+#!/usr/bin/env node
+'use strict';
+
+// scripts/gds/government-walk.js — THE GOVERNMENT WALK: one repeatable end-to-end
+// pass over a throwaway test project's government, producing a pass/fail table
+// (task 1004658, goal 1000111, criterion gov-proven-and-kept-proven).
+//
+// WHAT IT WALKS, in four sections:
+//   1. Genesis — start founding, decide with a chosen government, close all five
+//      stages, come alive; the constitution reads as the choice.
+//   2. Every available form (Monarchy / BDFL, Timocratic Republic, Direct Democracy,
+//      Foundation with a council rank) plus the two pass rules no form uses
+//      (majority, unanimous): switch to it through a charter amendment, then confirm
+//      who can vote and what passes.
+//   3. Every building: set it to decide by vote (a decision-rules amendment), try to
+//      act alone on each of its bound routes (refused), restore it (reachable again).
+//   4. Every matter action: open the matter, pass it, confirm the effect happened.
+//
+// HOW REAL IT IS. Every request is real HTTP through the real routers (government,
+// onboarding/genesis, and every building's own router), with the real
+// requirePermission gate resolving the real government port, and every decision is
+// the real code: the board, membership, the tally, the close, the charter apply
+// (written to a throwaway instance folder), the decision-rules apply, act-alone, and
+// each module's matter act. What is NOT real is the storage under them: there is no
+// Postgres on the machine this was built on, so the government module's db layer is
+// an in-memory fake with the same row shapes and the same guards (one open sitting
+// per subject, one vote per member, single-winner close, the decision-rules write
+// only from a passed decision-rules amendment), and the few writes a passed matter
+// makes into other modules are recorded in memory instead of written to a database
+// (or, for a gate approval, sent to GitHub). The table says which mode ran.
+//
+// Usage:
+//   node scripts/gds/government-walk.js           run it and print the table
+//   node scripts/gds/government-walk.js --write   also write docs/governance/government-walk.md
+//   node scripts/gds/government-walk.js --check   exit 1 if the committed table differs
+// tests/government_walk.mjs runs --check, so a change that flips any row reds CI.
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ROOT = path.resolve(__dirname, '..', '..');
+const DOC_PATH = path.join(ROOT, 'docs', 'governance', 'government-walk.md');
+
+// Bugs this walk found, filed as tasks under goal 1000111. A FAIL row names its task
+// so the table reads as a worklist; a row that starts passing again just passes.
+const KNOWN_BUGS = Object.freeze({});
+
+// ── the throwaway project ───────────────────────────────────────────────────
+
+// The test project's people. 42 founds it. 47 left the project; it only ever
+// authors the probe ideas, so no probe is decided by its own author.
+const BUILDERS = Object.freeze([
+  { id: '42', rank: 'archon', github_login: 'ada', display_name: 'Ada (founder)', status: 'active' },
+  { id: '43', rank: 'metic', github_login: 'ben', display_name: 'Ben', status: 'active' },
+  { id: '44', rank: 'metic', github_login: 'cy', display_name: 'Cy', status: 'active' },
+  { id: '45', rank: 'thetes', github_login: 'dee', display_name: 'Dee', status: 'active' },
+  { id: '46', rank: 'xenos', github_login: 'eve', display_name: 'Eve', status: 'active' },
+  { id: '47', rank: 'xenos', github_login: 'fay', display_name: 'Fay (left)', status: 'left' },
+]);
+const ACTIVE_IDS = BUILDERS.filter((b) => b.status === 'active').map((b) => b.id);
+const FOUNDER = '42';
+const COUNCIL = ['43', '44'];
+
+// Each bound route as a request that, as today, stops in its handler's own first
+// check (a bad id or body) before any database write — the same requests as
+// tests/government_act_alone_buildings.mjs, with People's two carrying a real
+// custom rank and builder of this project.
+const BAD = 'x';
+const REQUESTS = Object.freeze({
+  'PATCH /project-settings/rot-days': ['PATCH', '/project-settings/rot-days', { days: 'soon' }],
+  'PATCH /project-settings/ship-mode': ['PATCH', '/project-settings/ship-mode', { mode: 'sometimes' }],
+  'PATCH /work-categories/:id': ['PATCH', `/work-categories/${BAD}`, {}],
+  'POST /security/reports/:id/confirm': ['POST', `/security/reports/${BAD}/confirm`, {}],
+  'POST /security/reports/:id/dispute': ['POST', `/security/reports/${BAD}/dispute`, {}],
+  'POST /security/reports/:id/fix': ['POST', `/security/reports/${BAD}/fix`, {}],
+  'POST /government/assignments': ['POST', '/government/assignments', { builder_id: 46, rank_key: 'tester' }],
+  'DELETE /government/assignments/:builderId/:rankKey': ['DELETE', '/government/assignments/46/tester'],
+  'PATCH /access-requests/:id': ['PATCH', `/access-requests/${BAD}`, { status: 'invited' }],
+  'POST /access-requests/invite': ['POST', '/access-requests/invite', {}],
+  'POST /goals': ['POST', '/goals', {}],
+  'POST /goals/reorder': ['POST', '/goals/reorder', {}],
+  'POST /work-categories': ['POST', '/work-categories', {}],
+  'PUT /versions/focus': ['PUT', '/versions/focus', { version_id: '   ' }],
+  'POST /autonomy/fence': ['POST', '/autonomy/fence', { enabled: 'yes' }],
+  'POST /autonomy/fence/goals': ['POST', '/autonomy/fence/goals', { goal_id: 0 }],
+  'DELETE /autonomy/fence/goals/:goalId': ['DELETE', `/autonomy/fence/goals/${BAD}`],
+  'POST /autonomy/fence/priority': ['POST', '/autonomy/fence/priority', {}],
+  'POST /autonomy/builders/:builderId/pause': ['POST', `/autonomy/builders/${BAD}/pause`, { paused: false }],
+  'POST /done-when/:criterionId/satisfy': ['POST', `/done-when/${BAD}/satisfy`, {}],
+  'POST /done-when/:criterionId/unsatisfy': ['POST', `/done-when/${BAD}/unsatisfy`, {}],
+  'POST /gate-approvals/:pr/approve': ['POST', `/gate-approvals/${BAD}/approve`, {}],
+  'POST /override-requests/:id/decide': ['POST', `/override-requests/${BAD}/decide`, { decision: 'approve' }],
+  'POST /provisioning/instances/:id/core-upgrade': ['POST', `/provisioning/instances/${BAD}/core-upgrade`, { to: '1.2.3' }],
+  'POST /provisioning/instances/:id/update-channel': ['POST', `/provisioning/instances/${BAD}/update-channel`, { channel: 'nightly' }],
+  'POST /render-deploy/act': ['POST', '/render-deploy/act', { action: 'launch' }],
+  'POST /npm-release/release': ['POST', '/npm-release/release', { version: 'v-next' }],
+  'PATCH /builders/:id/budget': ['PATCH', `/builders/${BAD}/budget`, { monthly_budget_usd: 5 }],
+});
+
+// Every matter action, as the matter the walk opens and passes: [area, title, action,
+// the effect in words]. runWalk observes each effect (its HAPPENED table).
+const MATTER_PLAN = Object.freeze([
+  ['people', 'Give Eve the tester rank', { type: 'assign_rank', builder_id: 46, rank_key: 'tester' }, 'Eve holds tester'],
+  ['people', 'Take the tester rank from Eve', { type: 'unassign_rank', builder_id: 46, rank_key: 'tester' }, 'Eve no longer holds tester'],
+  ['automation', 'Switch unattended building on', { type: 'switch_on' }, 'fence on'],
+  ['automation', 'Switch unattended building off', { type: 'switch_off' }, 'fence off'],
+  ['automation', 'Allow goal 77 to build unattended', { type: 'allow_goal', goal_id: 77 }, 'goal 77 allowed'],
+  ['release', 'Approve override request 5', { type: 'approve_override', request_id: 5 }, 'request 5 approved'],
+  ['release', 'Clear the gate on PR 1500', { type: 'approve_gate', pr: 1500 }, 'PR 1500 cleared'],
+  ['review', 'Sign off criterion 9', { type: 'satisfy_criterion', criterion_id: 9 }, 'criterion 9 satisfied'],
+  ['treasury', 'Dee gets $50 a month', { type: 'set_budget', builder_id: 45, monthly_usd: 50 }, 'Dee\'s limit is $50'],
+]);
+
+// Every router the walk drives, mounted as the server mounts them.
+const ROUTERS = Object.freeze([
+  'modules/government/routes/government.js',
+  'modules/onboarding/routes/onboarding.js',
+  'modules/autonomy/routes/autonomy.js',
+  // no HTTP surface; it contributes the Release and Review matter acts, as at boot
+  'modules/lifecycle/routes/lifecycle.js',
+  'modules/lifecycle/routes/done-when.js',
+  'modules/lifecycle/routes/gate-approvals.js',
+  'modules/lifecycle/routes/tasks.js',
+  'modules/lifecycle/routes/goals.js',
+  'modules/lifecycle/routes/versions.js',
+  'modules/lifecycle/routes/project-settings.js',
+  'modules/render-deploy/routes/act.js',
+  'modules/npm-release/routes/release.js',
+  'modules/provisioning/routes/core-upgrade.js',
+  'src/bongos/routes/builders.js',
+  'modules/security/routes/reports.js',
+]);
+
+// ── the in-memory government store ──────────────────────────────────────────
+//
+// The government module's db.js, with the same row shapes and the same guards the
+// SQL carries. Any db function the walk did not expect throws, so a code path that
+// reaches storage this fake does not model shows up as a FAIL rather than a quiet
+// undefined.
+function makeStore(catalog) {
+  const s = {
+    seq: 100,
+    clock: 0,
+    builders: new Map(BUILDERS.map((b) => [b.id, { ...b }])),
+    customRanks: new Map(),
+    assignments: [], // { builder_id, rank_key, assigned_by }
+    items: [],
+    votes: [],
+    amendments: new Map(),
+    matters: new Map(),
+    rules: new Map(),
+    ideas: new Map(),
+    tasks: new Map(),
+    karma: [],
+    unexpected: [],
+  };
+  const next = () => String(++s.seq);
+  const tick = () => `T${String(++s.clock).padStart(4, '0')}`;
+  const heldRanks = (id) => {
+    const b = s.builders.get(String(id));
+    if (!b) return [];
+    return [b.rank, ...s.assignments.filter((a) => a.builder_id === String(id)).map((a) => a.rank_key)];
+  };
+  const isLive = (b) => b && b.status === 'active';
+  const copy = (x) => (x == null ? x : JSON.parse(JSON.stringify(x)));
+  const withExpiry = (i) => ({ ...copy(i), expired: false, remaining_seconds: null });
+  const voteRow = (v) => {
+    const b = s.builders.get(v.voter_id) || {};
+    return { ...copy(v), github_login: b.github_login || null, display_name: b.display_name || null };
+  };
+
+  const fns = {
+    async getPermissionKeysForBuilder(id) {
+      const keys = new Set();
+      for (const r of heldRanks(id)) for (const k of catalog.RANK_SEED[r] || []) keys.add(k);
+      return [...keys];
+    },
+    async getRankKeysForBuilder(id) { return heldRanks(id).sort(); },
+    async getRankByKey(k) {
+      if (catalog.RANK_SEED[k]) return { rank_key: k, label: k, is_system: true, seeded_rank: k };
+      return copy(s.customRanks.get(k)) || null;
+    },
+    async createRank({ rankKey, label, description, createdBy }) {
+      if (catalog.RANK_SEED[rankKey] || s.customRanks.has(rankKey)) throw Object.assign(new Error('dup'), { code: '23505' });
+      const row = { rank_key: rankKey, label, description: description ?? null, is_system: false, seeded_rank: null, created_by: String(createdBy) };
+      s.customRanks.set(rankKey, row);
+      return copy(row);
+    },
+    async assignRank({ builderId, rankKey, assignedBy }) {
+      const id = String(builderId);
+      if (!s.builders.has(id)) throw Object.assign(new Error('fk'), { code: '23503' });
+      if (s.assignments.some((a) => a.builder_id === id && a.rank_key === rankKey)) return false;
+      s.assignments.push({ builder_id: id, rank_key: rankKey, assigned_by: assignedBy == null ? null : String(assignedBy) });
+      return true;
+    },
+    async unassignRank({ builderId, rankKey }) {
+      const before = s.assignments.length;
+      s.assignments = s.assignments.filter((a) => !(a.builder_id === String(builderId) && a.rank_key === rankKey));
+      return s.assignments.length < before;
+    },
+    async listAssignments() { return copy(s.assignments); },
+    async getActiveBuildersWithRank(rankKeys) {
+      return [...s.builders.values()]
+        .filter((b) => isLive(b) && heldRanks(b.id).some((r) => rankKeys.includes(r)))
+        .sort((a, b) => Number(a.id) - Number(b.id))
+        .map((b) => ({ builder_id: b.id, github_login: b.github_login, display_name: b.display_name }));
+    },
+    async builderHoldsRankActive(id, rankKeys) {
+      const b = s.builders.get(String(id));
+      return isLive(b) && heldRanks(id).some((r) => rankKeys.includes(r));
+    },
+    async countActiveBuilders() { return [...s.builders.values()].filter(isLive).length; },
+    async openBoardItem({ subjectType, subjectId, openedBy = null, constitution, windowMinutes = null }) {
+      if (s.items.some((i) => i.subject_type === subjectType && i.subject_id === String(subjectId) && !i.closed_at)) return null;
+      const row = {
+        id: next(), subject_type: subjectType, subject_id: String(subjectId),
+        opened_by: openedBy == null ? null : String(openedBy), opened_at: tick(),
+        closes_at: windowMinutes == null ? null : `in ${windowMinutes} minutes`,
+        closed_at: null, outcome: null, constitution: copy(constitution || {}),
+      };
+      s.items.push(row);
+      return copy(row);
+    },
+    async getOpenBoardItem(type, subjectId) {
+      return copy(s.items.find((i) => i.subject_type === type && i.subject_id === String(subjectId) && !i.closed_at)) || null;
+    },
+    async getBoardItemForVote(id) {
+      const i = s.items.find((x) => x.id === String(id));
+      return i ? withExpiry(i) : null;
+    },
+    async getBoardItemAuthor(item) {
+      if (!item) return null;
+      if (item.subject_type === 'full_idea') {
+        const idea = s.ideas.get(String(item.subject_id));
+        return idea ? idea.captured_by : null;
+      }
+      return item.opened_by ?? null;
+    },
+    async insertBoardVote({ itemId, voterId, direction, reasonMd = null, sectionKey = null }) {
+      if (s.votes.some((v) => v.item_id === String(itemId) && v.voter_id === String(voterId))) return null;
+      const row = { id: next(), item_id: String(itemId), voter_id: String(voterId), direction, reason_md: reasonMd, section_key: sectionKey, cast_at: tick() };
+      s.votes.push(row);
+      return copy(row);
+    },
+    async getBoardVote(itemId, voterId) {
+      return copy(s.votes.find((v) => v.item_id === String(itemId) && v.voter_id === String(voterId))) || null;
+    },
+    async insertVoteKarma({ voterId, itemId, delta }) { s.karma.push({ builder_id: String(voterId), reason: `vote:${itemId}`, delta }); },
+    async getVotesForItem(id) { return s.votes.filter((v) => v.item_id === String(id)).map(copy); },
+    async getVotesForItems(ids) { const want = ids.map(String); return s.votes.filter((v) => want.includes(v.item_id)).map(voteRow); },
+    async closeBoardItem({ itemId, outcome, afterClose = null }) {
+      const i = s.items.find((x) => x.id === String(itemId) && !x.closed_at);
+      if (!i) return null;
+      // A transaction: the close and whatever rides it land together or not at all.
+      const rulesBefore = new Map(s.rules);
+      i.closed_at = tick();
+      i.outcome = outcome;
+      if (typeof afterClose === 'function') {
+        try {
+          await afterClose({ query: async () => { throw new Error('walk store: no raw SQL inside a close'); } }, copy(i));
+        } catch (err) {
+          i.closed_at = null;
+          i.outcome = null;
+          s.rules = rulesBefore;
+          throw err;
+        }
+      }
+      return copy(i);
+    },
+    async createAmendment({ proposed, rationaleMd = null, proposedBy, kind = 'constitution' }) {
+      const row = { id: next(), proposed: copy(proposed), rationale_md: rationaleMd, proposed_by: String(proposedBy), kind };
+      s.amendments.set(row.id, row);
+      return copy(row);
+    },
+    async getAmendment(id) { return copy(s.amendments.get(String(id))) || null; },
+    async listAmendmentHistory(limit = 50) {
+      return s.items
+        .filter((i) => i.subject_type === 'constitutional_amendment' && i.closed_at)
+        .sort((a, b) => (a.closed_at < b.closed_at ? 1 : -1))
+        .slice(0, limit)
+        .map((i) => {
+          const a = s.amendments.get(i.subject_id) || {};
+          return {
+            item_id: i.id, amendment_id: i.subject_id, proposed: copy(a.proposed), rationale_md: a.rationale_md,
+            proposed_by: a.proposed_by, opened_at: i.opened_at, closed_at: i.closed_at, outcome: i.outcome,
+            decided_under: copy(i.constitution), kind: a.kind || 'constitution',
+          };
+        });
+    },
+    async listDecisionRules() { return [...s.rules.values()].map(copy); },
+    // The SQL's guard: written only by a PASSED decision-rules amendment item.
+    async applyDecisionRules(_client, { itemId, rules }) {
+      const i = s.items.find((x) => x.id === String(itemId));
+      const a = i && s.amendments.get(i.subject_id);
+      const allowed = i && a && i.subject_type === 'constitutional_amendment' && i.outcome === 'passed' && a.kind === 'decision_rules';
+      if (!allowed) throw new Error(`decision rules not written (item ${itemId} is not a passed decision-rules amendment)`);
+      for (const r of rules) {
+        s.rules.set(r.area, { area: r.area, decided_by: r.decided_by, rule: r.rule, who: r.who, set_by_item_id: String(itemId), updated_at: tick() });
+      }
+      return rules.length;
+    },
+    async createMatter({ area, title, detailMd = null, action = null, proposedBy }) {
+      const row = { id: next(), area, title, detail_md: detailMd, action: copy(action), proposed_by: String(proposedBy) };
+      s.matters.set(row.id, row);
+      return copy(row);
+    },
+    async getMatter(id) { return copy(s.matters.get(String(id))) || null; },
+    async getMatterSubjects(ids) { return ids.map((id) => s.matters.get(String(id))).filter(Boolean).map(copy); },
+    async getTaskStatuses(ids) {
+      return ids.map(String).filter((id) => s.tasks.has(id)).map((id) => ({ id, status: s.tasks.get(id).status }));
+    },
+    async listLatestGenesisStageItems() {
+      const latest = new Map();
+      for (const i of s.items.filter((x) => x.subject_type === 'genesis_stage')) latest.set(i.subject_id, i);
+      return [...latest.values()].map(withExpiry);
+    },
+    async insertAuthorRatifyKarma({ authorId, itemId, delta }) {
+      const reason = `board.item.ratified:${itemId}`;
+      if (s.karma.some((k) => k.reason === reason)) return false;
+      s.karma.push({ builder_id: String(authorId), reason, delta });
+      return true;
+    },
+    async getIdeaCompleteness(id) { const idea = s.ideas.get(String(id)); return idea ? idea.completeness : null; },
+  };
+  return { s, fns };
+}
+
+function installStore(govDb, fns, unexpected) {
+  for (const k of Object.keys(govDb)) {
+    if (typeof govDb[k] !== 'function') continue;
+    govDb[k] = fns[k] || (async () => {
+      unexpected.push(k);
+      throw new Error(`walk store: unexpected db call ${k}`);
+    });
+  }
+}
+
+// ── the walk ────────────────────────────────────────────────────────────────
+
+async function runWalk() {
+  // The constitution is host content: point the instance root at a throwaway folder
+  // BEFORE anything reads it, so a ratified charter is written there (the real
+  // applyBoardAmendment) and never into this checkout.
+  const instanceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'government-walk-'));
+  process.env.BONGOS_INSTANCE_ROOT = instanceRoot;
+  delete process.env.DATABASE_URL; // the walk never touches a real database
+  // The modules' info lines (a fence switched, a budget set) would bury the table.
+  if (!process.env.LOG_LEVEL) process.env.LOG_LEVEL = 'warn';
+
+  const req = (rel) => require(path.join(ROOT, rel));
+  const api = req('src/module-api.js');
+  const seams = req('src/module-seams.js');
+  const authMod = req('src/bongos/auth.js');
+  const projectSettings = req('src/bongos/project-settings.js');
+  const { attachFail } = req('src/bongos/middleware/error-envelope.js');
+  const catalog = req('modules/government/catalog.js');
+  const govDb = req('modules/government/db.js');
+  const config = req('modules/government/config.js');
+  const board = req('modules/government/board.js');
+  const charter = req('modules/government/charter.js');
+  const membership = req('modules/government/board-membership.js');
+  const dr = req('modules/government/decision-rules.js');
+  const genesis = req('modules/onboarding/genesis-home.js');
+  const autoDb = req('modules/autonomy/db.js');
+  const lifeDb = req('modules/lifecycle/db.js');
+  const doneWhen = req('modules/lifecycle/done-when.js');
+  const doneWhenRoutes = req('modules/lifecycle/routes/done-when.js');
+  const gateRoutes = req('modules/lifecycle/routes/gate-approvals.js');
+  const express = require('express');
+  const http = require('http');
+
+  const { s: store, fns } = makeStore(catalog);
+  installStore(govDb, fns, store.unexpected);
+
+  // Project settings (founding mode + the plan) live in memory.
+  const settings = new Map();
+  projectSettings.getSetting = async (k) => (settings.has(k) ? { key: k, value: settings.get(k) } : null);
+  projectSettings.setSetting = async (k, v) => { settings.set(k, String(v)); return { key: k, value: String(v) }; };
+
+  // What passed matters write into other modules, recorded.
+  const effects = { fence: null, allowedGoals: [], overrides: [], gates: [], criteria: new Map([['9', false]]), budgets: new Map() };
+  autoDb.setFenceEnabled = async ({ enabled }) => { effects.fence = enabled; return { enabled }; };
+  autoDb.allowGoal = async ({ goalId }) => { effects.allowedGoals.push(String(goalId)); return { goal_id: goalId }; };
+  lifeDb.decideOverrideRequest = async ({ requestId, decision }) => { effects.overrides.push([String(requestId), decision]); return {}; };
+  gateRoutes.approveGatePr = async ({ number }) => { effects.gates.push(String(number)); return { ok: true, body: {} }; };
+  doneWhen.getCriterion = async (id) => (effects.criteria.has(String(id)) ? { id, satisfied: effects.criteria.get(String(id)) } : null);
+  doneWhenRoutes.satisfyByOverride = async ({ criterionId }) => { effects.criteria.set(String(criterionId), true); return { updated: {}, goalResult: {} }; };
+
+  // Ports the routers would otherwise reach a database for: the genesis seeder and
+  // the Treasury write. Registered first, so the routers' own registrations step aside.
+  const STAGE_TASK_IDS = { scope: '9001', strategize: '9002', charter: '9003', legalize: '9004', legislation: '9005' };
+  seams.registerProvider('lifecycle.kickoffSeed', {
+    seedGenesis: async () => {
+      for (const [stage, id] of Object.entries(STAGE_TASK_IDS)) store.tasks.set(id, { id, stage, title: `${stage} (walk)`, status: 'ready' });
+      return { seeded: 5 };
+    },
+    genesisTasks: async () => {
+      const out = {};
+      for (const t of store.tasks.values()) (out[t.stage] = out[t.stage] || []).push({ id: t.id, title: t.title, status: t.status });
+      return out;
+    },
+  });
+  seams.registerProvider('reward', {
+    setBuilderMonthlyBudget: async (id, usd) => {
+      if (!store.builders.has(String(id))) return null;
+      effects.budgets.set(String(id), usd);
+      return { id, monthly_budget_usd: usd };
+    },
+  });
+
+  // The session: whoever the request says it is, from this project's people.
+  const asHeader = 'x-walk-builder';
+  const fakeBuilder = (r, res, nextFn) => {
+    const b = store.builders.get(String(r.headers[asHeader] || ''));
+    if (!b || b.status !== 'active') return res.status(401).json({ error: { code: 'not_signed_in' } });
+    r.builder = { id: Number(b.id), rank: b.rank, github_login: b.github_login, display_name: b.display_name };
+    return nextFn();
+  };
+  api.requireBuilder = fakeBuilder;
+  authMod.requireBuilder = fakeBuilder;
+
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  for (const rel of ROUTERS) app.use(req(rel)());
+  const server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const BASE = `http://127.0.0.1:${server.address().port}`;
+
+  async function call(as, method, p, body) {
+    const res = await fetch(`${BASE}${p}`, {
+      method,
+      headers: { [asHeader]: as, ...(body === undefined ? {} : { 'content-type': 'application/json' }) },
+      body: body === undefined ? undefined : JSON.stringify(body),
+    });
+    let json = null;
+    try { json = await res.json(); } catch (_) { /* no body */ }
+    return { status: res.status, json };
+  }
+  const code = (r) => (r.json && r.json.error && r.json.error.code) || null;
+  const vote = (as, itemId, direction = 'yes') => call(as, 'POST', `/government/board/items/${itemId}/votes`,
+    direction === 'yes' ? { direction } : { direction, reason_md: 'Not yet: the walk objects.', section_key: 'purpose' });
+  const itemOf = (id) => store.items.find((i) => i.id === String(id)) || null;
+  const constitution = async () => (await call(FOUNDER, 'GET', '/government/constitution')).json;
+  const live = () => config.loadGovernmentConfig().board;
+  const stateOf = (id) => { const i = itemOf(id); return !i ? 'missing' : i.closed_at ? i.outcome : 'open'; };
+
+  // ── the table ──
+  const rows = [];
+  let current = '';
+  const section = (name) => { current = name; };
+  async function check(name, expected, fn) {
+    let got;
+    let pass = false;
+    try {
+      const out = await fn();
+      got = out.got;
+      pass = out.pass === true;
+    } catch (err) {
+      got = `threw: ${err && err.message}`;
+    }
+    const n = rows.filter((r) => r.section === current).length + 1;
+    rows.push({ section: current, key: `${current.split(' ')[0]}${n}`, name, expected, got: String(got), pass });
+    return pass;
+  }
+  const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+
+  // Every voter in `voters` votes; returns the state after each vote.
+  async function voteAll(itemId, voters, direction = 'yes') {
+    const after = [];
+    for (const v of voters) {
+      const r = await vote(v, itemId, direction);
+      after.push(r.status === 201 ? stateOf(itemId) : `${r.status} ${code(r)}`);
+      if (stateOf(itemId) !== 'open') break;
+    }
+    return after;
+  }
+
+  // ── setup: the council and the rank People's acts give ──
+  await call(FOUNDER, 'POST', '/government/ranks', { rank_key: 'council', label: 'Council' });
+  await call(FOUNDER, 'POST', '/government/ranks', { rank_key: 'tester', label: 'Tester' });
+  for (const id of COUNCIL) await call(FOUNDER, 'POST', '/government/assignments', { builder_id: Number(id), rank_key: 'council' });
+
+  // ══ 1. Genesis ══
+  section('G Genesis');
+  const CHOSEN = 'timocratic-republic';
+  await check('The test project is born a Monarchy (the state every genesis starts from)', 'reads as monarchy', async () => {
+    const f = charter.readCharter(live()).form;
+    return { got: `reads as ${f}`, pass: f === 'monarchy' };
+  });
+  await check('Founding starts', '200, stage decide', async () => {
+    const r = await call(FOUNDER, 'POST', '/founding/start');
+    const stage = r.json && r.json.mode && r.json.mode.stage;
+    return { got: `${r.status}, stage ${stage}`, pass: r.status === 200 && stage === 'decide' };
+  });
+  let charterItem = null;
+  await check(`Deciding with ${CHOSEN} saves the plan and files the pick as a charter amendment`, 'plan saved, charter sitting, one vote decides', async () => {
+    const r = await call(FOUNDER, 'POST', '/founding/plan', { government: CHOSEN });
+    const c = (r.json && r.json.charter) || {};
+    charterItem = c.item_id || null;
+    return { got: `${r.status}, charter ${c.state}, one vote decides ${c.one_vote_decides}`, pass: r.status === 200 && c.state === 'sitting' && c.one_vote_decides === true };
+  });
+  await check('Saving the plan moved the project to its first stage', 'stage scope', async () => {
+    const g = await genesis.readGenesis();
+    return { got: `stage ${g && g.stage}`, pass: !!g && g.stage === 'scope' };
+  });
+  await check('The founder\'s one yes ratifies the pick under the Monarchy it is born with', 'passed', async () => {
+    const r = await vote(FOUNDER, charterItem);
+    return { got: `${r.status} ${r.json && r.json.outcome}`, pass: r.status === 201 && r.json.outcome === 'passed' };
+  });
+  await check('The constitution now reads as the government chosen at decide', `reads as ${CHOSEN}, no divergence`, async () => {
+    const c = await constitution();
+    const f = c && c.charter && c.charter.reads_as && c.charter.reads_as.form;
+    return { got: `reads as ${f}, divergence ${c && c.divergence ? 'yes' : 'none'}`, pass: f === CHOSEN && !c.divergence };
+  });
+  await check('A stage with unfinished tasks cannot be put to the board', '409 stage_tasks_unfinished', async () => {
+    const r = await call(FOUNDER, 'POST', '/founding/stages/scope/close');
+    return { got: `${r.status} ${code(r)}`, pass: r.status === 409 && code(r) === 'stage_tasks_unfinished' };
+  });
+  const timocrats = ['42', '43', '44'];
+  for (const stage of genesis.PROPER) {
+    store.tasks.get(STAGE_TASK_IDS[stage]).status = 'shipped';
+    let itemId = null;
+    await check(`${stage}: its finished stage is put to the board`, 'a sitting under the chosen government', async () => {
+      const r = await call(FOUNDER, 'POST', `/founding/stages/${stage}/close`);
+      itemId = r.json && r.json.item_id;
+      const snap = itemId && itemOf(itemId) ? itemOf(itemId).constitution : {};
+      const reads = charter.readCharter(snap).form;
+      return { got: `${r.status}, sitting under ${reads}`, pass: r.status === 200 && !!itemId && reads === CHOSEN };
+    });
+    await check(`${stage}: the founder alone cannot close it; every trusted member's yes does`, 'open, open, passed', async () => {
+      const after = await voteAll(itemId, timocrats);
+      return { got: after.join(', '), pass: same(after, ['open', 'open', 'passed']) };
+    });
+    const nextStage = genesis.PROPER[genesis.PROPER.indexOf(stage) + 1];
+    await check(`${stage}: a pass moves the project on`, nextStage ? `stage ${nextStage}` : 'come-alive door opens', async () => {
+      const g = await genesis.readGenesis();
+      if (nextStage) return { got: `stage ${g && g.stage}`, pass: !!g && g.stage === nextStage };
+      return { got: `can come alive ${g && g.can_come_alive}`, pass: !!g && g.can_come_alive === true };
+    });
+  }
+  await check('The project comes alive', '200, founding over', async () => {
+    const r = await call(FOUNDER, 'POST', '/founding/alive');
+    const g = await genesis.readGenesis();
+    return { got: `${r.status}, founding ${g ? 'still on' : 'over'}`, pass: r.status === 200 && g === null };
+  });
+  await check('Alive, it is still governed by the choice', `reads as ${CHOSEN}`, async () => {
+    const f = charter.readCharter(live()).form;
+    return { got: `reads as ${f}`, pass: f === CHOSEN };
+  });
+
+  // ══ 2. Every form ══
+  section('F Forms');
+  let ideaSeq = 500;
+  // A probe: a Full Idea (by someone who left, so no author rule bends the count)
+  // put to the board in force, voted on to show who may vote and what passes.
+  async function probe() {
+    const id = String(++ideaSeq);
+    store.ideas.set(id, { captured_by: '47', completeness: 80 });
+    const out = await board.openWindowForFullIdea({ ideaId: id, completenessScore: 80 });
+    return out.item.id;
+  }
+  const FORMS = [
+    // key, how to switch, who is seated, the yes-path states, the objection path (voter order + states)
+    { key: 'timocratic-republic', label: 'Timocratic Republic (in force from genesis)', body: null,
+      seated: ['42', '43', '44'], outsider: '45', yes: ['open', 'open', 'passed'], no: { voters: ['43', '42', '44'], dir: ['no', 'yes', 'yes'], states: ['open', 'open', 'returned'] },
+      rule: 'consent: a yes does not end it; full turnout passes; one objection returns it' },
+    { key: 'direct-democracy', label: 'Direct Democracy', body: { form: 'direct-democracy' },
+      seated: ACTIVE_IDS, outsider: null, yes: ['open', 'open', 'open', 'open', 'passed'], no: { voters: ['46', '42', '43', '44', '45'], dir: ['no', 'yes', 'yes', 'yes', 'yes'], states: ['open', 'open', 'open', 'open', 'returned'] },
+      rule: 'consent over every builder' },
+    { key: 'foundation', label: 'Foundation (council rank)', body: { form: 'foundation', council_rank: 'council' }, selfRemoval: true,
+      seated: COUNCIL, outsider: '42', yes: ['open', 'passed'], no: { voters: ['44', '43'], dir: ['no', 'yes'], states: ['open', 'returned'] },
+      rule: 'consent over the council only' },
+    { key: 'custom', label: 'Every builder, majority (no named form)', body: { franchise: 'everyone', pass_rule: 'majority' }, passRule: 'majority',
+      seated: ACTIVE_IDS, outsider: null, yes: ['open', 'open', 'passed'], no: { voters: ['42', '43', '44'], dir: ['no', 'no', 'no'], states: ['open', 'open', 'returned'] },
+      rule: 'majority: 3 of 5 yes carries; 3 of 5 no makes it unreachable' },
+    { key: 'custom', label: 'Every builder, unanimous (no named form)', body: { pass_rule: 'unanimous' }, passRule: 'unanimous',
+      seated: ACTIVE_IDS, outsider: null, yes: ['open', 'open', 'open', 'open', 'passed'], no: { voters: ['43'], dir: ['no'], states: ['returned'] },
+      rule: 'unanimous: one yes does not end it; full turnout passes; one objection returns it at once' },
+    { key: 'monarchy', label: 'Monarchy / BDFL', body: { form: 'monarchy' },
+      seated: ['42'], outsider: '43', yes: ['passed'], no: { voters: ['42'], dir: ['no'], states: ['returned'] },
+      rule: 'first yes: the founder\'s one vote decides' },
+  ];
+  let seatedNow = ['42', '43', '44']; // who sits under the form in force
+  for (const form of FORMS) {
+    const tag = form.label;
+    if (form.body) {
+      let itemId = null;
+      await check(`${tag}: the switch is filed as a charter amendment`, form.selfRemoval ? '409 proposer_would_lose_their_seat, then 201 once acknowledged' : '201', async () => {
+        let r = await call(FOUNDER, 'POST', '/government/board/charter', form.body);
+        let got = `${r.status}`;
+        if (form.selfRemoval) {
+          const first = `${r.status} ${code(r)}`;
+          r = await call(FOUNDER, 'POST', '/government/board/charter', { ...form.body, acknowledge_self_removal: true });
+          got = `${first}, then ${r.status}`;
+          itemId = r.json && r.json.item && r.json.item.id;
+          return { got, pass: first === '409 proposer_would_lose_their_seat' && r.status === 201 && !!itemId };
+        }
+        itemId = r.json && r.json.item && r.json.item.id;
+        return { got, pass: r.status === 201 && !!itemId };
+      });
+      await check(`${tag}: the government in force decides the switch`, 'passed once every seated member has said yes', async () => {
+        const after = await voteAll(itemId, seatedNow);
+        return { got: after.join(', '), pass: after[after.length - 1] === 'passed' };
+      });
+    }
+    await check(`${tag}: the constitution reads as it`, form.key === 'custom' ? `reads as Custom, pass rule ${form.passRule}` : `reads as ${form.key}`, async () => {
+      const c = await constitution();
+      const ra = (c && c.charter && c.charter.reads_as) || {};
+      const ok = ra.form === form.key && (!form.passRule || ra.pass_rule === form.passRule) && !c.divergence;
+      return { got: `reads as ${ra.form === 'custom' ? 'Custom' : ra.form}${form.passRule ? `, pass rule ${ra.pass_rule}` : ''}${c.divergence ? ', DIVERGES' : ''}`, pass: ok };
+    });
+    await check(`${tag}: who is seated`, `builders ${form.seated.join(', ')}`, async () => {
+      const members = (await membership.resolveBoardMembers(live())).map((m) => String(m.builder_id));
+      return { got: `builders ${members.join(', ') || 'none'}`, pass: same(members, form.seated) };
+    });
+    if (form.outsider) {
+      await check(`${tag}: someone not seated cannot vote`, '403 not_board_member', async () => {
+        const id = await probe();
+        const r = await vote(form.outsider, id);
+        return { got: `${r.status} ${code(r)}`, pass: r.status === 403 && code(r) === 'not_board_member' };
+      });
+    }
+    await check(`${tag}: what passes (${form.rule})`, form.yes.join(', '), async () => {
+      const id = await probe();
+      const after = await voteAll(id, form.seated);
+      return { got: after.join(', '), pass: same(after, form.yes) };
+    });
+    await check(`${tag}: what returns`, form.no.states.join(', '), async () => {
+      const id = await probe();
+      const after = [];
+      for (let k = 0; k < form.no.voters.length; k += 1) {
+        const r = await vote(form.no.voters[k], id, form.no.dir[k]);
+        after.push(r.status === 201 ? stateOf(id) : `${r.status} ${code(r)}`);
+        if (stateOf(id) !== 'open') break;
+      }
+      return { got: after.join(', '), pass: same(after, form.no.states) };
+    });
+    seatedNow = form.seated;
+  }
+
+  // ══ 3. Every building ══
+  section('B Buildings');
+  // Who decides at a building is changed by an amendment, decided here under the
+  // Monarchy the walk restored: the founder's one yes.
+  async function setRules(rules) {
+    const r = await call(FOUNDER, 'POST', '/government/board/decision-rules', { rules });
+    const itemId = r.json && r.json.item && r.json.item.id;
+    if (r.status !== 201 || !itemId) return { ok: false, why: `${r.status} ${code(r)}` };
+    const v = await vote(FOUNDER, itemId);
+    return { ok: v.status === 201 && v.json.outcome === 'passed', why: `vote ${v.status} ${v.json && v.json.outcome}` };
+  }
+  const rowOf = async (area) => {
+    const c = await constitution();
+    return ((c.decision_rules && c.decision_rules.areas) || []).find((a) => a.area === area) || {};
+  };
+  for (const area of dr.AREAS.filter((a) => a.acts.length)) {
+    await check(`${area.name}: set to decide by vote (council, majority) by a passed amendment`, 'sitting, majority vote', async () => {
+      const out = await setRules([{ area: area.key, decided_by: 'rank:council', rule: 'majority' }]);
+      const row = await rowOf(area.key);
+      return { got: `${out.ok ? 'passed' : out.why}; ${row.sitting ? 'sitting' : 'as today'}, ${row.rule_words}`, pass: out.ok && row.sitting === true && row.rule === 'majority' };
+    });
+    for (const act of area.acts) {
+      await check(`${area.name}: acting alone on ${act} is refused`, `409 decided_by_sitting (${area.key})`, async () => {
+        const [method, p, body] = REQUESTS[act];
+        const r = await call(FOUNDER, method, p, body);
+        const d = (r.json && r.json.error && (r.json.error.details || r.json.error)) || {};
+        return { got: `${r.status} ${code(r)} (${d.area})`, pass: r.status === 409 && code(r) === 'decided_by_sitting' && d.area === area.key };
+      });
+    }
+    await check(`${area.name}: restored to as today, every one of its ${area.acts.length} routes reaches its own handler again`, 'none refused', async () => {
+      const out = await setRules([{ area: area.key, decided_by: 'gate' }]);
+      const bad = [];
+      for (const act of area.acts) {
+        const [method, p, body] = REQUESTS[act];
+        const r = await call(FOUNDER, method, p, body);
+        const reached = act.includes('/government/assignments') ? r.status < 300 : (r.status >= 400 && r.status < 500 && r.status !== 403 && code(r) !== 'decided_by_sitting');
+        if (!reached) bad.push(`${act} ${r.status} ${code(r)}`);
+      }
+      return { got: `${out.ok ? 'restored' : out.why}; ${bad.length ? bad.join('; ') : 'none refused'}`, pass: out.ok && bad.length === 0 };
+    });
+  }
+
+  // ══ 4. Every matter action ══
+  section('M Matters');
+  const SITTINGS = {
+    people: 'consent', automation: 'majority', release: 'unanimous', review: 'signoff', treasury: 'first',
+  };
+  await check('Each acting building is put to the council by one passed amendment', Object.entries(SITTINGS).map(([a, r]) => `${a} ${r}`).join(', '), async () => {
+    const out = await setRules(Object.entries(SITTINGS).map(([area, rule]) => ({ area, decided_by: 'rank:council', rule })));
+    const got = [];
+    for (const area of Object.keys(SITTINGS)) got.push(`${area} ${(await rowOf(area)).rule}`);
+    return { got: `${out.ok ? '' : `${out.why}; `}${got.join(', ')}`, pass: out.ok && same(got, Object.entries(SITTINGS).map(([a, r]) => `${a} ${r}`)) };
+  });
+  // Open a matter as the founder (not on the council), pass it with council votes.
+  async function passMatter(area, title, action, voters = COUNCIL, direction = 'yes') {
+    const r = await call(FOUNDER, 'POST', '/government/board/matters', { area, title, action });
+    const itemId = r.json && r.json.item && r.json.item.id;
+    if (r.status !== 201 || !itemId) return { outcome: `not opened: ${r.status} ${code(r)}` };
+    const after = await voteAll(itemId, voters, direction);
+    return { outcome: stateOf(itemId), after };
+  }
+  const holds = (id, rank) => store.assignments.some((a) => a.builder_id === id && a.rank_key === rank);
+  // Did the act happen? One observation per matter action in MATTER_PLAN.
+  const HAPPENED = {
+    'people.assign_rank': () => holds('46', 'tester'),
+    'people.unassign_rank': () => !holds('46', 'tester'),
+    'automation.switch_on': () => effects.fence === true,
+    'automation.switch_off': () => effects.fence === false,
+    'automation.allow_goal': () => effects.allowedGoals.includes('77'),
+    'release.approve_override': () => effects.overrides.some(([id, d]) => id === '5' && d === 'approve'),
+    'release.approve_gate': () => effects.gates.includes('1500'),
+    'review.satisfy_criterion': () => effects.criteria.get('9') === true,
+    'treasury.set_budget': () => effects.budgets.get('45') === 50,
+  };
+  const MATTERS = MATTER_PLAN.map(([area, title, action, effect]) => [area, title, action, effect, HAPPENED[`${area}.${action.type}`]]);
+  // How each building's sitting closes as Ben then Cy say yes, under its rule: the
+  // two-member consent, majority and unanimous sittings need both; first yes and
+  // sign-off (by someone who did not propose it) close on the first.
+  const CLOSES = { people: 'open, passed', automation: 'open, passed', release: 'open, passed', review: 'passed', treasury: 'passed' };
+  await check('Someone the building\'s row does not seat cannot vote on its matter', '403 not_board_member', async () => {
+    const r = await call(FOUNDER, 'POST', '/government/board/matters', { area: 'automation', title: 'Who may vote here?' });
+    const itemId = r.json && r.json.item && r.json.item.id;
+    const v = await vote(FOUNDER, itemId);
+    await voteAll(itemId, COUNCIL, 'no'); // close the probe so it carries out nothing
+    return { got: `${r.status}, then ${v.status} ${code(v)}`, pass: r.status === 201 && v.status === 403 && code(v) === 'not_board_member' };
+  });
+  for (const [area, title, action, effect, happened] of MATTERS) {
+    await check(`${area} ${action.type}: "${title}" passes under ${SITTINGS[area]} and is carried out`, `${CLOSES[area]}; ${effect}`, async () => {
+      const out = await passMatter(area, title, action);
+      const done = happened();
+      const steps = out.after ? out.after.join(', ') : out.outcome;
+      return { got: `${steps}; ${done ? effect : `NOT ${effect}`}`, pass: out.outcome === 'passed' && steps === CLOSES[area] && done };
+    });
+  }
+  await check('A returned matter carries out nothing', 'returned; fence unchanged', async () => {
+    const before = effects.fence;
+    const out = await passMatter('automation', 'Switch it on again', { type: 'switch_on' }, COUNCIL, 'no');
+    return { got: `${out.outcome}; fence ${effects.fence === before ? 'unchanged' : 'CHANGED'}`, pass: out.outcome === 'returned' && effects.fence === before };
+  });
+  await check('Every building restored to as today', 'all as today', async () => {
+    const out = await setRules(Object.keys(SITTINGS).map((area) => ({ area, decided_by: 'gate' })));
+    const c = await constitution();
+    const sitting = c.decision_rules.areas.filter((a) => a.sitting).map((a) => a.area);
+    return { got: `${out.ok ? '' : `${out.why}; `}${sitting.length ? `still sitting: ${sitting.join(', ')}` : 'all as today'}`, pass: out.ok && sitting.length === 0 };
+  });
+
+  // Any storage the fake did not model is a finding about the walk itself.
+  section('S Store');
+  await check('No code path reached storage the walk does not model', 'none', async () => {
+    const u = [...new Set(store.unexpected)];
+    return { got: u.length ? u.join(', ') : 'none', pass: u.length === 0 };
+  });
+
+  await new Promise((r) => server.close(r));
+  try { fs.rmSync(instanceRoot, { recursive: true, force: true }); } catch (_) { /* best effort */ }
+  return { mode: 'in-memory', rows };
+}
+
+// ── the table, as Markdown ──────────────────────────────────────────────────
+
+const SECTION_TITLES = {
+  G: '1. Genesis: founded, decided, five stages closed, alive',
+  F: '2. Every form: who can vote and what passes',
+  B: '3. Every building: decide by vote refuses acting alone',
+  M: '4. Every matter action: passed and carried out',
+  S: 'The walk itself',
+};
+const cell = (v) => String(v).replace(/\|/g, '\\|').replace(/\n/g, ' ');
+
+function renderTable({ mode, rows }) {
+  const out = [];
+  out.push('<!-- GENERATED by scripts/gds/government-walk.js - do not hand-edit. Regenerate: node scripts/gds/government-walk.js --write -->');
+  out.push('');
+  out.push('# The government walk');
+  out.push('');
+  out.push('One repeatable walk over a throwaway test project\'s government (task 1004658, goal 1000111). Re-run it with `node scripts/gds/government-walk.js`; `tests/government_walk.mjs` re-runs it in CI and fails if any row below changes, so this table is kept true, not just written once.');
+  out.push('');
+  out.push(`**Mode: ${mode}.** Every request is real HTTP through the real routers, and every decision is the real code: the permission gate, board membership, the vote, the tally, the close, the charter apply (written to a throwaway folder), the decision-rules apply, the act-alone gate on every building, and each module's matter act. The storage underneath is an in-memory stand-in for the government tables with the same guards (no Postgres was available where this was built), and the writes a passed matter makes into other modules (the automation fence, override requests, criteria, the GitHub gate approval, budgets) are recorded in memory. A real-database run of this walk is not built yet.`);
+  out.push('');
+  out.push('The test project: Ada founds it (Archon); Ben and Cy are trusted builders (Metic) and sit on a Council rank; Dee (Thetes) and Eve (Xenos) are newer builders; Fay has left and only authors the probe ideas, so no probe is decided by its own author.');
+  out.push('');
+  const keys = Object.keys(SECTION_TITLES).filter((k) => rows.some((r) => r.section.startsWith(k)));
+  out.push('| Section | Pass | Fail |');
+  out.push('|---|---|---|');
+  for (const k of keys) {
+    const rs = rows.filter((r) => r.section.startsWith(k));
+    out.push(`| ${SECTION_TITLES[k]} | ${rs.filter((r) => r.pass).length} | ${rs.filter((r) => !r.pass).length} |`);
+  }
+  out.push(`| **All** | **${rows.filter((r) => r.pass).length}** | **${rows.filter((r) => !r.pass).length}** |`);
+  for (const k of keys) {
+    out.push('');
+    out.push(`## ${SECTION_TITLES[k]}`);
+    out.push('');
+    out.push('| # | Check | Expected | Got | Result |');
+    out.push('|---|---|---|---|---|');
+    for (const r of rows.filter((x) => x.section.startsWith(k))) {
+      const bug = KNOWN_BUGS[r.key];
+      const result = r.pass ? 'PASS' : `**FAIL**${bug ? ` (${bug})` : ''}`;
+      out.push(`| ${r.key} | ${cell(r.name)} | ${cell(r.expected)} | ${cell(r.got)} | ${result} |`);
+    }
+  }
+  out.push('');
+  return out.join('\n');
+}
+
+async function main(argv) {
+  // Logs from the modules go to stderr so the table on stdout stays readable.
+  const realLog = console.log;
+  console.log = (...a) => console.error(...a);
+  const result = await runWalk();
+  const md = renderTable(result);
+  console.log = realLog;
+  const fails = result.rows.filter((r) => !r.pass);
+  if (argv.includes('--check')) {
+    const committed = fs.existsSync(DOC_PATH) ? fs.readFileSync(DOC_PATH, 'utf8').replace(/\r\n/g, '\n') : '';
+    if (committed !== md) {
+      process.stdout.write(md);
+      process.stdout.write(`\ngovernment-walk: the committed table (${path.relative(ROOT, DOC_PATH)}) differs from this run. A row changed: find it above, then regenerate with node scripts/gds/government-walk.js --write (and file any new FAIL as a bug under goal 1000111).\n`);
+      return 1;
+    }
+    process.stdout.write(`government-walk: ${result.rows.length - fails.length} pass, ${fails.length} fail - matches the committed table.\n`);
+    return 0;
+  }
+  process.stdout.write(md);
+  if (argv.includes('--write')) {
+    fs.writeFileSync(DOC_PATH, md);
+    process.stdout.write(`\nwrote ${path.relative(ROOT, DOC_PATH)}\n`);
+  }
+  process.stdout.write(`\ngovernment-walk: ${result.rows.length - fails.length} pass, ${fails.length} fail (${result.mode}).\n`);
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((exitCode) => process.exit(exitCode), (err) => {
+    console.error(err);
+    process.exit(2);
+  });
+}
+
+module.exports = { runWalk, renderTable, REQUESTS, ROUTERS, MATTER_PLAN, KNOWN_BUGS };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.98'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.99'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/government_walk.mjs

@@ -0,0 +1,56 @@
+// tests/government_walk.mjs — the government walk stays true (task 1004658, goal
+// 1000111, criterion gov-proven-and-kept-proven).
+//
+// scripts/gds/government-walk.js walks a throwaway project's whole government —
+// genesis, every form, every building's act-alone gate, every matter action — and
+// writes the pass/fail table to docs/governance/government-walk.md. This runs the
+// walk again in its own process (it points the instance root at a temp folder and
+// swaps the government db layer for its in-memory store, so it must not share a
+// module graph with other tests) and fails if ANY row differs from the committed
+// table: a change that breaks a decision flips a row from PASS to FAIL here, and a
+// fix to a filed bug flips one back, which asks for the table to be regenerated.
+//
+// Also pins the walk's own coverage, so it cannot quietly walk less: every bound
+// route of every building has a request in the walk, and every router a bound route
+// lives on is mounted.
+//
+// Run:  node --test tests/government_walk.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SCRIPT = path.join(ROOT, 'scripts', 'gds', 'government-walk.js');
+const walk = require(SCRIPT);
+const dr = require(path.join(ROOT, 'modules', 'government', 'decision-rules.js'));
+const decisionBoard = require(path.join(ROOT, 'modules', 'government', 'decision-board.js'));
+
+test('the walk covers every bound route of every building', () => {
+  const bound = dr.AREAS.flatMap((a) => a.acts).sort();
+  assert.deepEqual(Object.keys(walk.REQUESTS).sort(), bound, 'a route added to decision-rules AREAS[].acts needs a request in the walk');
+});
+
+test('the walk passes a matter for every action a passed matter can carry out', () => {
+  const planned = walk.MATTER_PLAN.map(([area, , action]) => `${area}.${action.type}`).sort();
+  const actions = Object.entries(decisionBoard.MATTER_ACTIONS)
+    .flatMap(([area, acts]) => Object.keys(acts).map((type) => `${area}.${type}`)).sort();
+  assert.ok(actions.length > 0, 'the matter-action table is not empty');
+  assert.deepEqual(planned, actions, 'a new matter action needs a matter in the walk');
+  // and every planned action is one the server would accept as written
+  for (const [area, , action] of walk.MATTER_PLAN) {
+    assert.equal(decisionBoard.validateMatterAction(area, action).ok, true, `${area} ${action.type} validates`);
+  }
+});
+
+test('the walk re-runs and matches the committed pass/fail table', () => {
+  const env = { ...process.env };
+  delete env.DATABASE_URL;
+  const r = spawnSync(process.execPath, [SCRIPT, '--check'], { cwd: ROOT, env, encoding: 'utf8', timeout: 240000 });
+  assert.equal(r.status, 0, `government-walk --check failed (exit ${r.status}):\n${r.stdout}\n${r.stderr}`);
+  assert.match(r.stdout, /matches the committed table/);
+});